this is pretty old by now but still very relevant. people dont look at this enough but with rising chip complexities for TPU units etc. and a shift towards poorly documented hardware like NVIDIA gives this problem new fuel.
Domas (and maybe his team or colleagues?) has put out shit tons of very interesting materials over the past years on advanced malware, implants and things like Cantor Dust which are amazing things to dive into.
using his own cpu fuzzer, msr fuzzing techniques etc. he has found, reversed and implemented attacks through hardware bugs and backdoors.
It cant be confirmed if a backdoor is malicious or for debugging but essentially the capabilities gained through them are what is important.
These techniques he shows throughout his videos are not super tricky to replicate and I can recommend people who have interest to dive into it, reproduce things and try to help in this domain to raise awareness and findings.
Another good avenu is:
Defcon 21 - Decapping Chips The Strike Easy Hard Way
People speak about supply chain issues in NPM and Pip etc. but these are much more severe and hard to detect.
Almost no one looks at it.
Most vendors totally ignore it because you cannot sell products against it. (if ud detect it u need to trash the hw so its not handy... for sales...)
I didn't know what Cantor Dust was, and had to click through a few different search results to get past all the abstract descriptions and begin to form a basic idea.
In a nutshell, I understand them as a sort of "blockie" for binary data formats. Things like WAV audio files, bitmaps, ASCII text, machine code, etc. each generate their own distinct visual signature (but different examples within any of these categories tend to generate similar signatures). So once you learn the "blockies" for different types of data, they really pop out when content is viewed this way ("hey there's an image buried in that sequence of 1's and 0's!").
The explanation on this page isn't bad, and the bitmap example near the bottom is particularly illustrative (once you've seen the reference image for bitmaps earlier in the page):
See, there's Math (which typically generates graphs, graphics, other visuals), and then there's Higher-dimensional Math (you could almost call it 'Meta-math') -- which generates graphs about graphs, graphics about graphics, visuals about previous visuals...
That is, take a math equation that generates a graph. OK, so a simple example is that we could take the derivative... That generates a second graph which gives us information about the first graph... a "graph about a graph", so to speak, a "signal about a signal", information about the original information...
Point is, Cantor Dust looks like another great mathematical tool in any Mathematician's and/or Computer Scientist's and/or Engineer's visualization/understanding toolbox!
Oh sure, bad faith actors could use it for hacking (bad faith actors could use aspects of Isaac Newton's Calculus for hacking in various contexts, heck, any mathematical tool could be exploited in specific contexts!) -- but those people I'm sure, would not have an appreciation of the sheer mathematical beauty of such things! (Why use it to hack, when you can admire the mathematical beauty?)
Also, I should point out that humanity as a whole is far from discovering every single possible method, every single equation, every single way to visualize higher dimensional mathematics...
In other words, Cantor Dust is one such method... there will no doubt be many more in the future (I'd love to see fractal visualizations of higher dimensions!), and of course, we still have yet to understand all of the "old" previously discovered math in terms of all of the possible ways it can be used to visualize higher dimensions...
A poorly documented or undocumented (debugging) backdoor in a chip marketed for ATMs and medical hardware, enabled by default, at the very least qualifies as reckless endangerment.
Not really. A properly designed network should take account for such things as unknown/irreparable flaws. An irreparable backdoor in a device can be mitigated with a gatekeeper, something akin to a firewall that will not allow a threat actor to have access to a faulty device.
The real recklessness would be allowing an ATM unfettered access to the internet on the assumption that the manufacturer has already protected the device from every known and unknown threat.
I was basically going to quote your whole statement here and then point to the more than 19 US states that have had Water Treatment plants forced to disconnect much of their Operational Technology systems.
it is not overkill to airgap OT tech. having it on the internet is really braindead.
most ones that are routable are hackable real easily. the only reason no one does it is because they dont need to or dont want to.
more people should do this. there should be laws to prevent such systems to be connected to others.
main problem is often billing systems and sometimes OT stuff will need things like weather info or external data which makes it harder or more expensive to effectively airgap. remote places are also a pain to maintain if u cant connect into them.
this is why most of these places rely on not being routable over most internet, so u vpn to some place and connect in from there. Sibsequently many engineers will not properly secure OT because its not routable.
then a routing mistake happen at ISP and oops all the boxes are rooted -_-.
ofcourse. its just a difference between 'ooh china is evil' or 'derp some company has shit processes' which on a certain level is quite a big difference, though for most consumers will indeed boil down to the same.
TBF the specific backdoor isn’t the point of the article. It’s a cautionary tale. The point is that practically all systems above the MCU level, and even some of those, have lower level systems that are often undocumented or not intended for use by the hardware designers, much less the end users. Those systems often have extremely low level access to system resources.
For example, I am building a device that records motion data, video, audio, and lidar imaging. Inside the 6 dollar IMU and the 12 dollar lidar sensor are powerful processors that load binary blobs provided by the manufacturer. The lidar could potentially gain access to any of the system data stored on the SPI bus, which includes the bulk storage and secondary RAM for the system. It could exfiltrate that data using its laser to anyone within a few hundred meters in the laser fov. It could also receive remote c&c over its optical sensor. The only thing that prevents that from being the case is that I trust the blob does not include the code to do those things, but it would be trivial to replace the blob with one that does.
Millions of devices are made that include basic wifi functionality. often, this comes in the form of a dedicated WiFi module. Those almost entirely consist of a powerful processor running a proprietary binary blobs, connected to some internal bus of the system that may give it access to some or all of the functions of the device, or at the very least could cause the device to malfunction. These WiFi phy modules are sub$1, pervasive, and often built in to devices that do not have any advertised connectivity features. A threat actor that has knowledge of an attack surface for that opaque blob can probably cause >50% of the connected devices built with that product to malfunction, in some cases in serious and dangerous ways, and sometimes to exfiltrate data that might be compromising or valuable.
