Backdoor in the Core: Altering Intel x86 Instruction Set at Runtime
Reverse engineers Intel CPU microcode on Goldmont cores, achieving persistent userspace microcode patching on Linux to create hardware backdoors in x86 execution.
Summary
The Hidden World of CPU Microcode
Modern x86 processors translate complex assembly instructions into sequences of low-level internal micro-operations managed by proprietary, encrypted CPU microcode ROMs.
Reverse Engineering Intel Goldmont Microcode ROM
Mathias Krog and Christian Skovsende analyze Intel Atom CPU microcode, detailing custom tracing tools developed to deconstruct instruction decoding and persistence checks.
Achieving Persistent Microcode Patching from Userspace
Bypassing hardware integrity checks allows applying custom microcode patches directly from unprivileged Linux userspace without requiring vendor cryptographic signatures.
Weaponizing Microcode for Undetectable Hardware Backdoors
The authors demonstrate modifying instruction execution semantics at the hardware core level, creating an operating-system-independent backdoor that subverts kernel access controls.
Related talks
Main Stage·46 min
Christopher Domas
Christopher Domas presents god mode unlocked hardware backdoors in redacted x86: Complexity is increasing.
Main Stage·42 min
Josep Pi Rodriguez
Josep Pi Rodriguez presents wingos: how to own millions of devices .: Extreme network's embedded WingOS (Originally created by Motorola) is an operating system used in several wireless devices such as access points...
Main Stage·51 min
Krotofil · Wetzels
Krotofil and Wetzels presents thru the eyes of the attacker designing embedded systems for ics: In 2017 a malware framework dubbed TRITON (also referred to as TRISIS or HatMan) was discovered targeting a petrochemic...