Login or Sign up Stories Firehose All Popular Polls Deals Submit Search 47 Topics: Devices Build Entertainment Technology Open Source Science YRO Follow us: Want to read Slashdot from your mobile device? Point it at m.slashdot.org and keep reading! Nickname: Password: 6-1024 characters long Public Terminal Log In Forgot your password? Sign in with Google Facebook Twitter LinkedIn Close × Researcher Finds A Hidden 'God Mode' on Some Old x86 CPUs (tomshardware.com) Posted by EditorDavid on Saturday August 11, 2018 @11:34AM from the look-what-I-found dept. "Some x86 CPUs have hidden backdoors that let you seize root by sending a command to an undocumented RISC core that manages the main CPU," Tom's Hardware reports, citing a presentation by security researcher Christopher Domas at the Black Hat Briefings conference in Las Vegas. The command -- ".byte 0x0f, 0x3f" in Linux -- "isn't supposed to exist, doesn't have a name, and gives you root right away," Domas said, adding that he calls it "God Mode." The backdoor completely breaks the protection-ring model of operating-system security, in which the OS kernel runs in ring 0, device drivers run in rings 1 and 2, and user applications and interfaces ("userland") run in ring 3, furthest from the kernel and with the least privileges. To put it simply, Domas' God Mode takes you from the outermost to the innermost ring in four bytes. "We have direct ring 3 to ring 0 hardware privilege escalation," Domas said. "This has never been done.... It's a secret, co-located core buried alongside the x86 chip. It has unrestricted access to the x86." The good news is that, as far as Domas knows, this backdoor exists only on VIA C3 Nehemiah chips made in 2003 and used in embedded systems and thin clients. The bad news is that it's entirely possible that such hidden backdoors exist on many other chipsets. "These black boxes that we're trusting are things that we have no way to look into," he said. "These backdoors probably exist elsewhere." Domas discovered the backdoor, which exists on VIA C3 Nehemiah chips made in 2003, by combing through filed patents. "Some of the VIA C3 x86 processors have God Mode enabled by default," Domas adds. "You can reach it from userland. Antivirus software, ASLR and all the other security mitigations are useless." bug hardware security → Should Online Courses Film Students Taking Tests? Windows 7 Has Lots of "God Modes" The Schizophrenic Programmer Who Built an OS To Talk To God Science Cannot Prove the Existence of God Malware Taps Windows' 'God Mode' Julia 1.0 Released After a Six-Year Wait Researcher Finds A Hidden 'God Mode' on Some Old x86 CPUs More | Reply Login Researcher Finds A Hidden 'God Mode' on Some Old x86 CPUs Post Load All Comments S5 eFaurlclh 1 485 A Cbbomremvieantetsd L2o2g H Iind/dCerneate an Account C/Soemaments Filter: AScllore: I5nsightful I4nformative I3nteresting F2unny 1The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way. ›0 I-1s it on the die? (Score:3) bMyo Breig |D RuekpelSy iLx o(g 8in32501 ) on Saturday August 11, 2018 @11:39AM (#57107256) I s the separate RISC core actually on the silicon or just in the patent? Time to get out the fuming sulfuric acid. NRicepklny atom Teh:i s Share tPwaisttsewr ofardce: b6o-o1k0 2li4n kcehdairna cters long F laPgu basli cIn Taeprpmroipnraial te Re:LIosg i tIn on thFeo rdgoiet ?y o(uSr cpoarsesw:5o,r dI?nformative) Cbylo dsuenkelfalke ( 91624 ) on Saturday August 11, 2018 @11:43AM (#57107264) CItl oiss ereal alright. Same with the Intel management engine and the AMD PSP. Reply to This Parent Share twitter facebook linkedin Flag as Inappropriate 2 hidden comments "monster" CPU Re:Is it on the die? (Score:1) by davidwr ( 791652 ) I run this [monster6502.com]. No microscope required. :) 1 hidden comment Re:Is it on the die? (Score:4, Informative) by sjames ( 1099 ) on Saturday August 11, 2018 @11:59AM (#57107330) Homepage Journal If you RTFA you will see that the patent hinted at it's presence and then he found it on real hardware by fuzzing. Reply to This Parent Share twitter facebook linkedin Flag as Inappropriate Re: (Score:2) by Megol ( 3135005 ) Lot of work to find something (partially) documented. Sandpile lists the instruction as ALTINST, the code is documented by VIA as used for testing with an MSR (Machine Specific Register) bit to enable it. If not enabled I assume it would be treated as an illegal instruction. That some machine with a C3 processor didn't set the correct machine configuration is bad but not the end of