I recently got an air purifier. The touch button controls for adjusting the fan speed didn't seem to be working, so I emailed support.
They had me download their app, link the air purifier, and give them its MAC address. Then they asked me to try pressing each of the buttons a few times and email them back. I did so, and they responded that they re-calibrated the buttons using my touch samples. It worked.
That’s insane. I actively avoid buying things that are pointlessly internet connected nowadays. An air purifier’s buttons should be simple electromechanical switches.
By "touch buttons" possibly he means that they are "buttons" on a touch screen. What's crazy to me is that this is now cheaper to put in a product than electromechanical switches.
It's a Mila, they're capacitive touch buttons but not a touchscreen. There's just a fan down, fan up, and mode button. Even still, I don't know how they got the calibration wrong enough at the factory that it can't detect a full-pressure thumb press.
I am amazed that by emailing support you were able to actually get in contact with someone technical who understood the product well enough to fix the problem.
I fancy myself as a decent writer, but I suck at writing documentation. People describe reading my notes frustrating and incomprehensible. I find it much better to use AI to untangle my, admittedly, convoluted reasoning
...which along with the already publicly-known microarchitecture of the C3 makes this statement sound like total nonsense:
The rosenbridge backdoor is a small, non-x86 core embedded alongside the main x86 core in the CPU
I remember laughing at this with a few others knowledgeable in x86 when it first came out; a self-proclaimed "security researcher" who somehow failed to RTFM.
"It's documented in the datasheet" is such a weak excuse for a backdoor.
Documenting a backdoor doesn't make it not a backdoor, just means it's not a hidden backdoor.
The fact that a number of machines shipped with the backdoor accidentally enabled, and nobody noticed for over a decade shows just how dangerous even a documented backdoor can be. The oversight wasn't even detected by someone reading the manual, it was detected by a security researcher who wrote a generic tool to fuzz out such backdoors.
backdoor means a secondary access point that defeats the security features of the primary. In the door analogy, the home owner spends a ton on a lock and camera for the front door but doesn't even have a deadbolt on the back.
Every definition of a “backdoor” in computing implicitly or explicitly considers it hidden/covert.
In the house analogy you don’t see the backdoor when approaching the front. If it was just “an alternative everyone knows about and can be broken easier than the front door” then it probably would have been called “a window”.
Most login forms have a weaker option like a SMS 2FA or password reset fallback. Nobody calls it a backdoor. It’s just a crappy second front door, or window.
The Free Software Foundation (FSF) calls the update system used in Windows 10 a "back door" [1], I think because it installs updates automatically. This sounds like nonsense to me, because it implies that I installed a back door on my own machine by enabling automatic upgrades (on Trisquel).
It's meaningful that the Windows 10 install method has no (official) way to disable it, but I don't think making something optional could make it not a back door, if it was one before.
Even when automatic updates are disabled, I'm not going to be reading every update so the effect seems mostly the same, regardless of whether updates are automatic or not.
The FSF's definition of "back door" (at the bottom of the linked page) is "any feature of a program that enables someone who is not supposed to be in control of the computer where it is installed to send it commands" which leaves a lot of ambiguity with the words "supposed to be". I am not sure how to interpret this definition.
The FSF definition can be interpreted in absurd ways; a very uncharitable interpretation would classify any network stack connected to the internet as backdoor because random, potentially misdirected packages trigger code exécution on the target machine, even if only to figure out that the packet must be ignored.
> Is there another term they could be classfied as?
As an advertised feature of the product.
Your personal definition doesn’t match the general understanding of the word and concept. By your definition every window on a house or car is a “backdoor”. Anything with an advertised fallback is a backdoor. And sometimes the “front door” is the back door: getting money from an ATM is less secure than with an ID at the bank teller.
Password resets aren't "backdoors" unless they contain a flaw the defeats any security protections. It's not just that the backdoor is less secure than the front, the backdoor has no security or is so easily defeated the security may as well not exist.
I'm surprised the hidden aspect of backdoor is so forward in folks minds. In my thinking nothing in cyber security is hidden, I drop the obviously present hidden part of backdoor definition when it's used in yhe cyber security context.
No offense but I don’t think you have a clear enough definition in your head and you’re making it up as we go along and you get challenged.
>> I'm probably mistaken, but I've always referred to password resets as backdoors
> Password resets aren't "backdoors" unless they contain a flaw the defeats any security protections.
You really have to make up your mind. It was “always” but then it wasn’t, and even as you put it you’d have been wrong almost every time to call a reset “a backdoor”.
> I'm surprised the hidden aspect of backdoor is so forward in folks minds.
Only because you misunderstand the meaning of the term, as made very clear above. Go through the wiki page for a “backdoor”.
> In my thinking nothing in cyber security is hidden
I wonder what all those security researchers do all day, with everything being so out in the open and known by everyone.
> I drop the obviously present hidden part of backdoor definition when it's used in yhe cyber security context.
You can drop it but then you’re just using the wrong definition and wrong understanding.
no offense taken. i shouldnt have included password resets in my def. it muddied the conversation. covert is part of a def, at least sometimes, but i think its still acurate to drop it. consider a machine with two copies of ssh running, one of 22 with authentication and another on 2222 with an automatic root login. the instance on 2222 would be considered a backdoor, even though its barely hidden. Swap the ports and it's an unauthenticated frontdoor, but i'd still call it a backdoor and expect everyone to know what i mean. the important part is its bypassing securit, not that its hidden.
Not really... backdoor just means something that can bypass the main security.
It's just that publicly known backdoors are of very limited usefulness, because people go out of their way to remove, disable, or avoid them. Or worse, use them for their own gains. There have been more than a few cases of governments trying to implement and enforce publicly known backdoors (with keys only the government knows), such as the Clipper cryptography chip in the 90s.
But... just because something is documented, doesn't mean it's publicly known. We have an example here of something obscure enough to be a useful backdoor (assuming someone knew about it).
