Has anyone on here actually used this at work?
The Intel ME subsystem can take over your machine, can't be audited
91–100 of 282 posts
Re: The Intel ME subsystem can take over your machine, can't be audited
#92I think this is time for AMD or IBM's POWER8/9 to step in. If anything a little good PR vis-a-vis the "rootkit nightmare waiting to happen in your server" would be nice.
If you don't need high-end single-thread performance, RISC-V will help.
Re: The Intel ME subsystem can take over your machine, can't be audited
#93I find people freaking out about this extremely strange. AMT is Intel's equivalent of IPMI. It is a non-standard implementation of it, and does not follow any of the relevant specifications. It does not integrate into most server management platforms. AMT costs extra. Most mobos do not have it enabled as you have to pay Intel's tax on it, even if some of the hardware to enable it is in every northbridge. A motherboar…
Re: The Intel ME subsystem can take over your machine, can't be audited
#94Where can people go if they want a fully-libre machine and are willing to sacrifice x86?
Wait for RISC-V/lowRISC or j-core/J4:
Re: The Intel ME subsystem can take over your machine, can't be audited
#95Serious question: are AMD chips a viable alternative (from a security standpoint)? I hear their new Zen chips are coming soon.
AMD PSP don't have access to the network (as far as I know).
Source on that? If nobody prove it's have access to all system memory that doesn't mean PSP don't have these access. Otherwise it's will have at least MMIO-based access to the network controllers.
Re: The Intel ME subsystem can take over your machine, can't be audited
#96Earlier quoted context omitted.
It's impossible to "reverse-engineer" a cryptographic signature. Properly implemented (and you can bet that Intel has had time to finalize this) it's computationally insurmountable.
Not the signature, the payload. It's very complex. I guarantee there are bugs.
Indeed, the blob can be reverse engineered.
Even more, an unbreakable signature can have it's private key stolen by hacking, by agencies inserting personnel into the companies, by agencies blackmailing key personnel and by agencies compelling the companies legally or ex-legally to hand them their keys.
Re: The Intel ME subsystem can take over your machine, can't be audited
#97Strange that Intel gives people more reason to go to other processors like ARM when Intel is under such pressure from competition.
Re: The Intel ME subsystem can take over your machine, can't be audited
#98Can someone tell me if people have actually spotted the Intel ME doing unauthorized communication?
I imagine it should be easy to spot in any network firewall log (note I said network, not OS), and in reality, if it's never been observed to communicate with the outside world without explicitly being told to then do people really need to worry?
Re: The Intel ME subsystem can take over your machine, can't be audited
#99Igor Skochinsky (of IDA Hex-Rays fame, among others) has been studying Intel ME for quite some time. He gave a nice talk at Breakpoint summarizing what he'd discovered (slides here [pdf]: https://github.com/skochinsky/papers/blob/master/2014-10%20%... ). Among other things, he finds that ME is capable of running signed Java code which is pushed to the device. Due to the complexity and size of the Java code, it's quit…
Very interesting presentation. Is the video available? I had no luck with the standard searches.
http://2014.ruxconbreakpoint.com/speakers/#Igor%20Skochinsky
Re: The Intel ME subsystem can take over your machine, can't be audited
#100Why can't Intel implement proper security and open up this blob to begin with? Not opening it and not allowing to disable it, suggests it's intended for something sinister.
As stated in the article, some researchers have managed to unpack it, and it can now be dissembled. You can't (and hpefully won't) be able to execute your own code there. There are 2 good reasons for this: 1) As per the article, to actually prevent ring -3 malware. The implemented signature is the best way to do this. If we could run our own "libre" code there, so could the attacker. 2) I bet this firmware controlls…
"You can't (and hpefully won't) be able to execute your own code there."
You don't have to beat the encryption scheme to executed code. You just need to jail break the signed code. If the code is complex there will be bugs and likely security holes. One sufficiently wide hole is all it takes to jail break a system.
edit: This is an example of breaking in to a jail rather than out of one.