Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

“We have obtained fully functional JTAG for Intel CSME via USB DCI”

twitter.com

Post reply on HN
Print view View original

41–50 of 413 posts

Re: “We have obtained fully functional JTAG for Intel CSME via USB DCI”

#41

Post by richmarr »

maccard wrote: post #33
nolok wrote: post #32

At first it looks nice "oh now we can get rid of it" but it also opens up a very scary near future security-wise. We've now entered a realm where an attacker could simply plug a device on an usb port of your computer for a few seconds to have it access your cpu's ME through USB JTAG and take over it, allowing him to have full access and control over what you do/read/open/type over the network, without you ever knowin…

I think you're being overly paranoid. If the attacker has physical access to the machine, chances are you're compromised anyway, even before this vulnerability.

So you're saying things are so bad anyway that this one vulnerability probably doesn't make any difference?

This interpretation of "you're being overly paranoid" is new to me ;)

Re: “We have obtained fully functional JTAG for Intel CSME via USB DCI”

#42

Post by jjevanoorschot »

exikyut wrote: post #31
Asdfbla wrote: post #2

Any reason Intel doesn't just offer IME-free CPUs too? There's obviously interest considering the lengths organisations like Google go to to disable it and Intel supposedly already has such offers for governments.

> the lengths organisations like Google go to to disable it TIL about this detail. Where can I learn more? EDIT: So this is now at 0 points. Interesting...

A recent talk [0] by Ronald Minnich from Google gives a nice overview of their efforts to replace parts of Intel ME and UEFI with Linux, mostly for security reasons.

[0] https://www.youtube.com/watch?v=iffTJ1vPCSo

Re: “We have obtained fully functional JTAG for Intel CSME via USB DCI”

#43

Post by drewg123 »

exikyut wrote: post #31
Asdfbla wrote: post #2

Any reason Intel doesn't just offer IME-free CPUs too? There's obviously interest considering the lengths organisations like Google go to to disable it and Intel supposedly already has such offers for governments.

> the lengths organisations like Google go to to disable it TIL about this detail. Where can I learn more? EDIT: So this is now at 0 points. Interesting...

https://firmwaresecurity.com/tag/google/

Re: “We have obtained fully functional JTAG for Intel CSME via USB DCI”

#45

Post by marcosdumay »

_0ffh wrote: post #15
jimmyswimmy wrote: post #8

Earlier quoted context omitted.

I'll give a try. Someone else can correct me later. These guys have used a JTAG f debugging dongle to access the Intel management engine. They can now read every bit of code. Which means that secrets stored within the code including keys and bugs are available to them and anyone who can replicate their work. Since the management engine is in nearly all of Intel chips, we're screwed. AMD have something similar so no h…

"AMD have something similar so no help there" It's probably worse for AMD. For Intel now at least we'll probably get the ability to securely disable everything below ring -1.

Not that fast. Being able to read the data does not mean you can write something different back.

Re: “We have obtained fully functional JTAG for Intel CSME via USB DCI”

#46

Post by petecooper »

jcims wrote: post #27
retrac98 wrote: post #3

Can someone explain like I have a degree in computer science from a good university, but opted for a career as a software engineer in some relatively high level languages?

There's a computer in your computer so your computer can computer while you computer. These guys just found the keyboard.

That's…a really good single-sentence explanation. Thank you!

Re: “We have obtained fully functional JTAG for Intel CSME via USB DCI”

#48

Post by cryogenic_soul »

nolok wrote: post #32

At first it looks nice "oh now we can get rid of it" but it also opens up a very scary near future security-wise. We've now entered a realm where an attacker could simply plug a device on an usb port of your computer for a few seconds to have it access your cpu's ME through USB JTAG and take over it, allowing him to have full access and control over what you do/read/open/type over the network, without you ever knowin…

Many people will now start to dig in. War is started and I hope somebody will find a way to totally remove/replace(with a stub) Intel ME before some critical vulnerability will be discovered in the Intel ME's network stack.

In white hats we trust :)

Re: “We have obtained fully functional JTAG for Intel CSME via USB DCI”

#49

Post by quickben »

dsr_ wrote: post #12
retrac98 wrote: post #3

Can someone explain like I have a degree in computer science from a good university, but opted for a career as a software engineer in some relatively high level languages?

Intel CPUs have an embedded supervisory CPU called the Management Engine. It can read all of memory, control power states on the main CPU, and generally has super-root privileges on everything. You, an end-user, aren't allowed to program it. The current MEs run a form of Minix. They represent an incredible security and privacy risk, because we don't know what code they run and it is widely believed that the NSA or ot…

To add, and maybe the others can correct me if I'm wrong:

Intel ME can be controlled remotely if you have an Intel lan card, even if the main cpu is off, but the motherboard is powered on. It goes from there and gets worse is my understanding.

Re: “We have obtained fully functional JTAG for Intel CSME via USB DCI”

#50

Post by gargravarr »

vog wrote: post #36
nolok wrote: post #32

At first it looks nice "oh now we can get rid of it" but it also opens up a very scary near future security-wise. We've now entered a realm where an attacker could simply plug a device on an usb port of your computer for a few seconds to have it access your cpu's ME through USB JTAG and take over it, allowing him to have full access and control over what you do/read/open/type over the network, without you ever knowin…

It's by far not the first time that a highly-priviledged "security" component turns out to actually reduce security, because it is a large and gainful attack surface. I can't help but to think of all those exploits that target anti-virus software.

"I know, let's examine some suspicious code in a highly-privileged process that the user explicitly trusts to keep them safe."

When you think about it, "it seemed like a good idea at the time" can explain most tragedies in human histories.

Post reply on HN