61–70 of 84 posts
Earlier quoted context omitted.
A privileged local user can provision AMT to its liking though, which is afaict what this malware did.
I posted it below already, but anyway as far as I personally understand to provision AMT you need it actually enabled in BIOS / EFI and it's in fact usually disabled by default. Am I missing something?
Earlier quoted context omitted.
SGX, if they allow arbitrary code to be signed, is amazing. It enables remote trust. You could execute jobs "in the cloud" without anyone being able to see your data. You could write a known-correct coin tumbler or trading platform. If it does only get locked to a few code authors, that would be a tremendous shame.
If Intel is the one source of ultimate trust, why not just run your secure whatever on Intel's servers? Seems a lot less complex than jumping through all these SGX hoops.
*then came uefi.
hoop-jumping never a problem with the i.t. market. more complexity is fine so long as managed by someone else. only the sales pitch needs to be simple.
why is it unfathomable that users could only trust themselves and other users? continual push toward more complexity helps keep users from ever believing this is achievable.
> Intel ME runs even when the main processor is powered off, and while this feature looks pretty shady, Intel built ME to provide remote administration capabilities to companies that manage large networks of thousands of computers. So they exposed millions of consumer and business computers in order to satisfy a niche enterprise usecase? Why is this not something that has to be manually turned on? Intel ME has always…
Earlier quoted context omitted.
Isn't it supposed to be enabled in BIOS in order to provision it? On most laptops and desktop motherboards such features simply disable by default like VT-d (IOMMU).
See this question on the Intel forums. Seems difficult to actually disable it. https://software.intel.com/en-us/forums/intel-business-clien...
Earlier quoted context omitted.
SGX, if they allow arbitrary code to be signed, is amazing. It enables remote trust. You could execute jobs "in the cloud" without anyone being able to see your data. You could write a known-correct coin tumbler or trading platform. If it does only get locked to a few code authors, that would be a tremendous shame.
Yeah it's will bring new amazing spyware and ransomware on millions of PCs.
Sure, it'd let you be a bit sloppier with randomware, not needing public key crypto to make it all work. Not really a huge deal.
It's surprising that everyone is up in arms about AMT and ME while not complaining in the slightest about SGX. SGX allows third parties to run code on your processor that is outside of your control. We're losing our computers to corporate interests. You are buying a device they can remotely manage, exert control with a higher privilege than yours, hide secrets inside your machine, and make all the decisions for you.…
> Intel ME runs even when the main processor is powered off, and while this feature looks pretty shady, Intel built ME to provide remote administration capabilities to companies that manage large networks of thousands of computers. So they exposed millions of consumer and business computers in order to satisfy a niche enterprise usecase? Why is this not something that has to be manually turned on? Intel ME has always…
It does have to be manually turned on.
It's surprising that everyone is up in arms about AMT and ME while not complaining in the slightest about SGX. SGX allows third parties to run code on your processor that is outside of your control. We're losing our computers to corporate interests. You are buying a device they can remotely manage, exert control with a higher privilege than yours, hide secrets inside your machine, and make all the decisions for you.…
SGX is the ultimate DRM. Once SGX programs talk directly to monitors that support some HDCP like protocol, it will be the end of ad/tracker blockers. Web pages will run in SGX land.
Aaaand I think this is the first public disclosure of malware using the Intel Management Engine / AMT's network connection (that uses SMBus, i talked about it here https://news.ycombinator.com/item?id=14309557 and gave links to appropriate datasheets). Welp. AMT/ME being used by malware created by well-resourced adversaries is no surprise, and is why Intel needed to give an irreversible and verifiable way of complete…
is why Intel needed to give an irreversible and verifiable way of completely disabling it. The article said it comes disabled by default. Isn't this a verifiable way, or is the article incorrect?
Another way that hasn't been verified since in theory the ARC controller could access other PCI devices anyway, is to install a new ethernet card in a free expansion slot and use that instead. AMT is supposedly only supported with a specific CPU, firmware, PCH and PHY combination. Breaking that chain by swapping one of those components with an unsupported one should work. If you simply don't use any of the AMT-enabled interfaces, it shouldn't be able to communicate at all. Best plug in a chopped off ethernet jack to make sure nobody plugs in a cable by mistake.
I believe there was a 802.11 variant as well, but that might have been before AMT and around the Centrino era. Best disconnect that as well...
Another round of crappy journalism. It's not obscure, it's not a CPU feature but a platform feature, and there are plenty of out-of-band communication channels out there, this isn't the only one. On top of that, this was already published two DEF CONs ago. You can exfil data and even do practival bi-directional communication over: SOL, IPMI, ASF, MT's ARC CPU via injected firmware and then via TCP/IP. Any of them wil…
Of these techs, which does AMD support? Would switching to AMD make us more secure?
That's not quite the right question: this is just standard use of a remote management feature which is disabled by default. If you enable any remote management service, which are extremely common on server class hardware and many enterprise desktop devices regardless of vendor, you have to take responsibility for securing the management features you enable.
The only real news would be if this was enabled by default or if the design didn't allow it to be secured.