Here we go again: Intel processors with problems

We all know the importance of chips in IT and embedded systems. Without the processing power, we would have many boat anchors sitting around collecting dust. One manufacturer, Intel, is in the news once again.

New Warning Issued

Research is being done on different platforms across the world. There are labs actively seeking viable exploits on the equipment, from the chip to the system level. In this case, Positive Technologies researched this issue and detected the exploit with the Intel processors. The processors released in the last five years have a security flaw in the silicon. As this is in the silicon, it can’t be fixed or patched with a firmware update, which is a problem.

Target

The issue is with the Converged Security and Management Engine (CSME). This is a subsystem in the CPU, which takes care of the security tasks, securing the entirety of the firmware. This process is during the processor operations, beginning when the power button is pressed.

Exploit

The vulnerability is would, when successful, would allow the unauthenticated user to potentially enable escalation of privilege. This would lead to the attacker being able to extract the chipset key stored on the PCH microchip and gain access to the data encrypted with this key. This is clearly not the optimal situation. What makes this worse is, if there were to be an attack, it is not possible to detect this.

On a brighter note, all is not lost. The exploit is rather difficult to process. First, the attacker would need physical access to the processor and time to complete the attack. Second, the attack itself is by far not easy. If one of the steps was not easy, having to complete them both only makes this exponentially more difficult to complete in the unauthorized environment. In certain limited instances, the attack could be performed with malware engineered to bypass the target’s OS-level protections. While this is a significant detriment, the potential attack removes the chain of trust for the platform.

Granted, this is still a possible attack, which is why there is attention being paid to this and mitigation put in place, correcting most of the issues. This sounds like a perfectly workable plan, however, there are so many known and unknown vectors, this is still a tough job.

Mitigations

While this is relatively serious, Intel has put in place mitigations. These mitigations were supposed to have done beginning in May 2019. Before the present mitigations are in place, the firmware and processor are still vulnerable when the system boots on. These, while the intent is in the right place, may not be sufficient to fully mitigate the issue. 

As noted, the issue with CSME cannot be fixed since the firmware errors are hard-coded in the Mask ROM. Instead of researching and trying options repeatedly which don’t work to fix the direct issue, Intel took this in a different direction and addressed the attack vectors, indirectly working to fix the problem. There are a number of attack vectors with this

References

Allan, D. (2020, March). Latest intel CPUs have ‘impossible to fix’ security flaw. Retrieved from https://www.techradar.com/news/latest-intel-cpus-have-impossible-to-fix-security-flaw

Dent, S. (2020, March 6). Researchers discover that intel chips have an unfixable flaw. Retrieved from https://www.engadget.com/2020-03-06-intel-chips-unpatchable-security-flaw.html

HalGameGuru. (2020, March 6). “Unfixable” security flaw found in intel CPUs. Retrieved from https://linustechtips.com/main/topic/1162393-unfixable-security-flaw-found-in-intel-cpus/

Help Net Security. (2020, March 12). Scientists expose another security flaw in intel processors. Retrieved from https://www.helpnetsecurity.com/2020/03/12/load-value-injection/

KW, T. (2020, March 22). Security experts have found another flaw in intel processors. Retrieved from https://klse.i3investor.com/blogs/future_tech/2020-03-22-story-h1485581927-Security_experts_have_found_another_flaw_in_Intel_processors.jsp

Lemos, R. (2020, March 6). Physical flaws: Intel’s root-of-trust issue mostly mitigated. Retrieved from https://www.darkreading.com/vulnerabilities---threats/physical-flaws-intels-root-of-trust-issue-mostly-mitigated/d/d-id/1337254

Positive Technologies. (2020, March 5). Positive technologies: Unfixable vulnerability in intel chipsets threatens users and content rightsholders. Retrieved from https://www.ptsecurity.com/ww-en/about/news/unfixable-vulnerability-in-intel-chipsets-threatens-users-and-content-rightsholders/

The Star. (2020, March 22). Security experts have found another flaw in intel processors. Retrieved from https://www.thestar.com.my/tech/tech-news/2020/03/22/security-experts-have-found-another-flaw-in-intel-processors

Warrant, T. (2020, March 6). A major new intel processor flaw could defeat encryption and DRM protections. Retrieved from https://www.theverge.com/2020/3/6/21167782/intel-processor-flaw-root-of-trust-csme-security-vulnerability

Qualcomm at it again

Android phones are in use across the planet. There is not a moment the sun is not shining on an android phone somewhere. The smartphone is a conglomerate of parts from multiple suppliers. It seems as though one of these suppliers had another issue recently. 

