Researcher claims to have discovered universal attack code for Intel chips: no one is safe

Also, he says he found Intel's diary and is totally telling everybody about that one thing. But seriously, we think Kris Kaspersky is being a bit of a tease here. He claims to have found a flaw in Intel's processors that would allow a hacker to bust up on a computer using JavaScript or TCP/IP, with no regard for what operating system the computer is running... only he won't say what it is. He's planning on unveiling the attack at the Hack In The Box conference in Malaysia this October, where he says he'll show working code that can take control of computers, all of which he plans to release publicly. The attack takes advantage of known errata in chips, which most vendors have a workaround for in BIOS, but not all. XP, Vista, Linux, BSD and Mac operating systems are all vulnerable, so we all get to run around panicking until October -- unless somebody figures it out first.

[(Unverified) Posted Jul 16th 2008 3:35PM]

Some dude who just learned binary code for the same purpose is really pissed right now.

[Ironmanxrs2 Posted Jul 17th 2008 2:08AM]

I bet if he used some of his time to "hack" womens panties he'd have a better life..... just sayin..

[edzy Posted Jul 16th 2008 3:36PM]

reminds me of the cartoon http://en.wikipedia.org/wiki/Wagon_Heels



"I know something I won't tell, I won't tell, I won't tell!"

[jlouiss Posted Jul 16th 2008 3:39PM]

HACK THE PLANET!!!!!

[CharlieX Posted Jul 16th 2008 3:41PM]

TOOL!

[(Unverified) Posted Jul 16th 2008 3:54PM]

MEH! It's another case of someone wanting 15 minutes of fame. I hate these people with RIDICULOUSLY stupid claims. Whatever.

[(Unverified) Posted Jul 16th 2008 3:52PM]

Yes! Gibson!

[(Unverified) Posted Jul 16th 2008 3:53PM]

In before cyber doomsday!

[Ed T Posted Jul 16th 2008 3:53PM]

Wow, my ten year old, G3 laptop that refuses to die will still be useful.

Bow, bow to your sensei!

[(Unverified) Posted Jul 16th 2008 3:55PM]

MEH! Whatever. Another asshole trying to get his 15 minutes of fame. Fucking fake!

[(Unverified) Posted Jul 16th 2008 4:00PM]

Seriously... isn't this guy being a little bit of a jerk? So instead of telling the ppl who need to know (read: Intel HP Apple Sony etc.) so that they can patch this gaping hole, he would rather grab attention for himself and tell the WHOLE WORLD how to gain access to ANY computer that just *happens* to run on THE most popular processor next to AMD.... doesn't that sound childish? I mean, there is obviously a huge risk here. Does Kaspersky not see his obligation to the computing world, or is he just an egomaniacal jerk? If he knows what's right he will (hopefully) tell the right people. Does anyone agree with me?

[(Unverified) Posted Jul 16th 2008 4:12PM]

I disagree. If it turns out that this large flaw in chip design is real, then he should be paid quite a bit of money for his findings. Asking that he just turn over the details of the bug to Intel for free is just wrong. People need to be properly paid for their work, nothing is free.

[(Unverified) Posted Jul 16th 2008 6:31PM]

No, I do not. You can use a government analogy for this one. Tell the people first and the man will respond very quickly to cover its own ass. Tell the man first and the people will never know how badly they were or are being screwed.

[retro77 Posted Jul 16th 2008 4:31PM]

Intel already knows about it.

[nanobis Posted Jul 16th 2008 4:01PM]

i sort of glad i have kaspersky AV then, so i should get the update as its releastd

[TreyIM2 Posted Jul 16th 2008 4:10PM]

Yea, this fool is starving for attention and must be certifiably nuts cuz this guy either doesn't even understand what kind of attention he will receive, criminal AND gov't wise or just has lost it, period.

[(Unverified) Posted Jul 16th 2008 4:09PM]

It's in the Garbage file. Intel is responsible, they're just trying to blame it on hackers in order to collect on the insurance.

[tkuhl87 Posted Jul 16th 2008 4:11PM]

eh, he's probably hoping that he gets enough hype up that intel buys his silence for $1mil

[(Unverified) Posted Jul 16th 2008 4:15PM]

Looks like the ps3/cell has won this time. Suck it 360!!!! ...................................................J/K

[ehisforadam Posted Jul 16th 2008 4:21PM]

Yes...because the three core Xenon in the 360 is a special PowerPC based chip that is actually an Intel processor.

[CubeGuy Posted Jul 16th 2008 4:22PM]

I thought it was funny. D=

[(Unverified) Posted Jul 16th 2008 4:38PM]

Maybe he can fix my processor so I can run Crysis.

[Jobee Posted Jul 16th 2008 4:42PM]

Kris Kaspersky IS Zero Cool!

[ran Posted Jul 16th 2008 4:51PM]

I totally understand this guy's need to address that this is a big issue, but by keeping it to himself, he will draw criticism from many people; by releasing code to compromise systems, he can practically be charged with conspiring to commit terrorism the way this country is heading. Sure it's computer exploitation, but if will affect many businesses and people's lives in the US, then it's can be considered said offense.

And if you people think he doing this to get paid, I think he's just doing to punish Intel for not finding this bug.

