Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The Intel ME subsystem can take over your machine, can't be audited

boingboing.net

Post reply on HN
Print view View original

181–190 of 282 posts

Re: The Intel ME subsystem can take over your machine, can't be audited

#181

Post by kuschku »

IshKebab wrote: post #90
Teever wrote: post #55

Earlier quoted context omitted.

> 1) As per the article, to actually prevent ring -3 malware. The implemented signature is the best way to do this. If we could run our own "libre" code there, so could the attacker. Why can't computers have physical switches that enable/disable writing the memory that this piece of software is located in?

That is actually slightly less secure - sometimes people do have physical access to your machines. For example, the NSA intercepted deliveries of switches and installed their malware on them. Would be easy if there is a physical switch. Not so easy if you need signed firmware (I'm sure the NSA could still do it, but it would definitely be harder).

The NSA could just produce their own chips, and put them onto your system.

Re: The Intel ME subsystem can take over your machine, can't be audited

#182

Post by kuschku »

johncolanduoni wrote: post #147
duncan_bayne wrote: post #47

Earlier quoted context omitted.

> As per the article, to actually prevent ring -3 malware. The implemented signature is the best way to do this. If we could run our own "libre" code there, so could the attacker. That's completely false; allowing the execution of libre software doesn't worsen security, and the security-by-obscurity model doesn't improve it.

> allowing the execution of libre software doesn't worsen security It does if I get temporary physical access to your machine and flash something that can spy on you, or if the method of flashing it can be done via your OS and I hack that. Those are two HUGE flaws.

If I have physical access, I can install malware in the firmware of your WiFi card, or I can replace the whole CPU with a malicious one.

Once physical access is gained, everything is over.

Re: The Intel ME subsystem can take over your machine, can't be audited

#183

Post by bArray »

SXX wrote: post #120
bArray wrote: post #113

My question is whether alternatives are secure, such as AMD or ARM? I imagine the ARM architecture to be too scrutinised and low power to get away with that sort of thing? Personally I want to buy a laptop that is secure due to travelling to questionable places, I am wondering now whether it will include an Intel CPU in light of this.

As mentioned in comments already they are both not secure: every new AMD CPU have ARM TrustZone core in it. For ARM I can't tell since there might be SOCs without TrustZone. Best usable hardware is old Intel laptops except you want something like MIPS laptop from Lemote.

Thanks, I'll check it out.

Re: The Intel ME subsystem can take over your machine, can't be audited

#184

Post by kuschku »

jacquesm wrote: post #122
SXX wrote: post #89

Earlier quoted context omitted.

That's not the case. ME code is large and not bundled inside CPU. On old systems it's was possible to not provide ME firmware while keep CPU operational. On modern systems it's will just poweroff every 30 minutes if ME firmware not present and this is why libreboot won't support any newer hardware.

> On modern systems it's will just poweroff every 30 minutes if ME firmware not present That's highly suggestive of a hidden agenda.

You can still turn ME into "manufacturing test mode", where it will not execute things.

But in that mode Intel Network Cards will poweroff every 3 minutes.

I wondered why my I219-V didn’t work, until I found it worked with ME in normal mode.

Now I’m back on a 2006 100M Realtek NIC

Re: The Intel ME subsystem can take over your machine, can't be audited

#185

Post by bArray »

lazyjones wrote: post #133
bArray wrote: post #113

My question is whether alternatives are secure, such as AMD or ARM? I imagine the ARM architecture to be too scrutinised and low power to get away with that sort of thing? Personally I want to buy a laptop that is secure due to travelling to questionable places, I am wondering now whether it will include an Intel CPU in light of this.

Possibly the Loongson 3B ( https://en.wikipedia.org/wiki/Loongson#Loongson_3B - MIPS64 with hardware-assisted x86 emulation) - but someone has to take a closer look and audit it first.

Looks promising, I'll keep my eye out for machines with this processor.

Re: The Intel ME subsystem can take over your machine, can't be audited

#186

Post by kevincox »

Dolores12 wrote: post #176
ferbivore wrote: post #104

Earlier quoted context omitted.

Who does this give reason to move to ARM? End-users generally don't have a choice (good luck running AutoCAD on ARM) and OEMs either don't seem to care or list ME as one of the selling points of their systems. You could make the case that this might convince people to use AMD CPUs, but from what I hear AMD has all the same issues with worse performance to boot.

I am pretty sure you can run VirtualBox on Linux. And you can run Linux on ARM.

But VirtualBox doesn't emulate different instructions sets, so you would have to run ARM windows inside of it and an ARM build of AutoCAD (which I don't believe exists).

Also I'm not sure that VirtualBox supports ARM at all.

Re: The Intel ME subsystem can take over your machine, can't be audited

#187

Post by oneplane »

While that article is correct, it's full of FUD with the constant littering of 'secret' and 'take over' in the text.

We already know about Igor's research and the published ARC CPU reverse engineering, "Ring -3" rootkits and the DEF CON presentations. This is bad, and this needs even more reverse engineering so at some point we might add an 'open' replacement for the required ME functions and run it together with say, LibreBoot/CoreBoot.

I wonder why there haven't been any NDA ME or ARC docs leaked yet, even some of the Broadcom SOCs had those leaked and via cleanroom design proper FOSS drivers for some of the wireless parts were created... this should be possible with the Intel ME as well. Hell, even a FOSS version or at least partially reverse engineered and modified version of laptop EC firmwares have popped up on the 'net.

Re: The Intel ME subsystem can take over your machine, can't be audited

#188

Post by whamlastxmas »

hugdru wrote: post #180

Oh my god it began with the oems installing a bunch of spyware on the default install. Many of which with vulnerabilities. Not to mention "modern" OSes not respecting users privacy. To make matters worse the hardware companies decided to follow suit and thus added unwanted and compromising features to everyday systems. Way to go! It seems I'll have to switch to stone age hardware just to have a little peace of mind.…

This has been in every Intel CPU since 2008

Re: The Intel ME subsystem can take over your machine, can't be audited

#189

Post by brudgers »

The thing about scale is that it doesn't look like ordinary individual experience. It ain't enough to run Core2/\Piledriver/\Power/\open source microcode: ME enabled computers are connected en masse to the network. The choices are air gap or head in the sand. ME was inside before Snowden.

Google, Facebook, Amazon, Ebay, Microsoft,, 百度 etc. buy Xeons by the bucketful. They're Intel's customers that matter. The retail box that comes with a fan for sale at NewEgg is just exhaust fumes. 42 or "It's the cloud": take your pick. Managing a gazillion server data center by hand just ain't practical.

Intel's customers that matter replace CPU assets on the IRS's three year depreciation schedule. It's why this [0] and why ME. Security by obscurity isn't so bad when dumping the vulnerable subsystem lowers overall costs for other reasons [performance boosts and lower power consumption].

ME is a good reason that Microsoft has been striving toward multiplatform. It no longer has such a big say in Intel's roadmap. Yes UEFI and the Windows 10 upgrade process kinda suck, but Microsoft ain't pwn'ing anyone's computer because Intel already pwn'd it. ME going sideways at scale would hurt and Microsoft would be the handy victim.

There's a strategic reason Apple is making it's own chips.

[0]: http://www.techspot.com/review/1155-affordable-dual-xeon-pc/

Re: The Intel ME subsystem can take over your machine, can't be audited

#190

Post by ssebastianj »

I wasn't aware about Intel ME until recently bought a brand new Lenovo ThinkPad and saw the "Intel Management Engine" on BIOS/UEFI boot menu.

The thing is: how can I configure this ME thing in order to avoid (or minimize, at least) possible attacks?

Post reply on HN