GOD MODE UNLOCKED - Hardware Backdoors in x86 CPUs
Black Hat1 HN recommender · recommended in 1 month, 2018–2021
talk · advanced · evergreen · 2018–2021 on HN
Christopher Domas's Black Hat talk demonstrates a hardware backdoor in a third-party x86 processor, a hidden core that grants root from userland. He uses it to discuss how feasible broader hardware backdoors might be.
Cited in hardware-trust and supply-chain threads as a concrete, startling demonstration of chip-level backdoors.
Up next
3 mo on HNJonathan Haidt: The moral roots of liberals and conservatives
TED
3 HN recommender · 2016–2018
5 mo on HNClickbait is Unreasonably Effective
Veritasium
5 HN recommender · 2021–2025
2 mo on HNThe Unreasonable Efficiency of Black Holes
minutephysics
2 HN recommender · 2020–2025
3 mo on HNHow Electricity Actually Works
Veritasium
4 HN recommender · 2023–2026
5 mo on HNGovernment Surveillance: Last Week Tonight with John Oliver (HBO)
LastWeekTonight
5 HN recommender · 2015–2023
3 mo on HNHow Not to Land an Orbital Rocket Booster
SpaceX
4 HN recommender · 2018–2026
3 mo on HNSpherical Geometry Is Stranger Than Hyperbolic - Hyperbolica Devlog #2
CodeParade
3 HN recommender · 2021–2026
6 mo on HNThe Biggest Misconception About Electricity
Veritasium
7 HN recommender · 2021–2026
11 mo on HNBehind the Scenes of iOS Security
Black Hat
9 HN recommender · 2016–2026
11 mo on HNWhy Electronic Voting Is Still A Bad Idea
Tom Scott
11 HN recommender · 2020–2026
10 mo on HNUSENIX Security '18-Q: Why Do Keynote Speakers Keep Suggesting That Improving Security Is Possible?
USENIX
10 HN recommender · 2018–2026
10 mo on HNDefcon 18 Changing threats to privacy Moxie Marlinspike Part
killab66661
6 HN recommender · 2012–2019
5 comments from Hacker News
Probably not. However, historically, these sorts of attacks always get better, not worse. And while even that can sometimes be empty rhetoric, I will say in the last 5 years I'm seeing a lot of security attacks that are already well beyond what even my moderately-trained intuition would suggest are possible, so I have to admit I've sort of given up on trying to guess on whether or not an attack can be made practical. I've seen too many mind-blowing presentations from security researchers to think I can bound their abilities safely. I wouldn't care to bet that they won't move the attacks I already am flabbergasted can exist to some other even-more practical attack that I am flabbergasted can exist. This is unrelated to the current matter, but let me give you an example: ▶ this video If you think that's trivially obvious, and you're confident you can predict how these sorts of things will play out in the future, more power to you, but I'm certainly not justified in that belief at my skill level. I'm just happy I can follow that presentation!
> we need tools that don't require so much blind trust Completely agree. > Open source and verifiable down to the firmware is the only chance we have at any real level of trust The hardware itself could be compromised though. There's just no way to know what's really inside these black boxes. ▶ this video We'll never have real trust until we get the ability to fabricate our own processors in our own home just like we already have the ability to write our own software.
Yeah Occam's razor says your efforts would be much better spent on flashing custom firmware than a retrofit. That or a deliberate backdoor built into the chip from the ground up. Or something like this: ▶ this video But a nearly magic rice-grain part with a microcontroller and networking?? You could make a fortune in IOT with something that capable.
Here is a demonstration by Christopher Domas where he uses an undocumented processor hidden in an X86 processor to become root: ▶ this video
This[0] is a backdoor that was discovered _only_ through reading patents on the chip. It gave the highest possible privilege(ring -4) to the user by simply running an undocumented cpu register. It would be incredibly easy to hide something like this within one of the 100 of thousands of computers that go to the big 4 or even the pentagon. I'd imagine people at the pentagon select randomly from a number of computers coming in and do some chip analysis like this[1] but I can only speculate and they probably can't stop all the hardware backdoors this way. Anybody that would be caught disclosing highly classified information would probably be found and promptly hanged(or get in some sort of freak car accident). They probably have some serious counterintelligence to catch the leaks. Once again I am only speculating. [0]: ▶ this video [1]: link