Intel today became the apparent victim of a massive internal data breach, as roughly 20 GB of various Intel documents and tools have begun showing up in a data cache uploaded to the wider internet. With materials seemingly spanning over a decade, the breach reportedly includes everything from Intel presentation templates to BIOS code and debugging tools, and would represent one of the biggest intellectual property leaks from a chipmaker in years.

Released by Till Kottmann, a Swiss software engineer and open security advocate, Kottmann has stated that this is the first of several planned Intel IP releases, calling this first release the “Intel exconfidential Lake Platform Release”. According to tweets posted by Kottmann, he received the material from an anonymous source who breached Intel earlier this year. Meanwhile, ZDNet reports that Kottmann is a regular figure in IP leaks, and has published a number of other tech company leaks before.

Responding to this leak, Intel this afternoon has issued a brief statement to the press acknowledging the leak, and stating that they believe it came form the Intel Resource and Design Center, a secure Intel repository for third party partners to access various confidential documents and schematics.

We are investigating this situation. The information appears to come from the Intel Resource and Design Center, which hosts information for use by our customers, partners and other external parties who have registered for access. We believe an individual with access downloaded and shared this data.

While AnandTech has not validated the contents of the data cache, I’ve heard from one source who has seen it that there are signed NDA documents in there mentioning an Intel partner. So while Intel may be right about the source of the data, the actual breach may have occurred with a partner rather than the actual Intel repository, or in concert with a breach of Intel’s repository.

Overall, Kottmann claims that the leak has a wide collection of various Intel confidential and NDA’d documents and tools, including:

  • Intel ME Bringup guides + (flash) tooling + samples for various platforms
  • Kabylake (Purley Platform) BIOS Reference Code and Sample Code + Initialization code (some of it as exported git repos with full history)
  • Intel CEFDK (Consumer Electronics Firmware Development Kit (Bootloader stuff)) SOURCES
  • Silicon / FSP source code packages for various platforms
  • Various Intel Development and Debugging Tools
  • Simics Simulation for Rocket Lake S and potentially other platforms
  • Various roadmaps and other documents
  • Binaries for Camera drivers Intel made for SpaceX
  • Schematics, Docs, Tools + Firmware for the unreleased Tiger Lake platform
  • (very horrible) Kabylake FDK training videos
  • Intel Trace Hub + decoder files for various Intel ME versions
  • Elkhart Lake Silicon Reference and Platform Sample Code
  • Some Verilog stuff for various Xeon Platforms, unsure what it is exactly.
  • Debug BIOS/TXE builds for various Platforms
  • Bootguard SDK (encrypted zip)
  • Intel Snowridge / Snowfish Process Simulator ADK
  • Various schematics
  • Intel Marketing Material Templates (InDesign)

Thus far, while no one has reported finding anything quite as sensitive as Intel CPU or GPU design schematics – which is consistent with the claim that it originated from Intel's Resource and Design Center. None the less, the material in the leak looks to be quite valuable, and potentially damaging in the long run. Firmware blobs are particularly interesting, as while these would need to be reverse engineered to extract useful information out of them, they could potentially contain significant information that hasn’t otherwise been shared before.

Otherwise, in a bit of situational irony, this leak is likely to cast doubt upon all future Intel leaks. The inclusion of the company’s presentation templates, while not particularly damaging to Intel, would mean that it’s now trivial to generate fake but accurate-looking Intel roadmaps and presentations. These kinds of materials are already regularly faked, but now it’s easier than ever to do so.

Ultimately with no reason to doubt Kottmann’s claims, it would seem that this just the start of a run of leaks for Intel. And while the company will no doubt be doing everything possible to stop the process, whether they have any legal power to do so remains to be seen.

