Intel is preparing the risk that unauthorized persons with physical access can be used to install malicious firmware on the chip to overcome a number of mechanisms, including the security provided by Bitlocker, trusted platform modules, copyright restrictions, and more.
The insecurity– found in Pentium, Celeron, and Atom CPUs on Apollo Lake, Gemini Lake, and Gemini Lake Refresh platforms – allows for smart theft to have affected devices. chip to use it in debugging and testing methods used by firmware developers. Intel and other chips makers work hard to prevent unauthorized access.
Once in the update, the attacker can remove the key used encrypt data stored in the TPM enclave and, if TPM is used to store the Bitlocker key, override the final security. The adversary can also bypass the code signature blocker which prevents unauthorized firmware from operating in Intel Management Engine, a small portion within vulnerable CPUs, and from there I reset the chip.
While the attack requires the attacker to be able to use a low-risk tool, the reality is that TPM, Bitlocker, and codeigning were designed to minimize it. The whole process takes about 10 minutes.
Each Intel CPU has a unique key that is used to generate tracking keys such as Intel’s TPM, Enhanced Privacy ID, and other self-defense devices that rely on Intel silicon-enabled devices. This special key is known as a “fuse encryption key” or “chipset key fuse.”
“We have found that you can remove this key from a security guard,” Maxim Goryachy, one of the investigators who found the threat, told me. “Instead, the key is encrypted, but we also found a way to change it, and it allows us to put unstable codes inside the control engine, remove bitlocker / tpm keys, and much more.”
A blog post published Monday expands the tools that thieves can use. Mark Ermolov, one of the investigators who identified the threat, wrote:
One example of real dangers is lost or stolen laptops that contain passwords. Using this security, the attacker can extract the encryption key and retrieve the information inside the laptop. This problem can also be applied to attacks that you want to incorporate chains. For example, an employee at Intel processor-based device supplier may, in theory, remove Intel CSME. [converged security and management engine] firmware key is to send spyware that security software cannot detect. This threat is even greater because it helps to remove passwords used technically by Intel PTT (Platform Trust Technology) and Intel EPID (Confidential ID ID) in digital security devices to prevent unauthorized copying. For example, several Amazon e-books use security from Intel EPID to promote digital freedom. Using this security, the intruder can remove the EPID key on the device (e-book), and then, after interfering with Intel EPID technology, download electronic devices from file providers, download, and distribute.
Bumps, Complex Tertiary Systems
Over the past few years, researchers have used a wide range of firmware and functionality in Intel products to overcome the important security guarantees that the company makes on its CPUs.
In October 2020, the same team of researchers released the secret key which hides the flexibility of various types of Intel CPUs. Having a modified copy can allow destroyers to change engineers and better learn how to use the hole they are entering. The key may allow parties other than Intel – titi, malicious thief or sportsman – to change their chips and microcodes, even if the modified version cannot survive the relapse.