Android phones are known to have many, many viable attacks over the years. These seem to appear with regularity, unfortunately for the consumer. One of the latest Android Security Bulletins was published in August 2019. Of the many vulnerabilities noted, three involved the Qualcomm chip. 

These attacks were engineered to exploit a vulnerability with the Android kernel with the over the air (OTA) function. On a brighter note, for the attackers, these are partial remote attacks. Thus the attacker can’t be in the Carribean on the beach and remotely take over your phone. For this to work, the attacker and target are required to be on the same network. This significantly limits the target base for the attackers. This also, curiously, does not require user interaction, such as a phishing attack with malware. These are attacks with malicious packets OTA. This directly affects over a dozen chipsets. 

Fortunately for the user, patches for these have been made available. For CVE-2019-10538, this was modified with a patch for the Android OS source code. Fro CVE-2019-10540, this was modified with code in Qualcomm’s firmware. This is different than the Android OS in that the Qualcomm firmware is closed-source, in comparison to the Android open-source OS. 

Specifically for this issue, there are three CVE’s involved; CVE 2019-10538, -10539, and 10540. These are all buffer overflow attacks. With -10538, this affects the Qualcomm WLAN and Android kernel. The exploit uses packets coded specifically for this to the WLAN to overwrite parts of the kernel. Once successful, the attacker is able to run code with kernel privileges. For -10539, the issue is present with the WLAN firmware. This operates due to a lack of validation with the length check for the IE header limit. Lastly, for -10540, this is a modem into the kernel issue. This affects the Qualcomm WLAN also. The nuance with this is the issue is located within the modem firmware included with the chip from the manufacturer. To exploit this, the attacker begins with a particularly coded packet aimed at the device modem. This is able to work so well due to a lack of validation for the count value and the specifically coded packets. This also allows for code execution. 

In theory, you could chain -10538 and -10540 together. This would allow attackers to take complete control over the Android phones within the attacker’s WiFi. this full access allows for the attacker to install any app, or rootkit, exfiltrate sensitive data, and other completely malicious activities. 

This is not a training issue for the staff, but an issue with applying security within the SDLC. A portion of the issues could have been caught with cybersecurity applied through the project, and a thorough pentest. 

Resources

Bhatia, R. (2019, April 25). Qualcomm chips vulnerability puts android devices at risk. Retrieved from https:/www.securitynewspaper.com/2019/04/25/qualcomm-chips-vulnerability-puts-android-devices-at-risk/ 

Cimpanu, C. (2019, August 6). Qualpwn vulnerabilities in qualcomm chips let hackers compromise android devices. Retrieved from https://www.zdnet.com/article/qualpwn-vulnerabilities-in-qualcomm-chips-let-hackers-compromise-android-devices/ 

Kumar, M. (2019, August 6). New flaws in qualcomm chips expose mills of android devices to hacking. Retrieved from https://thehackernews.com/2019/08/android-qualcomm-vulnerability.html 

Paganini, P. (2019, April 28). Critical flaw in qualcomm chips exposes sensitive data for android devices. Retrieved from https://securityaffairs.com/wordpress/84612/hacking/qualcomm-flaw-android-devices.html    

Samsung Mobile. (2019, August). Android security updates. Retrieved from https://security.samsungmobile.com/securityUpdate.smsb 

Qualcomm. (2019, August 5). Security bulletins. Retrieved from https://www.qualcomm.com/compnay/product-security/bulletins