the world - just set it correctly in the OS instead. Re: (Score:2) by jarkus4 ( 1627895 ) And he could save a lot of time by reading the manual for the processor as its a documented feature (ALTERNATE INSTRUCTION EXECUTION )... did VIA ever do anything right? (Score:2) by drinkypoo ( 153816 ) Their chipsets have always been hot garbage. Their x86 chips are already dog slow, now this? How was VIA even a thing? Re:did VIA ever do anything right? (Score:5, Informative) by vadim_t ( 324782 ) on Saturday August 11, 2018 @12:09PM (#57107370) Homepage VIA is cheap. Back in the C3 days they had a bit of popularity among the people who wanted a compact server, firewall or media box. Decently fast but cool running CPUs, and good silent fans were all a pretty new development back then, so there wasn't that much choice. So I tried. The Nehemiah CPU was a dog. The network card corrupted some of the outgoing packets, and it was visible by naked eye by just refreshing a page served by the box and seeing how a character was wrong somewhere. Sticking a system in a small box looked pretty, but the tiny fan was noisy as hell, and it killed the hard disk from the overheating after a while. There was some kind of trouble with the power supply. Accounting for the time I spent screwing around with that junk, it would have been far cheaper to just buy a normal board with a normal CPU. With the luck I've had with this specific product line, I'm amazed some of it is still alive today. Reply to This Parent Share twitter facebook linkedin Flag as Inappropriate Re: (Score:2) by squiggleslash ( 241428 ) I'm not saying the network card might also have had problems, but if you're seeing corrupted characters on a webpage, then that hints at problems beyond the network. Web pages are delivered via TCP, and TCP packets are error checked by the operating system, not the network card. Not always a bad thing (Score:1) by davidwr ( 791652 ) Ok, this IS always a bad thing for the typical end user, but I can see two rwal-world use cases: * For debugging. In this case, the customer wants the fearure. For the general case, there are better, safer ways of debugging, but there nay be cases where this is preferable. * Espionage, in which case tge real customer - your aversary - wants the feature. Beyond this, there isn't much point. 1 hidden comment Re: (Score:3, Insightful) by mmmVenison ( 5475826 ) I would be surprised if there wasn't a backdoor in any complex system, hardware or software. 3 hidden comments Surprise Re:Not always a bad thing (Score:1) by davidwr ( 791652 ) There are plenty of complex systems with no "backdoors." I assume "backdoor" means an intentional feature, not an unintentional security bug. If you meant an unintentionall bug, then we agree. I also assume "the complex system" as the part that was built, not the hardware or software levels below "the system.". That is, if you claim all complex OSes that are sold independently of hardware have backdoors, you are claiming that these backdoors exist regardless of which hardware they run on, as long as the hard Re: (Score:1) by mmmVenison ( 5475826 ) I take backdoor to mean an undocumented thing that allows the developers to access something that the end user isn't supposed to be aware of. So by that definition it would be intentional yes. It may not be malicious in nature, or may even be considered an inside joke or easter egg, or maybe I am paranoid. Re: Not always a bad thing (Score:1) by Anonymous Coward In tge rwal warld, I like to use a spelings checker and proofs read my grammer before spending. Bekause; A) its a great feature ! 2) its my preferable way to debuggings 4]. It stops tge aversary rite in there tracks!? * More, over its less RISK than x86, AND, an nay SPARK's CPU. , Re: (Score:1) by Anonymous Coward You're right, it was part of the debuging core, which is present on most current cisc, risc and mips cpu's. It could be disabled by sending a four byte sequence to the cpu during bootup, mostly done when the bios was in control, though it was better to leave it in and have an easy backdoor for when the pebkac. greetings ! and switch Re: (Score:2) by Rewind ( 138843 ) No, you looking for IDDQD. Re: (Score:2) by ArchieBunker ( 132337 ) I don't trust the government to properly fill potholes in the streets let alone have a design review of CPU silicon. Re: (Score:2) by iggymanz ( 596061 ) riiiight, last I checked the USA government wanted a backdoor in everything because citizens are to be treated like criminals by default.