The Intel ME subsystem can take over your machine, can't be audited • Hacker News Board

Re: The Intel ME subsystem can take over your machine, can't be audited

#241

Post by EdSharkey » Thu, Jun 16, 2016, 7:53 PM UTC

The fact that the ME microcontroller can run arbitrary Java code, uploaded at runtime rather than read from ROM is pernicious. The intel private key can sign any blob, and ME would run it.

It makes me wonder, could an Java program uploaded to ME crash it or put it into an infinite loop? What would the effect be on the host OS if ME suddenly became unresponsive?

Perhaps a "Kill ME" binary could be developed as open source, and perhaps we could get Intel to sign it? If there was a strong enough request to Intel by consumers, why wouldn't they go ahead and sign it for us? No skin of their noses what we do with our consumer-grade boxes, right?

Re: The Intel ME subsystem can take over your machine, can't be audited

#242

Post by xlayn » Thu, Jun 16, 2016, 8:03 PM UTC

I would use thunderbolt as it has DMA, create a CRC/F(x) cpu (external unit connected thru thunderbolt) that converts/encrypt code/data to a expected format by modified code generated by a compiler. making act the intel cpu as surrogate to it, delegating control to the CRC/F(x) cpu.

Extra points, make all the cpus work, and create extra tasks to run at the non used cpus to obscure the actual process running (yeah I know it's not energy efficient but someones has to give Intel inspiration to improve).

Re: The Intel ME subsystem can take over your machine, can't be audited

#243

Post by seanp2k2 » Thu, Jun 16, 2016, 8:12 PM UTC

snsr wrote: post #240

qb45 wrote: post #192

Earlier quoted context omitted.

This cruft doesn't need three letter agencies to exist. Big customers pay for it so it's done. Once it's done, it's easier to leave it there and soft-disable for people who haven't paid for it than to actually build two versions of the chip, with and without this feature. However, speaking of spooks, I heard rumors that either Intel AMT or BIOS or some drivers (don't remember which exactly) is sold to the Chinese mar…

Any links re: Chinese requirements or hardware with nerfed crypto?

It'd be interesting to start buying these un-un-cripple-able CPUs for use domestically, for increased security and maximum irony.

Re: The Intel ME subsystem can take over your machine, can't be audited

#244

Post by danudey » Thu, Jun 16, 2016, 8:16 PM UTC

userbinator wrote: post #167

nneonneo wrote: post #71

Igor Skochinsky (of IDA Hex-Rays fame, among others) has been studying Intel ME for quite some time. He gave a nice talk at Breakpoint summarizing what he'd discovered (slides here [pdf]: https://github.com/skochinsky/papers/blob/master/2014-10%20%... ). Among other things, he finds that ME is capable of running signed Java code which is pushed to the device. Due to the complexity and size of the Java code, it's quit…

"3 billion devices run Java" indeed.

47% of them intentionally!

Re: The Intel ME subsystem can take over your machine, can't be audited

#245

Post by arca_vorago » Thu, Jun 16, 2016, 8:19 PM UTC

nitrogen wrote: post #224

arca_vorago wrote: post #49

When it comes to hardware backdoors, one particular case seems to keep popping up in my mind, and that is Bill Hamilton of the infamous Inslaw/Promis octopus debacle. A few years ago when I was on Scheiers blog regular, he was claiming they had prearranged the backdoor installation at the silicon manufacturing level... Something about that has never left my mind, and I suspect its generally correct. Heres hoping that…

Is this the company you are referencing? https://en.wikipedia.org/wiki/Inslaw

Indeed it is.

Re: The Intel ME subsystem can take over your machine, can't be audited

#246

Post by lordcorusa » Thu, Jun 16, 2016, 8:25 PM UTC

SkyMarshal wrote: post #234

Santosh83 wrote: post #208

Earlier quoted context omitted.

