“We have obtained fully functional JTAG for Intel CSME via USB DCI”

Post by mlvljr » Fri, Nov 10, 2017, 8:20 PM UTC

madez wrote: post #208

WhitneyLand wrote: post #52

One way to think of ME is, we all woke up one day and discovered we have had high resolution night vision spy cams installed in our bedrooms. The next realization is there is no way to turn them off or remove them. It’s posisble even moving won’t help. And yet we really don’t seem to care much. Lesser issues generate national outrage and high volumes of press coverage. Why? HN may be uniquely positioned to show us th…

> And yet we really don’t seem to care much. I do care, a lot. I have decided to avoid Intel (and AMD) hardware like the pest. I will not buy any Core iSpyOnYou or AMD equivalent anymore. I'm an advocate of economic and judicial sanctions from the political level against Intel (and AMD). I tell people around me about the problems and explain how it is an issue of privacy, security, national sovereignty, and market po…

Post by tedunangst » Fri, Nov 10, 2017, 8:22 PM UTC

hnuser2357982 wrote: post #216

acqq wrote: post #113

Earlier quoted context omitted.

Previously, explaining what the author of the tweet did months ago: https://www.digitaltrends.com/computing/intel-kaby-lake-skyl... "As shown in the presentation by security researchers Maxim Goryachy and Mark Ermolov, one way of accessing the JTAG debugging interface" "is to use a" "hardware implant" "running Godsurge" "which can exploit the JTAG debugging interface. Originally used by the National Security Agency -…

That we have one more person capable of exploiting this in the wild.

Post by [deleted] » Fri, Nov 10, 2017, 8:38 PM UTC

kyberias wrote: post #234

ska wrote: post #125

Earlier quoted context omitted.

to the best of my knowledge but I honestly believe I would know Honestly, if a three letter agency was working with a tech company to produce a back door, the last people I would expect to know would be most of the engineers involved in the implementation.

> Honestly, if a three letter agency was working with a tech company to produce a back door, the last people I would expect to know would be most of the engineers involved in the implementation. Who would the first people be then?

Post by stordoff » Fri, Nov 10, 2017, 8:45 PM UTC

zgramana wrote: post #168

daxorid wrote: post #132

Earlier quoted context omitted.

Right. ME does make sense as a feature for sysadmins. Except . . . . Well, can you shed light on the following: 1. Why did your team deem it necessary to deny the end-user the capability to disable this feature? 2. Why did your team decide to enable ME on ALL consumer grade chips? You could have only enabled it on, say, Xeon, as a value-add - exactly like you do for ECC support. You could have made more money this wa…

Having been a sys-admin once upon a time (2006-2008), these answers are straight forward. Servers used to have discrete ME cards which were paid add-ons. Competition in the early 2000s drove these ME cards to be integrated in the motherboard in order to better compete on the low end of the market. I’ve had servers I was only able to remotely fix due to the out of band management interface (more than once). They pain…

Post by kyberias » Fri, Nov 10, 2017, 8:47 PM UTC