Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Disabling Intel ME 11 via undocumented mode

blog.ptsecurity.com

Post reply on HN
Print view View original

161–170 of 228 posts

Re: Disabling Intel ME 11 via undocumented mode

#161

Post by lsjdfkljdfwkwdf »

yzmtf2008 wrote: post #159
arca_vorago wrote: post #77

This is why I support Power/MIPS/RISC development going forward. It's just a shame that we allowed intel and amd to both put in cpu backdoors at such an obvious level (I like x86 but it's not the cpu of the future unless it's open). I highly suspect some national security letter type shit is going on in the background, ala Promis and William A. Hamilton who has claimed on Bruce Schneiers blog they (intel agencies) we…

I’m not sure where you got the idea that such things only exist on x86 and shame Intel and AMD for a feature that’s useful for many scenarios. Have you considered the fact that such features exist because there are actually many customers that want it? I was literally using the counterpart of ME on Power today. These tools are essential to many enterprise workloads, especially when you are in Boston and your data cen…

As I understand ME is not a prerequisite for IPMI?

Re: Disabling Intel ME 11 via undocumented mode

#162

Post by lsjdfkljdfwkwdf »

yellowapple wrote: post #145
cabalamat wrote: post #144

Earlier quoted context omitted.

As do all countries with any sense.

And sufficient money and other resources. I'm all for national governments making their own hardware not subject to backdoors installed by other national governments, but there's a huge difference in capability between Russia and, say, Lebanon.

You really have quite some faith in government, or defense contractors?

Re: Disabling Intel ME 11 via undocumented mode

#163

Post by goodplay »

yzmtf2008 wrote: post #159
arca_vorago wrote: post #77

This is why I support Power/MIPS/RISC development going forward. It's just a shame that we allowed intel and amd to both put in cpu backdoors at such an obvious level (I like x86 but it's not the cpu of the future unless it's open). I highly suspect some national security letter type shit is going on in the background, ala Promis and William A. Hamilton who has claimed on Bruce Schneiers blog they (intel agencies) we…

I’m not sure where you got the idea that such things only exist on x86 and shame Intel and AMD for a feature that’s useful for many scenarios. Have you considered the fact that such features exist because there are actually many customers that want it? I was literally using the counterpart of ME on Power today. These tools are essential to many enterprise workloads, especially when you are in Boston and your data cen…

Then let owners control whether it's enabled or not (by a hardware switch if necessary). As it currently stands, I can't imagine a benign reason that would drive intel and AMD to lock users out of their machines.

Re: Disabling Intel ME 11 via undocumented mode

#164

Post by zeep »

rrix2 wrote: post #119
rubatuga wrote: post #108

Earlier quoted context omitted.

Or remove the wifi chip?

don't forget the microphone, and the speakers (ultrasonic exfiltration) and the display (ISTR a fairly reproducable van eck attack in the last few years?) and the cpu (various research on elliptic curve extraction by monitoring CPU power draw using off the shelf SDR equipment)

We are pretty much screwed... the "smart" power meters can also probably "help".

Re: Disabling Intel ME 11 via undocumented mode

#165

Post by bri3d »

pantalaimon wrote: post #52
valarauca1 wrote: post #19

Earlier quoted context omitted.

It isn't a blanket sanction, just against government and computing centers. The last 3 chinese super computers have used home grown FeiTeng RISC processors which were binary compatible to Itanium, but for new models their using OpenSPARC.

> The last 3 chinese super computers have used home grown FeiTeng RISC processors which were binary compatible to Itanium, but for new models their using OpenSPARC. Where did you get that information? https://en.wikipedia.org/wiki/SW26010 doesn't claim any of that.

