DEF CON 26 - Christopher Domas - GOD MODE UNLOCKED Hardware Backdoors in redacted x86

Рет қаралды 74,071

5 жыл бұрын

Complexity is increasing. Trust eroding. In the wake of Spectre and Meltdown, when it seems that things cannot get any darker for processor security, the last light goes out. This talk will demonstrate what everyone has long feared but never proven: there are hardware backdoors in some x86 processors, and they're buried deeper than we ever imagined possible. While this research specifically examines a third-party processor, we use this as a stepping stone to explore the feasibility of more widespread hardware backdoors.

Пікірлер: 145

@collapzcursed 5 жыл бұрын

Dude's a legend... and every year his talks become more dystopian if you think about the implications.

@Mr_i_o 5 жыл бұрын

tru dat.

@TheNetherwalker 5 жыл бұрын

I can't help but think about all the things he's found that he isn't talking about.

@CellularInterceptor 5 жыл бұрын

@Brendon O'Connell There's NEVER been security - it's ALWAYS been an ILLUSION. It is just another made up story that most people believe!

@charlesnathansmith 4 жыл бұрын

@@CellularInterceptor yeah, but "the implication"

@Neurotik51 3 жыл бұрын

@@CellularInterceptor I'll take somewhat insecure computing over a world without them any day.

@tomkusmierz 5 жыл бұрын

Since 1995 we (software engineers) had a common mindset - if you allow to execute someones code on your machine - it's not your machine anymore ... 24 years later - still very valid.

@nicolareiman9687 4 жыл бұрын

Ken ( the creator of unix) talk about it in 1984 in a paper called Trusting trust.

@randomuser5237 5 жыл бұрын

The positive thing about this is that there are very few people in the world with the tenacity, intellect and mental discipline like Chris and go through the challenging and tedious process to uncover the backdoor. This is not something you can just stumble onto by luck. Awesome talk as always Chris, this was more interesting than most thriller movies. Just couldn't stop until the end.

@RobinObinray 5 жыл бұрын

Random User i'm gonna surprise you by telling you that "very few people" like these run our prison planet world. Literally. Research using keywords....

@RobinObinray 5 жыл бұрын

wertercatt you can call them whatever you want. But i know for myself, that these people are like demonic entities from somewhere inter/hyper-dimensionally...

@tomkusmierz 5 жыл бұрын

Or well paid state actors ... and this talk bluntly states: "relying your core services on networked computers is giving opponent a kill switch"

@timewave02012 4 жыл бұрын

The positive thing is there enough people like Chris, that some of them choose to reveal the secrets they find, and freely release security tools.

@Neurotik51 3 жыл бұрын

@@RobinObinray lol

@mattheck1561 Жыл бұрын

The first 3:30 of this are the most razor-sharp demo of an editor-to-root exploit I have ever seen, but the most important thing in this talk is his research methodology. This guy is scary fast.

@zulowski Жыл бұрын

I've watched him in "breaking the x86 instruction set"... So happy youtub sugested this talk... three and a half minutes in, and already spoiled some words loud to my self

@ArtemShitov 11 ай бұрын

"the most razor-sharp demo of an editor-to-root exploit" Although you should also remember that before that he assumed that you already have access to Ring 0 and change some register state beforehand. IMO if you have access to Ring 0, you're already baked.

@unknowndefaultguest 11 ай бұрын

@@ArtemShitov I get your point. It would be interesting to see something similarly fast and clear for that precursor step as well, of course.

@ryjelsum 6 ай бұрын

@@ArtemShitov except he said at the end that some other VIA processors have the necessary 'magic bit' flipped on by default... which removes the one-time ring 0 assumption from being an issue on those models assuming all else is identical

@strat5520 4 жыл бұрын

This guy. Just a phenomenal understanding. What an amazing SOB. Just genius.

@coolxjl 4 жыл бұрын

"Probably a useful feature for their customers" :D Hmmm... What kind of customers and what kind of use they had in mind, I wonder :D

@elmateo77 4 жыл бұрын

Well I guess if the NSA gives them money then they technically qualify as a customer...

@metaforest 4 жыл бұрын

Domas is The Ring Master!!

@NolePTR 3 жыл бұрын

You might say he is a Lord of the Rings.

