Tag: Intel

OpenBSD gets RETGUARD (anti-ROP) for Clang x64

~ hucktech ~ 1 Comment

RETGUARD for clang (amd64) added to -current

Contributed by rueda on 2018-06-06 from the d(e)ropping-the-gadgets dept.

Todd Mortimer has committed “RETGUARD” for clang (for amd64).

http://undeadly.org/cgi?action=article;sid=20180606064444

Intel releases SMM-free processor! :-)

~ hucktech ~ Leave a comment

Time to stock up new FreeDOS-capable hardware, while you have a chance. 😉

Actually, I’m not sure, maybe this limited edition processor *DOES* have SMM, that’d be interesting in other ways.

https://www.intel.com/content/www/us/en/products/processors/core/i7-processors/i7-8086k.html

https://game.intel.com/8086sweepstakes/

https://www.intel.com/content/dam/products/hero/foreground/core-i7-8086k-limited-edition-1x1.png.rendition.intel.web.225.225.png

https://www.bleepingcomputer.com/news/hardware/intel-announces-the-intel-core-i7-8086k-5ghz-limited-edition-cpu/

https://www.bleepingcomputer.com/news/hardware/intel-core-i7-8086k-5ghz-anniversary-edition-cpus-leaked-online/

BlackHat cancels Intel/Eclypsium CHIPEC training

~ hucktech ~ Leave a comment

I notice that the Intel/Eclypsium training at Black Hat USA 2018 is no longer listed. Sounds like not enough people signed up?!

AFAIK, the next opportunity to get Eclypsium CHIPSEC training is at REcon (and REcon appears to have cheaper training rates than Blackhat):

https://recon.cx/2018/montreal/training/trainingfirmware.html

There’s also the training materials from older training from Intel ATR/CHIPSEC team, available here:

Intel ATR releases UEFI firmware training materials!

 

pmem.io: Intel persistent memory

~ hucktech ~ Leave a comment

Re: https://firmwaresecurity.com/2018/04/11/intel-persistent-memory/ and https://firmwaresecurity.com/2018/05/10/intel-adds-python-bindings-to-persistent-memory-sdk/

https://twitter.com/daniel_bilar/status/1002250766357278720

https://newsroom.intel.com/editorials/re-architecting-data-center-memory-storage-hierarchy/

http://pmem.io/

EPA-RIMM: A Framework for Dynamic SMM-based Runtime Integrity Measurement

~ hucktech ~ Leave a comment

EPA-RIMM: A Framework for Dynamic SMM-based Runtime Integrity Measurement
Brian Delgado, Karen L. Karavanic
(Submitted on 9 May 2018)

Runtime integrity measurements identify unexpected changes in operating systems and hypervisors during operation, enabling early detection of persistent threats. System Management Mode, a privileged x86 CPU mode, has the potential to effectively perform such rootkit detection. Previously proposed SMM-based approaches demonstrated effective detection capabilities, but at a cost of performance degradation and software side effects. In this paper we introduce our solution to these problems, an SMM-based Extensible, Performance Aware Runtime Integrity Measurement Mechanism called EPA-RIMM. The EPA-RIMM architecture features a performance-sensitive design that decomposes large integrity measurements and schedules them to control perturbation and side effects. EPA-RIMM’s decomposition of long-running measurements into shorter tasks, extensibility, and use of SMM complicates the efforts of malicious code to detect or avoid the integrity measurements. Using a Minnowboard-based prototype, we demonstrate its detection capabilities and performance impacts. Early results are promising, and suggest that EPA-RIMM will meet production-level performance constraints while continuously monitoring key OS and hypervisor data structures for signs of attack.

https://arxiv.org/abs/1805.03755

http://web.cecs.pdx.edu/~karavan/research/SMM.html

CVE-2018-8897: Debug Exception May Cause Unexpected Behavior

~ hucktech ~ Leave a comment

A statement in the System Programming Guide of the Intel 64 and IA-32 Architectures Software Developer’s Manual (SDM) was mishandled in the development of some or all operating-system kernels, resulting in unexpected behavior for #DB exceptions that are deferred by MOV SS or POP SS, as demonstrated by (for example) privilege escalation in Windows, macOS, some Xen configurations, or FreeBSD, or a Linux kernel crash. The MOV to SS and POP SS instructions inhibit interrupts (including NMIs), data breakpoints, and single step trap exceptions until the instruction boundary following the next instruction (SDM Vol. 3A; section 6.8.3). (The inhibited data breakpoints are those on memory accessed by the MOV to SS or POP to SS instruction itself.) Note that debug exceptions are not inhibited by the interrupt enable (EFLAGS.IF) system flag (SDM Vol. 3A; section 2.3). If the instruction following the MOV to SS or POP to SS instruction is an instruction like SYSCALL, SYSENTER, INT 3, etc. that transfers control to the operating system at CPL < 3, the debug exception is delivered after the transfer to CPL < 3 is complete. OS kernels may not expect this order of events and may therefore experience unexpected behavior when it occurs.

