Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The Intel ME subsystem can take over your machine, can't be audited

boingboing.net

Post reply on HN
Print view View original

231–240 of 282 posts

Re: The Intel ME subsystem can take over your machine, can't be audited

#231

Post by Natanael_L »

jug wrote: post #149
Philipp__ wrote: post #139

And this is why monopoly of one giant monolith is bad, in any area or case! They get to the whatever the f they want! It's not like everything is made today to track, and give access to "authorities" when they want it. But what really drives me mad is that I feel tricked! You put trust into someone and it's work, and give them money for that, but they do this, without you even knowing. I was always making fun of swor…

I think AMD and ARM have similar features though. ARM with TrustZone for example, hiding the "secure world" from knowledge by the "normal world".

At least you have the option to get an ARM SoC where you're the one in control, see the USB Armory.

Re: The Intel ME subsystem can take over your machine, can't be audited

#232

Post by therealjumbo »

ferbivore wrote: post #104
hoodoof wrote: post #97

Strange that Intel gives people more reason to go to other processors like ARM when Intel is under such pressure from competition.

Who does this give reason to move to ARM? End-users generally don't have a choice (good luck running AutoCAD on ARM) and OEMs either don't seem to care or list ME as one of the selling points of their systems. You could make the case that this might convince people to use AMD CPUs, but from what I hear AMD has all the same issues with worse performance to boot.

>AMD has all the same issues with worse performance to boot.

AMD chips aren't just slower to boot, they're slower overall!

Re: The Intel ME subsystem can take over your machine, can't be audited

#233

Post by Natanael_L »

Philipp__ wrote: post #153
jug wrote: post #149

Earlier quoted context omitted.

I think AMD and ARM have similar features though. ARM with TrustZone for example, hiding the "secure world" from knowledge by the "normal world".

Yeah I thought so, but I hoped competition would make things different, where one of leaders would go like full transparent, without these "spy" sectors, and it would give it edge over others. And it's not about securing, it's about control! Who owns the thing I bought, that I use. It's not only they can watch, but now they can control whole computer. That's what bugs me the most. :(

See the USB Armory, which gives you the keys to control the TrustZone system (or rather, you give your public key to it so that it will only run code YOU signed).

Re: The Intel ME subsystem can take over your machine, can't be audited

#234

Post by SkyMarshal »

Santosh83 wrote: post #208
throw2016 wrote: post #162

This adds a whole new dimension to 'Intel Inside'. It says exactly what anyone needs to know. If it's for enterprise features as 'innocently' suggested that those who do not need or want this feature should be able to put it off simply without drama, debate or discussion. Its not surprising that both AMD and ARM have it. This is an orchestrated effort signifying the win of paranoia and security over privacy in the we…

This is simply a barrier of resources and technology. Let's consider how software became "free". An idealist, an university and a motivated Finnish student, among many others, were able to create two complete, free operating systems and toolchains, on top of which anybody and everybody in the world could build. Now free software is a resounding reality and even increasingly adopted by large corps who were 100% closed…

You're right that the barrier to open hardware is very high, but I hope that open firmware may at least help mitigate, if not solve, this problem. Buy a machine with ME-like hardware, flash the firmware with something open source and trusted and which disables ME, or returns control to the system owner.

Re: The Intel ME subsystem can take over your machine, can't be audited

#235

Post by Someone »

wolfgke wrote: post #140
SXX wrote: post #116

Earlier quoted context omitted.

> And it shouldn't be too hard to find a GBit ethernet NIC without. Just wonder how exactly you going to check if hardware have firmware inside it.

The criterion by the FSF is: If you can't replace the firmware (by somethings free), but someone else is able to change the firmware, the firmware has to be considered as malware.

But how do you know? Even if you can flash new firmware, how do you know it is all the firmware? There may be a layer below what you can see, with its own CPU, memory, and firmware.

Re: The Intel ME subsystem can take over your machine, can't be audited

#236

Post by etatoby »

jacquesm wrote: post #122
SXX wrote: post #89

Earlier quoted context omitted.

That's not the case. ME code is large and not bundled inside CPU. On old systems it's was possible to not provide ME firmware while keep CPU operational. On modern systems it's will just poweroff every 30 minutes if ME firmware not present and this is why libreboot won't support any newer hardware.

> On modern systems it's will just poweroff every 30 minutes if ME firmware not present That's highly suggestive of a hidden agenda.

Yes. What on earth would be the non-malicious purpose of this feature?

Re: The Intel ME subsystem can take over your machine, can't be audited

#237

Post by etatoby »

kuschku wrote: post #184
jacquesm wrote: post #122

Earlier quoted context omitted.

> On modern systems it's will just poweroff every 30 minutes if ME firmware not present That's highly suggestive of a hidden agenda.

You can still turn ME into "manufacturing test mode", where it will not execute things. But in that mode Intel Network Cards will poweroff every 3 minutes. I wondered why my I219-V didn’t work, until I found it worked with ME in normal mode. Now I’m back on a 2006 100M Realtek NIC

> in that mode Intel Network Cards will poweroff every 3 minutes

This is ridiculous. This is not a rootkit waiting to happen, it's already an operational rootkit!

What is this company trying to achieve? Is this a military asset designed to attack foreign countries? Is the Cold War not over?

Re: The Intel ME subsystem can take over your machine, can't be audited

#239

Post by slasaus »

FWIW, there is a petition for Intel to release an ME-less CPU design: https://puri.sm/posts/petition-for-intel-to-release-an-me-le...

(as mentioned in a comparable thread five days ago: "Intel and ME, and why we should get rid of ME" (fsf.org) https://news.ycombinator.com/item?id=11880935)

Re: The Intel ME subsystem can take over your machine, can't be audited

#240

Post by snsr »

qb45 wrote: post #192
throw2016 wrote: post #162

This adds a whole new dimension to 'Intel Inside'. It says exactly what anyone needs to know. If it's for enterprise features as 'innocently' suggested that those who do not need or want this feature should be able to put it off simply without drama, debate or discussion. Its not surprising that both AMD and ARM have it. This is an orchestrated effort signifying the win of paranoia and security over privacy in the we…

This cruft doesn't need three letter agencies to exist. Big customers pay for it so it's done. Once it's done, it's easier to leave it there and soft-disable for people who haven't paid for it than to actually build two versions of the chip, with and without this feature. However, speaking of spooks, I heard rumors that either Intel AMT or BIOS or some drivers (don't remember which exactly) is sold to the Chinese mar…

Any links re: Chinese requirements or hardware with nerfed crypto?
Post reply on HN