@arlobubble3748 3 жыл бұрын

@@NolePTR ba dum tss

@Quancept Ай бұрын

damn

@a3axon 3 жыл бұрын

I used this information to program hello world in html

@yoloswaggins2161 4 жыл бұрын

This guy was hired by Intel last year, hasn't made a lot of noise since. Everyone has their price I guess.

@RN1441 4 жыл бұрын

Well thank goodness, he can do a lot of good there.

@dorukayhanwastaken 4 жыл бұрын

@@RN1441 >Intel >a lot of good Choose one.

@sepg5084 4 жыл бұрын

proof?

@JB-qq1xz 4 жыл бұрын

@@sepg5084 a simple google search pulls his public linkdin page...

@TheMrKeksLp 3 жыл бұрын

@@dorukayhanwastaken Yeah I hate Intel patching security bugs

@Tastybiscuit64 3 жыл бұрын

Your a wizard Harry! Nicely done, all of your instruction research is awesome AF.

@TheNoodlyAppendage 3 жыл бұрын

The sad thing is all the effort companies spend trying to keep control of these products could instead be used to make them faster and cheaper.

@tonirrolquimiguitau745 Жыл бұрын

I use this video as an ASMR to put me to sleep every single day

@AkashMishra23 5 жыл бұрын

This guy is not a mere mortal but a God

@Dosamer 5 жыл бұрын

Damn this is interesting.

@alfin3644 4 жыл бұрын

Cypher sees through The Matrix

@hygri 4 жыл бұрын

Wow Chris, you're god mode!

@statinskill 3 жыл бұрын

How's this for a knocking sequence? Poke bit 14 of MSR 26381 to 1. Poke bit 17 of MSR 1378 to 1. Poke bit 14 in MSR 26381 to 0. Poke bit 17 of MSR 1378 to zero. Load the magical value 495352414542020 into rax. Run clear decimal op three times followed by 18 nops followed by set decimal and a final clear decimal. Then you get access to two new opcodes, one is a SAVEALL instruction the other is a LOADALL. The point here is they can hide these things where we will simply never ever find them without taking the chip apart transistor for transistor. And at the same time once they have access to the instruction stream they own that box.

@GeorgeTsiros 2 жыл бұрын

dank af

@AntoshaPushkin 2 жыл бұрын

Even if we see every transistor, we may still have problems getting the sequence. For example, a processor may have some logic to calculate a hash of N recent opcodes and check if it's equal to some predefined value. Though if we see CPU transistor by transistor, it will be possible to see that there is something fishy

@statinskill 2 жыл бұрын

@@AntoshaPushkin Maybe we would not then know the knocking sequence, but I think we could tell if there is some sort of SAVEALL/LOADALL capability or anything that lets a thread break out of its privilege/processor mode.

@AntoshaPushkin 2 жыл бұрын

@@statinskill yep, that's what I meant. Though, maybe there is a way to obfuscate CPU to the point where you can't understand anything even with complete blueprint. After all, now CPUs have billions or even tens of billions of transistors, and malicious logic can be hidden in different parts in, say, 500k transistors, that will take an eternity to find or even understand if they exist

@statinskill 2 жыл бұрын

@@AntoshaPushkin At some point in complexity it becomes easier to simply obtain the cooperation of the people responsible.

@mushkamusic 5 жыл бұрын

Not too many humans like this on the planet.

@ruthannmarie7119 Жыл бұрын

Always someone smarter, just not one of them

@camelotenglishtuition6394 4 ай бұрын

Amazing.. no other words for it

@AvioInsane 4 жыл бұрын

Why do all the videos of Chris Domas have such horrendous audio quality? I would love to listen to them but i get a cluster headache 5 minutes in.

@DingleFlop 4 жыл бұрын

OMFG literally this.

@arlobubble3748 3 жыл бұрын

Don't listen on headphones. Very tolerable listening on a phone.

@SirGolfalot- 3 жыл бұрын

This presentation was spectacular. Of course our computer systems aren't 100% secure. So if I know about the gbit, I tend to think that I could soft trap for instruction attempting to access it. Nah

@zakmann8180 2 жыл бұрын

Our hardware is all run by Israeli-Russian Intelligence. All of the hardware and now software such as Windows OSs are now all done in Soviet-Israel. A backdoor into the west for Soviets now Russian and Chinese Intelligence to steal US Military technology and secrets etc.

@kentvandervelden 5 жыл бұрын

Epic!!

@svensubunitnillson1568 4 жыл бұрын

Rosenbridge :) clever!