https://www.triplefault.io/2018/05/spurious-db-exceptions-with-pop-ss.html

Click to access popss.pdf

https://software.intel.com/en-us/articles/intel-sdm

https://www.kb.cert.org/vuls/id/631579
https://nvd.nist.gov/vuln/detail/CVE-2018-8897
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-8897
http://openwall.com/lists/oss-security/2018/05/08/1
http://openwall.com/lists/oss-security/2018/05/08/4

https://github.com/torvalds/linux/commit/d8ba61ba58c88d5207c1ba2f7d9a2280e7d03be9
http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=d8ba61ba58c88d5207c1ba2f7d9a2280e7d03be9
https://patchwork.kernel.org/patch/10386677/
https://people.canonical.com/~ubuntu-security/cve/2018/CVE-2018-8897.html
https://security-tracker.debian.org/tracker/CVE-2018-8897
https://kb.vmware.com/s/article/54988
https://bugzilla.redhat.com/show_bug.cgi?id=1567074
https://support.apple.com/HT208742
https://svnweb.freebsd.org/base?view=revision&revision=333368
https://www.freebsd.org/security/advisories/FreeBSD-SA-18:06.debugreg.asc
https://xenbits.xen.org/xsa/advisory-260.html
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8897

Intel reboots Android-IA as Project Celadon

~ hucktech ~ Leave a comment

We are excited to let you know about the refresh of the Android-IA project called Celadon. Celadon is the open sourced Android reference stack for Intel architecture that you are already familiar with, but now with more added to the stack. What started with a few open source drivers support including Mesa i965, I915 Linux Kernel Graphics Driver, and Video Acceleration API last year has since grown into a feature-rich Android stack for IA. Celadon will continue to be dedicated to driving Android support and innovation on IA in addition to providing a place for collaboration. We believe Celadon can help you enhance validation, debug and accelerate development across Android implementations on IA platforms.

https://lists.01.org/pipermail/celadon/2018-May/001235.html
https://lists.01.org/pipermail/celadon/2018-May/001237.html
https://01.org/projectceladon
https://github.com/projectceladon

Intel Platform Armoring and Resiliency group seeking senior security researcher

~ hucktech ~ Leave a comment

The Platform Armoring and Resiliency SSG/STO/PSI/PAR organization is looking for a senior security researcher. The ideal candidate will be responsible for secure design, development and operation of Intel’s hardware and software products and services. […]

https://jobs.intel.com/ShowJob/Id/1605323/Security%20Researcher

I wonder, is this to fill John’s recently-vacated position? 🙂

 

 

Bypassing code protection on an Intel 8752

~ hucktech ~ Leave a comment

Bypassing code protection on an Intel 8752
Kibo Schaffer

The security bits that enforce code protection on the Intel 8752 can be cleared with UV, while keeping the main program memory mostly intact by applying a UV mask (nail polish) to the EPROM regions of the die.[…]

https://blog.inach.is/8752/

Ceramic chip decapping rig

Intel SGX hardening patent, by Intel

~ hucktech ~ Leave a comment

https://twitter.com/vpikhur/status/989561250609709057

PATENT ALERT. Engineers not wanting to be tainted by external patent info should not read this post. It is only the title/abstract of the patent, however.

.
.
.
.
.
.
.

Inventor: Volodymyr Pikhur, Atul A. Khare
Current Assignee: Intel Corp
Priority date: 2016-09-07

Non-enclave access prevention

A processing system includes an execution unit comprising a logic circuit to implement an architecturally-protected execution environment associated with a protected region in a memory, in which the execution unit is to execute application code stored in the protected region as a thread running in the architecturally-protected execution environment, determine that an access mode flag is set to a first value, detect an attempt by the thread to access data stored outside the protected region, and responsive to detecting the attempt and determining that the access mode flag is set to the first value, generate an exception.

https://patents.google.com/patent/US20180067873A1

Purism pulls FSP blog post

~ hucktech ~ Leave a comment

Re: https://firmwaresecurity.com/2018/04/03/intel-fsp-reverse-engineering-finding-the-real-entry-point/

https://puri.sm/posts/intel-fsp-reverse-engineering-finding-the-real-entry-point/

2018-04-23 update: after receiving a courtesy request from Intel’s Director of Software Infrastructure, we have decided to remove this post’s technical contents while we investigate our options.

What You Don’t Know about Firmware Might Get You ∅wn3d

~ hucktech ~ Leave a comment

Brian Richardson of Intel has an article on firmware security. It even mentions CHIPSEC and NIST 147!

http://eecatalog.com/intel/2018/04/09/what-you-dont-know-about-firmware-might-get-you-own3d/#.WtZPvUZ6xU0.twitter

 

 

 

Intel Security Essentials: A Built-in Foundation with Security at the Core

~ hucktech ~ Leave a comment

Intel Threat Detection Technology (TDT) announced at RSA. Includes GPU-powered antivirus code.

https://newsroom.intel.com/editorials/securing-digital-world-intel-announces-silicon-level-security-technologies-industry-adoption-rsa-2018/

https://software.intel.com/en-us/blogs/2018/04/16/intel-security-essentials-a-built-in-foundation-with-security-at-the-core

https://www.intel.com/content/www/us/en/security/hardware/hardware-security-overview.html

https://www.engadget.com/2018/04/17/intel-malware-scanner-gpu-processor-cpu-speed/

https://arstechnica.com/gadgets/2018/04/intel-microsoft-to-use-gpu-to-scan-memory-for-malware/

https://twitter.com/diodesign/status/986099399104212993

Intel Security Essentials