Pentium computers vulnerable to cyberattack

Security experts warn of that and other risks at CanSecWest/core 06

VANCOUVER, British Columbia —The built-in procedure that Intel Pentium-powered computers use to blow off their digital steam could put users in hot water by making the machines vulnerable to cyberattacks, computer security researchers announced at the CanSecWest/core06 conference last week.

When the processor begins to overheat or encounters other conditions that could threaten the motherboard, the computer interrupts its normal operation, momentarily freezes and stores its activity, said Loïc Duflot, a computer security specialist for the French government’s Secretary General for National Defense information technology laboratory.

Cyberattackers can take over a computer by appropriating that safeguard to make the machine interrupt operations and enter System Management Mode, Duflot said. Attackers then enter the System Management RAM and replace the default emergency-response software with custom software that, when run, will give them full administrative privileges.

Every computer that runs on x86 chip architecture may be vulnerable to this attack, including the millions of computers that the U.S. government and industry use, said Dragos Ruiu, the conference organizer. He is a Canadian computer security consultant for businesses, governments and the U.S. military.

CanSecWest is an informal annual gathering for hard-core code gurus who create the software that businesses and governments use. The conference presented the latest in what hackers — both helpful and malicious — are doing in IT security, said Eric Byres, a member of the research faculty at the British Columbia Institute of Technology.

A growing number of cyberattacks are targeting Web applications, an area of concern widely discussed during the conference. That ties in to the rapid spread of voice-over-IP technology.

“Have vendors even heard of Web application security?” asked Nicolas Fischbach, senior manager for network engineering security at COLT Telecom, who gave a presentation on VOIP security issues.

VOIP vendors are so driven to beat the competition to market and include new features that they have no idea how to write secure Web applications, he said. He predicted it will take years for such applications to be made secure retroactively.

Among the numerous topics presented at the conference, IPv6 has the most long-term significance because it will probably still be in use 50 years from now, Ruiu said.

IPv6 has 128-bit addresses, a huge step up from IPv4’s 32-bit addressing scheme. That means IPv6 could provide millions of unique addresses for each person on Earth, along with “every toaster, door and window,” said van Hauser, an alias for the security team leader at n.runs, a German security company, and founder of The Hacker’s Choice, a hacker group.

With all those IP addresses, IPv6 resists most traditional worm attacks that rely on randomly finding active addresses, said van Hauser. IPv6 users must enable IP security protocols, he warned, because without them, attackers can use IPv6’s hierarchical structure to get immediate access to Domain Name Servers and other critical system components.

Control systems are at risk, experts warn

One of the biggest information technology security issues that nobody is talking about, but should be, is the vulnerability of supervisory control and data acquisition (SCADA) systems, computer security experts at the CanSecWest/core06 conference said.

SCADA systems control the operation of critical infrastructure, from power plants to traffic lights.

SCADA is one of the most important but least explored areas of IT security because the private-sector owners of critical infrastructure refuse to release data and deny that their aging systems pose any security risk.

“It’s one of those issues that is so big you just don’t want to see it because any solutions will be expensive, awkward and prohibitive,” said Dragos Ruiu, the conference organizer.

Eric Byres, a member of the research faculty at the British Columbia Institute of Technology, presented a new tool his team developed, called Achilles, to help infrastructure owners know whether the IT security products they buy are secure.

Vendors can pre-test their products with Achilles, which deeply probes the security vulnerabilities of sensors, infrastructure control mechanisms and other SCADA devices.


  • Defense
    Soldiers from the Old Guard test the second iteration of the Integrated Visual Augmentation System (IVAS) capability set during an exercise at Fort Belvoir, VA in Fall 2019. Photo by Courtney Bacon

    IVAS and the future of defense acquisition

    The Army’s Integrated Visual Augmentation System has been in the works for years, but the potentially multibillion deal could mark a paradigm shift in how the Defense Department buys and leverages technology.

  • Cybersecurity
    Deputy Secretary of Homeland Security Alejandro Mayorkas  (U.S. Coast Guard photo by Petty Officer 3rd Class Lora Ratliff)

    Mayorkas announces cyber 'sprints' on ransomware, ICS, workforce

    The Homeland Security secretary announced a series of focused efforts to address issues around ransomware, critical infrastructure and the agency's workforce that will all be launched in the coming weeks.

Stay Connected