Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How to become the sole owner of your PC [pdf]

github.com

Post reply on HN
Print view View original

21–30 of 126 posts

Re: How to become the sole owner of your PC [pdf]

#21

Post by userbinator »

30 years ago you could buy an IBM PC/AT and it would come with schematics, detailed programming information, and the complete source code listing for the BIOS[1]. There wasn't really anything "hidden", and you really felt like "the sole owner of your PC". The PC became the dominant platform because of this. Now, because of corporate interests[2][3], much of it is officially under a thick layer of red-tape NDAs, and what little else interesting out there comes mainly from leaks (be thankful for East-Asian companies' insecurity...), and there are still plenty of things hidden away. On the the other hand, all of this stuff is documented somewhere; whether that documentation will ever see the light of day is the real question (for anyone reading this who does possess such information: please do the right thing ;-) Especially when it's far easier now than before to distribute lots of data, putting the complete ME programming documentation and maybe even source code online as a download or on a disc to be supplied is entirely feasible. But Intel decided against, leading me to think they really intended it to be a backdoor-ish sort of thing, and that makes me really sad.

[1] https://archive.org/details/bitsavers_ibmpcat150ferenceMar84...

[2] http://boingboing.net/2012/01/10/lockdown.html

[3] http://boingboing.net/2012/08/23/civilwar.html

Re: How to become the sole owner of your PC [pdf]

#22

Post by spash »

Animats wrote: post #20

Has anyone found a remote attack via the Management Engine yet? It's basically a backdoor; there must be some way to make it do things.

Though not a simple remote attack in that sense, AMT has been used by rootkits before:

https://en.wikipedia.org/wiki/Intel_Active_Management_Techno...

A nice overview of what AMT and ME is capable of (and has been for the past decade) can be found in libreboot FAQ:

https://libreboot.org/faq/#intel

Re: How to become the sole owner of your PC [pdf]

#23

Post by spydum »

Animats wrote: post #20

Has anyone found a remote attack via the Management Engine yet? It's basically a backdoor; there must be some way to make it do things.

perhaps everyone who finds something disappears?

seriously, AMT is stuff of nightmares. runs even when machine is powered off.

Re: How to become the sole owner of your PC [pdf]

#24

Post by nateberkopec »

Animats wrote: post #20

Has anyone found a remote attack via the Management Engine yet? It's basically a backdoor; there must be some way to make it do things.

Yes. Wiki: https://en.wikipedia.org/wiki/Intel_Active_Management_Techno...

> A Ring -3 rootkit was demonstrated by Invisible Things Lab for the Q35 chipset; it does not work for the later Q45 chipset as Intel implemented additional protections.[39] The exploit worked by remapping the normally protected memory region (top 16 MB of RAM) reserved for the ME. The ME rootkit could be installed regardless of whether the AMT is present or enabled on the system, as the chipset always contains the ARC ME coprocessor. (The "-3" designation was chosen because the ME coprocessor works even when the system is in the S3 state, thus it was considered a layer below the System Management Mode rootkits.[32]) For the vulnerable Q35 chipset, a keystroke logger ME-based rootkit was demonstrated by Patrick Stewin.[40][41]

Re: How to become the sole owner of your PC [pdf]

#25

Post by zanny »

keyle wrote: post #10

I've never heard of this before. This feels like science-fiction. You'd think this would have blown over the internet 50 times over? What can 'they' do with this?

It is like cell phone radios with DMA access. Anything they want, in practice. If you are buying any computer commercially it always has backdoored hardware with a wholly proprietary coprocessor with networking and memory access.

Re: How to become the sole owner of your PC [pdf]

#26

Post by nickpsecurity »

spydum wrote: post #23
Animats wrote: post #20

Has anyone found a remote attack via the Management Engine yet? It's basically a backdoor; there must be some way to make it do things.

perhaps everyone who finds something disappears? seriously, AMT is stuff of nightmares. runs even when machine is powered off.

AMT is the reason I mock anyone here that talks about concerns of backdoors in Intel's RNG's being ridiculous. The whole CPU is backdoored with a backdoor that can run when it's off. Including probably the RNG given debug wires are probably connected to it. Let's not worry about one feature when we have a subversion this big.

Biggest irony: they advertise it as a feature for IT management. ;)

Re: How to become the sole owner of your PC [pdf]

#27

Post by nickpsecurity »

snaky wrote: post #8
setra wrote: post #5

Just more evidence that modern CPU designs need to die, and that a libre alternative is required.

The vast majority of users are comfortable with status quo. Therefore anyone who would implement and sell their own modern CPU with no 'features' like ME, would sell it by premium price - at least, due the much less target audience - and that will lead to audience shrink yet much more.

That's exactly what happened almost every time. Another commenter posted a link to OSS CPU's. Two, LEON3 and SPARCT1/T2, are great CPU's released under GPL. Gaisler had a lot of other I.P. to go with LEON3. Now, tell me what FOSS loving companies brought those to market or have a board to sell me? Anyone? Bueller?

Re: How to become the sole owner of your PC [pdf]

#28

Post by yoo1I »

mashlol wrote: post #2

The PDF won't open for me on a Nexus 5, doesn't show thru githubs mobile site either. Edit: It worked when I requested the desktop version of github though.

Sigh... chrashes on Chromium on Linux as well.

maybe ME is detecting it and wants to prevent us from knowing about it?!?

Re: How to become the sole owner of your PC [pdf]

#30

Post by woodman »

incompatible wrote: post #11
incompatible wrote: post #7

How about firewalling whatever ports the Intel code may use? If it can't communicate with the Internet, presumably it's not likely to do any harm.

Firewalling ports for incoming connections and IP addresses for outgoing, I should say.

Just be mindful of the fact that you've only increased the difficulty of an attack, the vulnerability still exists. I've got a lenovo that regularly sends out dhcp broadcasts, despite no dhcp code being on disk - it could just as easily call home with dns (sending recursive requests to the same ip as the last successful user initiated query). The only way to fix a ring -N rootkit is to remove ring -N.
Post reply on HN