[(Unverified) Posted Jul 16th 2008 5:17PM]

Hey I completely agree. I wish to restate here that he does have an obligation to report this bug, as it were, to the proper parties. On a side note, he did not do any "work", in the state of on-the-books labor: by the wording in the article it would appear as if he discovered this on his own time, by no-one's request, by his own volition. That being said, if Intel/Apple/HP/MS wishes to pay him, more power to him. Nonetheless, if he wishes to "punish" Intel then I seriously think he should not take it out on the millions of businesses and individuals that use Intel's chips. And I do think that if computer forensics can prove (later) that a given act of computer sabotage/terrorism comes from this guy's publicly available code, then he should be persecuted for that.

[(Unverified) Posted Jul 16th 2008 5:34PM]

I think you meant "prosecuted".

; )

[(Unverified) Posted Jul 16th 2008 6:29PM]

Wow... with comments like these, no wonder you elected Bush twice.

[ran Posted Jul 16th 2008 6:43PM]

Yes I voted for Bush.

[(Unverified) Posted Jul 16th 2008 9:52PM]

Uh... To be honest I *woulda* voted for Bush too were I of age at the time... In fact it appears most people did.

And I did mean persecuted ( :) ) but prosecuted would be okay too I guess. But I have been hearing a lot of people say that Intel *already knows* about this bug. I hope that this is the case, because other comments on the original site state that it doesn't affect all operating systems, contrary to the article. Again, I hope this is the case.

Nonetheless, if it is a serious problem, then this guy is pretty much yelling out the instructions to the computing equivalent of an atomic bomb free of charge to anyone who will listen. Doesn't that seem a little... unethical?

[Ownaginatious Posted Jul 16th 2008 5:02PM]

@CubeGuy

stfu no you didn't...

[benjgvps Posted Jul 16th 2008 5:16PM]

OLD MACS FTW!!!

[(Unverified) Posted Jul 16th 2008 5:25PM]

Hackers screenshot ftw

[(Unverified) Posted Jul 16th 2008 6:45PM]

eh, he's not some anonymous dude looking for his 15-minutes of fame. It's Kaspersky.
And [although I agree with the sentitment] for those of you who are yammering that he should "forwarn" the manufacturers -- what good would it do if he's got a hack that circumvents everything down to the hardware level? It isn't like Intel can just send out a patch for our chips :) Hopefully I'm wrong, and whatever he's cooked up in his lair-^d^d-ab can be prevented through a software update. /shrug.

[suhag1029 Posted Jul 16th 2008 5:39PM]

tomorrow in the news we hear that this man has mysteriously disappeared...and that also intel's chief engineers have gone to their other office in guantanamo.

[(Unverified) Posted Jul 16th 2008 6:37PM]

I'm safe...my computer chip uses thousands of really tiny gerbils on tiny little wheels. Besides, I have GEICO.

[(Unverified) Posted Jul 16th 2008 7:55PM]

I'm not saying I believe a word of this, but if he really did find something, then why do guys like this want to post it publically? What on earth is that supposed to accomplish by placing everyone at potential risk? Maybe he's talkin' bunk, but until we know for sure, "Thanks a lot ya boob for deciding to advertise your findings to every idiot out there. Way to contribute to society."

How about letting Intel know so they can fix it (if this truly is a real flaw), without creating a stir. If you find something that places people at risk, you don't go yelling it at the top of your lungs. You keep your big mouth shut and quietly provide the info to those who can do something about it without harming the rest of us.

[(Unverified) Posted Jul 16th 2008 8:59PM]

(ominous music in the background).........and who said it was a flaw?.....(menacing)you guys dont know the half of it......(ominous music ends)

[poet Posted Jul 16th 2008 9:05PM]

Don't you joke about this. Once he controls your CPU he'll use a quatum entanglement errata he found in the human genom to take over your brain by blinken lights. So better be good now, or he will be very, very angry ...

[(Unverified) Posted Jul 17th 2008 12:19AM]

There is something wrong with this whole premise:

1) TCP/IP, in and of itself, does not pass executable code and have it directly executable by the CPU. If it does, it's a bug in the TCP/IP stack, not the CPU.

2) Javascript doesn't run native machine code. If it allowed native machine code through, it would be a bug/fault of the Javascript execution engine, not the CPU.

In either case, I call attention-whoring BS on this.

[takes12no1 Posted Jul 17th 2008 8:52AM]

I bet the CIA/NSA is pissed about their backdoor being discovered.

[(Unverified) Posted Jul 17th 2008 10:26AM]

Love the picture... GREAT MOVIE!!!

[(Unverified) Posted Jul 17th 2008 10:56AM]

all talk no action...
i can hack up a super computer in 1 day!

why 1 day?

coz that damn computer is huge dude!!!
even with a big axe i still need lots of time.

[(Unverified) Posted Jul 17th 2008 10:57AM]

Intel: "Mr. Smith, kill Neo know!".
Neo: "Ok ok, i won't tell..."

[(Unverified) Posted Jul 17th 2008 1:53PM]

JavaScript is not the same as Java. JavaScript is not run on the virtual machine provided by Sun, but is interpreted by the browser itself (eg Firefox, Opera, IE).

[jmcloughlin Posted Jul 17th 2008 1:55PM]

I'm just waiting for the stream of "Hai, I'm in ur Java, sploitin' your errata" lolcats pictures. -_-

[TheHoldSteady Posted Jul 17th 2008 7:49PM]

On the plus side, anyone falsely accused of copyright theft or child porn can point to this vulnerability and say EVERYONE can be hacked / framed.

[(Unverified) Posted Jul 18th 2008 3:53AM]

Eventually we will be back to doing basic "computing" with a pencil, paper, calculator, compasses, rulers etc... and a little bit of brain power.