Intel's new CPUs are vulnerable to USB hacks

[cozz]

Positive Technologies, a security vendor has discovered that some of Intel's new CPUs have a debugging interface that can be accessed through USB 3.0 ports. This provides the hacker full control over the PC. Worse yet, it is completely undetectable by current security tools.

 

TweakTown's Anthony Garreffa stated "The possibilities of this are virtually unlimited, as someone could plug a USB 3.0 stick in and upload malicious code, keyloggers, and virtually anything else they wanted"

 

 

Maxim Goryachy at the 33rd Chaos Communication Congress in Hamburg Germany said: "We have reported this case to Intel, As of today this mechanism can be exploited only on Intel U-series processors. As of today, no publicly available security system will detect it."

 

 

 

 

Source; TweakTown
 

 

 

[anybodykek]

Does that mean the USB Killer would install Norton onto a device running Kaby lake instead of killing it? The horror!

[iRileyx]

If its done through usb ports, surely the hacker would have to be at the computer then? So this wouldn't be a worry for most people at home, or companies.

[sazrocks]

U-series CPUs, aren't those laptops? If so that makes this even worse.

[cozz]

1 minute ago, sazrocks said:

U-series CPUs, aren't those laptops? If so that makes this even worse.

Laptops and NUCs, which IMO is worse than desktops.

[Himommies]

2 minutes ago, sazrocks said:

U-series CPUs, aren't those laptops? If so that makes this even worse.

indeed they are

[cozz]

2 minutes ago, RKRiley said:

If its done through usb ports, surely the hacker would have to be at the computer then? So this wouldn't be a worry for most people at home, or companies.

Yes, and no, it's still a MAJOR flaw, in the article they also state that it's U-series CPU's, which are the ones found in laptops and small factor PC's like NUCs, which people usually take around with them.

[ARikozuM]

So... Same sh#t, different day...

[TheKDub]

Well shit, hopefully they come up with something soon... My laptop has an i5 7200u.

 

Guess I'll just have to keep any usb devices that are not my own out of it for now.

[cozz]

1 minute ago, ARikozuM said:

So... Same sh#t, different day...

Idk about the same shit, show me another example of CPU's having an open back door with the key being in the lock ready to open whenever.

[Mira Yurizaki]

I'm curious about this considering the USB 3.0 ports go through the PCH, not the processor directly.

 

Either way, spin a new revision of the CPU or chipset, have the manufacturers issue recalls or UEFI updates if it can be fixed in microcode, and call it a day.

[sazrocks]

Wasn't kabylake supposed to increase security?

 

Seriously, how are they going to fix this? I'm assuming at the minimum a bios update, and at worst its in the hardware and thus impossible to turn off.

[Mira Yurizaki]

1 minute ago, sazrocks said:

Seriously, how are they going to fix this? I'm assuming at the minimum a bios update, and at worst its in the hardware and thus impossible to turn off.

You spin a new revision of the chip. Intel has had hardware bugs in the past that were fixed this way.

[Mira Yurizaki]

3 minutes ago, cozz said:

Idk about the same shit, show me another example of CPU's having an open back door with the key being in the lock ready to open whenever.

We can start with: http://danluu.com/cpu-backdoors/

Here's a post (http://www.realworldtech.com/forum/?threadid=35566&curpostid=35566) that suggests AMD's K7 and K8 had an issue with the microcode allowing someone to inject arbitrary code.

 

And then there's the whole conspiracy theory that Intel and AMD have backdoors in all CPUs courtesy of the NSA.

[cozz]

1 minute ago, M.Yurizaki said:

We can start with: http://danluu.com/cpu-backdoors/

Here's a post (http://www.realworldtech.com/forum/?threadid=35566&curpostid=35566) that suggests AMD's K7 and K8 had an issue with the microcode allowing someone to inject arbitrary code.

 

And then there's the whole conspiracy theory that Intel and AMD have backdoors in all CPUs courtesy of the NSA.

You got me there

[ARikozuM]

6 minutes ago, cozz said:

Idk about the same shit, show me another example of CPU's having an open back door with the key being in the lock ready to open whenever.

Intel introduced a 3G chip (radio band) onto their CPU's in 2012 (?) allowing IT to remotely diagnose PC's even when wireless.

[handymanshandle]

Does it affect Kaby Lake running on Z170.

[♠FlamieMeister♠]

Just now, wcreek said:

Does it affect Kaby Lake running on Z170.

Yup

[cozz]

1 minute ago, ARikozuM said:

Intel introduced a 3G chip (radio band) onto their CPU's in 2012 (?) allowing IT to remotely diagnose PC's even when wireless.

Didn't know about that, that's concerning..

[handymanshandle]

1 minute ago, ARikozuM said:

Intel introduced a 3G chip (radio band) onto their CPU's in 2012 (?) allowing IT to remotely diagnose PC's even when wireless.

Illuminati is confirm

[ARikozuM]

Just now, cozz said:

Didn't know about that, that's concerning..

It isn't. This is merely reinforcing the fact that you need to practice safe techs.

[cozz]

1 minute ago, ARikozuM said:

It isn't. This is merely reinforcing the fact that you need to practice safe techs.

I was just talking to my boss about this news and he's said the 3G chip was meh, the real thing you need to look out for is vPro, intels own hidden backdoor to your CPU.

 

How did i not know about this stuff haha

[handymanshandle]

Just now, ♠FlamieMeister♠ said:

Yup

Well. Interesting. I'm still planning on running a Kaby Lake CPU on my Z170 board. Honestly I should've gotten a Z270 mobo but I liked the way it looked and when I ordered it, I was thinking about a 6700K. Really there's not much difference but it'd be cool to have a CPU OC to 5.2GHz on a Kraken X52.

[Mira Yurizaki]

In all honesty, while this is scary, the layman need not be concerned because:

• You're not a valuable target
• Someone needs to have physical access to your computer
• If your OS is smart enough, it won't autorun stuff from removable drives unless they're using some other attack surface.

[handymanshandle]

16 minutes ago, RKRiley said:

If its done through usb ports, surely the hacker would have to be at the computer then? So this wouldn't be a worry for most people at home, or companies.

Perhaps a USB drive could be infected without the user knowing it. Though I'm not sure how remote the hacker can actually be or if they can rely on other means to get access without being physically present.