Live data from Hacker News

Disabling Intel ME 11 via undocumented mode

blog.ptsecurity.com

201–210 of 228 posts

Re: Disabling Intel ME 11 via undocumented mode

#201
post #58

Earlier quoted context omitted.

Intel ME is not an effective DRM scheme. You need to be exceptionally careful when you mention DRM, because if it becomes commonly believed that Intel ME could be used to implement DRM all of a sudden the DMCA comes into play. Research into Intel ME vulnerabilities becomes a federal crime.

> because if it becomes commonly believed that Intel ME could be used to implement DRM all of a sudden the DMCA comes into play. Research into Intel ME vulnerabilities becomes a federal crime. This is rather an argument against DMCA or an argument why researchers working in this area should consider leaving the USA.

All signatories to WIPO have DMCA-like laws (including the "effective anti-circumvention" clauses). Given how many countries are signatories to WIPO, there are very few countries where it would be strictly legal to do research into "effective DRM schemes".

Re: Disabling Intel ME 11 via undocumented mode

#202
post #58

Earlier quoted context omitted.

Intel ME is not an effective DRM scheme. You need to be exceptionally careful when you mention DRM, because if it becomes commonly believed that Intel ME could be used to implement DRM all of a sudden the DMCA comes into play. Research into Intel ME vulnerabilities becomes a federal crime.

This isn't necessarily true: https://www.ftc.gov/news-events/blogs/techftc/2016/10/dmca-s... Of the four criteria in the exemption, I wouldn't put it past the government trying to make the case that exposing a NSA spy program somehow falls afoul of good faith investigation - but the general view that "any DRM research is a crime" is no longer accurate.

The good-faith requirement also means that likely you could not publish a way for someone to disable the "effective anti-circumvention measure". Even if you could, anyone who used that research to disable their own devices is arguably not conducting "good faith security research". While researchers might be safe, nobody will be able to use the results of their research legally except the companies that produce DRM (so that they can make it more secure). I don't think that's actually an improvement to be honest.

Re: Disabling Intel ME 11 via undocumented mode

#203

Earlier quoted context omitted.

You can't think of any reason? Have you or do you work for a large company [1], especially hardware companies? I've sat through I don't know how many "planning" meetings, which were little better than design by committee, and whose outcome was not in the best interest of the customer despite the best intentions of everyone there. 1. Or the government or one of it's contractors. I've even sat through meetings 12 engin…

Explain to me why I can't disable it for my home PC.

While I too wish it was able to be disabled easily, I'm surprised the parent poster is getting down voted. Having worked for hardware companies, and chip companies in particular, I can very easily see the benign answer being that this isn't even on their radar as something to do. That they are providing the ME features because Sales Guys say that some big enterprise customers want them, and once it was designed in, there wasn't a convincing proposal to make it an optional / opt-in feature, because there simply isn't someone on the engineering team who is voicing the concerns of the "home PC user who cares about this-kind-of-thing."

And even if there is, the "non-evil" reason for keeping this as is might be that "enterprise customer doesn't want something that is easily disabled, and we can't justify cost of a separate design / fab run for a small minority of customers", vs. "Haha, now we have a backdoor into EVERYTHING!"

(Hell, even the proposals about disable via hardware switch, or having the ME on a separate component probably boil down to money. To an outsider, hardware companies are funny beasts in that they really start caring about things like counting pennies and minimizing BOM cost as much as possible. I've been in worried meetings where we were literally counting and debating pennies, and wondering how I got there, but it makes sense at a company level since those pennies add up when you are building thousands or millions of something! This may have boiled down to "motherboard manufacturer doesn't want to have to put another mechanical part on the board, and they are looking to buy a shitload of our parts, let's keep them happy")

Please note: I'm not saying, or even advocating, that this is a good thing, or results in ideal outcomes when I say "benign". I'm just using it in the sense that this likely wasn't a malicious decision, but probably one motivated by money at some point, by people who didn't necessarily see the harm in it.

Re: Disabling Intel ME 11 via undocumented mode

#204

Earlier quoted context omitted.

I’m not sure where you got the idea that such things only exist on x86 and shame Intel and AMD for a feature that’s useful for many scenarios. Have you considered the fact that such features exist because there are actually many customers that want it? I was literally using the counterpart of ME on Power today. These tools are essential to many enterprise workloads, especially when you are in Boston and your data cen…

Then let owners control whether it's enabled or not (by a hardware switch if necessary). As it currently stands, I can't imagine a benign reason that would drive intel and AMD to lock users out of their machines.

Will you pay for the cost of designing a new architecture that contains such a switch when ME is responsible for many parts of the lifecycle?

Re: Disabling Intel ME 11 via undocumented mode

#205
post #11

Earlier quoted context omitted.