China's newest supercomputers are based on Sunway like you linked, but newer FeiTeng models (post-Itanium) were indeed OpenSPARC:

https://en.wikipedia.org/wiki/FeiTeng_(processor)

Re: Disabling Intel ME 11 via undocumented mode

#166

Post by feelin_googley »

userbinator wrote: post #113
arca_vorago wrote: post #77

This is why I support Power/MIPS/RISC development going forward. It's just a shame that we allowed intel and amd to both put in cpu backdoors at such an obvious level (I like x86 but it's not the cpu of the future unless it's open). I highly suspect some national security letter type shit is going on in the background, ala Promis and William A. Hamilton who has claimed on Bruce Schneiers blog they (intel agencies) we…

If some other CPU architecture were the dominant PC platform, do you think it wouldn't grow such features too? It's not hard to imagine an alternate universe in which we all have RISC workstations with the equivalent of ME, and Intel/AMD are the minorities who have more "open" CPUs without, but only because they hadn't grown enough. The underlying reason why ME became popular is the same reason why proprietary walled…

"... because they marketed it as for DRM/identification"

Scott McNealy, Sun Microsystems (1999): "You have zero privacy anyway. Get over it."

https://www.wired.com/1999/01/sun-on-privacy-get-over-it/

Re: Disabling Intel ME 11 via undocumented mode

#167

Post by blitmap »

arca_vorago wrote: post #77

This is why I support Power/MIPS/RISC development going forward. It's just a shame that we allowed intel and amd to both put in cpu backdoors at such an obvious level (I like x86 but it's not the cpu of the future unless it's open). I highly suspect some national security letter type shit is going on in the background, ala Promis and William A. Hamilton who has claimed on Bruce Schneiers blog they (intel agencies) we…

Speaking as a naive outside observer, I am excited with the rumors that Microsoft and Apple will be making a move toward ARM in the nearish future. I don't think ARM is the answer (dear god give us riscv) but I see it as a step in the right direction away from closed systems.

Re: Disabling Intel ME 11 via undocumented mode

#168

Post by therealjumbo »

goodplay wrote: post #163
yzmtf2008 wrote: post #159

Earlier quoted context omitted.

I’m not sure where you got the idea that such things only exist on x86 and shame Intel and AMD for a feature that’s useful for many scenarios. Have you considered the fact that such features exist because there are actually many customers that want it? I was literally using the counterpart of ME on Power today. These tools are essential to many enterprise workloads, especially when you are in Boston and your data cen…

Then let owners control whether it's enabled or not (by a hardware switch if necessary). As it currently stands, I can't imagine a benign reason that would drive intel and AMD to lock users out of their machines.

You can't think of any reason? Have you or do you work for a large company [1], especially hardware companies? I've sat through I don't know how many "planning" meetings, which were little better than design by committee, and whose outcome was not in the best interest of the customer despite the best intentions of everyone there.

1. Or the government or one of it's contractors. I've even sat through meetings 12 engineers sat around and argued about what to name something internal. I started calling this "name by committee".

Re: Disabling Intel ME 11 via undocumented mode

#169

Post by ece »

userbinator wrote: post #113
arca_vorago wrote: post #77

This is why I support Power/MIPS/RISC development going forward. It's just a shame that we allowed intel and amd to both put in cpu backdoors at such an obvious level (I like x86 but it's not the cpu of the future unless it's open). I highly suspect some national security letter type shit is going on in the background, ala Promis and William A. Hamilton who has claimed on Bruce Schneiers blog they (intel agencies) we…

If some other CPU architecture were the dominant PC platform, do you think it wouldn't grow such features too? It's not hard to imagine an alternate universe in which we all have RISC workstations with the equivalent of ME, and Intel/AMD are the minorities who have more "open" CPUs without, but only because they hadn't grown enough. The underlying reason why ME became popular is the same reason why proprietary walled…

https://code.facebook.com/posts/1601610310055392/introducing...

It could be an open solution too. I have only cursory followed OCP and other hardware advances, but this being used with Raptor's power servers. Opensparc before Oracle, and recently the RISC V community might have built something similar too.

Re: Disabling Intel ME 11 via undocumented mode

#170

Post by [deleted] »

forapurpose wrote: post #127
arca_vorago wrote: post #93

Earlier quoted context omitted.

>remote monitoring and control There are opensource ways to do out of band management without it. >consumer benefits. Related tech also helped DRM machines through Trusted Computing alliance. Nobody I knew who was knowledgeable wanted that shit in the first place. It was always edging away consumer control of the platform. DRM is part of the problem here! Same thing with web standards. What annoys me the most about t…

>>remote monitoring and control > There are opensource ways to do out of band management without it. I'd be surprised if there is a cost-effective open source alternative to this requirement: Remotely access and control a computer under any circumstance where it has power and a physical network connection. Solutions like AMT work even if there is no functioning processor or memory, because ME provides its own process…

[deleted]
Post reply on HN