9

After reading this article, I am really curious as to how, exactly processor microcode updates from Intel or AMD are issued. In what way is the data transmitted? Is it possibly to 'firewall' these updates if one was paranoid about Putin switching to typewriters to avoid inherent computer security flaws? If I am using Linux, is it possible I am safe because I am not receiving Windows updates? I would think that someone would notice a connection from their computer to intel or an attackers server, at some point.

From what I have read, the consensus around the security community is that these attacks are not very feasible. But I am still curious as to how these updates are issued, and what type of transmission protocol is used. In order for this to be possible, the computer would have to request the connection to get through a properly configured firewall, regardless of whether the backdoor exists purely in the processor itself, and not the operating system.

Is it possible to block these updates altogether, if one was very paranoid?

  • 2
    Microcode is never written to the CPU. It's just loaded very early in the boot process by the OS itself. On Linux, you need to explicitly load the µcode by adding an extra line to your bootloader's configuration, so you can just remove that line to prevent loading it. On Windows I'm not sure how this µcode is delivered, but I guess you can just not install the related Windows update. – user42178 Mar 20 '15 at 3:24
  • That's good to know, thank you. However, my bios was installed on Windows, in fact I had to install Windows just to update my bios, so can I trust it? It makes me wonder.. Does the BIOS have the ability to make internet connections during boot, (or do other things with hardware connected to it)? And if so, would there be any way to detect what it is doing from my operating system? Intel has been descent to the open source community, but to get they're updates you need to manually install their software. So why all this microcode-backdoor paranoia? Would you say it's pure speculation? – Chev_603 Mar 20 '15 at 22:31
  • A BIOS is just software, it can do anything and it's only limited by the size of the EEPROM (a few megabytes) it resides on. I'm pretty sure it's possible to implement a basic network and HTTP stack in that amount of code. As far as trusting it, I'd say you're fine as you're already trusting your hardware's manufacturer, and BIOS-based attacks are extremely hard to pull off (as an attacker you'll need to buy the exact same hardware and do reverse-engineering on it to write your custom malicious BIOS). – user42178 Mar 21 '15 at 5:04
  • Yeah, it is hard enough to implement a working web server on a router with 4mbs of flash, so I see your point. This kind of attack, although theoretically possible, would take more effort than its worth. However, there was that German manufacturer of SIM cards that the NSA hacked, the master key was stolen and the NSA can decrypt all communications those sims make. Let's hope Intel airgaps their encryption keys. – Chev_603 Mar 21 '15 at 6:58
  • 1
    Key protection isn't an issue, I'd love to see those keys leak on the internet personally, just so everyone gets the right to run whatever microcode on their CPUs. If the attacker can run (you can't install it as it's again only loaded by the OS on each boot) you've already lost, so keys make little difference. And the GSM model was flawed from the start, SIM cards are a complete heresy, thankfully we don't have such bullshit with Wi-Fi. – user42178 Mar 21 '15 at 8:15
5

Answers to your questions, one by one:

  1. How are the microcode update files published?

    • They are simple, rather small, files, published by the processor makers.
  2. How are they loaded into the CPU?

    • Your processor comes with an initial version, that it boots up with.
    • Your processor has a sequence of instructions to initiate a microcode upload.
    • The BIOS/UEFI of your system may have a newer version, that it will load into the processor before your boot-loader gets control.
    • The operating system may have an even newer version. If so, it will load it into the processor during system start.
  3. How are new versions normally transferred into your computer:

    • If the BIOS gets updated by you, it could contain a newer version.
    • Your operating system may be setup for receiving microcode update through system update. (All current ones can)
    • If somebody nice from Intel gives you the encryption key for their microcode, you could encrypt/sign a modified version, place it on your hard-drive, and load it with some instructions.
    • If somebody else can run processes on your system with System/root rights (e.g. Virus, Trojan), they can even do it for/to you.
  4. How could somebody apply such an update without me knowing?

    • These days, BIOS/UEFI implementations are entire operating systems in themselves, with all modern features, networking, usb, graphics, ... support.
    • Most network cards runs an entire, independent Operating System too. Aside from bugs, which you can bet there are, these firmwares all have (partly) documented remote communication protocols.
    • Somebody exploiting a bug in your NIC, or using the magic_key/protocol, could send a correctly signed microcode update to your CPU.
  5. How feasible is this type of attack?

    • For somebody with authority over the key-holders: Very easy.
    • For the savvy neighbor kid: impossible
  • Thanks, very thorough, and a little scary. Afaik, my microcode is loaded from the linux repositories, and verified with gpg. But I have no idea what my mobo could be doing, and it certainty implements a tcp stack, as I can update the bios over the internet. Hopefully, if this attack is being exploited in the wild, someone that monitors their connections with furious paranoia (like me), would take notice, and we'd all hear about it. Thus, if this is happening, I would think that it's on a very limited and targeted basis. – Chev_603 Oct 29 '16 at 13:38
2

Yes, it's absolutely possible to shun them. And there's no kind of enforcing. Nor any particular way you shouldn't be able to rollback.

Updates either come with newer BIOS, or OS loads them. In the latter case, we can assume either you are on Linux or on Windows.

In the first situation, they get loaded from linux-firmware/intel-ucode, in the second they come via normal Windows Update. And as such you can install/uninstall them at will.

If you are really paranoid, delete any instance of mcupdate_AuthenticAMD.dll and mcupdate_GenuineIntel.dll you find on your system.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.