Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

“We have obtained fully functional JTAG for Intel CSME via USB DCI”

twitter.com

Post reply on HN
Print view View original

141–150 of 413 posts

Re: “We have obtained fully functional JTAG for Intel CSME via USB DCI”

#141

Post by kaffeemitsahne »

throwaway230958 wrote: post #114

I worked on what became ME at Intel from the mid 2000s through around 2012 ou 2013. I completely agree that in retrospect, it wasn't the best idea. However, I really want to say that it was never a project for the CIA as some keep saying. This was a widely-marketed product at the time of its inception. It was the whole point of the Intel vPro line. I've been to a ton of roadshows between 2008 and 2009 where the marke…

>but the notion that it was designed by/with the CIA is simply not true to the best of my knowledge

Seems irrelevant. The internet and smartphones were also not created by the CIA/NSA for mass surveillance, yet the 3 letter guys still uses those technologies for mass surveillance very successfully.

Re: “We have obtained fully functional JTAG for Intel CSME via USB DCI”

#143

Post by kazagistar »

throwaway230958 wrote: post #94
mrschwabe wrote: post #60

Companies like Intel, who are complicit in helping CIA or any intel agency (government, rogue or otherwise) infiltrate and exploit our systems - need to be held accountable by the market. Intel ME and the (assumed [0]) partnership with CIA to design and build this system - should be an absolute travesty blow to the integrity of their business long-term. Will you, as lead engineer or sys admin for your mission critica…

> Intel ME and the (assumed [0]) partnership with CIA to design and build this system I worked at Intel on ME and the things that came before it until around 2013. I can tell you two things -- 1. No, Intel ME wasn't born out of a desire to spy on people nor was it -- to the best of my knowledge but I honestly believe I would know -- created at the request of the US government (or others). It was an honest attempt at…

Why doesn't Intel offer their chips without an ME, as an option? The mandatory nature makes it malicious.

Re: “We have obtained fully functional JTAG for Intel CSME via USB DCI”

#144

Post by elif »

WhitneyLand wrote: post #52

One way to think of ME is, we all woke up one day and discovered we have had high resolution night vision spy cams installed in our bedrooms. The next realization is there is no way to turn them off or remove them. It’s posisble even moving won’t help. And yet we really don’t seem to care much. Lesser issues generate national outrage and high volumes of press coverage. Why? HN may be uniquely positioned to show us th…

It's not that "we really don't seem to care much"

It's that even those of us that care vehemently, have no recourse. It is impossible to fight a secret police state.

Re: “We have obtained fully functional JTAG for Intel CSME via USB DCI”

#145

Post by dmitriid »

andruby wrote: post #119
d0mine wrote: post #90

Earlier quoted context omitted.

"opaque, obtuse, and obscure" is a red herring. Imagine, Intel were a Russian company. Tomorrow, there would be a simple and clear [screaming] headline similar to "Russians hacked the election" (general public doesn't need to know or understand how the network, computers or elections actually work). The day after tomorrow it would be illegal to buy anything Intel.

What do you think the headline about Intel be in Russian media?

Most likely they will be quiet because Russia is 100% dependent on foreign technology.

Re: “We have obtained fully functional JTAG for Intel CSME via USB DCI”

#146

Post by pavement »

SeanDav wrote: post #92
WhitneyLand wrote: post #52

One way to think of ME is, we all woke up one day and discovered we have had high resolution night vision spy cams installed in our bedrooms. The next realization is there is no way to turn them off or remove them. It’s posisble even moving won’t help. And yet we really don’t seem to care much. Lesser issues generate national outrage and high volumes of press coverage. Why? HN may be uniquely positioned to show us th…

> "Apparently, ME is the perfect combination of opaque, obtuse, and obscure. It’s not rocket science, but complicated enough it’s hard to explain well quickly." The way I see it is Intel ME is a processor-level application that has full control of all computer activity and cannot be blocked or disabled and can be accessed and controlled remotely. Would like to hear other people's opinions of what it is.

The mnemonic "opaque, obtuse, and obscure" is a valid denotation of targeted qualities, not unlike the qualities targeted for drone activity are related, with the mnemonic "dull, dirty or dangerous."

