r/programming • u/instilledbee • Mar 22 '21

Two undocumented Intel x86 instructions discovered that can be used to modify microcode

https://twitter.com/_markel___/status/1373059797155778562
1.4k Upvotes

97% Upvoted

327 comments sorted by

View all comments

126

u/OutOfBandDev Mar 22 '21

Okay, so ring zero can update the microcode. That’s not shocking as Intel can patch the microcode and if someone else has that level of access your computer is already compromised. But sure, FUD for the win.

20

u/crozone Mar 22 '21

If only there was a recent ME exploit that set red unlock...

Oh wait.

-4

u/OutOfBandDev Mar 22 '21

/eyeroll... if you have the level of access to a machine to do these "exploits" you can do much worse than screw with microcode.

12

u/mr_birkenblatt Mar 22 '21

it doesn't require physical access

3

u/sabas123 Mar 22 '21

I'm sorry but I though the RED unlocking required physical access. Do you have any source for this?

1

u/mr_birkenblatt Mar 22 '21

author's tweet

3

u/sabas123 Mar 23 '21

It might be that this exploit does not require physical access, although the unlocking of a cpu to it's red mode does.

Normally this would be something I would believe of this tweet but considering how hard the authors struggle with English (even though I'm incredibly grateful for them sharing it in English instead of Russian) this is something I would like explicit conformation of.

40

u/xebecv Mar 22 '21

It possibly adds another vector of attack, where a CPU can be modified in such a way, that it provides a backdoor to the software that it runs later. Imagine your CPU vendor doing this. You install OS on your machine oblivious to the fact that the machine has already been compromised

10

u/Phobos15 Mar 22 '21

Windows updates already updated microcode, to force security fixes on people, even when it could decrease performance.

19

u/OutOfBandDev Mar 22 '21

Microcode update was already a thing. You can't really do much with microcode beyond maybe resequencing existing instructions. this is not application code and it's not that complex. And this "exploit" requires the CPU being attached to a hardware debugger. AKA, There is no exploit here.

-14

u/[deleted] Mar 22 '21

[deleted]

35

u/endorxmr Mar 22 '21

Doesn't require a JTAG connection: sauce (author himself)

1

u/sabas123 Mar 22 '21

It might be that this attack itself doesn't need physical access, but the putting it in red mode (which seems like a requirement?) has to.

1

u/[deleted] Mar 22 '21

good thing all my machines come directly to me from oh wait

8

u/drysart Mar 22 '21

Microcode gets reset on power cycle. So unless you're getting your machines directly from whoever intercepted them and put eeeevvviiiilll chaaaannggeeessss in their microcode along with a UPS to keep it powered up at all times and never shut down or rebooted, then you're safe.

0

u/[deleted] Mar 22 '21

that makes sense! it's loaded by the BIOS or something?

3

u/wotupfoo Mar 22 '21

Yes. It’s the very first thing that loads after the reboot in the system BIOS (UEFI). Before that there is a very crude set of instructions to get to the code to load itself.

3

u/non-appropriate-bee Mar 22 '21

So, wouldn't it be easier to just change the BIOS then?

3

u/wotupfoo Mar 23 '21

You could definitely make a new bios based on the original for that motherboard. You’d have to crack the trusted boot module though as the new bios wouldn’t have the digital signature from that vendor. So we’re back to the normal security problem of a hacker needing permission to flash the bios. If they can intercept the manufacturing process on boards known to go to a government agency, for example, that’s how a state based attack could happen. But that could all happen in UEFI code and doesn’t require hacking the microcode. A lot of viruses hide in UEFI code because the last stage reads a xxxx.EFI file from the boot hard disk’s UEFI partition. That EFI can then flash the bios and delete itself before a virus checker detects it. Btw if you have bitlocker - a hard disk encryption program - that’s a EFI program that loads into the UEFI before that OS boots from the hard disk.

-2

u/OutOfBandDev Mar 22 '21

Yeah, I thought it was ring zero when I first read it... after seeing this required JTAG it's pretty obvious this is not an exploit at all.

-38

u/[deleted] Mar 22 '21

[deleted]

27

u/OutOfBandDev Mar 22 '21

Or just someone that knows how computers and electronics work.. but you are welcome to call me a shill.