A recent Intel security vulnerability allows unauthorized individuals with physical access to exploit and install malware on the chip. The vulnerability is known as CVE-2021-0157 and lets anyone with access circumvent various security measures, including Bitlocker protections, trusted platform modules, anti-copying restrictions, and other measures. What makes it worse is that the vulnerability that threatens Intel can lead to possible high impacts on its users.
Intel and other chipmakers go to extraordinary lengths to ensure that unauthorized individuals do not get access to their systems. However, the recent vulnerability affects Pentium, Celeron, and Atom CPUs on the Apollo Lake, Gemini Lake, and Gemini Lake Refresh platforms. It gives way to skilled hackers to obtain a hold of an affected chip to run it in debugging and testing modes. Developers commonly use these to test and debug firmware. These chips are used in various products, including computers, mobile devices, embedded systems, medical equipment, and Internet of Things (IoT) solutions.
What The Vulnerability Can Bring To The Table
An attacker may exploit a high-severity vulnerability that threatens Intel to extract encryption keys and gain elevated privileges on devices running Intel’s Apollo Lake and Gemini Lake-based Pentium, Celeron, and Atom CPUs. These operating systems are popular options for small-form-factor white-box CPE, such as routers and firewalls, among other applications because of their low power consumption. The vulnerability discovered by Positive Technologies researchers and an independent threat researcher comes down to an overabundance of capabilities granted by the chip’s built-in debugging feature.
Likewise, anyone with physical access to the hardware may use this flaw to extract encrypted information from a device affected by it. An attacker can extract the key to encrypt data stored in the TPM enclave in developer mode. If the TPM is also being used to hold a Bitlocker key, they can bypass that latter security. Another option is for an adversary to circumvent code-signing constraints that prohibit illegal software from operating in the Intel Management Engine, a subsystem within susceptible CPUs, and from there permanently backdoor the processor.
While the attack necessitates the attacker gaining physical access to the susceptible device for a short period, this is precisely the situation that TPM, Bitlocker, and codesigning are intended to prevent. The whole procedure takes around ten minutes. Each Intel CPU has a unique key to create follow-on keys for Intel’s TPM, Enhanced Privacy ID, and other safeguards that depend on the features built into Intel silicon. This key is needed to identify the CPU in question.
The discovered vulnerability that threatens Intel can impact users as an attack would enable thieves to extract the encryption key from a device. Once they obtain access, they can gather contents that present a high privilege with potential effect. An attacker might use this vulnerability to obtain the root EPID key from a device. After successfully compromising Intel EPID technology, they download electronic resources from providers in file form, duplicate them, and disseminate them to their networks. Furthermore, a vulnerability might enable cybercriminals to launch targeted assaults throughout the supply chain and cause a catastrophic impact.
Intel’s Retaliation
Intel responded to this problem by releasing firmware mitigation for its impacted computers and using a security information and event management (SEIM) platform to identify and monitor breaches. Researchers who found the vulnerability suggested that users update the BIOS on impacted devices as soon as they get the chance.
How To Prevent Possible Infiltration
Understanding how to prevent malware assaults is vital to your organization’s sensitive data security and confidentiality. Having the protocols, rules, and IT security technologies in place to avoid malware attacks comes down to having them in place in the first place. It did, however, need the training of your end-users for them to detect and react to the typical techniques thieves employ to distribute malware.
Use Network and Endpoint Security Tools
Use the appropriate tools so your organization can be safe from infiltration like the vulnerability that threatens Intel. Your IT professionals should investigate every avenue via which a criminal may employ malware to infiltrate and compromise the devices and network of your firm. When it comes to avoiding malware-related security problems, using a mix of endpoint and network security protection technologies is the best solution.
Install Antivirus or Anti-Malware Software
It is beneficial to use antivirus and anti-malware software to detect and defend your endpoint devices and your more comprehensive network against a wide range of old and novel malware-related threats.
Use A Firewall
Adding a firewall to your network adds another layer of protection and ensures that your devices and network are protected further. This barrier between the internet and your IT infrastructure is responsible for preventing various sorts of malware assaults and other dangerous actions from occurring (both inbound and outbound). Both hardware and software versions are available. However, many companies use both. For those curious about how to avoid malware assaults, this is an excellent method to try.
Any unwanted access to your network is detected, and if the traffic is determined to be malicious, the traffic is prevented by your network firewall. A firewall also allows users to specify which traffic is permitted and which traffic must be denied. This implies that the user can select the IP addresses or ports that should be banned or opened. However, although not completely effective, a firewall may significantly improve the security of your network and devices against malware assaults.
Educate Your Employees to Recognize Common Cyber Threats
Your organization’s cyber security is just as strong as the weakest link in its chain of command, so make your selection carefully. It should provide frequent training sessions for your employees to increase their understanding of cyber security and lower the risk of malware assaults. Even if you invest a significant amount of money on cybersecurity products and IT personnel, if your non-IT staff is not educated to be alert for possible threats, all of your efforts may be rendered ineffective. Cybercriminals primarily target these employees, so all employees should get regular training on cyber security procedures and rules.
Update Your IT Systems, Plugins And Software Regularly
After discovering a vulnerability in a program, developers offer patches or other upgrades to address the flaws that have been discovered. On the other hand, many companies take these changes for granted and put them off. Unfortunately, if they do not deploy their downloaded patches, their computers may be left susceptible to malware and other cyber threats for weeks or months.
Cybercriminals are well aware of this and use the situation to their advantage. To target enterprises that have not updated their software, they may exploit these unpatched vulnerabilities. The need to provide updates as quickly as feasible is thus critical.
All software applications and your IT infrastructure’s firmware and operating systems fall under this category. In addition, anti-malware or antivirus software must be updated regularly to be effective. This will protect you from the most recent dangers.
Final Thoughts
Unfortunately, establishing a BIOS password will not completely prevent you from this attack since the weaknesses may also be exploited remotely if the attacker has gained access to the machine via a compromised browser. Therefore, you need to make sure you have a strong defense against any possible infiltration. Keeping vigilant and doing all recommended steps to keep cybercriminals at bay would be possible to lessen any impact one might encounter through these vulnerabilities.
References
https://www.bleepingcomputer.com/news/security/high-severity-bios-flaws-affect-numerous-intel-processors/
https://www.sdxcentral.com/articles/news/intel-bug-exposes-encryption-keys/2021/11/
https://www.metacompliance.com/blog/what-is-malware-and-how-to-prevent-against-it/