@Chexsum 5 жыл бұрын

thats some alice in wonderland shit

@AdamBast Жыл бұрын

Simple:you need 2752 computers and you finish in 1 day

@sciencoking Жыл бұрын

But you do need root to set the bit ... *or do you?* _vsauce music_

@rishav4343 5 жыл бұрын

lets jus t go back to the drawing board with risc-v

@1O101O1O 11 ай бұрын

WHAT UP CHRISTOPHER

@denysvlasenko4952 2 жыл бұрын

It's obviously not an additional core, "deeply embedded" or otherwise. Instructions get executed right in the same context as surrounding x86 insns (in the ooo core, no less!). Looks like additional logic in the instruction decoder which decodes BOUND (opcode 0x62) differently (possibly only one specific form of it, with SIB byte, maybe even only with fixed values for MODRM and SIB bytes). In his example, opcode in binary is: 62 04 05 xx xx xx xx. When additional logic is enabled, this encoding no longer does the BOUND thing, instead it executes whatever is encoded in those 32 bits of xx's.

@caiocc12 9 ай бұрын

Modern (as in the last 2 decades) CISC processors actually have the decoder convert the instructions into lower level RISC instructions which are then executed. Probably this is just a bypass on the decoder so the "deeply embedded core" is just... the actual, real core. This "feature" can be extremely useful in debugging the CPU during its design, and I bet all processors have something like that, but in all probability fused off during manufacturing

@elmateo77 4 жыл бұрын

So there could be malware running on a secret architecture build into your cpu... Well done Intel, well done.

@faceplants2 4 жыл бұрын

Intel? This whole case study was done on VIA C3 machines. He even says in the conclusion "This is an old processor, not in widespread use."

@DingleFlop 4 жыл бұрын

Though, Intel DOES do shady shit, too. Check out his other talks for more info.

@anon58973 3 жыл бұрын

Should be sufficient to detect that a risc instruction has been executed. Yep.

@soutano1924 3 жыл бұрын

Just had a joint and that first demonstration he did made absolute no sense whatsoever.

@ryjelsum 2 жыл бұрын

Honestly, it's not supposed to make sense on the first pass.

@Stu49583 3 жыл бұрын

He is God

@luisponce3580 4 жыл бұрын

Can someone please tell me if this guy gave a talk in 2019?

@Mortyst 3 жыл бұрын

If you can't find it, that's probably because he didn't

@bartlx 2 жыл бұрын

Intel bought him an early retirement

@ryjelsum 2 жыл бұрын

Look at his linkedin, he's worked at intel since... shortly after his series of talks that blew the lid off of a bunch of x86 vulnerabilities. Interesting, huh?

@davidgreen7392 2 жыл бұрын

I'm an old ASM programmer from late last century; are we also stating that the architecture is of alien origin?

@itfitness5791 3 жыл бұрын

I have no idea what im talking about, but isnt it possible to spot a deeply embedded core by slicing the processor open and having a look at the Hardware?

@GeorgeTsiros 2 жыл бұрын

It is _possible_ but circumstances may make it very, very difficult.

@AntoshaPushkin 2 жыл бұрын

It probably costs a ton of money to get a blueprint out of an actual CPU and then a ton of money to make sense out of that blueprint and explain what different parts do

@thewhitefalcon8539 7 ай бұрын

It's not actually a separate core, but a way to bypass the instruction decoder.

@MichaelOfRohan Жыл бұрын

Defcon; blackhat for happy people!

@thewhitefalcon8539 7 ай бұрын

Wait until you find out about CCC

@tthtlc 4 жыл бұрын

I supposed all these should not exists in AMD, anyone experienced before?

@martinsalko1 5 жыл бұрын

I thought via was dead.

@RobinObinray 5 жыл бұрын

Martin Šalko who🦉?

@Caesim9 3 жыл бұрын

They make CPUs in China now.

@GeorgeTsiros 2 жыл бұрын

They still in 2021 make low power (consumption) CPUs, quite popular in the tiny form factor circles. At least, that is what i've understood

@soutano1924 3 жыл бұрын

How come everyone in these comments seems to know what he’s talking about while it might as well be an alien language to me.

@GeorgeTsiros 2 жыл бұрын

Take it slow! There is nothing demonstrated here that is above a normal person's ability to understand how CPUs work!

