The Intel ME subsystem can take over your machine, can't be audited • Hacker News Board

Re: The Intel ME subsystem can take over your machine, can't be audited

#131

Post by Tepix » Thu, Jun 16, 2016, 9:57 AM UTC

keyme wrote: post #57

Teever wrote: post #55

Earlier quoted context omitted.

> 1) As per the article, to actually prevent ring -3 malware. The implemented signature is the best way to do this. If we could run our own "libre" code there, so could the attacker. Why can't computers have physical switches that enable/disable writing the memory that this piece of software is located in?

Good question. Why don't phones have physical switches on GPS and microphones? In this case, the RSA sig is still better, though. Imagine that anyone sitting between the Intel plant and your local computer parts supplier could flip the switch. It's a weak argument, I admit. There should be both protections at the same time.

There are phones that do have these switches.

Re: The Intel ME subsystem can take over your machine, can't be audited

#132

Post by sspiff » Thu, Jun 16, 2016, 9:57 AM UTC

Animats wrote: post #108

nneonneo wrote: post #71

Igor Skochinsky (of IDA Hex-Rays fame, among others) has been studying Intel ME for quite some time. He gave a nice talk at Breakpoint summarizing what he'd discovered (slides here [pdf]: https://github.com/skochinsky/papers/blob/master/2014-10%20%... ). Among other things, he finds that ME is capable of running signed Java code which is pushed to the device. Due to the complexity and size of the Java code, it's quit…

ME is capable of running signed Java code How much firmware is in the thing? Is there a whole JVM in there? An OS? That's a lot of attack surface.

It is most likely running a Java Card[0] environment, which is a special embedded fork of Java, with a different (more limited) bytecode format.

[0]: https://en.wikipedia.org/wiki/Java_Card

Re: The Intel ME subsystem can take over your machine, can't be audited

#133

Post by lazyjones » Thu, Jun 16, 2016, 9:57 AM UTC

bArray wrote: post #113

My question is whether alternatives are secure, such as AMD or ARM? I imagine the ARM architecture to be too scrutinised and low power to get away with that sort of thing? Personally I want to buy a laptop that is secure due to travelling to questionable places, I am wondering now whether it will include an Intel CPU in light of this.

Possibly the Loongson 3B (https://en.wikipedia.org/wiki/Loongson#Loongson_3B - MIPS64 with hardware-assisted x86 emulation) - but someone has to take a closer look and audit it first.

Re: The Intel ME subsystem can take over your machine, can't be audited

#134

Post by dingdingdang » Thu, Jun 16, 2016, 9:58 AM UTC

markokrajnc wrote: post #70

It may be, that Intel didn't plan this as an NSA/XYZ back door - but it doesn't actually matter. What matters is that we know 1) Intel has such technology implemented in allmost all desktops/servers currently running 2) you can access those machines remotely (even over GSM) and perform reads/writes. Example misuse: somebody can put illegal stuff on your machine and then sue you... (Intel has marketed this feature for…

>> you can access those machines remotely (even over GSM)

Is this really true? All modern Intel chips come with embedded mobile phone tech to allow remote access? Sources on this?

Re: The Intel ME subsystem can take over your machine, can't be audited

#135

Post by kukx » Thu, Jun 16, 2016, 9:59 AM UTC

kriro wrote: post #66

Joanna Rutkowska has written a nice paper on the topic, highly recommended: http://blog.invisiblethings.org/papers/2015/x86_harmful.pdf Edit: There's also a talk from 32c3 for those more inclined to watch a video. I am pretty worried ever since I watched that: https://www.youtube.com/watch?v=rcwngbUrZNg (which is why I have researched non-Intel laptop alternatives..cliffnotes: GPUs without BLOBs are hard to find and…

I like her summary of Intel ME:

"We have seen that Intel ME is potentially a very worrisome technology. We cannot know what’s really executing inside this co-processor, which is always on, and which has full access to our host system’s memory. Neither can we disable it.

If you think that this sounds like a bad joke, or a scene inspired by George Orwell’s work, dear reader, you might not be alone in your thinking..."

Re: The Intel ME subsystem can take over your machine, can't be audited

#136

Post by sspiff » Thu, Jun 16, 2016, 9:59 AM UTC

I knew about ME, but I didn't know it had an ARC processor in it. Odd that Intel didn't opt for an in-house design, like one of their older cores backported to a newer process. (like a P54 or 386).

Re: The Intel ME subsystem can take over your machine, can't be audited

#137

Post by vog » Thu, Jun 16, 2016, 10:01 AM UTC

kriro wrote: post #66

Joanna Rutkowska has written a nice paper on the topic, highly recommended: http://blog.invisiblethings.org/papers/2015/x86_harmful.pdf Edit: There's also a talk from 32c3 for those more inclined to watch a video. I am pretty worried ever since I watched that: https://www.youtube.com/watch?v=rcwngbUrZNg (which is why I have researched non-Intel laptop alternatives..cliffnotes: GPUs without BLOBs are hard to find and…

Note that the video is also available on media.ccc.de (this is the source, youtube is just a "bad" mirror):

https://media.ccc.de/v/32c3-7352-towards_reasonably_trustwor...

This is her corresponding blog post:

http://blog.invisiblethings.org/2015/12/23/state_harmful.htm...

Re: The Intel ME subsystem can take over your machine, can't be audited

#138

Post by sidhu1f » Thu, Jun 16, 2016, 10:07 AM UTC

DiabloD3 wrote: post #40

I find people freaking out about this extremely strange. AMT is Intel's equivalent of IPMI. It is a non-standard implementation of it, and does not follow any of the relevant specifications. It does not integrate into most server management platforms. AMT costs extra. Most mobos do not have it enabled as you have to pay Intel's tax on it, even if some of the hardware to enable it is in every northbridge. A motherboar…

Not exactly, ME even without AMT is scary[1].

[1]https://libreboot.org/faq/#intelme

Re: The Intel ME subsystem can take over your machine, can't be audited

#139

Post by Philipp__ » Thu, Jun 16, 2016, 10:10 AM UTC

And this is why monopoly of one giant monolith is bad, in any area or case! They get to the whatever the f they want! It's not like everything is made today to track, and give access to "authorities" when they want it. But what really drives me mad is that I feel tricked! You put trust into someone and it's work, and give them money for that, but they do this, without you even knowing.

I was always making fun of sworn GNU guys, always thought they were overblowing things out of the context. But maybe they were on the track! Anyhow, I want more competitive CPU space, we need AMD to get back into game, IBMs Power9, ARM, anything. But as things are standing right now, we won't see that anytime soon.

Re: The Intel ME subsystem can take over your machine, can't be audited

#140

Post by wolfgke » Thu, Jun 16, 2016, 10:21 AM UTC

SXX wrote: post #116

creshal wrote: post #114

Earlier quoted context omitted.

NICs exist, occasionally: Atheros Wifi chips work with open-source firmwares. And it shouldn't be too hard to find a GBit ethernet NIC without. Everything else is a lost cause right now. Keyboards, mice, displays, … Everything is running proprietary firmware blobs.

> And it shouldn't be too hard to find a GBit ethernet NIC without. Just wonder how exactly you going to check if hardware have firmware inside it.

The criterion by the FSF is: If you can't replace the firmware (by somethings free), but someone else is able to change the firmware, the firmware has to be considered as malware.