Intel Secret Microcode Keys is Exposed

One of Intel's secret keys that they use to protect microcode patches has been exposed, and this creates an interesting challenge in the long term in regards to vulnerabilities of Intel products. So let's unpack this. This, this is going to get a little complicated here, but I'm going to keep it as simple as possible. So let's first talk about what the researchers found. So a group of security researchers spent several months, and they were able to chain some vulnerabilities together. And what they were able to do is gain access to a debug function within the CPU of the Goldmont Intel architecture chips, right? And that includes Celerons and Atoms and a whole series. They were released in 2016, 2017 is when the Goldmonts were released, first released. So the researchers, building upon that, they were able to gain access into some very sensitive memory areas and tease out some information. And as part of that, they were able to uncover a specific RC4 key. Okay, and RC4 is the encryption cipher. It's a symmetric encryption cipher, which means it both encrypts and decrypts data. And this particular key encrypts microcode patches. So when a CPU needs a patch, you know, a company will create that patch and they'll do two things. First off, they will encrypt the patch so you can't read it, right? It stays hidden, obfuscated. The second thing they're gonna do is they're gonna sign the patch to make sure it's authentic. So when you deliver a patch, right, when a patch is sent to a machine, the first thing it does is it checks to see if it's authentic. If it's not, it disregards it. If it is, then it goes in and it uses a key to decrypt it. So it knows what to do, what the code is actually telling it to do. And it was this second key, the key to decrypt the patches that was discovered. And that's very, very important. So what it enables though, is it enables security researchers to, to unpack, right, to decrypt those patches. And in those patches, it basically says, well, what are the vulnerabilities, right? What are the things can be exploited on a system? And that's really important to know from a vulnerability researcher perspective. So this is very interesting. And the RC4 cipher, well, there's been weaknesses identified in that since 2001. By the time 2015 rolled around, it was pretty much deprecated from all use. It was ripped out of TLS and SSL because there were so many different vulnerabilities around it. So it really shouldn't be in use. But this particular key was discovered, right? And it was just announced not that long ago. Unfortunately, Intel's response has been, well, less than stellar. I'm kind of disappointed, right? I've read the official statement from Intel, and honestly, it sounds like it was written by a bunch of lawyers and engineers without the benefit of any security professionals probably in the building, nowhere close. It really kind of just wants to protect Intel and say, hey, there's no threat to our customers or to our products. Okay, the signing key, which is very, very important, it is, was not exposed. And they went on to say that it wasn't exposed. It doesn't reside actually in the processors. Great. But what they failed to acknowledge is the long-term ramifications of vulnerability researchers gaining this level of visibility and access, gaining access to, you know, the section of the chip that you can do debugging, gaining access so that they can decrypt and understand what these patches, these microcode patches contain and what they're doing. There's also a likelihood that if somebody had physical access to a device, they could probably craft a temporary hack to upload or modify the current microcode so that they could gain a whole bunch of access into the system. But again, that would be short-lived, but that really isn't the threat. The long-term threat is how this will be a launching pad. This is a series of tools and visibility that empower security researchers to do what they do very well. And when they're given that level of access and visibility, they find lots of problems. And with this particular capability, I expect them to find a lot more vulnerabilities and develop a lot more exploits based on those vulnerabilities. So where Intel should be talking about is potentially where some mistakes were made, how they've corrected those, how future generations aren't, you know, subject to this direct vulnerability. And more importantly, that they understand the long-term ramifications and what they're doing to get ahead of that, because that's important. Just simply trying to hide things and hope they don't get discovered is not good security practice. And that's really what their statement kind of reads. And yes, agreed. The signing key is not exposed. So there really isn't a risk right now based on this current vulnerability, right? This current key exposure for somebody to remotely push a BIOS update or a microcode update. All right, there really isn't much of a chance because again, if somebody tries to do that, the signing isn't there., and so the system will reject it because the authentication just isn't valid. Great. But when you start considering, the researchers got to this point by chaining together a whole bunch of vulnerabilities. And this is a big one, right? This is giving a lot more understanding of the systems. We're gonna see this and other things chained together. So this does play. In the long-term risks that Intel and all other manufacturers who have similar architectures really need to worry about, because this will give the methods and the modes and the ideas and the pathways for the security researchers to go down. So strategically, this opens the doors, right? Not a lot, but a lot more than they were before. And that's gonna create problems long-term. So Intel, you should be real concerned here, as should other silicon manufacturers as they look at their microcode update process and how they secure the inner workings of their silicon.