Reply to post: Won't work

Amazing new WikiLeaks CIA bombshell: Agents can install software on Apple Macs, iPhones right in front of them

Conundrum1885

Won't work

Apparently all the Intel chips made since the P2 *which includes Celeron* have CPUID, but its turned off.

Or so they say.......... (X-files theme)

I did suggest way back when that it is possible using a timing attack to determine which CPU a piece of code is running on, by measuring things like instruction unitialised value bias shifts and decay time on unrefreshed memory, this is basically also how data is exfiltrated from "erased" SSDs and HDDs.

There's a few kB unused which is kept refreshed but no data is written to it, that caches the microcode during bootup but is usually not written to after that, so this is entirely feasible.

Similar to how some older machines would let you access the SMBus or SPD chips as they only ever normally get read during initial boot-up. Even found a few laptops and netbooks (eg PCG-61611) that let you write and read to them which is handy when you have flaky RAM that needs to be underclocked.

Obviously replacing the chips with a slightly larger (eg 256KB) re-marked custom part would let you compromise a machine using buffer overflow on each and every startup, even flashing a custom rooted BIOS that fakes out the password routine so the target thinks the machine is secure.

Some webcams in laptop screens have 512KB of memory in them and this stores things like the offset

tables for the CMOS sensor so that the image is clear. Obviously this would also be trivial to replace.

POST COMMENT House rules

Not a member of The Register? Create a new account here.

  • Enter your comment

  • Add an icon

Anonymous cowards cannot choose their icon