And while the underlying feature might have been documented, the fact that many BIOSes enabled the feature was not documented anywhere. That does count as hidden.
It's not as clear cut as you describe it here. In the other old thread you linked there was no real consensus if this should be considered a backdoor or not.
This shows that large companies making closed-source CPUs cannot be trusted. No doubt they would add whatever the government asks them to add.
What can be done to mitigate this? One option would be to buy a large FPGA and flash it with an open-source CPU. Another would be to emulate a CPU, working with encrypted data and commands, so that even if the backdoor in a host CPU tries to overwrite memory, it would only crash the emulated OS. One more option would be to run the code in a Virtual Machine like QEMU which translates the code and prevents issuing unknown instructions.
Buy hardware used by government computers that are rivals to your country.
So if American, buy Chinese CPUs and install Chinese Linux or HarmoneyOS Assuming there is nothing you are doing of interest to them, as that will also have back doors
After Snowden, one can only imagine the worst and think everything has a backdoor.
But unless you are a high level terrorist or other person of interest, no state organization is going to target you at this level
P.s. you say no one can trust closed source, but a lot of open source is maintained by one or two people or a small group, just takes infiltration by one or two trusted contributors to push malicious code in and unless someone looks and finds that code amongst millions of lines of code, may never be discovered (more so as mainstream media won't publish any thing)
I was thinking about something similar recently: if you bought a US govt purchased laptop like the ruggedized Dell Latitude I saw, would it be less likely to have Intel's IME enabled?
Sure but the cops aren't going to pull you over based on what you think about Chinese policy. Government do mess with people across international borders, but the capacity to do that is inherently limited.
> "This is gaming the system, changing the post between this and https://news.ycombinator.com/item?id=49073612
edit for clarity: the submitter kept changing the title and body between this and the linked post. This was the "mistaken duplicate" before."
Bruh, I am not "gaming the system", the CIA (Central Intelligence Agency) is gaming the system.
That still doesn't resolve who is more likely to blackmail or otherwise misuse data. I think it's a Chinese saying: the mountains are high and the emperor is far away.
It's not just the government. The government sneakily adds stuff they think only they can exploit, but skilled non-state actors can exploit hardware features regardless of whether it was put there by the government. And as we get widespread diffusion of increasingly capable AI, it will become easy and cheap to do for pretty much anyone, and so will defense.
Assuming bio-digital integration continues (i.e., humans keep pace with ASI via neural interfaces), the long term solution is total hardware sovereignty, aka the digital equivalent of bodily integrity and autonomy. We have to miniaturize and widely diffuse fab technology such that computer manufacturing can be done in local small businesses or even at home: automated chip fabbing, 3D printing, and assembly in one fridge-sized appliance you can buy at the nearest supermarket, and it can make parts to build another one of itself.
It's basically reproduction, but for the digital part of your body instead of the bio part. You should be able to design and fab your own custom chips, PCB, and chassis to build your neural interface from scratch, and write personal defense software that actively adapts to threats - a digital immune system. You'll also have the option to delegate some or all of that to a collective, but it would mean losing your individual sovereignty and becoming part of a larger organism in a symbiogenesis or multicellular evolution kind of way.
Which you already do not have. And what you do have, is being eroded further.
You live in a world where you can be forcibly caged for a faulty manipulation of symbols you did not even consent to learning! You can be caged for doing things for your "own" body; in turn, repairs to your body can be denied and even deemed "impossible" because your physical existence threatens someone's illusions.
Maybe hunter-gatherer bands could've been said to have been autonomous. But the individual? Simply a replaceable embodiment for vast, impersonal forces. Your body and mind have always been property of the society that manufactured you. You do not own even your cherished the illusion of autonomy; it's just another behavior taught to you to make you produce more for your masters.
That's a somewhat accurate description, and you could even replace "society" with "universe". But what I'm defending is precisely the apparent feeling of autonomy, which is just called "autonomy" in colloquial terms omitting the philosophical baggage. I don't think it's fair to call this illusory, because you have no basis to define what an illusion is if you accept that all you know and all that you are is the product of universal influence. Included in that universal influence is every instance of experience from which your understanding of the concept of "illusion" was derived, so "illusion"/"real" would refer to the same thing in your worldview.
Now, taking a pragmatic materialist stance: we are obviously bound by physics and cannot move in certain ways. We can predict what action a person will take from their brain activity before the person becomes aware of their decision themselves. But what the brain does to convince you that oneself is in control is probably the exact thing that's required for life to thrive. It was the evolutionary path taken, and it's also the future I strive for, and I hope others would do the same.
The issue are "bugs" could be randomly distributed, even across the same version number of some device.
Sample sizes and statistics come into play at that point.
Whistleblower protections are an avenue, but people can still be dealt with harshly (Schulte) and degree-of-protection can come down to motive. But motive itself is multivariate, is it not? A local-first Fediverse, with some type of "guaranteed anonymity" would work, though. But anonymity doesn't mean something can't be a hoax either, so it becomes a signal vs noise issue at that point. Yet,
"nothing totally secure ever really is."
Source information can be embedded in the period of a printed sentence too.
A moral world is the answer to many problems. Something to ponder. People are said to only see the errors in their ways after death in the "hall of mirrors."
Economic espionage is something to also think about. You may be doing everything right and that's what makes you a target. "If I'm not top dog, target anyone that is."
Perfect anonymity in crypto can also aid whistleblowing so that dump data = get paid.
Calling it a "backdoor" is subjective, because it looks enough like an unintentional exploitable bug that one could make that argument. Is an accidental backdoor still a backdoor? That's pure semantics.
So is it apparent that this backdoor was intentionally added by VIA for nefarious purposes? Or is there any other reasonable explanation for its existence?
