Recently I was thinking of the feasibility of hardware backdoors in the CPU introduced by manufacturers at the behest of three letter agencies. I can think of two potential backdoors that seem extremely powerful, but want to see if they would be practical.

The first backdoor would be a god-mode privilege execution backdoor. Essentially, if a series of magic values were introduced to registers and an undocumented instruction was executed, the CPU would take some chunk of memory and begin executing it in ring0. In this hypothetical situation, registers rax, rbx, rcx, and rdx could hold the magic value giving 256 bits of entropy to ensure that the backdoor couldn't be stumbled upon accidentally, a fifth and sixth register would hold the starting and ending address of the chunk of memory to execute.

This seems entirely possible and even practical to me, but an even more powerful backdoor would be to not only elevate privileges, but execute code remotely, and that's the backdoor I'm not sure is feasible. For this backdoor, the manufacturer would have to depend upon a networking driver reliably loading some series of values into cpu registers based on the characteristics of incoming network traffic. Presumably if you assume the cpu manufacturer is onboard with the three letter agency the network card manufacturer could be brought onboard as well to ensure this is the case.

If this could be guaranteed, the backdoor could work as follows. The cpu checks the values loaded into the four "magic value" registers. If the four registers together contain the magic value, the next two registers are used as before to define the addresses in memory to load into ring0. When the attacker wishes to exploit the backdoor, he sends crafted network packets that are guaranteed to end up loading the magic values into the correct cpu registers, along with the starting and ending addresses to be loaded into ring0. In addition, the packets send the actual code to be executed, which is stored in the network card driver's memory buffer and pointed to be the magic values in the fifth and sixth registers.

When all is said and done, the attacker is essentially able to go from no access to ring0 access simply by firing some network packets at the computer.

The biggest issue with such a backdoor that I can see is ASLR and configuration differences causing the memory layout to be uncertain. To prevent this from causing problems, instead of the fifth and sixth registers containing direct addresses, they could contain offsets from the starting address of the network driver, which the CPU could retrieve by examining the interrupt descriptor table register to get the IDT address and using the IDT to get the address associated with the interrupt generated when a network packet is received.

How feasible would each of these backdoors be? I'm by no means a hardware expert, but it seems to me that the simple privilege execution backdoor would be entirely feasible, while the remote execution backdoor may be too error prone.

  • Feasible - maybe. Realistic in my opinion not. Just imagine how hard it will be to keep this kind of backdoor really secret. There are thousands involved in the design of a processor and millions of these CPU are build, so the chance of a leak or even accidental detection will be high. And then imagine the loss of trust into the CPU vendor and the resulting loss of business. Aug 30, 2021 at 20:43
  • @steffen-ullrich It seems like the actual logic to be implemented would be fairly simple (just compare a fixed set of registers to a magic value and if they match go to an address and execute it in ring0) so it would seem like not too many people would actually need to know about the design. And given the billions of transistors in a modern cpu it would easy for it all to be lost in the clutter. Regarding trust, IMHO PRISM showed tech companies really don't have to fear working with the feds when it comes to surveillance. Aug 30, 2021 at 20:51
  • Just working together and actually deliberately hiding this kind of clear backdoor in all CPU is in my opinion vastly different. It would be probably be smarter instead to deliberately introduce "accidental" bugs in the design, since this provides better believable excuses ones the issue gets detected. Aug 30, 2021 at 21:13
  • @steffen-ullrich In that case, do you think it would be feasible to trigger these accidental bugs without having any software running on the system, via network packets in a manner similar to the remote access backdoor I mentioned above? Aug 30, 2021 at 21:36
  • "without having any software running on the system ..." - a CPU without software does not even get network packets. There need to be at least some firmware for network cards, system setup ... Aug 31, 2021 at 4:13


You must log in to answer this question.

Browse other questions tagged .