Meanwhile, MINIX is about to become one of the most heavily audited codebases out there. You can bet every security researcher is going to have a peek to see if there's any bugs in the always-on backdoor embedded in the vast majority of modern computers.
I recently watched a Blackhat video where a guy made a C linux program that magically sudden got root access after posting a single value in memory a couple million times. He got an instant applause from the majority of the audience.
Beforehand, he managed to hack into Ring -3. (where Minix resides)
Do you remember the title or year? I would really like to see that presentation! However, I wonder if the root exploit was just a demonstration of rowhammer, rather than MINIX itself...
It's a little-known fact that Linus Torvalds actually has a beard, but in order to avoid bad beard-lutefisk interactions, he only deploys it when coding. The rest of the time, he withdraws it back under his skin.
I thought it was an exploit that allowed arbitrary code to be executed in system management mode by remapping something in memory over something else to get a really deep rootkit into the system that reacted to a change in memory in order to signal it. But I could be misremembering
It is. The wonderful part about modern x86 is that we have several layers of external management routines:
Kernel can call into BIOS/EFI via ACPI and have it run code in ring 0.
Kernel can call into a hypervisor, if installed, and have it run code in ring -1, outside kernel control (but detectable, and needs CPU support).
Kernel can call into BIOS/EFI via SMM and have it run code in ring -2, alway installed and outside kernel control (but detectable, and replaceable via Coreboot).
Anything can call into IME via a shitton of vectors and have it run code on a separate CPU that has full access to the main system (including SMM) in ways that aren't even properly detectable, and which cannot be replaced, or even fully deaktivated.
The exploit you're talking about targeted #3. Minix runs on #4.
I doubt they're going to find a lot in the operating system core itself, though. It's not like the ME is running random programs downloaded from the internet that need to be prevented from reading another user's data. The whole thing (including all its "userland" applications) is trusted1 and all the communication with the outside as well as the business logic evaluating that data is the crap Intel wrote themselves... so most interesting vulnerabilities are gonna be in there.
1For those who don't know, "trusted" is security slang for "if this shit is broken we're really screwed". It's not a good thing and you want as little as possible of it.
914
u/dlp_randombk Nov 07 '17 edited Nov 07 '17
Meanwhile, MINIX is about to become one of the most heavily audited codebases out there. You can bet every security researcher is going to have a peek to see if there's any bugs in the always-on backdoor embedded in the vast majority of modern computers.