Yes there is a harmless explanation. The VIA C3 is a fairly simple CPU design that cracks x86 instructions into an internal simpler instruction format. Some complex x86 behaviour is normally implemented by lengthy microcode or complex state machines. VIA wanted to make their CPU simpler than Intel and AMD. To do that they exposed this internal instruction set to the BIOS to let it handle hardware initialisation and documented how to lock this feature safely away afterward. Some BIOS authors didn't read/understand the full specification. shrug.
IIRC there are also a few hints they at least considered exposing this alternative instruction set at runtime to get more performance out of the CPU core e.g. more useable registers, more three operand instructions, saturating and packed math for DSP workloads, etc.
I was wondering the same, this is an ancient CPU by now, having been introduced in 2001. During development and at the introduction, most people were still running Windows 95/98/ME, which had more serious security issues (like every user essentially being admin). It may just have been a handy (debugging?) feature?
Misleading, clickbait title. Technically accurate, but it would be accurate if it were 3 total cpu's rather than thousands or millions so that is a low bar.
Via C3 CPUs are the only ones affected. A security problem sure, but a relatively obscure one that doesn't effect anyone's laptop, server in the cloud, etc.
A reasonable title is "Backdoor found in Via C3 cpus".
I owned an HP 2133 mini-note netbook for a little while around 2008-2010. It was sporting a VIA C7-M with a VIA Chrome 9 gpu. Honestly the cpu was slow, probably slower than the equivalent Atom of that era but the Linux version of that laptop (sold with Linux Enterprise) made up for it with 2GB as standard which was glorious for a netbook at the time.
The keyboard and trackpad was also way ahead of the competition (ie other netbooks). The GPU was the biggest issue as VIA only built a proprietary driver for the kernel that was used at the time by Suse Enterprise. Thanksfully someone quickly wrote an openchrome driver that allowed me to install my distro of choice at the time with a newer kernel.
I think it would still be a decent portable machine to write stuff and or use as a portable terminal emulator to connect to remote machines but completely unusable to do anything else. I remember resizing photos to create thumbnails for a web gallery was taking ages and that was with much fewer megapixel than today.
this is pretty old by now but still very relevant. people dont look at this enough but with rising chip complexities for TPU units etc. and a shift towards poorly documented hardware like NVIDIA gives this problem new fuel.
Domas (and maybe his team or colleagues?) has put out shit tons of very interesting materials over the past years on advanced malware, implants and things like Cantor Dust which are amazing things to dive into.
using his own cpu fuzzer, msr fuzzing techniques etc. he has found, reversed and implemented attacks through hardware bugs and backdoors.
It cant be confirmed if a backdoor is malicious or for debugging but essentially the capabilities gained through them are what is important.
These techniques he shows throughout his videos are not super tricky to replicate and I can recommend people who have interest to dive into it, reproduce things and try to help in this domain to raise awareness and findings.
Another good avenu is: Defcon 21 - Decapping Chips The Strike Easy Hard Way
People speak about supply chain issues in NPM and Pip etc. but these are much more severe and hard to detect.
Almost no one looks at it. Most vendors totally ignore it because you cannot sell products against it. (if ud detect it u need to trash the hw so its not handy... for sales...)
I didn't know what Cantor Dust was, and had to click through a few different search results to get past all the abstract descriptions and begin to form a basic idea.
In a nutshell, I understand them as a sort of "blockie" for binary data formats. Things like WAV audio files, bitmaps, ASCII text, machine code, etc. each generate their own distinct visual signature (but different examples within any of these categories tend to generate similar signatures). So once you learn the "blockies" for different types of data, they really pop out when content is viewed this way ("hey there's an image buried in that sequence of 1's and 0's!").
The explanation on this page isn't bad, and the bitmap example near the bottom is particularly illustrative (once you've seen the reference image for bitmaps earlier in the page):
https://inside.battelle.org/blog-details/battelle-publishes-...
My armchair-expertise here is only about 20 minutes old, but I hope this helps someone else looking for a starting point to learn about them!
Fascinating, thanks for sharing. A candor dust guessing game would be pretty fun to play
AFAIK it is similar to how Enigma got cracked, due to certain variables always being the same (end of letter greeting, date, etc.)
See also ECB penguin [1]
[1] https://words.filippo.io/the-ecb-penguin/
An absolutely great link!
Not so much for the hacking (White Hat, Black hat, other-color-hat) aspects (although they're certainly there too), but for the
visualization of higher-dimensional mathematics aspect...
In other words, have a look at the following URL's, then come back here:
https://gods.art/articles/equation_shadows.html
https://kettenreihen.wordpress.com/
See, there's Math (which typically generates graphs, graphics, other visuals), and then there's Higher-dimensional Math (you could almost call it 'Meta-math') -- which generates graphs about graphs, graphics about graphics, visuals about previous visuals...
That is, take a math equation that generates a graph. OK, so a simple example is that we could take the derivative... That generates a second graph which gives us information about the first graph... a "graph about a graph", so to speak, a "signal about a signal", information about the original information...
Point is, Cantor Dust looks like another great mathematical tool in any Mathematician's and/or Computer Scientist's and/or Engineer's visualization/understanding toolbox!
Oh sure, bad faith actors could use it for hacking (bad faith actors could use aspects of Isaac Newton's Calculus for hacking in various contexts, heck, any mathematical tool could be exploited in specific contexts!) -- but those people I'm sure, would not have an appreciation of the sheer mathematical beauty of such things! (Why use it to hack, when you can admire the mathematical beauty?)
Also, I should point out that humanity as a whole is far from discovering every single possible method, every single equation, every single way to visualize higher dimensional mathematics...
In other words, Cantor Dust is one such method... there will no doubt be many more in the future (I'd love to see fractal visualizations of higher dimensions!), and of course, we still have yet to understand all of the "old" previously discovered math in terms of all of the possible ways it can be used to visualize higher dimensions...
Anyway, great link!
This is excellent!
A poorly documented or undocumented (debugging) backdoor in a chip marketed for ATMs and medical hardware, enabled by default, at the very least qualifies as reckless endangerment.