@AntoshaPushkin 2 жыл бұрын

At computer science b.sc degree the first year of studying should be enough to understand what is described here. Also you can study computer architecture yourself. People in the comments are not random people for the most part, they should know some things to be interested in this type of content

@thewhitefalcon8539 7 ай бұрын

Here's the layperson version: with a little bit of luck and a huge amount of trial and error, he found a secret backdoor in some old Intel-compatible embedded CPUs.

@ko-Daegu 5 жыл бұрын

So is anyone used the open source stuff he published...??? Wanna write an actual payload in metaspoit where I can send it to other damn ...that will be cool

@RobinObinray 5 жыл бұрын

Ko- Jap or port it to ARM and iPhones🤯

@RobinObinray 4 жыл бұрын

@barnyard but the algorithms should be the same at least?

@DingleFlop 4 жыл бұрын

@@RobinObinray No. That's the whole point. These backdoors are built on a per chip basis. ESPECIALLY the one demonstrated here, it's using a COMPLETELY weird processor architecture with an additional bizzare core embedded in it.

@Ghi102 3 жыл бұрын

It's a specific problem with these c3 chips, but the goal of the presentation is to show that it's possible. There's most likely a similar issue with the common intel and other processors, they just haven't been discovered yet.

@mariarahelvarnhagen2729 10 ай бұрын

skin in the game

@mariarahelvarnhagen2729 10 ай бұрын

Define Joint Chiefs

@ogamibirdflu5152 10 ай бұрын

The only vulnerability/problem Intel/Israel has with this is that someone was able to detect it. Its not like they put this in their chips by accident ffs.

@JohnTurney 5 жыл бұрын

Too many secrets

@ds-pc9ys 5 жыл бұрын

I like all kinds of astronomy.

@Inus 5 жыл бұрын

'so i build a tool' .. 'so i've written >name

@Bobby-fj8mk 6 ай бұрын

It means that the NSA can write software to hack you - they must have forced Intel do it - that's nasty.

@MadeAnAccountOnlyToReplyToThis 4 ай бұрын

Lol implying that Intel wouldn't like to have this for their own reasons

@Bobby-fj8mk 4 ай бұрын

@@MadeAnAccountOnlyToReplyToThis - Bill Gates was forced to hand over the source code to the NSA of Windows ever since Win95 and he wasn't allowed to tell the public that. They had Bill Gates by the balls. The NSA have been hacking Windows computers ever since 1995 which is 28 years. Every file on your hard disk could be read by them without your permission, every time you were connected to the internet and that is still the case right now. It's obvious that the NSA forced Intel to make their chips hackable - that's the way they are.

@Bleu_Sky Жыл бұрын

Only 64k views LOL

@recreationalplutonium 4 жыл бұрын

uncle ted was right

@TheOisannNetwork 3 жыл бұрын

This guy is a living osrs bot

@whatever2144 3 жыл бұрын

Okkkk....f***...has it been patched? It's red flag kind of thing here.Escalation to root by HW.....same as giving him the root password....only shorter.

@ryjelsum 2 жыл бұрын

THIS isn't on Intel. Only Via C3.

@TheMrTape 5 жыл бұрын

This exact talk with the same slides were released at Black Hat 2 months ago.. Disappointing, thought this was new stuff. At least this has comments enabled.

@gaeel330 5 жыл бұрын

Both talks were given within days of each other by the same researcher. Black Hat was between the 4th and 9th of August, DefCon between the 9th and 12th of August. These two events are organised by the same organisation, and have a very similar focus. Domas was invited to give his talk to both events, and I don't see why he would be expected to present different slides for this important research that cost him a lot of time, money and effort

@TheMrTape 5 жыл бұрын

@@gaeel330 Thanks. You don't have to wonder what's expected because that's irrelevant to my comment. I just think it's disappointing to see "new content" on youtube that isn't new; at least it could have had a disclaimer so I didn't waste time finding out it's the exact same. The description indicates it's never released information. It's bullshit and frankly fuck off with your justifying of it; the talks themselves has nothing to do with anything, it's a video on KZfaq pretending to be something new when it's not, and it wasted my time unwarranted.

@CellularInterceptor 5 жыл бұрын

@Brendon O'Connell EVERY nation state uses exploits!

@rezganger 5 жыл бұрын

@@CellularInterceptor U dont getit,do u..?

@djosearth3618 2 жыл бұрын

@@TheMrTape you make such fine use of it yourself, time ♥_♥