Pentium computers vulnerable to cyberattack

Security experts warn of that and other risks at CanSecWest/core 06

VANCOUVER, British Columbia —The built-in procedure that Intel Pentium-powered computers use to blow off their digital steam could put users in hot water by making the machines vulnerable to cyberattacks, computer security researchers announced at the CanSecWest/core06 conference last week.

When the processor begins to overheat or encounters other conditions that could threaten the motherboard, the computer interrupts its normal operation, momentarily freezes and stores its activity, said Loïc Duflot, a computer security specialist for the French government’s Secretary General for National Defense information technology laboratory.

Cyberattackers can take over a computer by appropriating that safeguard to make the machine interrupt operations and enter System Management Mode, Duflot said. Attackers then enter the System Management RAM and replace the default emergency-response software with custom software that, when run, will give them full administrative privileges.

Every computer that runs on x86 chip architecture may be vulnerable to this attack, including the millions of computers that the U.S. government and industry use, said Dragos Ruiu, the conference organizer. He is a Canadian computer security consultant for businesses, governments and the U.S. military.

CanSecWest is an informal annual gathering for hard-core code gurus who create the software that businesses and governments use. The conference presented the latest in what hackers — both helpful and malicious — are doing in IT security, said Eric Byres, a member of the research faculty at the British Columbia Institute of Technology.

A growing number of cyberattacks are targeting Web applications, an area of concern widely discussed during the conference. That ties in to the rapid spread of voice-over-IP technology.

“Have vendors even heard of Web application security?” asked Nicolas Fischbach, senior manager for network engineering security at COLT Telecom, who gave a presentation on VOIP security issues.

VOIP vendors are so driven to beat the competition to market and include new features that they have no idea how to write secure Web applications, he said. He predicted it will take years for such applications to be made secure retroactively.

Among the numerous topics presented at the conference, IPv6 has the most long-term significance because it will probably still be in use 50 years from now, Ruiu said.

IPv6 has 128-bit addresses, a huge step up from IPv4’s 32-bit addressing scheme. That means IPv6 could provide millions of unique addresses for each person on Earth, along with “every toaster, door and window,” said van Hauser, an alias for the security team leader at n.runs, a German security company, and founder of The Hacker’s Choice, a hacker group.

With all those IP addresses, IPv6 resists most traditional worm attacks that rely on randomly finding active addresses, said van Hauser. IPv6 users must enable IP security protocols, he warned, because without them, attackers can use IPv6’s hierarchical structure to get immediate access to Domain Name Servers and other critical system components.

Control systems are at risk, experts warn

One of the biggest information technology security issues that nobody is talking about, but should be, is the vulnerability of supervisory control and data acquisition (SCADA) systems, computer security experts at the CanSecWest/core06 conference said.

SCADA systems control the operation of critical infrastructure, from power plants to traffic lights.

SCADA is one of the most important but least explored areas of IT security because the private-sector owners of critical infrastructure refuse to release data and deny that their aging systems pose any security risk.

“It’s one of those issues that is so big you just don’t want to see it because any solutions will be expensive, awkward and prohibitive,” said Dragos Ruiu, the conference organizer.

Eric Byres, a member of the research faculty at the British Columbia Institute of Technology, presented a new tool his team developed, called Achilles, to help infrastructure owners know whether the IT security products they buy are secure.

Vendors can pre-test their products with Achilles, which deeply probes the security vulnerabilities of sensors, infrastructure control mechanisms and other SCADA devices.


  • Elections
    voting security

    'Unprecedented' challenges to safe, secure 2020 vote

    Our election infrastructure is bending under the stress of multiple crises. Administrators say they are doing all they can to ensure it doesn't break.

  • FCW Perspectives
    zero trust network

    Can government get to zero trust?

    Today's hybrid infrastructures and highly mobile workforces need the protection zero trust security can provide. Too bad there are obstacles at almost every turn.

Stay Connected


Sign up for our newsletter.

I agree to this site's Privacy Policy.