Not really. A properly designed network should take account for such things as unknown/irreparable flaws. An irreparable backdoor in a device can be mitigated with a gatekeeper, something akin to a firewall that will not allow a threat actor to have access to a faulty device.
The real recklessness would be allowing an ATM unfettered access to the internet on the assumption that the manufacturer has already protected the device from every known and unknown threat.
I was basically going to quote your whole statement here and then point to the more than 19 US states that have had Water Treatment plants forced to disconnect much of their Operational Technology systems.
And those disconnects would be that effective gatekeeper. Maybe overkill, but "air gapping" is a often a reasonable mitigation.
it is not overkill to airgap OT tech. having it on the internet is really braindead.
most ones that are routable are hackable real easily. the only reason no one does it is because they dont need to or dont want to.
more people should do this. there should be laws to prevent such systems to be connected to others.
main problem is often billing systems and sometimes OT stuff will need things like weather info or external data which makes it harder or more expensive to effectively airgap. remote places are also a pain to maintain if u cant connect into them.
this is why most of these places rely on not being routable over most internet, so u vpn to some place and connect in from there. Sibsequently many engineers will not properly secure OT because its not routable.
then a routing mistake happen at ISP and oops all the boxes are rooted -_-.
airgapping is not overkill.
Both can be negligent at once.
ofcourse. its just a difference between 'ooh china is evil' or 'derp some company has shit processes' which on a certain level is quite a big difference, though for most consumers will indeed boil down to the same.
This backdoor only appears on decades-old VIA C3 embedded x86 processors
TBF the specific backdoor isn’t the point of the article. It’s a cautionary tale. The point is that practically all systems above the MCU level, and even some of those, have lower level systems that are often undocumented or not intended for use by the hardware designers, much less the end users. Those systems often have extremely low level access to system resources.
For example, I am building a device that records motion data, video, audio, and lidar imaging. Inside the 6 dollar IMU and the 12 dollar lidar sensor are powerful processors that load binary blobs provided by the manufacturer. The lidar could potentially gain access to any of the system data stored on the SPI bus, which includes the bulk storage and secondary RAM for the system. It could exfiltrate that data using its laser to anyone within a few hundred meters in the laser fov. It could also receive remote c&c over its optical sensor. The only thing that prevents that from being the case is that I trust the blob does not include the code to do those things, but it would be trivial to replace the blob with one that does.
Millions of devices are made that include basic wifi functionality. often, this comes in the form of a dedicated WiFi module. Those almost entirely consist of a powerful processor running a proprietary binary blobs, connected to some internal bus of the system that may give it access to some or all of the functions of the device, or at the very least could cause the device to malfunction. These WiFi phy modules are sub$1, pervasive, and often built in to devices that do not have any advertised connectivity features. A threat actor that has knowledge of an attack surface for that opaque blob can probably cause >50% of the connected devices built with that product to malfunction, in some cases in serious and dangerous ways, and sometimes to exfiltrate data that might be compromising or valuable.
That’s what this article is really about.
I recently got an air purifier. The touch button controls for adjusting the fan speed didn't seem to be working, so I emailed support.
They had me download their app, link the air purifier, and give them its MAC address. Then they asked me to try pressing each of the buttons a few times and email them back. I did so, and they responded that they re-calibrated the buttons using my touch samples. It worked.
That’s insane. I actively avoid buying things that are pointlessly internet connected nowadays. An air purifier’s buttons should be simple electromechanical switches.
By "touch buttons" possibly he means that they are "buttons" on a touch screen. What's crazy to me is that this is now cheaper to put in a product than electromechanical switches.
It's a Mila, they're capacitive touch buttons but not a touchscreen. There's just a fan down, fan up, and mode button. Even still, I don't know how they got the calibration wrong enough at the factory that it can't detect a full-pressure thumb press.
I am amazed that by emailing support you were able to actually get in contact with someone technical who understood the product well enough to fix the problem.
Feels like having touch calibration procedure built into firmware and documented in the manual (remember those?) would also work.
> This backdoor only appears on decades-old VIA C3 embedded x86 processors
Modern Intel and AMD chips also have separate CPU cores that neither the user nor the installed OS control.
Intel Management Engine:
https://en.wikipedia.org/wiki/Intel_Management_Engine
AMD Platform Security Processor:
https://www.wikipedia.org/wiki/AMD_Platform_Security_Process...
Intel added them in 2008. AMD followed suit about five years later.
They should have mentioned that in the first line of the github readme, not burried deep down in the text.
Buried? Deep down? The fourth paragraph, clearly labeled "Affected Systems", a minute or two into the read.
Opening with the title "hardware backdoors in x86 CPUs" is quite misleading, though.
We have shorter attention spans now.
Multiple things can be true at the same time. While we do have shorter attention spans, some (lots of?) developers absolutely suck at writing articles
And some intentionally write clickbait headlines even though the have the skills to do better.
I fancy myself as a decent writer, but I suck at writing documentation. People describe reading my notes frustrating and incomprehensible. I find it much better to use AI to untangle my, admittedly, convoluted reasoning
They knew what they were doing by not including "VIA C3 CPUs" before the fourth paragraph. Come on. It should have been in the title.
Imagine getting a letter "High Risk of Cancer" and getting all the way to the 4th paragraph to see it's just relevant to a race of blue aliens...
It's not even a "backdoor", it's documented in the datasheet...
http://datasheets.chipdb.org/VIA/Nehemiah/VIA%20C3%20Nehemia... (page 82)
...which along with the already publicly-known microarchitecture of the C3 makes this statement sound like total nonsense:
The rosenbridge backdoor is a small, non-x86 core embedded alongside the main x86 core in the CPU
I remember laughing at this with a few others knowledgeable in x86 when it first came out; a self-proclaimed "security researcher" who somehow failed to RTFM.
There's even a Wikipedia article about it now, with a link to the alternate instruction set documentation: https://en.wikipedia.org/wiki/Alternate_Instruction_Set
"It's documented in the datasheet" is such a weak excuse for a backdoor.
