Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The Intel ME subsystem can take over your machine, can't be audited

boingboing.net

Post reply on HN
Print view View original

71–80 of 282 posts

Re: The Intel ME subsystem can take over your machine, can't be audited

#71

Post by nneonneo »

Igor Skochinsky (of IDA Hex-Rays fame, among others) has been studying Intel ME for quite some time. He gave a nice talk at Breakpoint summarizing what he'd discovered (slides here [pdf]: https://github.com/skochinsky/papers/blob/master/2014-10%20%...).

Among other things, he finds that ME is capable of running signed Java code which is pushed to the device. Due to the complexity and size of the Java code, it's quite likely to have bugs.

ME is a bit scary partly because it's a totally closed-source and proprietary component of your computer with full and essentially unfettered access to everything - RAM, peripherals, and network I/O. Any bug in a publicly-accessible component would have the potential to do serious damage. For example, a bug in the network stack might make it possible for attackers to remotely own your box.

Re: The Intel ME subsystem can take over your machine, can't be audited

#72

Post by khedoros »

cocomutator wrote: post #30

I still don't understand why this ME feature has been created to begin with. Assuming that breaking it is a matter of time (someone clever enough thinking about it for long enough), it seems like a serious security vulnerability, worse still because an attack is undetectable. Why create it in the first place? Are the enterprise uses the article mentions worth the risk?

The board needs vPro/AMT for things like remote access. If the board doesn't implement those things (and you'd usually know, because you pay more for them), the ME ends up doing...well, I'm not sure what. I think mostly things like enforcing DRM? Still, the machine needs special support on the motherboard and ethernet controller to enable the features that people are complaining the most about.

Re: The Intel ME subsystem can take over your machine, can't be audited

#73

Post by confounded »

captainmuon wrote: post #60

Very naively, I wonder what happens if you just call Intel and complain about this. Say you want a way to remove the ME completely. They won't help you, but I wonder how they will justify making it compulsory if pressed. Now if I call them, I wouldn't reach anybody important. But surely there are a couple of people on HN who are lawyers, CEOs, with the government etc.? If you have an imposing job and a few minutes to…

https://puri.sm/posts/petition-for-intel-to-release-an-me-le...

Re: The Intel ME subsystem can take over your machine, can't be audited

#75

Post by techdragon »

confounded wrote: post #73
captainmuon wrote: post #60

Very naively, I wonder what happens if you just call Intel and complain about this. Say you want a way to remove the ME completely. They won't help you, but I wonder how they will justify making it compulsory if pressed. Now if I call them, I wouldn't reach anybody important. But surely there are a couple of people on HN who are lawyers, CEOs, with the government etc.? If you have an imposing job and a few minutes to…

https://puri.sm/posts/petition-for-intel-to-release-an-me-le...

Another lame petition won't get the same kind of results as a well connected question. The PR department lives to shield a company from such negative external noise, a well connected question can surface inside the company and be heard by people with the capability to actually do things.

Re: The Intel ME subsystem can take over your machine, can't be audited

#76

Post by confounded »

I'm very surprised that no-one on HN has talked about their experiences of using AMT for enterprise IT management. Aside from the security problems, I've personally never encountered or seen it's use, which makes the ME's inclusion (on all chips, for about 6 years) seem like an odd decision from Intel.

Re: The Intel ME subsystem can take over your machine, can't be audited

#77

Post by rekado »

narrator wrote: post #38

Almost makes you want to get a Lemote Laptop like Richard Stallman.

You don't have to. Libreboot is available for some Thinkpads. I use an X200s. There are businesses that offer Libreboot flashing services or sell refurbished Laptops with Libreboot installed.

Re: The Intel ME subsystem can take over your machine, can't be audited

#78

Post by coderdude »

markokrajnc wrote: post #70

It may be, that Intel didn't plan this as an NSA/XYZ back door - but it doesn't actually matter. What matters is that we know 1) Intel has such technology implemented in allmost all desktops/servers currently running 2) you can access those machines remotely (even over GSM) and perform reads/writes. Example misuse: somebody can put illegal stuff on your machine and then sue you... (Intel has marketed this feature for…

They can remotely wipe my stolen machines? That's the one cool thing I've heard. How come I haven't received that email in my spam box? Poor marketing attempt if that's what they're aiming for. I'm not running a huge company but they could at least try targeting the SMB sector (I think I qualify for that). I'm against the ME vector up until it's actually useful to me.

P.S. fbi please don't hax0r me for commenting. Actually, go ahead, ya bastards.

Re: The Intel ME subsystem can take over your machine, can't be audited

#79

Post by SXX »

kriro wrote: post #66

Joanna Rutkowska has written a nice paper on the topic, highly recommended: http://blog.invisiblethings.org/papers/2015/x86_harmful.pdf Edit: There's also a talk from 32c3 for those more inclined to watch a video. I am pretty worried ever since I watched that: https://www.youtube.com/watch?v=rcwngbUrZNg (which is why I have researched non-Intel laptop alternatives..cliffnotes: GPUs without BLOBs are hard to find and…

  > GPUs without BLOBs are hard to find
Any devices without firmware are hard to find. Even if only some have option to upload firmware almost every device on market have closed-source firmware inside it: NICs, USB controllers, hard drives and especially modern SSD, sound cards, etc.

Re: The Intel ME subsystem can take over your machine, can't be audited

#80

Post by yoo1I »

rekado wrote: post #77
narrator wrote: post #38

Almost makes you want to get a Lemote Laptop like Richard Stallman.

You don't have to. Libreboot is available for some Thinkpads. I use an X200s. There are businesses that offer Libreboot flashing services or sell refurbished Laptops with Libreboot installed.

Except libreboot doesn't help. ME executes below BIOS/UEFI.
Post reply on HN