Intel Chip Flaw Proves Unfixable Despite Patches

guest · Mar 5, 2020

Intel Chip Flaw Proves Unfixable Despite Patches
An error in chipset read-only memory (ROM) could allow attackers to compromise platform encryption keys and steal sensitive information
March 5, 2020
https://www.fool.com/investing/2020/03/05/intel-chip-flaw-unfixable-despite-patches.aspx

A security flaw on Intel (NASDAQ:INTC) CPUs that was supposedly fixed last year wasn't, leaving scores of computer users still at risk.

Security research firm Positive Technology reports that an error in the chipset's read-only memory could enable hackers to compromise encryption keys and steal data. Most of Intel's chipsets released during the past five years have the security flaw, according to the report. Making it worse, Positive Technology said it's "impossible" to detect a key breach and that the vulnerability is unfixable.

"With the chipset key, attackers can decrypt data stored on a target computer and even forge its Enhanced Privacy ID (EPID) attestation, or in other words, pass off an attacker computer as the victim's computer," wrote Positive Technology in the report.
Intel has been offering software updates to address the vulnerability but Positive Technology advised that users should move to a tenth generation or later Intel CPU instead. The researchers did note it would require a highly advanced hacker to exploit the vulnerability.
Click to expand...

Positive Technologies: Unfixable vulnerability in Intel chipsets threatens users and content rightsholders

Intel has thanked Positive Technologies experts for their discovery of a vulnerability in Intel CSME. Most Intel chipsets released in the last five years contain the vulnerability in question.

By exploiting vulnerability CVE-2019-0090, a local attacker could extract the chipset key stored on the PCH microchip and obtain access to data encrypted with the key.
In ROM, this vulnerability also allows for arbitrary code execution at the zero level of privilege of Intel CSME. No firmware updates can fix the vulnerability.
Click to expand...

Positive Technologies: Intel x86 Root of Trust: loss of trust

The scenario that Intel system architects, engineers, and security specialists perhaps feared most is now a reality. A vulnerability has been found in the ROM of the Intel Converged Security and Management Engine (CSME). This vulnerability jeopardizes everything Intel has done to build the root of trust and lay a solid security foundation on the company's platforms.
Click to expand...

guest · Mar 6, 2020

New Intel chip flaw threatens encryption, but Macs are safe
March 6, 2020
https://appleinsider.com/articles/2...p-flaw-threatens-encryption-but-macs-are-safe

Specifically, it's a vulnerability affecting Intel's Converged Security Management Engine, a key security feature in Intel technology and firmware running on Intel hardware.
Along with loading and varying BIOS and power management firmware, CSME also provides the "cryptographic basis" for features such as Digital Rights Management (DRM) technologies, firmware-based trusted platform modules (TPMs), or Intel's own Enhanced Privacy ID.

Intel released a patch in 2019 to mitigate the issue, but researchers at Positive Technologies have found it to be much worse than originally anticipated.
That could be a major problem for DRM-protected media. Used offensively, the flaw could be leveraged to decrypt traffic inbound or outbound from the impacted device. On a larger scale, it could be used on Intel-based servers.

Intel points out that 10th-generation chips are safe from it, however. The vulnerability, and others like it, is also one of many potential reasons why Apple may soon move its Macs over to ARM-based processors.
Click to expand...

mirimir · Mar 6, 2020

That could be a major problem for DRM-protected media.
Click to expand...

That's a good thing, right?

Log in or Sign up

Intel Chip Flaw Proves Unfixable Despite Patches

guest Guest

guest Guest

mirimir Registered Member

Log in or Sign up

Intel Chip Flaw Proves Unfixable Despite Patches

guest Guest

guest Guest

mirimir Registered Member

Useful Searches