Documenting a backdoor doesn't make it not a backdoor, just means it's not a hidden backdoor.
The fact that a number of machines shipped with the backdoor accidentally enabled, and nobody noticed for over a decade shows just how dangerous even a documented backdoor can be. The oversight wasn't even detected by someone reading the manual, it was detected by a security researcher who wrote a generic tool to fuzz out such backdoors.
Doesn’t backdoor imply hidden? If it’s clearly documented it’s just a (front)door?
backdoor means a secondary access point that defeats the security features of the primary. In the door analogy, the home owner spends a ton on a lock and camera for the front door but doesn't even have a deadbolt on the back.
Every definition of a “backdoor” in computing implicitly or explicitly considers it hidden/covert.
In the house analogy you don’t see the backdoor when approaching the front. If it was just “an alternative everyone knows about and can be broken easier than the front door” then it probably would have been called “a window”.
Most login forms have a weaker option like a SMS 2FA or password reset fallback. Nobody calls it a backdoor. It’s just a crappy second front door, or window.
The Free Software Foundation (FSF) calls the update system used in Windows 10 a "back door" [1], I think because it installs updates automatically. This sounds like nonsense to me, because it implies that I installed a back door on my own machine by enabling automatic upgrades (on Trisquel).
It's meaningful that the Windows 10 install method has no (official) way to disable it, but I don't think making something optional could make it not a back door, if it was one before.
Even when automatic updates are disabled, I'm not going to be reading every update so the effect seems mostly the same, regardless of whether updates are automatic or not.
The FSF's definition of "back door" (at the bottom of the linked page) is "any feature of a program that enables someone who is not supposed to be in control of the computer where it is installed to send it commands" which leaves a lot of ambiguity with the words "supposed to be". I am not sure how to interpret this definition.
[1] https://www.gnu.org/proprietary/proprietary-back-doors.html#...
I agree with any automatic updates being a back door.
Doesnt really matter which platform, automatic updates are bad news.
On windows it led to clownstrike. On BMW it led to dash ads.
Theres infinite examples of auto updates being an attack vector for OEMs and other bad actors.
Always disable updates on every product. Can always reenable as needed or even sideload updates.
How do you decide when to update?
The FSF definition can be interpreted in absurd ways; a very uncharitable interpretation would classify any network stack connected to the internet as backdoor because random, potentially misdirected packages trigger code exécution on the target machine, even if only to figure out that the packet must be ignored.
I like where this is going.
Can we refer to user data as “the garage”?
And instead of hackers they should be “coons”.
The headlines can read: ”Buncha Coons In The Garage Again”
It’s more quaint
I'm probably mistaken, but I've always referred to password resets as backdoors. Is there another term they could be classfied as?
> Is there another term they could be classfied as?
As an advertised feature of the product.
Your personal definition doesn’t match the general understanding of the word and concept. By your definition every window on a house or car is a “backdoor”. Anything with an advertised fallback is a backdoor. And sometimes the “front door” is the back door: getting money from an ATM is less secure than with an ID at the bank teller.
Password resets aren't "backdoors" unless they contain a flaw the defeats any security protections. It's not just that the backdoor is less secure than the front, the backdoor has no security or is so easily defeated the security may as well not exist.
I'm surprised the hidden aspect of backdoor is so forward in folks minds. In my thinking nothing in cyber security is hidden, I drop the obviously present hidden part of backdoor definition when it's used in yhe cyber security context.
No offense but I don’t think you have a clear enough definition in your head and you’re making it up as we go along and you get challenged.
>> I'm probably mistaken, but I've always referred to password resets as backdoors
> Password resets aren't "backdoors" unless they contain a flaw the defeats any security protections.
You really have to make up your mind. It was “always” but then it wasn’t, and even as you put it you’d have been wrong almost every time to call a reset “a backdoor”.
> I'm surprised the hidden aspect of backdoor is so forward in folks minds.
Only because you misunderstand the meaning of the term, as made very clear above. Go through the wiki page for a “backdoor”.
> In my thinking nothing in cyber security is hidden
I wonder what all those security researchers do all day, with everything being so out in the open and known by everyone.
> I drop the obviously present hidden part of backdoor definition when it's used in yhe cyber security context.
You can drop it but then you’re just using the wrong definition and wrong understanding.
no offense taken. i shouldnt have included password resets in my def. it muddied the conversation. covert is part of a def, at least sometimes, but i think its still acurate to drop it. consider a machine with two copies of ssh running, one of 22 with authentication and another on 2222 with an automatic root login. the instance on 2222 would be considered a backdoor, even though its barely hidden. Swap the ports and it's an unauthenticated frontdoor, but i'd still call it a backdoor and expect everyone to know what i mean. the important part is its bypassing securit, not that its hidden.
Not really... backdoor just means something that can bypass the main security.
It's just that publicly known backdoors are of very limited usefulness, because people go out of their way to remove, disable, or avoid them. Or worse, use them for their own gains. There have been more than a few cases of governments trying to implement and enforce publicly known backdoors (with keys only the government knows), such as the Clipper cryptography chip in the 90s.
But... just because something is documented, doesn't mean it's publicly known. We have an example here of something obscure enough to be a useful backdoor (assuming someone knew about it).
And while the underlying feature might have been documented, the fact that many BIOSes enabled the feature was not documented anywhere. That does count as hidden.
The documentation was locked away behind NDAs when the faulty BIOS leaving it reachable was discovered. Look at the publication dates.
Was this documentation public at the time? The pdf still does not document the instructions themselves.
It was public at least 4 years before he first announced his discovery:
https://web.archive.org/web/20140130160743/http://datasheets...
yes, AIS was known
sandsifter was lots of noisy PR, but no new encoding findings
AFAIK, sandsifter did find a halt-and-catch-fire instruction on one of the CPUs, but I haven't seen anyone announce which CPU model it was.