This is simply a barrier of resources and technology. Let's consider how software became "free". An idealist, an university and a motivated Finnish student, among many others, were able to create two complete, free operating systems and toolchains, on top of which anybody and everybody in the world could build. Now free software is a resounding reality and even increasingly adopted by large corps who were 100% closed…

You're right that the barrier to open hardware is very high, but I hope that open firmware may at least help mitigate, if not solve, this problem. Buy a machine with ME-like hardware, flash the firmware with something open source and trusted and which disables ME, or returns control to the system owner.

ME operates above typical UEFI firmware. ME updates must be signed by Intel and Intel alone.

Re: The Intel ME subsystem can take over your machine, can't be audited

#247

Post by redtuesday » Thu, Jun 16, 2016, 8:26 PM UTC

Philipp__ wrote: post #139

And this is why monopoly of one giant monolith is bad, in any area or case! They get to the whatever the f they want! It's not like everything is made today to track, and give access to "authorities" when they want it. But what really drives me mad is that I feel tricked! You put trust into someone and it's work, and give them money for that, but they do this, without you even knowing. I was always making fun of swor…

That's why I like the initiative to revive the SuperH architecture now that the patents have run out - completely as open source. [1][2] Sure they are not fast enough to replace Intel or AMD CPU's but they could replace the smaller chips in our computers, which would be a good start.

[1] http://0pf.org/j-core.html [2] https://www.youtube.com/watch?v=lZGHbMS882w

Re: The Intel ME subsystem can take over your machine, can't be audited

#248

Post by Animats » Thu, Jun 16, 2016, 8:30 PM UTC

aruggirello wrote: post #158

Animats wrote: post #39

The real question is what the firmware can be convinced to do remotely. Probably most of the things in here.[1] Remote management is supposed to be listening on TCP ports TCP 623 for HTTP and 664 for HTTPS. [1] http://www.dmtf.org/sites/default/files/standards/documents/...

Are you suggesting that detecting if your system is exposed to remote control is as easy as checking to see if your machine appears to have such ports open? And would the ports appear to be open if checked from the same machine?

Unclear. There are issues such as what IP address the ME is using. IP addresses are an OS level thing, and the ME is below that. Ethernet controllers don't know about IP addresses. The ME has the ability to make DHCP requests, so it can get an IP address of its own.[1]

The real question is what the ME does in addition to what it is documented to do.

[1] https://software.intel.com/sites/manageability/AMT_Implement...

Re: The Intel ME subsystem can take over your machine, can't be audited

#249

Post by akavel » Thu, Jun 16, 2016, 9:04 PM UTC

Santosh83 wrote: post #208

throw2016 wrote: post #162

This adds a whole new dimension to 'Intel Inside'. It says exactly what anyone needs to know. If it's for enterprise features as 'innocently' suggested that those who do not need or want this feature should be able to put it off simply without drama, debate or discussion. Its not surprising that both AMD and ARM have it. This is an orchestrated effort signifying the win of paranoia and security over privacy in the we…

This is simply a barrier of resources and technology. Let's consider how software became "free". An idealist, an university and a motivated Finnish student, among many others, were able to create two complete, free operating systems and toolchains, on top of which anybody and everybody in the world could build. Now free software is a resounding reality and even increasingly adopted by large corps who were 100% closed…

Aren't FPGAs a possible solution?

Re: The Intel ME subsystem can take over your machine, can't be audited

#250

Post by kuschku » Thu, Jun 16, 2016, 9:13 PM UTC

etatoby wrote: post #237

kuschku wrote: post #184

Earlier quoted context omitted.

You can still turn ME into "manufacturing test mode", where it will not execute things. But in that mode Intel Network Cards will poweroff every 3 minutes. I wondered why my I219-V didn’t work, until I found it worked with ME in normal mode. Now I’m back on a 2006 100M Realtek NIC

> in that mode Intel Network Cards will poweroff every 3 minutes This is ridiculous. This is not a rootkit waiting to happen, it's already an operational rootkit! What is this company trying to achieve? Is this a military asset designed to attack foreign countries? Is the Cold War not over?

And, even worse, why is there not yet a startup competing with Intel in the desktop market?

Are fabs the issues? Knowledge? Engineers? I mean, Uber got many billions in funding, with Ubers funding one could build easily a fab for 14nm process and hire all of AMD.