[Info-vax] Next release of OpenVMS x86

[Stephen Hoffman]

On 2020-07-20 19:26:11 +0000, johnwallace4 at yahoo.co.uk said:

> On Monday, 20 July 2020 20:00:56 UTC+1, Stephen Hoffman  wrote:
>> 
>> And the available tooling options increase with x86-64, even if the 
>> exploits aren't usually all that portable.  Perl DoS tools and such 
>> aside.
>> ...
> I'd have thought that Intel's various "Management Engine"  
> vulnerabilities were about as portable and OS-independent  as a 
> vulnerability can be...

Quite true.

AMT and Intel processors in general have been receiving fixes. And yes, 
have been incurring yet newer vulnerabilities, too.

This isn't particularly new exposure for OpenVMS, though. OpenVMS has 
been paired with vulnerable iLO management processor options for a 
while. HPE was indicating that no fixes were feasible, due to iLO 
hardware limits.

Some of the various Intel AMT-related exploit information:
http://blog.ptsecurity.com/2018/01/running-unsigned-code-in-intel-me.html
https://www.blackhat.com/docs/eu-17/materials/eu-17-Goryachy-How-To-Hack-A-Turned-Off-Computer-Or-Running-Unsigned-Code-In-Intel-Management-Engine-wp.pdf 

https://kakaroto.homelinux.net/2019/11/exploiting-intels-management-engine-part-1-understanding-pts-txe-poc/ 

https://www.bleepingcomputer.com/news/security/malware-uses-obscure-intel-cpu-feature-to-steal-data-and-avoid-firewalls/ 


"Fun" with Intel threading:
hhttps://lists.debian.org/debian-devel/2017/06/msg00308.html
ttp://www.daemonology.net/hyperthreading-considered-harmful/

And on capturing hardware bugs:
https://blog.cloudflare.com/however-improbable-the-story-of-a-processor-bug/
https://www.servethehome.com/fake-cisco-switches-in-the-supply-chain-uncovered/

And there are a whole lot more links stashed away, including the rather 
porous SGX implementation.

For where other vendors are headed with security and with hardware 
including processors and systems:
https://manuals.info.apple.com/MANUALS/1000/MA1902/en_US/apple-platform-security-guide.pdf 

https://www.youtube.com/watch?v=OmO_oewq_2c
https://www.servethehome.com/gigabyte-shows-marvell-thunderx3-r282-2u-server/

The x86-64 security tools are fodder for several other discussions, 
particularly as VSI gets further along with llvm and clang and related 
tooling, and with the x86-64 releases.

-- 
Pure Personal Opinion | HoffmanLabs LLC