It's not as clear cut as you describe it here. In the other old thread you linked there was no real consensus if this should be considered a backdoor or not.
Also worth noting that the exploit was published nearly decade ago. Still, even at that time, those VIA CPUs were over 15 years old.
Perfect. The next the the bank's ATM "cannot process the transaction" we now have a pathway to debug the issue.
This shows that large companies making closed-source CPUs cannot be trusted. No doubt they would add whatever the government asks them to add.
What can be done to mitigate this? One option would be to buy a large FPGA and flash it with an open-source CPU. Another would be to emulate a CPU, working with encrypted data and commands, so that even if the backdoor in a host CPU tries to overwrite memory, it would only crash the emulated OS. One more option would be to run the code in a Virtual Machine like QEMU which translates the code and prevents issuing unknown instructions.
>What can be done to mitigate this?
Buy hardware used by government computers that are rivals to your country.
So if American, buy Chinese CPUs and install Chinese Linux or HarmoneyOS Assuming there is nothing you are doing of interest to them, as that will also have back doors
After Snowden, one can only imagine the worst and think everything has a backdoor.
But unless you are a high level terrorist or other person of interest, no state organization is going to target you at this level
P.s. you say no one can trust closed source, but a lot of open source is maintained by one or two people or a small group, just takes infiltration by one or two trusted contributors to push malicious code in and unless someone looks and finds that code amongst millions of lines of code, may never be discovered (more so as mainstream media won't publish any thing)
While I do think this is a good idea, it may no longer be as good as it once was: https://journalrecord.com/2026/08/05/fbi-law-enforcement-tie...
If you’re just an average dissident, it’s probably still good advice though.
I was thinking about something similar recently: if you bought a US govt purchased laptop like the ruggedized Dell Latitude I saw, would it be less likely to have Intel's IME enabled?
If many people do this then I'm sure China will find some uses for that data at some point.
Sure but the cops aren't going to pull you over based on what you think about Chinese policy. Government do mess with people across international borders, but the capacity to do that is inherently limited.
> Sure but the cops aren't going to pull you over based on what you think about Chinese policy.
You might be surprised to learn that China has operated clandestine prisons in the US!
https://www.justice.gov/archives/opa/pr/two-arrested-operati...
> "This is gaming the system, changing the post between this and https://news.ycombinator.com/item?id=49073612 edit for clarity: the submitter kept changing the title and body between this and the linked post. This was the "mistaken duplicate" before."
Bruh, I am not "gaming the system", the CIA (Central Intelligence Agency) is gaming the system.
Blackmail is still a possibility ...
Plus your data can be sold on the market. To US based entities. While the Chinese still hold on to the data for future uses ...
That still doesn't resolve who is more likely to blackmail or otherwise misuse data. I think it's a Chinese saying: the mountains are high and the emperor is far away.
Can't Chinese government exchange the data with your government whenever they need it?
It's not just the government. The government sneakily adds stuff they think only they can exploit, but skilled non-state actors can exploit hardware features regardless of whether it was put there by the government. And as we get widespread diffusion of increasingly capable AI, it will become easy and cheap to do for pretty much anyone, and so will defense.
Assuming bio-digital integration continues (i.e., humans keep pace with ASI via neural interfaces), the long term solution is total hardware sovereignty, aka the digital equivalent of bodily integrity and autonomy. We have to miniaturize and widely diffuse fab technology such that computer manufacturing can be done in local small businesses or even at home: automated chip fabbing, 3D printing, and assembly in one fridge-sized appliance you can buy at the nearest supermarket, and it can make parts to build another one of itself.
It's basically reproduction, but for the digital part of your body instead of the bio part. You should be able to design and fab your own custom chips, PCB, and chassis to build your neural interface from scratch, and write personal defense software that actively adapts to threats - a digital immune system. You'll also have the option to delegate some or all of that to a collective, but it would mean losing your individual sovereignty and becoming part of a larger organism in a symbiogenesis or multicellular evolution kind of way.
>bodily integrity and autonomy
Which you already do not have. And what you do have, is being eroded further.
You live in a world where you can be forcibly caged for a faulty manipulation of symbols you did not even consent to learning! You can be caged for doing things for your "own" body; in turn, repairs to your body can be denied and even deemed "impossible" because your physical existence threatens someone's illusions.
Maybe hunter-gatherer bands could've been said to have been autonomous. But the individual? Simply a replaceable embodiment for vast, impersonal forces. Your body and mind have always been property of the society that manufactured you. You do not own even your cherished the illusion of autonomy; it's just another behavior taught to you to make you produce more for your masters.
That's a somewhat accurate description, and you could even replace "society" with "universe". But what I'm defending is precisely the apparent feeling of autonomy, which is just called "autonomy" in colloquial terms omitting the philosophical baggage. I don't think it's fair to call this illusory, because you have no basis to define what an illusion is if you accept that all you know and all that you are is the product of universal influence. Included in that universal influence is every instance of experience from which your understanding of the concept of "illusion" was derived, so "illusion"/"real" would refer to the same thing in your worldview.
Now, taking a pragmatic materialist stance: we are obviously bound by physics and cannot move in certain ways. We can predict what action a person will take from their brain activity before the person becomes aware of their decision themselves. But what the brain does to convince you that oneself is in control is probably the exact thing that's required for life to thrive. It was the evolutionary path taken, and it's also the future I strive for, and I hope others would do the same.
Another thing that can be done is more crowdfunded bounty programs.
5 here: https://cybersecuritynews.com/bug-bounty-platforms/
The issue are "bugs" could be randomly distributed, even across the same version number of some device.
Sample sizes and statistics come into play at that point.
Whistleblower protections are an avenue, but people can still be dealt with harshly (Schulte) and degree-of-protection can come down to motive. But motive itself is multivariate, is it not? A local-first Fediverse, with some type of "guaranteed anonymity" would work, though. But anonymity doesn't mean something can't be a hoax either, so it becomes a signal vs noise issue at that point. Yet, "nothing totally secure ever really is."
