Read through it all. Seems legit so far. This is bad.
Exploiting non-vulnerable SMM code through a remap flaw in x86 architecture. Ouch.
Not only can this arbitrarily exploit the running OS. It might actually be able to physically destroy the computer it's running on, for example by abusing thermal controls.
Yep. I didn't read most of the last 1/2-1/3 of the slides, but it looks like the magic number may be different for each machine (ie. there is no one binary to rule them all[all though you could probably trivially generate all possibilities])? And that there is at least some process involved in determining the number what the number is?
invites to what? CIA front for reverse engineering?
Guy works for a non profit that happens to be the biggest employee for RE coders, nobody heard of it _and_ its only client is DoD, all of this is dodgy as F
edit: quick google shows Battelle Memorial is a 'known' CIA front company.
/tinfoilhat mode
Now Im starting to suspect this SMM escalation was in their arsenal and he overheard some details in the cafeteria?
What is the relevance of a CIA front? The software was demo'd, explained, and makes sense.
More likely, the software is quite powerful and was developed into a larger, more automated version that Domas/Battelle/CIA/whoever doesn't want to give away.
The "intuitive" feeling that he claims to develop after using it for awhile seems like it would be useful of you do a lot of reverse engineering or forensics work.
yeah perhaps I just havn't gotten the feel for it - think I've spent some 8-10 hours total playing around (more comfortable with regular hex+disasm+debug+scripts), I liked the https://github.com/letoram/senseye/wiki/Sense_MFile thing though
The severity of this depends on whether you consider SMM the same privilege level as ring 0, or higher. From my understanding, SMM seems like it was never really designed to be a higher privilege level with strong isolation guarantees.
It was not designed as one, but it was mutated into one. SMRR were added for that reason, and various fixes were made to the chipsets in order to isolate SMM better.
Remember that SMM is _the_ trusted base for UEFI secure boot.
Exploiting non-vulnerable SMM code through a remap flaw in x86 architecture. Ouch.
Not only can this arbitrarily exploit the running OS. It might actually be able to physically destroy the computer it's running on, for example by abusing thermal controls.
Doesn't affect Sandy bridge or newer.