So, the three O's is a good conceptual utility, for understanding the combination of traits that can exploit the realities of human psychology, and explain why no one seems to care about how technical paralysis can stifle apparent relevance.

It's not only a means of explaining sneaky cloak and dagger stuff. You could describe lots of niche tech staples with this mnemonic.

When something is difficult to explain, that's often enough to derail any casual conversation with simple mental fatigue.

  Opaque:
Any number of qualities can render subject matter opaque. A poorly indexed, large volume of data is opaque, but a recursive function may also be opaque in it's behaviors.

  Obtuse:
Intel ME's position in the stack is placed at a key choke point, requiring highly abstract approaches to utility. In other words, it is obtuse.

  Obscure:
It's readily available, but sequestered as a feature behind interfaces non-technical users rarely visit, without advertising to promote, train or recommend it's use. Is it supposed to be an easter egg? For who?

Re: “We have obtained fully functional JTAG for Intel CSME via USB DCI”

#147

Post by whatdidyousay1 »

WhitneyLand wrote: post #52

One way to think of ME is, we all woke up one day and discovered we have had high resolution night vision spy cams installed in our bedrooms. The next realization is there is no way to turn them off or remove them. It’s posisble even moving won’t help. And yet we really don’t seem to care much. Lesser issues generate national outrage and high volumes of press coverage. Why? HN may be uniquely positioned to show us th…

dear lord ... top comment ... all problems no solutions

im guessing you could have told us what ME is or provided a link in the same amount of info that you put in your last paragraph

your last paragrah derails the topic to be an exploration in press coverage vs hn comments

I hope your hn comment and this hn comment displays what has happened to this forum. Its uninformative , and we have alot of people talking smart but not being smart.

HN is entertainment for smart people. Not a research resource any more. Even if that was not the intended consequence

Re: “We have obtained fully functional JTAG for Intel CSME via USB DCI”

#148

Post by scurvy »

_lqaf wrote: post #95
gargravarr wrote: post #40

Earlier quoted context omitted.

The 'evil maid' attack is well known, and states that once someone has physical access to your computer, all bets are off. Anything that has DMA enabled (e.g. Firewire or Thunderbolt) offers an external device direct access to the system RAM that is very difficult to defend against, or they could attach a keylogger or modify your bootloader, basically unleash all manner of havok. USB JTAG is really no different from…

> The concern with the Intel ME is that it has a native network adapter. Yep, this is the big deal. After I "discovered" the ME, my first stop on my home network was the switch, to block all that crap. (And I found my storage server, equipped with a Supermicro all-in-one motherboard, helpfully grabbed an IP for the ME to listen on with an 'admin/admin' password.) I just wish the empire builders at the NSA would care…

The BMC is listening on that IP, not the ME.

Re: “We have obtained fully functional JTAG for Intel CSME via USB DCI”

#149

Post by nv-vn »

lima wrote: post #91
mrschwabe wrote: post #60

Companies like Intel, who are complicit in helping CIA or any intel agency (government, rogue or otherwise) infiltrate and exploit our systems - need to be held accountable by the market. Intel ME and the (assumed [0]) partnership with CIA to design and build this system - should be an absolute travesty blow to the integrity of their business long-term. Will you, as lead engineer or sys admin for your mission critica…

Seriously? A 4chan post? While the ME is worrying for many reasons, there's absolutely zero evidence that the Intel ME contains a backdoor. Backdoors don't stay hidden forever.

4chan has been popular for leaks/reverse engineering because of its anonymity and the fact that it's seen as (whether or not this is true, and I would wager that it isn't) as a "hacker haven". For example, a guy on 4chan reverse engineered Google's new captcha system almost as soon as it came out, leading Google to eventually hire him in exchange for his deleting the GitHub repo he was using.

Re: “We have obtained fully functional JTAG for Intel CSME via USB DCI”

#150

Post by stephengillie »

jcims wrote: post #27
retrac98 wrote: post #3

Can someone explain like I have a degree in computer science from a good university, but opted for a career as a software engineer in some relatively high level languages?

There's a computer in your computer so your computer can computer while you computer. These guys just found the keyboard.

"The remote session is coming from inside the laptop!"
Post reply on HN