31–40 of 413 posts
Any reason Intel doesn't just offer IME-free CPUs too? There's obviously interest considering the lengths organisations like Google go to to disable it and Intel supposedly already has such offers for governments.
TIL about this detail. Where can I learn more?
EDIT: So this is now at 0 points. Interesting...
We've now entered a realm where an attacker could simply plug a device on an usb port of your computer for a few seconds to have it access your cpu's ME through USB JTAG and take over it, allowing him to have full access and control over what you do/read/open/type over the network, without you ever knowing it since you can't see it. And the only way to get rid of it for sure would be to pretty much throw that cpu away and buy a new one.
Or am I being overly paranoid and there is something I haven't considered that makes this scenario impossible ?
EDIT: given the answers I think my main concern wasn't well expressed above. I'm not saying this as in "ME is making it easier to be compromised". That may or may not be true, but that's not my point.
My point is, we all know that once compromised, you can't clean it and need to burn it all and start from scratch: recover from backup (not files on the compromised machine), format everything, reinstall. Due to the nature of the ME, this is not a solution here. The cleanup needs to be done at the hardware level. Unless I misunderstood something, once it happens, your cpu is done for, period. And 'using a hack to cleanup the hack' is still in the realm of cleaning up rather than start from scratch, it's not a solution for the same reason than cleaning up your comprised linux box is not one and you need to start from scratch.
At first it looks nice "oh now we can get rid of it" but it also opens up a very scary near future security-wise. We've now entered a realm where an attacker could simply plug a device on an usb port of your computer for a few seconds to have it access your cpu's ME through USB JTAG and take over it, allowing him to have full access and control over what you do/read/open/type over the network, without you ever knowin…
Where should I start if I want to dip my toe in this topic? Have a few years of web development experience and a Bsc in software engineering in progress.
Next, download Minix and get a good handle on it. The next step is getting access to the Minix kernel on the ME, and after that, it'll be a case of who has the best apps for the CPU in their CPU.
On an unrelated note, did anyone hear about any answer from Intel to Prof. Tanenbaum's open letter? It's high time they pulled their heads out of the sand and started explaining the whole issue.
Why do you think would they have to answer him anything? He published something, using a license saying you could use it without telling anyone nor giving back changes, and that's exactly what Intel did. And in his letter he acknowledged that. There was no call nor need for an answer...
I think this was Minix's first real-world use case (read: ego validation), and Andrew Tanenbaum was just unimpressed he learned about it by proxy.
At first it looks nice "oh now we can get rid of it" but it also opens up a very scary near future security-wise. We've now entered a realm where an attacker could simply plug a device on an usb port of your computer for a few seconds to have it access your cpu's ME through USB JTAG and take over it, allowing him to have full access and control over what you do/read/open/type over the network, without you ever knowin…
I can't help but to think of all those exploits that target anti-virus software.
At first it looks nice "oh now we can get rid of it" but it also opens up a very scary near future security-wise. We've now entered a realm where an attacker could simply plug a device on an usb port of your computer for a few seconds to have it access your cpu's ME through USB JTAG and take over it, allowing him to have full access and control over what you do/read/open/type over the network, without you ever knowin…
I think you're being overly paranoid. If the attacker has physical access to the machine, chances are you're compromised anyway, even before this vulnerability.
Earlier quoted context omitted.
"AMD have something similar so no help there" It's probably worse for AMD. For Intel now at least we'll probably get the ability to securely disable everything below ring -1.
It's such a pity that there is no real competition in that area. (Unless you go the totally different architectures such as ARM or RISC-V.) AMD had the chance to differentiate from Intel here, instead they blindly immitate the same customer-hostile stunt.
If you want to compete with Intel or AMD in the CPU market, you are talking tens of billions in NRE before you ever have something that is remotely competitive. And then you have to do it all over when we switch from 14nm to 7nm, and then again when we go from 7nm to 3nm.
If you want more competition, you have to level the playing field by banning most of the op-codes. But even then you still have crazy amounts of pipelining and other optimizations which are nontrivial to figure out and very expensive to implement.
Intel is in a great position.
At first it looks nice "oh now we can get rid of it" but it also opens up a very scary near future security-wise. We've now entered a realm where an attacker could simply plug a device on an usb port of your computer for a few seconds to have it access your cpu's ME through USB JTAG and take over it, allowing him to have full access and control over what you do/read/open/type over the network, without you ever knowin…
The concern with the Intel ME is that it has a native network adapter. You can bet efforts are currently underway to discover how to exploit the ME remotely. THAT'S when things get scary.
Your paranoia is not unjustified. Personally, I am nervous that some of my systems have the ME. When attention turned to it about a year ago, i knew it would only be a matter of time before someone broke into it.