News for hackers. Stuff that matters.
Re:Meltdown Update Kernel doesnt boot by Animats on Wednesday January 10, 2018 @08:01PM (#16120621)
The Intel Management Engine is a backdoor. Speed variations in speculative execution are an inherent property of the technology. Until recently, few people thought this was exploitable, and it took a lot of work to figure out how to exploit this.
Re:Meltdown Update Kernel doesnt boot by andrewflnr on Wednesday January 10, 2018 @08:17PM (#16120720)
You do realize those are ideal properties for a backdoor, don't you? If you were writing the spec for a dream backdoor, you would write that down. The only way you could improve it would be "everyone thinks it's impossible, and they never figure it out."
Re:Meltdown Update Kernel doesnt boot by netsharc on Thursday January 11, 2018 @06:34AM (#16122991)
This backdoor is too tricky to be a backdoor. A simpler backdoor would be "Call this opcode 45 times, followed by another opcode 20 times, and you will have activated backdoor mode where these opcodes are now available"...
Re:Meltdown Update Kernel doesnt boot by jijji on Thursday January 11, 2018 @01:35AM (#16121848)
the ideal properties of a backdoor were visualized to me the day i hacked into an author of a largely distributed piece of smtp mail server, only to find sitting in his home directory an unpublished integer overflow exploit written by him years earlier for a version of the software that is currently in wide distribution...
Re:Meltdown Update Kernel doesnt boot by dvfjsdhgfv on Thursday January 11, 2018 @02:18AM (#16122019)
That's close to perfect, indeed. The drawbacks in this scenario are that (1) not everybody runs an SMTP server, (2) if it's open source (and if it's very popular, then it is), some other smart people will look for the bug and publish it for fame. That's quite different from a backdoor built into a processor (although I really doubt Intel was really involved in any shady practices, it looks like they were not smart enough).
Re:Meltdown Update Kernel doesnt boot by paulie_a on Thursday January 11, 2018 @03:12AM (#16122201)
Judging from the numerous decades old bugs recently found, the concept of many eyes needs to die.

And in the case of SMTP, it's basically a pinata of bugs for the last 30 years regardless of platform

Re:Meltdown Update Kernel doesnt boot by sigi45 on Thursday January 11, 2018 @07:00AM (#16123090)
it is still way more likely a reasonable design decision for performance reasons than it is for a backdoor.

Alone the risk would not be worth to intel. Do you really think, nsa has enough money to compensate for this backslash and newscoverage?

Re:Meltdown Update Kernel doesnt boot by Animats on Wednesday January 10, 2018 @09:13PM (#16120967)
Yes, though it's moderately hard to exploit against a specific target. It's more useful for bulk attacks - getting everyone who visits a specific web site to run a DDOS attack, or ransomware.
Re:Meltdown Update Kernel doesnt boot by eli_gottlieb on Wednesday January 10, 2018 @09:06PM (#16120941)
If any quantity about what the processor does, outside the intended effect, has a different distribution when X happens versus Y, then the distribution of that quantity is exploitable. Period.

Any nonuniform distribution in any quantity that is not part of the spec is exploitable!

Re:Meltdown Update Kernel doesnt boot by fpoling on Thursday January 11, 2018 @02:50AM (#16122130)
It is only exploitable if one can measure the difference and extract useful information. Until Spectre guys discovered the double read technique, the expectation was that speculative execution did not allow to extract useful information besides extremely artificial theoretical cases.