Source information can be embedded in the period of a printed sentence too.
A moral world is the answer to many problems. Something to ponder. People are said to only see the errors in their ways after death in the "hall of mirrors."
-- https://web.archive.org/web/20060102095331/http://maitreya-e...
Economic espionage is something to also think about. You may be doing everything right and that's what makes you a target. "If I'm not top dog, target anyone that is."
Perfect anonymity in crypto can also aid whistleblowing so that dump data = get paid.
Once you control the hosts CPU it's game over for the guest. The best you can do is to fetch old PPC G4 Apple computers or Thinkpads.
[dead]
As noted by userbinator: https://news.ycombinator.com/item?id=49220030
Not a backdoor, but a documented CPU feature.
The whitepaper about rosenbridge cannot be published because it would constitute scientific fraud.
> Not a backdoor, but a documented CPU feature.
I would be even more explicit and call it “Not a backdoor, but a documented feature of ancient de facto unused Via C3 CPU.”
Calling it a "backdoor" is subjective, because it looks enough like an unintentional exploitable bug that one could make that argument. Is an accidental backdoor still a backdoor? That's pure semantics.
For Intel-ME and AMD PSP, you fundamentally can't see the backdoor they could produce unless you probe the seperate chip lol.
Even before that, wasn't SMM the OG x86 backdoor?
Or we use AI to find bug in those systems. Along with the way to completely disable those.
If you have an AI, you could make it analyze crystal photos?
You can find recorded presentations on YouTube: https://youtu.be/_eSAF_qT_FY
So is it apparent that this backdoor was intentionally added by VIA for nefarious purposes? Or is there any other reasonable explanation for its existence?
Yes there is a harmless explanation. The VIA C3 is a fairly simple CPU design that cracks x86 instructions into an internal simpler instruction format. Some complex x86 behaviour is normally implemented by lengthy microcode or complex state machines. VIA wanted to make their CPU simpler than Intel and AMD. To do that they exposed this internal instruction set to the BIOS to let it handle hardware initialisation and documented how to lock this feature safely away afterward. Some BIOS authors didn't read/understand the full specification. shrug.
IIRC there are also a few hints they at least considered exposing this alternative instruction set at runtime to get more performance out of the CPU core e.g. more useable registers, more three operand instructions, saturating and packed math for DSP workloads, etc.
I was wondering the same, this is an ancient CPU by now, having been introduced in 2001. During development and at the introduction, most people were still running Windows 95/98/ME, which had more serious security issues (like every user essentially being admin). It may just have been a handy (debugging?) feature?
Misleading, clickbait title. Technically accurate, but it would be accurate if it were 3 total cpu's rather than thousands or millions so that is a low bar.
Via C3 CPUs are the only ones affected. A security problem sure, but a relatively obscure one that doesn't effect anyone's laptop, server in the cloud, etc.
A reasonable title is "Backdoor found in Via C3 cpus".
Should add (2018) to the title
My bad, but I don't see an edit option anymore.
Title should be: ..in VIA C3 processors.
(2018)
And "x86" sort of gives the wrong impression -- this isn't an AMD or Intel chip; it's a 2001-era VIA chip.
Intel chips also have a hardware backdoor in the form of a separate core that the neither the user nor the installed operating system control.
Intel Management Engine:
https://www.wikipedia.org/wiki/Intel_Management_Engine
As do AMD chips:
AMD Platform Security Processor:
https://www.wikipedia.org/wiki/AMD_Platform_Security_Process...
Irrelevant. The IME/PSP are not described in this article and function differently.
While the README calls it a separate core, it's more likely to be a direct encoding of uops.
"Not this shit again"...
Almost exactly 8 years ago: https://news.ycombinator.com/item?id=17727140
Interesting codenames: https://en.wikipedia.org/wiki/List_of_VIA_C3_microprocessors
https://www.eetimes.com/hot-25-wen-chi-chenvia-technologies/
It’s lovely to think some x86 CPUs have a nice ISA buried under the layers of cruft that form a recent x86 ISA.
I still remember the time when mnemonics were 2 or 3 characters. Good days.
Apparently a chain of bugs leads to this. This is an internal debugging feature for VIA, but some motherboards accidentally left it enabled.
I am always wondering how those backdoors are discovered without internal leaks, fuzzing or enumerating all instructions bytes seem like too random.
Google “sandsifter”
Click bait title, please change it to VIA C3 CPUs
I recommend flagging this sort of crap to death...
Stupid autistic policy of "Don't editorialize the title"...
My bad, HN doesn't allow editing after an hour of posting
The backdoor(sic) is to delete and repost as you wipe the egg off your face.
The CPU is not the most used vector, the firmware is.
A much better title would be "A hardware backdoor in a historical VIA x86 CPU".
I had not heard of VIA since the 1990's.
I owned an HP 2133 mini-note netbook for a little while around 2008-2010. It was sporting a VIA C7-M with a VIA Chrome 9 gpu. Honestly the cpu was slow, probably slower than the equivalent Atom of that era but the Linux version of that laptop (sold with Linux Enterprise) made up for it with 2GB as standard which was glorious for a netbook at the time.
The keyboard and trackpad was also way ahead of the competition (ie other netbooks). The GPU was the biggest issue as VIA only built a proprietary driver for the kernel that was used at the time by Suse Enterprise. Thanksfully someone quickly wrote an openchrome driver that allowed me to install my distro of choice at the time with a newer kernel.
I think it would still be a decent portable machine to write stuff and or use as a portable terminal emulator to connect to remote machines but completely unusable to do anything else. I remember resizing photos to create thumbnails for a web gallery was taking ages and that was with much fewer megapixel than today.
Can we add "some ancient Via CPUs" to the title. Current title is pure click bait.
(2018)
[flagged]
[dead]
[dead]
[dead]
[dead]