Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Vulnerabilities / Threats

Physical Flaws: Intel's Root-of-Trust Issue Mostly Mitigated

An insider, or security expert with physical access, can compromise the hardware protections of Intel chips sold in the past five years.

Most Intel processors produced in the past five years have a vulnerability in the component of the chip responsible for securely executing security services, threatening the system's so-called root of trust, warns Positive Technologies.

Intel fixed the vulnerability in the Intel Converged Security and Management Engine (CSME) in May 2019 and updated its guidance in February, but it has not released enough details for companies to assess their risk, says Mark Ermolov, lead specialist of operating system and hardware security at Positive Technologies. The security firm has produced a proof-of-concept attack for the flaw but will not release it yet, he says.

"The worst-case scenario is that a hacker gains access to the chipset key, which would enable him to access all information stored on the computer, encrypted or otherwise, and even run a keylogger on Intel CSME to track everything a victim types into the affected computer," Ermolov says. "Exploitation is difficult but possible. Most importantly, now, in order to get the root key, you do not need multimillion-dollar equipment or much time. Using this vulnerability, a qualified specialist can get the master key in just a few hours using only software tools and then do whatever he wants with this system."

The severity of the vulnerability remains to be seen. Because the CSME is the root of critical security functions on the system — handling encryption and secure boot — a compromised system, and the information on that system, can no longer be trusted.

On unpatched systems, an attacker who already compromised the operating system could exploit the issue, assigned CVE-2019-0090, in the Intel CSME to undermine the system's fundamental security. For patched system, only physical access will allow such a compromise. Yet the vulnerability itself cannot be patched because it's in the hardware and part of the chip's architecture, says Ermolov, who considers the issue worse than the speculative execution flaws Spectre and Meltdown.

"Since this is a hardware vulnerability, the situation cannot be fixed with updates," he says. "Intel has issued a mitigation, which greatly complicates the attack but does not make it impossible."

Intel considered the flaw to be critical but, with patching, not a risk for companies. Intel acknowledged the issue, but highlighted the fact that patched systems that are not run in Intel Manufacturing Mode — an undocumented execution mode meant for manufacturers to test their systems — can only be attacked at the keyboard. 

"Intel recommends that end users adopt best security practices by installing updates as soon as they become available and being continually vigilant to detect and prevent intrusions and exploitations," the company said in a statment sent to Dark Reading. "End users should maintain physical possession of their platform."

Security researchers have heavily scrutinized Intel's CSME because compromising the hardware allows the security of a system to be undermined at a fundamental level. Two years ago, a collection of researchers published two attacks, Meltdown and Spectre, that took advantage of the speculative execution of Intel processors to allow attackers to gain access to any information flowing through the hardware. Since then, at least six other similar flaws have been found.

In reaction to the vulnerabilities, Intel has committed to putting security first and has recently published an analysis of all the 236 vulnerabilities reported in 2019. Two Intel security experts also discussed the companies approach to securing the CSME during a talk at the 2019 Black Hat Security Conference.

Postive Technologies has focused on Intel's Management Engine and, now, Intel's Converged Security and Management Engine. In 2017, the company found a stack overflow bug in the Intel ME that could be used by insiders and supply chain attackers to gain and retain total control of a system. 

With the latest vulnerability, Positive Technologies researchers focused on the input-output memory management unit (IOMMU), finding that the boot order of the devices allowed external drivers to gain control of execution too early to ensure secure booting. 

"Researchers found that there is a very big bug: The IOMMU is activated too late after x86 paging structures were created and initialized," Ermolov says. "Only Intel can mitigate all of known exploitations vectors by blocking all integrated devices that are known to have DMA [direct memory access] capabilities [to the CSME]." 

Positive Technologies found it could exploit the issue through the Integrated Sensors Hub. Intel's patch has closed that vector, eliminating any current way of exploiting the bug using local code execution — that is, after an attacker has already compromised the system.

"Intel blocked ISH [Integrated Sensors Hub], so now it can't issue DMA transactions to the CSME," Ermolov says. "But we're convinced there other exploitation vectors, and they will be found soon."

Related Content:

Check out The Edge, Dark Reading's new section for features, threat data, and in-depth perspectives. Today's top story: "The Perfect Travel Security Policy for a Globe-Trotting Laptop."

Veteran technology journalist of more than 20 years. Former research engineer. Written for more than two dozen publications, including CNET News.com, Dark Reading, MIT's Technology Review, Popular Science, and Wired News. Five awards for journalism, including Best Deadline ... View Full Bio
 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
COVID-19: Latest Security News & Commentary
Dark Reading Staff 11/19/2020
New Proposed DNS Security Features Released
Kelly Jackson Higgins, Executive Editor at Dark Reading,  11/19/2020
How to Identify Cobalt Strike on Your Network
Zohar Buber, Security Analyst,  11/18/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win an Amazon Gift Card! Click Here
Latest Comment: A GONG is as good as a cyber attack.
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-26890
PUBLISHED: 2020-11-24
Matrix Synapse before 1.20.0 erroneously permits non-standard NaN, Infinity, and -Infinity JSON values in fields of m.room.member events, allowing remote attackers to execute a denial of service attack against the federation and common Matrix clients. If such a malformed event is accepted into the r...
CVE-2020-28348
PUBLISHED: 2020-11-24
HashiCorp Nomad and Nomad Enterprise 0.9.0 up to 0.12.7 client Docker file sandbox feature may be subverted when not explicitly disabled or when using a volume mount type. Fixed in 0.12.8, 0.11.7, and 0.10.8.
CVE-2020-15928
PUBLISHED: 2020-11-24
In Ortus TestBox 2.4.0 through 4.1.0, unvalidated query string parameters to test-browser/index.cfm allow directory traversal.
CVE-2020-15929
PUBLISHED: 2020-11-24
In Ortus TestBox 2.4.0 through 4.1.0, unvalidated query string parameters passed to system/runners/HTMLRunner.cfm allow an attacker to write an arbitrary CFM file (within the application's context) containing attacker-defined CFML tags, leading to Remote Code Execution.
CVE-2020-28991
PUBLISHED: 2020-11-24
Gitea 0.9.99 through 1.12.x before 1.12.6 does not prevent a git protocol path that specifies a TCP port number and also contains newlines (with URL encoding) in ParseRemoteAddr in modules/auth/repo_form.go.