Intel today became the apparent victim of a massive internal data breach, as roughly 20 GB of various Intel documents and tools have begun showing up in a data cache uploaded to the wider internet. With materials seemingly spanning over a decade, the breach reportedly includes everything from Intel presentation templates to BIOS code and debugging tools, and would represent one of the biggest intellectual property leaks from a chipmaker in years.

Released by Till Kottmann, a Swiss software engineer and open security advocate, Kottmann has stated that this is the first of several planned Intel IP releases, calling this first release the “Intel exconfidential Lake Platform Release”. According to tweets posted by Kottmann, he received the material from an anonymous source who breached Intel earlier this year. Meanwhile, ZDNet reports that Kottmann is a regular figure in IP leaks, and has published a number of other tech company leaks before.

Responding to this leak, Intel this afternoon has issued a brief statement to the press acknowledging the leak, and stating that they believe it came form the Intel Resource and Design Center, a secure Intel repository for third party partners to access various confidential documents and schematics.

We are investigating this situation. The information appears to come from the Intel Resource and Design Center, which hosts information for use by our customers, partners and other external parties who have registered for access. We believe an individual with access downloaded and shared this data.

While AnandTech has not validated the contents of the data cache, I’ve heard from one source who has seen it that there are signed NDA documents in there mentioning an Intel partner. So while Intel may be right about the source of the data, the actual breach may have occurred with a partner rather than the actual Intel repository, or in concert with a breach of Intel’s repository.

Overall, Kottmann claims that the leak has a wide collection of various Intel confidential and NDA’d documents and tools, including:

  • Intel ME Bringup guides + (flash) tooling + samples for various platforms
  • Kabylake (Purley Platform) BIOS Reference Code and Sample Code + Initialization code (some of it as exported git repos with full history)
  • Intel CEFDK (Consumer Electronics Firmware Development Kit (Bootloader stuff)) SOURCES
  • Silicon / FSP source code packages for various platforms
  • Various Intel Development and Debugging Tools
  • Simics Simulation for Rocket Lake S and potentially other platforms
  • Various roadmaps and other documents
  • Binaries for Camera drivers Intel made for SpaceX
  • Schematics, Docs, Tools + Firmware for the unreleased Tiger Lake platform
  • (very horrible) Kabylake FDK training videos
  • Intel Trace Hub + decoder files for various Intel ME versions
  • Elkhart Lake Silicon Reference and Platform Sample Code
  • Some Verilog stuff for various Xeon Platforms, unsure what it is exactly.
  • Debug BIOS/TXE builds for various Platforms
  • Bootguard SDK (encrypted zip)
  • Intel Snowridge / Snowfish Process Simulator ADK
  • Various schematics
  • Intel Marketing Material Templates (InDesign)

Thus far, while no one has reported finding anything quite as sensitive as Intel CPU or GPU design schematics – which is consistent with the claim that it originated from Intel's Resource and Design Center. None the less, the material in the leak looks to be quite valuable, and potentially damaging in the long run. Firmware blobs are particularly interesting, as while these would need to be reverse engineered to extract useful information out of them, they could potentially contain significant information that hasn’t otherwise been shared before.

Otherwise, in a bit of situational irony, this leak is likely to cast doubt upon all future Intel leaks. The inclusion of the company’s presentation templates, while not particularly damaging to Intel, would mean that it’s now trivial to generate fake but accurate-looking Intel roadmaps and presentations. These kinds of materials are already regularly faked, but now it’s easier than ever to do so.

Ultimately with no reason to doubt Kottmann’s claims, it would seem that this just the start of a run of leaks for Intel. And while the company will no doubt be doing everything possible to stop the process, whether they have any legal power to do so remains to be seen.

Source: ZDNet

Comments Locked


View All Comments

  • Spunjji - Tuesday, August 11, 2020 - link

    Savage. Flawless victory and a genuinely useful response for other readers, too. Thanks Carmen00.
  • Spunjji - Tuesday, August 11, 2020 - link

    Cool cool. An assortment of slurs, grossly overstated pompous claims about security and then the creation of an elaborate strawman to beat on.

    If physical access is sO mUcH eAsIeR then why is my organisation under constant threat of IT attacks but hasn't had a break-in in years? 🤔
  • PeachNCream - Tuesday, August 11, 2020 - link

    "...retarded mitigations..."

    Isn't Intel responsible for writing the code for those mitigations? Does that not imply the problem in the performance decrease is caused by Intel? How does that fit into your view of the company and your loyalties if you despise it for poor performance? That seems conflict with your established brand loyalties.
  • ZoZo - Friday, August 7, 2020 - link

    You don't need to exfiltrate 20GB, only a few bytes for the password.
  • Spunjji - Friday, August 7, 2020 - link

    It's sweet that you think they would exfiltrate the data when, in reality, they would just exfiltrate information that gives them access to that data.

    It's almost like you have no real idea how any of this works! 🤔
  • peevee - Tuesday, August 11, 2020 - link

    All you need is getting the password out, just a few bytes.
  • brucethemoose - Friday, August 7, 2020 - link

    On the contrary, it looks like yet another public, unsecured server that someone stumbled upon.

    Misconfigured cloud instances are the gift that just keeps on giving.
  • Krysto - Monday, August 10, 2020 - link

    And it somehow only happens on Amazon's cloud.

    Wait, I think I'm seeing a pattern here...

    Defaults ALWAYS matter. If you, as a developer, expect 100% of your users to NOT be idiots (and understand all of the complexities of your solution), then YOU are the bigger idiot. UX 101.
  • Lord of the Bored - Friday, August 7, 2020 - link

    I petition to rename this article
    "Intel's Chief of Cybersecurity and the Terrible, Horrible, No-Good, Very Bad Day."
  • FakThisShttyGame - Friday, August 7, 2020 - link

    Is it only me that it’s kind of coincide with their recent management changes

Log in

Don't have an account? Sign up now