Intel warns users of a security flaw 🔓

If your computer runs on an Intel CPU older than 10th generation, we have bad news: an encryption vulnerability, said to be uncontrollable and unfixable, has been confirmed.

This security flaw makes cyber attacks impossible to detect. Researchers found the vulnerability in the ROM (Read-Only Memory) of Intel CPUs, and it could let attackers compromise encryption keys and steal data.

Mark Ermolov, the man behind the discovery who raised the alarm, says that for now "it is impossible to fix the firmware errors that are hard-coded in the Mask ROM of microprocessors and chipsets". This is very worrying because, given that a successful attack can reach even the hardware, we could be facing a complete loss of trust in these devices.

What is CVE-2019-0090?

Lately there have been a few 'scares' involving encryption-related security flaws, including Curveball, the threat to Windows 10 users reported by the US NSA.

This security breach is called CVE-2019-0090 and, in practical terms, it puts millions of computers at risk. In other words, every machine with an Intel processor made in the last five years is in danger. The only exception is the new Intel Core 1000 Ice Point. Installing the necessary updates seems to be the only way to try to avoid this serious problem.

The vulnerability concerns the CSME (Converged Security and Management Engine), which is basically a CPU-like engine inside the CPU itself. It has access to all the security data of every component in the computer and provides the low-level cryptographic checks when the motherboard boots, among other functions.

It is the first thing that runs when you press the power button on your computer, and it establishes the chain of trust for every step that follows.

If the name sounds familiar, that is normal: CVE-2019-0090 was first discovered in May 2019, when Intel released a security update to tackle and fix the problem.

However, it later emerged that this fix only covered part of the problem. Although all the details are still being kept somewhat 'under wraps', the man who discovered the problem, an employee of Positive Technologies, wrote in his report that there may be several ways to exploit this ROM vulnerability, and that not all of them require physical access to the computer, contrary to what was first believed.

But is it all bad news?

There is, after all, some good news in the middle of this security disaster. Looking at these attacks from a real-world perspective, we can see that a cyber attack on this scale is very hard to carry out.

In other words, a hacker would need to extract a hardware key used to encrypt the chipset key, which in turn is stored in the SKS (Secure Key Storage). "This is not simple at all, in any way", says Ermolov, and there is no evidence that anyone has yet worked out how to do anything like it.

Even so, the expert believes it is only "a matter of time" before someone works out how to extract this key, and adds: "When that happens, hardware IDs will be forged, digital content will be extracted and data encrypted on hard drives will lose its encryption". For Eoin Keary, CEO and founder of Edgescan, "this is a very serious flaw that cannot easily be fixed with a sticking plaster, and it also spreads very quickly. This security breach cannot be fixed in the ROM of existing hardware".

He also says that, to succeed, an attack like this needs to be very advanced and carefully prepared by highly sophisticated hackers.

Intel offers guidance to mitigate the problem

An Intel spokesperson has told journalists that the company was notified of a potential vulnerability affecting the Intel Converged Security Management Engine, in which an unauthorised user, with specialised hardware and physical access to the computers, may be able to run arbitrary code within the CSME subsystem on certain Intel products.

The tech company has already published recommendations and guidance to mitigate the problem, which mainly involve keeping your system up to date. More specific information about CVE-2019-0090 can be found here.

What do the experts say?

Positive Technologies warns that, since this problem cannot be fully fixed without replacing the hardware, users should disable components that use CSME encryption or consider upgrading their CPUs to 10th generation or later.

For the founder of iCyber-Security, "since this vulnerability requires some kind of physical access to be exploited", it is highly recommended that organisations, individuals and businesses review their security protocols in this area.

Putting more secure methods in place, both physical and in software, is Marco Essomba's main recommendation.

If you have any concerns, or you want to keep your computers secure at all times, talk to Indigit! We are cyber security experts.