Inertia War

the author's other articles are worth reading too http://inertiawar.com/

They're signed and I believe encrypted by Intel. The CPU will fail to apply a microcode update whose signature fails validation. Here's the best public discussion about the format of microcode updates I know of offhand: http://www.inertiawar.com/microcode/

Ben Hawkes from Google Project Zero has an excellent blog post on Intel CPU Microcode: http://www.inertiawar.com/microcode/ He even extracted and posted the RSA public keys used to verify the microcode. Though he later removed them, they're still available on the internet archive: https://web.archive.org/web/20140403200048/http://inertiawar.com/micro…

> But if you have a way to pop the machine into redstate you can exfiltrate the secret key and actually sign microcode changes that will be accepted as legit. No. The article mentions that the key required to decrypt microcode updates can be extracted. http://inertiawar.com/microcode/ indicates that the encrypted microcode image is also signed, and being able to decrypt the image doesn't mean you can also generate an appropriate signature.

This might be interesting reading for you: http://inertiawar.com/microcode/ Signed with 2048-bit RSA, and probably encrypted too.

Thanks, I'll take a look tomorrow. For more uCode work, there's http://inertiawar.com/microcode/ which contains some interesting bits.

Separate research has been done on microcode. The general consensus is that Intel's microcode binaries are encrypted, and are secured with a RSA2048-SHA256 signature. http://inertiawar.com/microcode/

I think they are mostly undocumented, but here is some research I found online: http://inertiawar.com/microcode/ I'm guessing the private RSA keys are extremely well guarded, probably stored in a HSM that only allows signing, not key extraction, so that the keys cannot even be revealed to Intel. On the other hand, who knows. There's certainly been cases of code signing keys on the loose (Adobe, etc) and even a compromised HSM host (Fedora, someone managed to sign compromised openssh .rpms)

http://inertiawar.com/microcode/ provides a good background summary of microcode on AMD/Intel CPU in general.

microcode updates are volatile - after a reboot the CPU is back to its programmed state. BIOS installs updates (which is why some CPU bugs are fixable by BIOS updates), and the OS can do this, too: Linux has drivers to update microcode on CPUs. The microcode files comes from Intel and are mostly incomprehensible blobs (see http://inertiawar.com/microcode/)

SMM and closed source hardware drivers means that it can happen from anywhere. I wouldn't be surprised but I would be surprised that nobody has bothered doing deep inspection of network packets or Microsoft binaries since the time when Microsoft doing an update without asking a user was considered a big deal... Now nobody cares about that. http://inertiawar.com/microcode/

Images don't seem to be cached indeed. They never work in a cached article, but also when trying to google for "cache:http://inertiawar.com/microcode/fig-1-1.png " it says they're not cached. Edit: HN bug? The double-quote sign behind the URL in this post disappears when I don't put a space in between.

The microcode updates that people have been mentioning are not updates to your motherboard's firmware, EFI or otherwise. They are updates to the code that runs inside your central processor chip, the so-called microcode, that does the work of understanding and enacting processor instructions (in all programs, from the programs in your firmware to the programs that you download and run from the WWW). Firmware updates are largely irrelevant to this issue, only being involved in the sense that one way to perform microcode updates is for your machine's firmware to upload the new microcode image file. But that is just one way for that to be done; your operating system can do it, too. * http://inertiawar.com/microcode/ * https://news.ycombinator.com/item?id=16081366 * https://newsroom.intel.com/wp-content/uploads/sites/11/2018/01/Intel-A… (https://news.ycombinator.com/item?id=16079910)

Have a look at: http://inertiawar.com/microcode/