DEF CON 26 - Christopher Domas - GOD MODE UNLOCKED Hardware Backdoors in redacted x86 on HackerTube: recommended by 4 Hacker News commenters across 3 separate months, 2019–2026.
talk · advanced · evergreen
Christopher Domas presents research at DEF CON 26 showing a hidden alternate instruction set and undocumented hardware backdoor in some x86 processors, found on a third-party CPU. He uses it to ask how feasible wider hardware backdoors are.
HN regulars treat Domas as a favorite hacker and bring this talk up in any discussion of CPU backdoors, hidden instruction sets or processor security.
“Christopher Domas is one of my absolute favorite all-time hackers. He does such a fantastic job of explaining his work.”
10 Hacker News comments link this video. Each one links back to its thread.
I cannot wait for the accompanying Black Hat talk. Christopher Domas is one of my absolute favorite all-time hackers. He does such a fantastic job of explaining his work. Some of my favorite talks of his: - Psychological Warfare in Reverse Engineering [link] - The MoVfuscator [link] - Hardware Backdoors in redacted x86 ▶ this video
in “Spaghettifying DRAM” · View on HN
These links don't work for me, but the videos are on YT: - ▶ this video - [link] And yes, they are spectacular.
in “Compiling C Programs Into “Mov” Instructions (And Only “Mov” Instructions)” · View on HN
Holy shit, Christopher Domas is back. I remember watching his Defcon talks on x86 shenanigans[^1][^2] and being amazed at what he's been able to discover. Then he got whisked away by Intel and now drops this. I'm excited. [^1]: [link] [^2]: ▶ this video
in “Spaghettifying DRAM” · View on HN
This guy now works for intel: DEF CON 26 - Christopher Domas - GOD MODE UNLOCKED Hardware Backdoors in redacted x86 ▶ this video This is one of many amazing videos this guy did before they hired him.
in “Intel updates mysterious ‘software-defined silicon’ code in the Linux kernel” · View on HN
What are the implications of such hardware on user security? Threat persistence, i.e. persistent rootkits, persistent remote monitoring if one has privs to tickle the CPU instructions that give access. It is just a matter of time before there are public tools for script kiddies to manage the OS within the CPU. Here [1] is an example of someone slowly making progress decoding all the undocumented instructions and here is a talk with a brief overview of the tools. [2] This is not specific to Intel's ME but it is the way people will eventually tame/exploit that beast in my opinion. There are more recent talks that get deeper into security rings in the CPU. This video [3] more related to your question but not specific to ME however can be used to access ME and much more. If this appears to difficult and time consuming just know that some folks out there have the documentation for the undocumented instructions. You may find some tools on github and other public repos for disabling ME. Use with care. Test on an identical model of system that is at the same firmware/BIOS and same model of CPU as those tools can brick your CPU. As @rocket_surgeron stated, one can buy CPU's with ME disabled but that will not disable the "God Mode" referenced in [3]. [1] - [link] [2] - [link] [3] - ▶ this video
in “Ask HN: Do you worry about CPU backdoors like IME?” · View on HN
If the downvotes are due to poor quality discussion, that's fair enough. If they're due to skepticism, here's his talk from the next year: [0]: ▶ this video "DEF CON 26 - Christopher Domas - GOD MODE UNLOCKED Hardware Backdoors in redacted x86"
in “A PCIe network interface card that adds full router capabilities to your servers” · View on HN
haha maybe Christopher Domas knows :D ▶ this video [x86 god mode] but there is a difference between knowing vaguely how internal combustion engine works versus treating your car as a magic box from the future. (which of course now most cars are, you can not even disable the tire pressure alert after you pump your tires without going to the service shop) I fear that nobody will even teach the fetch-execute cycle to our kids.
in “Web-based editor” · View on HN
Related: a defcon talk about it (DEF CON 26 - Christopher Domas - GOD MODE UNLOCKED Hardware Backdoors in redacted x86) ▶ this video Website collecting info on thin clients, which many are VIA, if anyone gets interested in exploring it from a recycled unit: [link] EDIT: also [link] - Christopher Domas: Hardware Backdoors in X86 CPUs
in “Alternate Instruction Set” · View on HN
You are taking these ideas into crazy places! Fun to think about. Given this context, I have a few thoughts: Contemporary processors may be interesting when simplified some. Your projects make me think about the Zachtronics games. [link] That is an assembly language game with surprising depth. People, who play it seriously will learn quite a lot. Using older hardware in tandem with current is a lot of fun. The terminal, for example, still does exactly what it was designed to do and is still useful today. A C64 has a user port for this kind of thing. Apple 2 computers saw all manner of expansion cards capable of data capture, control, computation... making ones own card with a PIA was a standard type project, just as connecting a circuit to the user port was. BASIC was often enough for many basic controls, say regulating temperature, or turning things off and on based on time, or other data states, assembly language brought more of the speed possible, and with more speed, we get more posibilities. Take one bit wired to a speaker. That is what the Apple and IBM PC shipped with to make sound. The PC had a spiffy timer to bang out notes, and the Apple had nothing but a toggle. Speaker on, or off. Here is where the fun part was back in the day: At first, it seems useless. Access an address and the speaker pops out. Do it again, and the speaker pops in. One can type this right into the computer with a BASIC POKE statement, or the monitor by address and watch the speaker change stat
in “Dunfield 6809 Portable” · View on HN
While somewhat interesting, I'm not sure there's much to discuss unless the presentation or details are already available. Interestingly, this reminds me of two Defcon talks I watched in the last day or two, which also cover vulnerability through additional processors onboard.[1][2] 1: ▶ this video 2: [link]
in “Everybody Be Cool, This Is a Robbery” · View on HN