>even before US embargo'd Intel from china You can see how well this embargo works in every electronics mall

>> even before US embargo'd Intel from china > You can see how well this embargo works in every electronics mall IIRC, the embargo was only against very specific processors used in a specific supercomputer design.

I mean both Phi, and Itanics. Just look for them in places trading second hand server equipment

Re: Disabling Intel ME 11 via undocumented mode

#206
post #149

Earlier quoted context omitted.

Register windows and delay slots. These turned out to be not such a great idea.

[I'm not a microarchitecture expert] I've read that x86 has multiple registers (eg, https://news.ycombinator.com/item?id=9264195 , http://blog.erratasec.com/2015/03/x86-is-high-level-language... ). "You want to do something with rax, so the processor grabs one of its 168 internal registers to play the role of rax for a moment" sounds like a type of register-window implementation to me. Or I'm completely misinterpreti…

OoO register renaming is a nearly orthogonal concept compared to SPARC style register windows. And I say nearly, mainly because if you try to implement both it increases the complexity more than you would think due to microarchitectual interactions between the two concepts.

Also, it's not really an x86 thing (for instance most Atoms don't have these extra registers), it's an in-order vs out-of-order thing. Most Power cores do have the larger bank and renaming.

Re: Disabling Intel ME 11 via undocumented mode

#207
post #171

Earlier quoted context omitted.

Wouldn't it just take a motherboard maker or two to find an alternative to the PCH, like Nvidia nforce or a VIA chipset. adopt something like openbmc and sell it as an open feature? No intel PCH, no Intel ME. Seems like the Linux kernel is eager to support it: https://lwn.net/Articles/683320/ What happened to 3rd parties making chipsets? Another case of Intel abusing it's monopoly?

Short answer: yes https://arstechnica.com/gadgets/2009/02/intel-sues-nvidia-ov... https://www.extremetech.com/extreme/57766-update-intel-sues-...

Thank you for the links. Here is FTC's ruling against Intel from 2010: https://www.ftc.gov/news-events/press-releases/2010/08/ftc-s...

Seems like they mention chipsets, but didn't go far enough given what happened to Nvidia chipsets vis-a-vis GPUs. They could do a little bit better as a regulator.

http://www.mercurynews.com/2010/02/13/nvidia-gains-ally-agai...

Re: Disabling Intel ME 11 via undocumented mode

#208
post #58

Earlier quoted context omitted.

Intel ME is not an effective DRM scheme. You need to be exceptionally careful when you mention DRM, because if it becomes commonly believed that Intel ME could be used to implement DRM all of a sudden the DMCA comes into play. Research into Intel ME vulnerabilities becomes a federal crime.

It's only a federal crime in the US ... aren't these guys in the UK?

http://www.legislation.gov.uk/ukpga/1988/48/section/296ZB

(Though it is somewhat more limited than the DMCA.)

Re: Disabling Intel ME 11 via undocumented mode

#209

This is why I support Power/MIPS/RISC development going forward. It's just a shame that we allowed intel and amd to both put in cpu backdoors at such an obvious level (I like x86 but it's not the cpu of the future unless it's open). I highly suspect some national security letter type shit is going on in the background, ala Promis and William A. Hamilton who has claimed on Bruce Schneiers blog they (intel agencies) we…

If some other CPU architecture were the dominant PC platform, do you think it wouldn't grow such features too? It's not hard to imagine an alternate universe in which we all have RISC workstations with the equivalent of ME, and Intel/AMD are the minorities who have more "open" CPUs without, but only because they hadn't grown enough. The underlying reason why ME became popular is the same reason why proprietary walled…

> because they are heavily promoted as a security/safety feature,

You can build such features without baking the keys into the hardware. You can have an open security module where changing the key simply makes everything that has been previously secured by it unreadable. That way a user can load his custom keys and firmware if he wants to. You can cascade that dependency down the secure boot chain by mixing some secret from the module into the HDD decryption for example.

Only vendor lock-in (e.g. windows RT) and DRM require hardcoded keys.

Re: Disabling Intel ME 11 via undocumented mode

#210
post #149

Earlier quoted context omitted.

Register windows and delay slots. These turned out to be not such a great idea.

[I'm not a microarchitecture expert] I've read that x86 has multiple registers (eg, https://news.ycombinator.com/item?id=9264195 , http://blog.erratasec.com/2015/03/x86-is-high-level-language... ). "You want to do something with rax, so the processor grabs one of its 168 internal registers to play the role of rax for a moment" sounds like a type of register-window implementation to me. Or I'm completely misinterpreti…

You are describing "register renaming". And it's what everybody discovered was a better idea than putting "specific tasks" to registers with windows, banks, etc.

Of course, IBM knew about this way back.

https://en.wikipedia.org/wiki/Tomasulo%27s_algorithm

Those who do not study history are doomed to repeat it.

Post reply on HN