Intel x86 considered harmful
Joanna Rutkowska
October 2015
Contents
1 Introduction
5
Trusted, Trustworthy, Secure?
. . . . . . . . . . . . . . . . . . . . . .
6
2 The BIOS and boot security
8
BIOS as the root of trust. For everything.
. . . . . . . . . . . . . . .
8
Bad SMM vs. Tails
. . . . . . . . . . . . . . . . . . . . . . . . . . .
9
How can the BIOS become malicious?
. . . . . . . . . . . . . . . . .
9
Write-Protecting the flash chip
. . . . . . . . . . . . . . . . . . . . .
10
Measuring the firmware: TPM and Static Root of Trust
. . . . . . . .
11
A forgotten element: an immutable CRTM
. . . . . . . . . . . . . . .
12
Intel Boot Guard
. . . . . . . . . . . . . . . . . . . . . . . . . . . . .
13
Problems maintaining long chains of trust
. . . . . . . . . . . . . . .
14
UEFI Secure Boot?
. . . . . . . . . . . . . . . . . . . . . . . . . . .
15
Intel TXT to the rescue!
. . . . . . . . . . . . . . . . . . . . . . . . .
15
The broken promise of Intel TXT
. . . . . . . . . . . . . . . . . . . .
16
Rescuing TXT: SMM sandboxing with STM
. . . . . . . . . . . . . .
18
The broken promise of an STM?
. . . . . . . . . . . . . . . . . . . .
19
Intel SGX: a next generation TXT?
. . . . . . . . . . . . . . . . . . .
20
Summary of x86 boot (in)security
. . . . . . . . . . . . . . . . . . . .
21
2
Intel x86 considered harmful Contents
3 The peripherals
23
Networking devices & subsystem as attack vectors
. . . . . . . . . . .
23
Networking devices as leaking apparatus
. . . . . . . . . . . . . . . .
24
Sandboxing the networking devices
. . . . . . . . . . . . . . . . . . .
24
Keeping networking devices outside of the TCB
. . . . . . . . . . . .
25
Preventing networking from leaking out data
. . . . . . . . . . . . . .
25
The USB as an attack vector
. . . . . . . . . . . . . . . . . . . . . .
26
The graphics subsystem
. . . . . . . . . . . . . . . . . . . . . . . . .
29
The disk controller and storage subsystem
. . . . . . . . . . . . . . .
30
The audio card
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
31
Microphones, speakers, and cameras
. . . . . . . . . . . . . . . . . .
31
The Embedded Controller
. . . . . . . . . . . . . . . . . . . . . . . .
32
The Intel Management Engine (ME)
. . . . . . . . . . . . . . . . . .
33
Bottom line
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
33
4 The Intel Management Engine
34
ME vs. AMT vs. vPro
. . . . . . . . . . . . . . . . . . . . . . . . . .
35
Two problems with Intel ME
. . . . . . . . . . . . . . . . . . . . . . .
35
Problem #1: zombification of general-purpose OSes?
. . . . . . . . .
36
Problem #2: an ideal rootkiting infrastructure
. . . . . . . . . . . . .
37
Disabling Intel ME?
. . . . . . . . . . . . . . . . . . . . . . . . . . .
37
Auditing Intel ME?
. . . . . . . . . . . . . . . . . . . . . . . . . . . .
38
Summary of Intel ME
. . . . . . . . . . . . . . . . . . . . . . . . . .
39
5 Other aspects
40
CPU backdoors
. . . . . . . . . . . . . . . . . . . . . . . . . . . . .
40
Isolation technologies on Intel x86
. . . . . . . . . . . . . . . . . . . .
41
Covert and side channel digression
. . . . . . . . . . . . . . . . . . .
42
Summary
44
And what about AMD?
. . . . . . . . . . . . . . . . . . . . . . . . .
4
http://blog.invisiblethings.org/papers/2015/x86_harmful.pdf