Intel Flaw Impact on VMS / NVRs Examined

The flaw requires a malicious program to be loaded and executed on a machine with an affected processor

Other than patches, is there anything we can do to help protect against this? Most of the servers we install are never interacted with so I am not sure what the level of risk is for us. Performance decrease is a major concern for me. While we typically allow for some wiggle room a potential for up to 20% decrease in performance is entirely unacceptable.

So the real question is, on small systems is it even worth patching? This is way outside of my skill set so I am mostly in the dark here.

Reactions:

(2)

Brian Karas

IPVM

Other than patches, is there anything we can do to help protect against this?

Do everything you can to ensure no new/unknown code gets on the servers. This also means limiting or strictly controlling things like RDP access, or even plugging USB devices in that could be used for attacks as a method to install malicious programs.

So the real question is, on small systems is it even worth patching?

In a pre-internet era, where you could reasonably expect to keep devices sandboxed away from the rest of the world, I would probably say "don't bother". But in modern setups, where remote access to video is common and expected, it seems potentially risky.

A good compromise might be to delay patches for a while until the full extent of the performance impacts, and updates from VMS manufacturers are known. This trades some exposure risk for better potential to minimize performance hits. You may find that initial performance hits are somewhat large, but then things improve and settle out to something like 5% that could be more easily absorbed.

Reactions:

(3)

Undisclosed Integrator #1

In reply to Brian Karas

A good compromise might be to delay patches for a while until the full extent of the performance impacts, and updates from VMS manufacturers are known.

I think you might be onto something there, I will wait it out a week or two and see what news comes out of all this. I don't like the idea of jumping when everyone else jumps.

Reactions:

(1)

Undisclosed Integrator #7

Just as an FYI. Even if you do patch your servers there is a very high likelihood that the first few patches are going to be targeted by hackers because Microsoft is currently just putting a band-aid on a gaping wound. I would do a lot more research before planning which part of the ship you want to jump from...

Reactions:

(1)

Undisclosed #4

•Jan 06, 2018

IPVMU Certified

I think you might be onto something there... I don't like the idea of jumping when everyone else jumps.

Convinced me too. I don’t mind the idea of not jumping when everyone else doesn’t.

Reactions:

Undisclosed Integrator #6

What VMS do you utilize? Are you using edge motion detection or is motion detection occurring at the server?

Reactions:

Undisclosed End User #2

Y2K Redux...

Reactions:

Brian Karas

In reply to Undisclosed End User #2

IPVM

How so? Do you think the panic is overhyped, or something else?

Reactions:

Undisclosed End User #2

In reply to Brian Karas

No, the opposite, server replacements or additional servers to handle the new load.

Busy PACS systems and VMS servers especially....

Back in 1999, I swapped many F/W chips in Schlage(Westinghouse) 808 Panels

Reactions:

(2)

Undisclosed Integrator #3

What about Hikvision? Should they not be the target as usual? Or the Chinese? What happened Hikvison is soo soo bad and does all these evil things, and every other American or South Korean manufacturer is solid as a rock, never makes mistakes like this, no way.... how could this even come under consideration? Engineering flaw my ass ....that was not acceptable from Hikvision why now believable from Intel without question?.....Maybe it's the NSA planting something to see you remotely?....maybe Intel made a mistake? Hikvision has been claimed to make these type flaws from such "poor engineering standards" and done intentionally on there part, remember?

Where is secret agent Bashis? He must missed this one....

We reap what you sow.... Just saying!

Reactions:

(2)

(7)

(1)

(39)

(1)

Brian Karas

IPVM

It is unfortunate that you claim to install surveillance systems in sensitive areas, and cannot understand the basic differences between a flaw buried deep in the nuances of how microprocessors handle virtual memory allocations, and a wide-open backdoor that a manufacturer incorporates into their products.

Reactions:

(13)

(4)

Undisclosed Integrator #3

In reply to Brian Karas

Once again you attempt to override what I said with attitude and a feeble attempt to insult another commenter.

Did you notice I said 'engineering flaw' My comment was not about technology, or Hikvision per se it was a comparison of the difference in reporting between anything Hikvision and Intel, you missed it.

Its unfortunate that you believe understanding a"flaw buried deep in the nuances of how microprocessors handle virtual memory allocations" is a major requirement for being a leading Integrator, your belief holds no water.

I would ponder just how many integrators rise to level of your wizardry and would venture to say they can actually, really, technically explain the above? Only problem IPVM only has 10-11,000 members, quite a minor audience to get a real world opinion from.

Reactions:

(2)

(3)

(18)

Undisclosed Integrator #6

being a leading Integrator

LOL

Your reality distortion field must have a 1' radius.

Reactions:

(3)

(2)

Brian Karas

IPVM

Did you notice I said 'engineering flaw' My comment was not about technology, or Hikvision per se it was a comparison of the difference in reporting between anything Hikvision and Intel, you missed it.

Your first words were: "What about Hikvision? Should they not be the target as usual?" This shows either an extremely poor attempt at sarcasm, or a lack of understanding of the basic concepts being conveyed in reports on vulnerabilities. Since you are a very adamant Hikvision supporter, I interpreted your opening words as genuine concern, not sarcasm. Further, I think that was the right interpretation, based on your response above.

Its unfortunate that you believe understanding a"flaw buried deep in the nuances of how microprocessors handle virtual memory allocations" is a major requirement for being a leading Integrator, your belief holds no water.

I do not think it is a major requirement. I do believe you should be able to tell the differences at least to the extent you are able understand that a flaw in a processor, which is a component complete systems are built around, is fundamentally different than a glaring flaw in the software developed and shipped by a "finished goods" manufacturer. Hikvision cannot be held accountable for using Intel processors, as they, like others, had no real way to be aware of this flaw. Hikvision can, and should, be held accountable for their own errors, which provide a highly exploitable flaw in their products that can be leveraged with cut-and-paste simplicity.

I would ponder just how many integrators rise to level of your wizardry and would venture to say they can actually, really, technically explain the above?

No idea. But hopefully after reading this post today, that number is a little higher than it was yesterday, as one of my overarching goals in joining IPVM was to share knowledge and help people understand new concepts. While I have certainly made some inroads in that regard, I clearly have more work to do.

Reactions:

(16)

(1)

Undisclosed #4

IPVMU Certified