Source: ZDNet



View All Comments

  • Carmen00 - Monday, August 10, 2020 - link

    Since my doctorate is in the field of information security, I have to say that this made me laugh - and also cry a bit, because it is exactly this attitude that actively prevents OS vendors from allowing users full control over their machines. The classic case-in-point is Sasser, a worm for which the patch had been issued over 2 weeks earlier, but which many admins and ordinary users had decided not to apply (or not yet decided to apply - the effects were the same). The resulting carnage downed critical organizations for hours or days.

    Sasser does not stand alone, of course. Decades of experience have taught us that users strongly believe that they know enough about risk and infosec to make good choices, and also that they are most often grossly mistaken. We live in a world filled with zombie botnets because of this. Nor does more education rectify the problem: study after study shows that despite strong security messaging, many users will give up their passwords for something as trivial as a candy-bar. Users also fail to realize the subtlety of the risks that they are faced with on the internet, and this is why browser manufacturers have had to essentially create mini-OSes with sandboxing to keep users safe from their poor choices (and even then, users find ways to screw themselves over). Unless you have at least 2-4 years of deep experience with infosec, it's difficult to properly comprehend the modern risk landscape, and it's very easy to make poor decisions through ignorance alone. There are few users who will immerse themselves in the field to that extent, which means that it really is up to vendors, at a practical and pragmatic level.

    Your response joins a long line of arrogant user statements that claim, despite all observable facts, to know better than trained infosec professionals. Congratulations, I suppose? And please understand that you (and people like you) are the reason that we cannot have some very nice things, such as developer access to ring-0. You are the reason that OS vendors HAVE to apply Intel's mitigations whether you like them or not, because they simply cannot trust you to make reasonable and informed decisions.

    I fully understand that this response will not change your mind one whit and research shows that, if anything, you will become even more adamant that you are right. That's OK; I'm not writing it for you. I'm writing it for other people who may run across it because research also shows that if you don't have your ego on the line, you actually can learn a lot from the experts.

    I wish you the best of luck on the internet, timecop1818. You'll certainly need it.
  • K_Space - Tuesday, August 11, 2020 - link

    Thanks Carmen00; comments like these makes AT worth it... and timecop1818 for the laughs :P Reply
  • Spunjji - Tuesday, August 11, 2020 - link

    Savage. Flawless victory and a genuinely useful response for other readers, too. Thanks Carmen00. Reply
  • Spunjji - Tuesday, August 11, 2020 - link

    Cool cool. An assortment of slurs, grossly overstated pompous claims about security and then the creation of an elaborate strawman to beat on.

    If physical access is sO mUcH eAsIeR then why is my organisation under constant threat of IT attacks but hasn't had a break-in in years? 🤔
  • PeachNCream - Tuesday, August 11, 2020 - link

    "...retarded mitigations..."

    Isn't Intel responsible for writing the code for those mitigations? Does that not imply the problem in the performance decrease is caused by Intel? How does that fit into your view of the company and your loyalties if you despise it for poor performance? That seems conflict with your established brand loyalties.
  • ZoZo - Friday, August 7, 2020 - link

    You don't need to exfiltrate 20GB, only a few bytes for the password. Reply
  • Spunjji - Friday, August 7, 2020 - link

    It's sweet that you think they would exfiltrate the data when, in reality, they would just exfiltrate information that gives them access to that data.

    It's almost like you have no real idea how any of this works! 🤔
  • peevee - Tuesday, August 11, 2020 - link

    All you need is getting the password out, just a few bytes. Reply
  • brucethemoose - Friday, August 7, 2020 - link

    On the contrary, it looks like yet another public, unsecured server that someone stumbled upon.

    Misconfigured cloud instances are the gift that just keeps on giving.
  • Krysto - Monday, August 10, 2020 - link

    And it somehow only happens on Amazon's cloud.

    Wait, I think I'm seeing a pattern here...

    Defaults ALWAYS matter. If you, as a developer, expect 100% of your users to NOT be idiots (and understand all of the complexities of your solution), then YOU are the bigger idiot. UX 101.

Log in

Don't have an account? Sign up now