<story><title>An introduction to reverse-engineering x86 microcode and writing it</title><url>https://media.ccc.de/v/34c3-9058-everything_you_want_to_know_about_x86_microcode_but_might_have_been_afraid_to_ask</url></story><parent_chain><item><author>madez</author><text>Recently here on Hacker News I had a short discussion with Steve Klabnik about JavaScript and WebAssembly among other things.[0] My point is that to execute randomly downloaded code is realistically impossible to secure, practically used to deliver malware and usually used against the interests of the user of the computer. If I can infer from Steve&amp;#x27;s stance the opinion of Mozilla, then it&amp;#x27;s sad to see that the only big browser developer organization I had hopes in simply waves these problems away and keeps on making JavaScript and WebAssembly more usable and widespread. It&amp;#x27;s disheartening to see that.&lt;p&gt;The connection to this talk is that they demo triggering a backdoor hidden in microcode by executing some WebAssembly code in an up-to-date FireFox.&lt;p&gt;[0] &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;news.ycombinator.com&amp;#x2F;item?id=15981178&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;news.ycombinator.com&amp;#x2F;item?id=15981178&lt;/a&gt;</text></item></parent_chain><comment><author>rft</author><text>Author here:
I chose WebAssembly, because it allowed for easy insertion of an instruction we understand perfectly and can backdoor. With more work we could have highjacked an instruction in the actual binary of Firefox and started the attack from there. WebAssembly simply gives primitives that allow for an easier attack (emitting of a specific instruction, chosing constants and predictive code generation). Not WebAssembly itself enabled the attack, it just made it easier.&lt;p&gt;Exploiting HTML or font rendering is more work, but as you still run known instructions in a known sequence processing known data the primitives are still there. The same can happen for anything that processes foreign data, be it script, video, images or just CSV.</text></comment>
<story><title>An introduction to reverse-engineering x86 microcode and writing it</title><url>https://media.ccc.de/v/34c3-9058-everything_you_want_to_know_about_x86_microcode_but_might_have_been_afraid_to_ask</url></story><parent_chain><item><author>madez</author><text>Recently here on Hacker News I had a short discussion with Steve Klabnik about JavaScript and WebAssembly among other things.[0] My point is that to execute randomly downloaded code is realistically impossible to secure, practically used to deliver malware and usually used against the interests of the user of the computer. If I can infer from Steve&amp;#x27;s stance the opinion of Mozilla, then it&amp;#x27;s sad to see that the only big browser developer organization I had hopes in simply waves these problems away and keeps on making JavaScript and WebAssembly more usable and widespread. It&amp;#x27;s disheartening to see that.&lt;p&gt;The connection to this talk is that they demo triggering a backdoor hidden in microcode by executing some WebAssembly code in an up-to-date FireFox.&lt;p&gt;[0] &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;news.ycombinator.com&amp;#x2F;item?id=15981178&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;news.ycombinator.com&amp;#x2F;item?id=15981178&lt;/a&gt;</text></item></parent_chain><comment><author>afuchs</author><text>&amp;gt; [...] My point is that to execute randomly downloaded code is realistically impossible to secure, practically used to deliver malware and usually used against the interests of the user of the computer. [...]&lt;p&gt;This argument has been rehashed over and over again. Some of the mass appeal of the web, as a platform, is that random arbitrary code can be downloaded and run inside a sandbox. It appears that these web technologies will continue to be used regardless of any security implications.&lt;p&gt;If users demand something like JavaScript or WebAssembly, do you have an alternative proposal to satisfy them?</text></comment>