Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The Intel ME subsystem can take over your machine, can't be audited

boingboing.net

Post reply on HN
Print view View original

41–50 of 282 posts

Re: The Intel ME subsystem can take over your machine, can't be audited

#41

Post by mappu »

DiabloD3 wrote: post #40

I find people freaking out about this extremely strange. AMT is Intel's equivalent of IPMI. It is a non-standard implementation of it, and does not follow any of the relevant specifications. It does not integrate into most server management platforms. AMT costs extra. Most mobos do not have it enabled as you have to pay Intel's tax on it, even if some of the hardware to enable it is in every northbridge. A motherboar…

>Now, is the ME chip a threat? Possibly, not not as much as your cell phone's baseband modem is. The baseband modem can talk to outside networks, ME can't unless it is paired with a NIC it can talk to (Intel does not require mobos that have this; and generally, motherboards meant for AMT ship Intel NICs, but not always).

The last ~dozen regular (gigabyte/asus/asrock/...) desktop PC motherboards i've seen have all used intel NICs for ethernet.

Re: The Intel ME subsystem can take over your machine, can't be audited

#42

Post by keyme »

shmerl wrote: post #14

Why can't Intel implement proper security and open up this blob to begin with? Not opening it and not allowing to disable it, suggests it's intended for something sinister.

As stated in the article, some researchers have managed to unpack it, and it can now be dissembled.

You can't (and hpefully won't) be able to execute your own code there.

There are 2 good reasons for this:

1) As per the article, to actually prevent ring -3 malware. The implemented signature is the best way to do this. If we could run our own "libre" code there, so could the attacker.

2) I bet this firmware controlls stuff like wether your CPU is "really" a Core i3 or Core i7, how many cores are activated, etc. Basically, its reasonable to assume that the silicon is the same, but what you pay determines the actual "unlocked" performance.

Re: The Intel ME subsystem can take over your machine, can't be audited

#43

Post by stephengillie »

textmode wrote: post #17

Taking another angle: What if the computer's owner wants to use it to access her computer remotely? Are there some instructions how to do this? Is it feasible? If not, then there seems little justification to have a relatively new feature like this turned on by default. Who is this feature really for? If it's not for all users then why is activation mandatory in CPUs after Core2? I mean, if ME has to be active, then…

Enterprise console software is likely needed to interface with the chip. And this software is probably priced like most enterprise software.

Re: The Intel ME subsystem can take over your machine, can't be audited

#44

Post by mappu »

endgame wrote: post #33

Where can people go if they want a fully-libre machine and are willing to sacrifice x86?

https://libreboot.org/docs/hcl/

If you want to avoid the ME specifically, some other not-100%-libre options you might consider are the TALOS (high performance) or the ODROID C2 (low cost)

Re: The Intel ME subsystem can take over your machine, can't be audited

#46

Post by Illniyar »

zf00002 wrote: post #32
Illniyar wrote: post #27

Earlier quoted context omitted.

Maybe I'm missing something, is this chipset on the motherboard? The article makes it seem like its coupled with the cpu.

I don't know how its actually implemented, but normally to enable AMT you have to have both a compatible motherboard and processor. Intel calls it VPRO. Most desktop consumer boards do not have this feature, but quite a few of the i5 processors do.

Oh, so not very frieghtning then.

Re: The Intel ME subsystem can take over your machine, can't be audited

#47

Post by duncan_bayne »

keyme wrote: post #42
shmerl wrote: post #14

Why can't Intel implement proper security and open up this blob to begin with? Not opening it and not allowing to disable it, suggests it's intended for something sinister.

As stated in the article, some researchers have managed to unpack it, and it can now be dissembled. You can't (and hpefully won't) be able to execute your own code there. There are 2 good reasons for this: 1) As per the article, to actually prevent ring -3 malware. The implemented signature is the best way to do this. If we could run our own "libre" code there, so could the attacker. 2) I bet this firmware controlls…

> As per the article, to actually prevent ring -3 malware. The implemented signature is the best way to do this. If we could run our own "libre" code there, so could the attacker.

That's completely false; allowing the execution of libre software doesn't worsen security, and the security-by-obscurity model doesn't improve it.

Re: The Intel ME subsystem can take over your machine, can't be audited

#48

Post by [deleted] »

keyme wrote: post #42
shmerl wrote: post #14

Why can't Intel implement proper security and open up this blob to begin with? Not opening it and not allowing to disable it, suggests it's intended for something sinister.

As stated in the article, some researchers have managed to unpack it, and it can now be dissembled. You can't (and hpefully won't) be able to execute your own code there. There are 2 good reasons for this: 1) As per the article, to actually prevent ring -3 malware. The implemented signature is the best way to do this. If we could run our own "libre" code there, so could the attacker. 2) I bet this firmware controlls…

[deleted]

Re: The Intel ME subsystem can take over your machine, can't be audited

#49

Post by arca_vorago »

When it comes to hardware backdoors, one particular case seems to keep popping up in my mind, and that is Bill Hamilton of the infamous Inslaw/Promis octopus debacle. A few years ago when I was on Scheiers blog regular, he was claiming they had prearranged the backdoor installation at the silicon manufacturing level...

Something about that has never left my mind, and I suspect its generally correct. Heres hoping that power8 workstation Talos gets off the ground...or some risc equiv.

Re: The Intel ME subsystem can take over your machine, can't be audited

#50

Post by Dylan16807 »

paulmd wrote: post #22
digler999 wrote: post #20

No doubt various three-letter agencies are having a field-day with this right now. Hopefully a robin-hood type will reverse-engineer the blob and post a permanent fix to disable this thing before a more nefarious person/group uses it to devastate the PC landscape with something even worse than bitlocker.

It's impossible to "reverse-engineer" a cryptographic signature. Properly implemented (and you can bet that Intel has had time to finalize this) it's computationally insurmountable.

Not the signature, the payload. It's very complex. I guarantee there are bugs.
Post reply on HN