Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Disabling Intel ME 11 via undocumented mode

blog.ptsecurity.com

Post reply on HN
Print view View original

61–70 of 228 posts

Re: Disabling Intel ME 11 via undocumented mode

#61

Post by verall »

etatoby wrote: post #38
dmitrygr wrote: post #25

Earlier quoted context omitted.

You missed the point. It was added for people with big money. I promise you - it is supported. Just not for you. You need to be backdoorable. They don't

ME itself was added for people with big money. I'm not an engineer experienced in this kind of work, but I fail to see how a company whose core business is manufacturing chips would develop an entire computer (comprising an x86 CPU, its own RAM, MINIX OS, and access to all kinds of I/O) hidden inside each one of their chips and made largely inaccessible to regular users and developers. Unless they are paid very well…

This sort of microcontroller for bringup and/or power in a large processor/SoC is not surprising at all. Intel ME is used for large scale setup and provisioning of new machines and is probably worth every penny to their OEM customers.

I'm not saying that the NSA isn't possibly using it as a backdoor, but to say that the whole ME subsystem was created because they were paid off by the NSA is a bit far fetched.

Re: Disabling Intel ME 11 via undocumented mode

#62

Post by owenmarshall »

cyphar wrote: post #58
codedokode wrote: post #47

Earlier quoted context omitted.

It can be useful for other purposes too, for example for enforcing DRM so that DRM code runs on a ME engine. And of course DRM code can be backdoored too so playing a specially crafted video would run code from it.

Intel ME is not an effective DRM scheme. You need to be exceptionally careful when you mention DRM, because if it becomes commonly believed that Intel ME could be used to implement DRM all of a sudden the DMCA comes into play. Research into Intel ME vulnerabilities becomes a federal crime.

This isn't necessarily true: https://www.ftc.gov/news-events/blogs/techftc/2016/10/dmca-s...

Of the four criteria in the exemption, I wouldn't put it past the government trying to make the case that exposing a NSA spy program somehow falls afoul of good faith investigation - but the general view that "any DRM research is a crime" is no longer accurate.

Re: Disabling Intel ME 11 via undocumented mode

#63

Post by SXX »

baybal2 wrote: post #11
valarauca1 wrote: post #6

Earlier quoted context omitted.

If ME isn't a backdoor why did Russia and China start efforts to surplant Intel with locally sourced processors (even before US embargo'd Intel from china)

>even before US embargo'd Intel from china You can see how well this embargo works in every electronics mall

Still it does work. It's may not prevent foreign government for getting electronics, but it increase costs significantly and kill local commercial companies in that market.

Re: Disabling Intel ME 11 via undocumented mode

#64

Post by leeter »

valarauca1 wrote: post #6
codedokode wrote: post #4

If ME is not a backdoor then why doesn't Intel allow to disable it? Why don't they publish detailed descriptions? Why don't they allow user to run their programs on ME CPU?

If ME isn't a backdoor why did Russia and China start efforts to surplant Intel with locally sourced processors (even before US embargo'd Intel from china)

For the same reason the government requires chips made in the US for Classified uses. If a fab is in another country there is always the possibility that the design could be compromised. Even shipping chips internationally can cause this concern as the chips can be swapped out. This isn't exactly a new concept... Russia did this to the US embassy a long while back http://www.cryptomuseum.com/covert/bugs/selectric/

Re: Disabling Intel ME 11 via undocumented mode

#65

Post by monocasa »

equalunique wrote: post #28
valarauca1 wrote: post #19

Earlier quoted context omitted.

It isn't a blanket sanction, just against government and computing centers. The last 3 chinese super computers have used home grown FeiTeng RISC processors which were binary compatible to Itanium, but for new models their using OpenSPARC.

I wish there were OpenSPARC super computers in the US...

Ehh, SPARC was a great architecture for ancient process nodes, but doesn't really line up with today's needs IMO.

Re: Disabling Intel ME 11 via undocumented mode

#66

Post by yborg »

Impressive work on reverse engineering this.

Am I correct in assuming that since this backdoor chip has access to all of the peripheral I/O that it could even be used on a device with onboard wireless in "power off" mode, which is usually some kind of low-level sleep? So a compromise of this subsystem (or intentional backdoor) would allow one to take control of even a device that is "off". Given the trend to non-removable batteries, it might actually be impossible to prevent such an attack without physically destroying a laptop.

Re: Disabling Intel ME 11 via undocumented mode

#67

Post by the8472 »

cyphar wrote: post #58
codedokode wrote: post #47

Earlier quoted context omitted.

It can be useful for other purposes too, for example for enforcing DRM so that DRM code runs on a ME engine. And of course DRM code can be backdoored too so playing a specially crafted video would run code from it.

Intel ME is not an effective DRM scheme. You need to be exceptionally careful when you mention DRM, because if it becomes commonly believed that Intel ME could be used to implement DRM all of a sudden the DMCA comes into play. Research into Intel ME vulnerabilities becomes a federal crime.

> Intel ME is not an effective DRM scheme.

The PAVP module is part of the ME firmware. Which means the management engine is, among other things, a DRM implementation.

https://en.wikipedia.org/wiki/Intel_GMA#Protected_Audio_Vide...

https://recon.cx/2014/slides/Recon%202014%20Skochinsky.pdf (page 17)

Re: Disabling Intel ME 11 via undocumented mode

#68

Post by matt_wulfeck »

trhway wrote: post #54
discreditable wrote: post #7

TL;DR: Intel put a special High Assurance Platform (HAP) mode in ME for the US government. If toggled on, it disables all non-critical ME functionality. Questioned, Intel responded: > In response to requests from customers with specialized requirements we sometimes explore the modification or disabling of certain features. In this case, the modifications were made at the request of equipment manufacturers in support…

basically govt finally learned about ME (like VNC built into CPU) and said "what?! are you kidding!?" and on second breath - "keep it on for everybody else though!"

It's really not just the US government. I'm sure there are many other countries who demand such a feature.

Re: Disabling Intel ME 11 via undocumented mode

#70

Post by the8472 »

etatoby wrote: post #38
dmitrygr wrote: post #25

Earlier quoted context omitted.

You missed the point. It was added for people with big money. I promise you - it is supported. Just not for you. You need to be backdoorable. They don't

ME itself was added for people with big money. I'm not an engineer experienced in this kind of work, but I fail to see how a company whose core business is manufacturing chips would develop an entire computer (comprising an x86 CPU, its own RAM, MINIX OS, and access to all kinds of I/O) hidden inside each one of their chips and made largely inaccessible to regular users and developers. Unless they are paid very well…

> comprising an x86 CPU

The ME runs an Argonaut RISC Core instruction set and leverages a lot of the existing infrastructure in the system since it sits directly in the chipset and can ask the main CPU to do some things on its behalf too.

Post reply on HN