Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The Intel ME subsystem can take over your machine, can't be audited

boingboing.net

Post reply on HN
Print view View original

121–130 of 282 posts

Re: The Intel ME subsystem can take over your machine, can't be audited

#121

Post by creshal »

SXX wrote: post #116
creshal wrote: post #114

Earlier quoted context omitted.

NICs exist, occasionally: Atheros Wifi chips work with open-source firmwares. And it shouldn't be too hard to find a GBit ethernet NIC without. Everything else is a lost cause right now. Keyboards, mice, displays, … Everything is running proprietary firmware blobs.

> And it shouldn't be too hard to find a GBit ethernet NIC without. Just wonder how exactly you going to check if hardware have firmware inside it.

Good point. Usually the criterion is "can we send it a firmware blob? Can we send it an open-source firmware blob?". If you have a firmware that can't be replaced at all, it's usually handwaved away.

Re: The Intel ME subsystem can take over your machine, can't be audited

#122

Post by jacquesm »

SXX wrote: post #89
yoo1I wrote: post #80

Earlier quoted context omitted.

Except libreboot doesn't help. ME executes below BIOS/UEFI.

That's not the case. ME code is large and not bundled inside CPU. On old systems it's was possible to not provide ME firmware while keep CPU operational. On modern systems it's will just poweroff every 30 minutes if ME firmware not present and this is why libreboot won't support any newer hardware.

> On modern systems it's will just poweroff every 30 minutes if ME firmware not present

That's highly suggestive of a hidden agenda.

Re: The Intel ME subsystem can take over your machine, can't be audited

#123

Post by endgame »

kriro wrote: post #67
endgame wrote: post #33

Where can people go if they want a fully-libre machine and are willing to sacrifice x86?

Pi-top like laptop with your choice of pi3 or BeagleBone running Linux. The performance of a pi3 is actually decent. It's not perfect as there's a GPU BLOB in the pi3 and the BB also has some issue. It's my compromise for now, hoping the blob will be reversed/replaced eventually. Or anything that runs libreboot: https://libreboot.org/docs/hcl/ If OpenBSD runs on it that's also a good sign usually as they won't touch…

I do actually on a Pi3, so that's an encouraging piece of info. A GPU blob is at least a step up from the ring-negative-3 management engine.

Re: The Intel ME subsystem can take over your machine, can't be audited

#124

Post by endgame »

badsock wrote: post #65
endgame wrote: post #33

Where can people go if they want a fully-libre machine and are willing to sacrifice x86?

https://www.raptorengineering.com/TALOS/prerelease.php It's quite expensive, and prerelease, but from what I heard it fits the bill.

Outside of my price range but worth keeping an eye on. Thanks.

Re: The Intel ME subsystem can take over your machine, can't be audited

#125

Post by throwaway2048 »

kriro wrote: post #67
endgame wrote: post #33

Where can people go if they want a fully-libre machine and are willing to sacrifice x86?

Pi-top like laptop with your choice of pi3 or BeagleBone running Linux. The performance of a pi3 is actually decent. It's not perfect as there's a GPU BLOB in the pi3 and the BB also has some issue. It's my compromise for now, hoping the blob will be reversed/replaced eventually. Or anything that runs libreboot: https://libreboot.org/docs/hcl/ If OpenBSD runs on it that's also a good sign usually as they won't touch…

rpis have even more blobs to initalize the hardware than x86/intel

Re: The Intel ME subsystem can take over your machine, can't be audited

#126

Post by SXX »

creshal wrote: post #121
SXX wrote: post #116

Earlier quoted context omitted.

> And it shouldn't be too hard to find a GBit ethernet NIC without. Just wonder how exactly you going to check if hardware have firmware inside it.

Good point. Usually the criterion is "can we send it a firmware blob? Can we send it an open-source firmware blob?". If you have a firmware that can't be replaced at all, it's usually handwaved away.

This is main point of many developers we can speak with in public like AMD Linux graphics team. There is a lot of people who blame them for proprietary firmware, but in same time totally okay about using tons of devices that simply not expose way to replace their firmware.

Re: The Intel ME subsystem can take over your machine, can't be audited

#127

Post by nl »

captainmuon wrote: post #60

Very naively, I wonder what happens if you just call Intel and complain about this. Say you want a way to remove the ME completely. They won't help you, but I wonder how they will justify making it compulsory if pressed. Now if I call them, I wouldn't reach anybody important. But surely there are a couple of people on HN who are lawyers, CEOs, with the government etc.? If you have an imposing job and a few minutes to…

There are plenty of reasons why this is useful. See slides 7 and 8 from http://www.slideshare.net/codeblue_jp/igor-skochinsky-enpub

If this functionality is a good trade-off is a different question.

Re: The Intel ME subsystem can take over your machine, can't be audited

#128

Post by zeta0134 »

joe_the_user wrote: post #96
Dylan16807 wrote: post #50

Earlier quoted context omitted.

Not the signature, the payload. It's very complex. I guarantee there are bugs.

Indeed, the blob can be reverse engineered. Even more, an unbreakable signature can have it's private key stolen by hacking, by agencies inserting personnel into the companies, by agencies blackmailing key personnel and by agencies compelling the companies legally or ex-legally to hand them their keys.

Really, if someone has gone to the trouble of working out an exploit for Intel ME, the most ironic thing they could pull off would be to use that very exploit against Intel's own systems to steal their key, use it to patch the bugs, and release the patch to the world.

Re: The Intel ME subsystem can take over your machine, can't be audited

#129

Post by qb45 »

creshal wrote: post #114
SXX wrote: post #79

Earlier quoted context omitted.

> GPUs without BLOBs are hard to find Any devices without firmware are hard to find. Even if only some have option to upload firmware almost every device on market have closed-source firmware inside it: NICs, USB controllers, hard drives and especially modern SSD, sound cards, etc.

NICs exist, occasionally: Atheros Wifi chips work with open-source firmwares. And it shouldn't be too hard to find a GBit ethernet NIC without. Everything else is a lost cause right now. Keyboards, mice, displays, … Everything is running proprietary firmware blobs.

> Atheros Wifi chips work with open-source firmwares.

Interesting. Isn't such firmware able to initiate unlawful transmissions? How are they going to deal with this new FCC goodness?

Re: The Intel ME subsystem can take over your machine, can't be audited

#130

Post by Tepix »

creshal wrote: post #114
SXX wrote: post #79

Earlier quoted context omitted.

> GPUs without BLOBs are hard to find Any devices without firmware are hard to find. Even if only some have option to upload firmware almost every device on market have closed-source firmware inside it: NICs, USB controllers, hard drives and especially modern SSD, sound cards, etc.

NICs exist, occasionally: Atheros Wifi chips work with open-source firmwares. And it shouldn't be too hard to find a GBit ethernet NIC without. Everything else is a lost cause right now. Keyboards, mice, displays, … Everything is running proprietary firmware blobs.

The upcoming Keyboardio model 01 has an open source firmware, you can dive in at https://github.com/keyboardio/KeyboardioFirmware
Post reply on HN