131–140 of 195 posts
Since the monitor is external, I wonder if they've considered monitors as attack surface: https://github.com/RedBalloonShenanigans/MonitorDarkly
Since the monitor is external, I wonder if they've considered monitors as attack surface: https://github.com/RedBalloonShenanigans/MonitorDarkly
This is an example of someone reprogramming the monitor, not using a monitor to attack the computer that it's connected to the video-out of. I'm not clear if there's an attack against the ORWL itself you have in mind here.
Earlier quoted context omitted.
In order for the Management Engine to really do much, you need to have a network card that the management engine knows how to talk to. If you don't have such a network interface, the ME can't do all that much, and any adverse security risks are near zero. Add to that things like the firmware write line being controlled by a completely separate microcontroller, and the big things that are discussed are completely infe…
In order for the Management Engine to really do much, you... ...have to trust Intel's publicly available documentation. In other words, this has to be taken on pure faith that it does exactly what they say it does in exactly the way they say it does it, and no more. The problem with ME is that it consists of unauditable code that could be doing literally anything on the computer, completely transparent to the user. F…
Now this is really cool! Though as with all things wireless I'd worry about working and somehow the key fob getting interfered with and boom computer locks up or if a sensor thinks I'm moving the computer when it's really just an Earth quake or maybe even my cat jumping on the table and then the encryption key is deleted. So I love the idea but not sure of the practicality. Those sensors has to essentially work perfe…
The SSD encryption key will only be deleted in case of a tamper event, NOT when the unit is moved. Tamper events are: * freezing the unit * drilling the secure enclosure or other wise breaking the traces on it * prying the enclosure off the PCB So I don't think you have to be too worried about a false trigger of a key erasing.
Isn't the phrase Evil Maid a bit off-key? I'm sure this must have been discussed at great length elsewhere. We could express the same idea without the power and gender relations implied.
It's the common name of the attack that people get. So it's useful whether PC types, who are a tiny minority of many audiences, like it or not. I'm not sure how "Evil Maid" label was derived. I do know from espionage reading that the most common form of the attack came from maids in hotels of business or government people passing through. Janitors and maintenance types, too, but they were in a trusted, protected buil…
If you haven't heard the phrase before it sounds weird, I do understand it's not intended maliciously.
I don't think I'd use the term without quotes in my own writing.
Earlier quoted context omitted.
In order for the Management Engine to really do much, you... ...have to trust Intel's publicly available documentation. In other words, this has to be taken on pure faith that it does exactly what they say it does in exactly the way they say it does it, and no more. The problem with ME is that it consists of unauditable code that could be doing literally anything on the computer, completely transparent to the user. F…
Interdiction could happen with open source hardware too. Swipe the SoC, and no one would be the wiser. Given everything that has to be in place for vPro/the ME to work, looking at the pcb would give enough information to tell exactly how much, if any, information it could steal, if all the malicious items were in place. All of which could be easily undone by reflashing it, because the write line on the bios is not co…
It would have to get swiped on the way from the manufacturer to the OEM. Once the OEM has sent it out, it's protected against this exact kind of attack. And while it may make sense for interdiction of a single package to a known target, doing the same with an entire batch of chips seems prohibitively expensive.
>Given everything that has to be in place for vPro/the ME to work
Again, per Intel's documentation. For all anyone here knows, data exfil begins the moment a certain sequence of bits crosses the right registers - and it's not like this is beyond the capabilities of what ME lets you do.
There is no good reason that the entire subsystem can't be disabled by the user, permanently. But, come to find out about it, the chips are configured to shut the system down within 30 minutes if the ME firmware doesn't pass checksum.
That, in my mind, puts it uncomfortably close to malware territory. Every one of these concerns evaporate if the ME area could be wiped or dumped - it's not as if remote management is some secret competitive advantage.
Earlier quoted context omitted.
It's the common name of the attack that people get. So it's useful whether PC types, who are a tiny minority of many audiences, like it or not. I'm not sure how "Evil Maid" label was derived. I do know from espionage reading that the most common form of the attack came from maids in hotels of business or government people passing through. Janitors and maintenance types, too, but they were in a trusted, protected buil…
DSK conspiracy theories are a fun example of French intelligence services in hotels. Certainly, the phrase has a titillating James Bond aspect to it. If you haven't heard the phrase before it sounds weird, I do understand it's not intended maliciously. I don't think I'd use the term without quotes in my own writing.
Earlier quoted context omitted.
Correction. The temperature monitor is INSIDE the secure shell.
He's talking about display monitors AKA the screens which can be exploited via the i2c bus over the graphical interface (e.g. HDMI). The GP is 100% correct, if you can't trust your keyboard, mouse, and the monitor the "secure computer" concept in this case is problematic, while it does reduce the attack surface somewhat it just focuses the attention of the adversary onto a different vector. If we take their "cleaning…
Earlier quoted context omitted.
This is an example of someone reprogramming the monitor, not using a monitor to attack the computer that it's connected to the video-out of. I'm not clear if there's an attack against the ORWL itself you have in mind here.
Once you reprogram the monitor, you can store or exfiltrate all of the data the user sees, and do clever things like erase and redraw the mouse pointer, or draw new prompts, to induce the user to click on the things they wouldn't have otherwise.