Physical Flaws: Intels Root-of-Trust Issue Mostly Mitigated

An insider, or security expert with physical access, can compromise the hardware protections of Intel chips sold in the past five years.

Most Intel processors produced in the past five years have a vulnerability in the component of the chip responsible for securely executing security services, threatening the systems so-called root of trust, warns Positive Technologies.
Intel fixed the vulnerability in the Intel Converged Security and Management Engine (CSME) in May 2019 and updated its guidance in February, but it has not released enough details for companies to assess their risk, says Mark Ermolov, lead specialist of operating system and hardware security at Positive Technologies. The security firm has produced a proof-of-concept attack for the flaw but will not release it yet, he says.
The worst-case scenario is that a hacker gains access to the chipset key, which would enable him to access all information stored on the computer, encrypted or otherwise, and even run a keylogger on Intel CSME to track everything a victim types into the affected computer, Ermolov says. Exploitation is difficult but possible. Most importantly, now, in order to get the root key, you do not need multimillion-dollar equipment or much time. Using this vulnerability, a qualified specialist can get the master key in just a few hours using only software tools and then do whatever he wants with this system.
The severity of the vulnerability remains to be seen. Because the CSME is the root of critical security functions on the system — handling encryption and secure boot — a compromised system, and the information on that system, can no longer be trusted.
On unpatched systems, an attacker who already compromised the operating system could exploit the issue, assigned
CVE-2019-0090
, in the Intel CSME to undermine the systems fundamental security. For patched system, only physical access will allow such a compromise. Yet the vulnerability itself
cannot be patched
because its in the hardware and part of the chips architecture, says Ermolov, who considers the issue worse than the speculative execution flaws Spectre and Meltdown.
Since this is a hardware vulnerability, the situation cannot be fixed with updates, he says. Intel has issued a mitigation, which greatly complicates the attack but does not make it impossible.
Intel considered the flaw to be critical but, with patching, not a risk for companies. Intel
acknowledged the issue
, but highlighted the fact that patched systems that are not run in Intel Manufacturing Mode — an undocumented execution mode meant for manufacturers to test their systems — can only be attacked at the keyboard.
Intel recommends that end users adopt best security practices by installing updates as soon as they become available and being continually vigilant to detect and prevent intrusions and exploitations, the company said in a statment sent to Dark Reading. End users should maintain physical possession of their platform.
Security researchers have heavily scrutinized Intels CSME because compromising the hardware allows the security of a system to be undermined at a fundamental level. Two years ago, a collection of researchers published two attacks, Meltdown and Spectre, that took advantage of the speculative execution of Intel processors to allow attackers to gain access to any information flowing through the hardware. Since then,
at least six other similar flaws have been found
.
In reaction to the vulnerabilities, Intel has committed to
putting security first
and has recently published
an analysis
of all the 236 vulnerabilities reported in 2019. Two Intel security experts also discussed the companies approach to securing the CSME during
a talk at the 2019 Black Hat Security Conference
.
Postive Technologies has focused on Intels Management Engine and, now, Intels Converged Security and Management Engine. In 2017, the company
found a stack overflow bug
in the Intel ME that could be used by insiders and supply chain attackers to gain and retain total control of a system.
With the latest vulnerability, Positive Technologies researchers focused on the input-output memory management unit (IOMMU), finding that the boot order of the devices allowed external drivers to gain control of execution too early to ensure secure booting.
Researchers found that there is a very big bug: The IOMMU is activated too late after x86 paging structures were created and initialized, Ermolov says. Only Intel can mitigate all of known exploitations vectors by blocking all integrated devices that are known to have DMA [direct memory access] capabilities [to the CSME].
Positive Technologies found it could exploit the issue through the Integrated Sensors Hub. Intels patch has closed that vector, eliminating any current way of exploiting the bug using local code execution — that is, after an attacker has already compromised the system.
Intel blocked ISH [Integrated Sensors Hub], so now it cant issue DMA transactions to the CSME, Ermolov says. But were convinced there other exploitation vectors, and they will be found soon.
Related Content:
Intel Analyzes Vulns Reported in its Products Last Year
Intel Previews Newest Zombieload Patch
Intels CPU Flaws Continue to Create Problems for the Tech Community
New Intel Vulnerabilities Bring Fresh CPU Attack Dangers
How the Major Intel ME Firmware Flaw Lets Attackers Get God Mode on a Machine
Check out The Edge, Dark Readings new section for features, threat data, and in-depth perspectives. Todays top story:
The Perfect Travel Security Policy for a Globe-Trotting Laptop
.

Last News
▸ DHS-funded SWAMP scans code for bugs. ◂ Discovered: 23/12/2024 Category: security	▸ Debunking Machine Learning in Security. ◂ Discovered: 23/12/2024 Category: security	▸ Researchers create BlackForest to gather, link threat data. ◂ Discovered: 23/12/2024 Category: security

**Cyber Security Categories**
Google Dorks Database	Exploits Vulnerability	Exploit Shellcodes

CVE List

Tools/Apps

News/Aarticles

Phishing Database

Deepfake Detection

Trends/Statistics & Live Infos

Tags:
Physical Flaws: Intels Root-of-Trust Issue Mostly Mitigated