Intel tried to bribe VU University Amsterdam into suppressing news of the latest security flaw
Intel is reverting to the illegal behaviors that they were found guilty of in many jurisdictions worldwide during the 2003 to 2007 period.
The following is a Google translation of a Dutch report about VU University Amsterdam’s announcement of this latest (among many) of Intel security leaks that have compromised the security and performance of their customers. The performance impact alone can, according to Intel, be as high as 9%, and this leaps up to nearly 50% if you also (as many recommend) turn off hyperthreading. The article is long, but well worth a read. I’ve bolded the following two excerpts from the full text:
According to the VU, Intel tried to downplay the severity of the leak by officially paying $40,000 in reward and “$80,000” in addition. That offer was politely refused.
“If it were up to Intel, they would have wanted to wait another six months”
Source here: https://www.nrc.nl/nieuws/2019/05/14/hackers-mikken-op-het-intel-hart-a3960208
Translation from Dutch to English:
Thanks to a mistake, the VU uncovered a mega breach in Intel chips. Intel pays the price for a fast but risky design.
The news in brief:
Researchers from the VU University Amsterdam have found an extensive data breach that is present in all Intel processors. These chips are in more than 80 percent of all computers and servers.
On Tuesday evening, Intel and VU announced the details of RIDL (Rogue In-Flight Data Load), a vulnerability that allows malicious parties to “steal almost all data” from computers. Unauthorized persons can view the data that the processor is currently processing.
The vulnerability is in all Intel processors of the last ten years – including the very latest. Hackers can exploit the vulnerability by hiding code in a web advertisement.
Two rack cabinets from the Ikea full of computer walls, a jumble of cables and a stack of second-hand processors. It is not immediately the test lab that you expect from which VU University researchers uncovered the sophisticated, super-complex leak in recent months.
Here, in room P455, on the fourth floor of the W&N building in Amsterdam, it was demonstrated that all Intel processors of the past ten years are susceptible to a major leak. This means that more than 80 percent of all computers in the world are susceptible to an attack that gives access to data at the heart of the computer.
RIDL, as the new vulnerability was baptized, came to light by chance. On Tuesday 11 September, Stephan van Schaijk, Computer Science student at VU University Amsterdam, worked on his study assignment: investigating a leak in the Intel processor.
Van Schaijk: „I was busy for an hour but did not advance. I adjusted something in my code and then I saw something strange appear on the screen. Values I did not expect. “
Van Schaijk had made a mistake, a bug in a bug, with which he could suddenly watch what happened in another program. It was a bigger and more serious leak than he was actually looking for.
His colleagues and teachers were just as surprised. Together, they wrote more than 20 “exploits” attack scenarios in a short time that would allow hackers to take control of the computer.
One of those tricks: by logging in with an incorrect password, the attacker forces the computer to compare the wrong password with the correct password. This data runs through the ‘pipelines’ of the chip and can be intercepted, after which the hacker can retrieve the correct password after some tinkering. “You find fragments. As if you are going to get a paper document through the shredder and then reassemble the shreds, ”says Herbert Bos, professor of system and network security at the VU.
Stephan van Schaijk was sent out to buy as many different processors as possible, to see if they were all vulnerable.
And that was true. Even the oldest one, from 2008, that was picked up via Marktplaats, turned out to be vulnerable to RIDL, or Rogue In-Flight Data Load. And so, Intel was immediately warned.
A beer please
It is not the first time that Intel gets into trouble with a leak in its processors. The chip is extra fast because it is ahead of things: each time the processor speculates which data is probably needed next. This presents risks because computer processes do not remain well separated from each other.
Assistant professor Kaveh Razavi compares it to a café: the processor works like a waitress who assumes that you want to drink the same as the one before you. The glass is poured automatically without the waitress checking whether you can have that beer.
The solution: the tray must be emptied after every order. That makes the processor slower. Depending on the programs you use, the speed difference can be considerable, the researchers expect. That explains why Intel has been struggling so long to fix this leak.
RIDL cuts right through all existing security layers. This applies to the data centers where virtual systems often run on the same server. The encrypted environment that Intel devised for business customers is also vulnerable.
Premium with aftertaste
Although parts of the leak were found by several researchers from different universities and companies, the VU has discovered the majority. Amsterdam University is also the only party to receive a reward: $100,000 (89,000 euros), Intel’s maximum reward for discoverers of critical leaks.
There is a small taste to the premium. According to the VU, Intel tried to downplay the severity of the leak by officially paying $40,000 in reward and “$80,000” in addition. That offer was politely refused.
Anyone who accepts a reward must also adhere to the rules. In this case, that meant: no consultation between researchers and uncertainty about which software manufacturers were warned in advance. According to the researchers, tech companies do not reason in the interests of the user, but of the shareholder.
Intel initially failed to notify Google and Mozilla, two major browser manufacturers.
The VU tried to force the manufacturer to come out faster. Eventually the VU forced Intel to come out in May – otherwise the university would publish the details itself. “If it were up to Intel, they would have wanted to wait another six months,” says Bos.
Intel had promised that the next generation of chips would not be vulnerable to RIDL, but that is not the case.
Hackers usually anticipate software vulnerabilities. Undiscovered holes (zero days) in important programs are sold for a lot of money in the black circuit. But after Specter and Meltdown, two fundamental holes that were previously found in Intel chips, both the ethical computer experts and the criminal figures are pointing their hardware. “Processors have become so complex that chip makers no longer have security under control,” said Bos.
And what should you do as a computer user? Update, update and update again. It is expected that all major software manufacturers will close the gap or have already closed the latest releases. It’s not for nothing that RIDL comes out on Patch Tuesday, the monthly update day from Microsoft.