Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

“We have obtained fully functional JTAG for Intel CSME via USB DCI”

twitter.com

Post reply on HN
Print view View original

371–380 of 413 posts

Re: “We have obtained fully functional JTAG for Intel CSME via USB DCI”

#371

Post by bobsoap »

Natsu wrote: post #172
fragmede wrote: post #170

Earlier quoted context omitted.

Prior to the NSA contractor Edward Snowden's revelations in 2013, Room-641A had already been exposed by an AT&T employee-turned-whistleblower Mark Klein. The EFF sued the government in 2006 over it. Tape over laptop cameras isn't just a "parents-of-friends" thing, it's a good idea. Buy a set of stickers and support the EFF: https://supporters.eff.org/shop/laptop-camera-cover-set Anyone know somebody at Wired?

We should start demanding physical shutters for laptop webcams. Does anyone make those yet?

There's been a Kickstarter called Nope for cams for a few years now, they exceeded funding by a large multiple each time. I got the second version a year ago, they are now on version 3 and added a headphone jack blocker.

https://www.kickstarter.com/projects/bungajungle/nope-sound-...

Re: “We have obtained fully functional JTAG for Intel CSME via USB DCI”

#372

Post by Dunedan »

dm319 wrote: post #359
LeoPanthera wrote: post #308

Earlier quoted context omitted.

I've never tried but Debian has a lengthy (if out of date?) wiki page about running it on Macbooks: https://wiki.debian.org/MacBook https://wiki.debian.org/MacBookPro

The latest macbook pros essentially don't work well with linux. I think wifi isn't a solved issue still, for example.

Depends on the model. On the non-TouchBar models WiFi works fine, on the TouchBar models it doesn't. For more details check: https://github.com/Dunedan/mbp-2016-linux

Re: “We have obtained fully functional JTAG for Intel CSME via USB DCI”

#373

Post by _nedR »

Apparently Intel ME can be killed by setting an undocumented flag discovered by the same group?

https://www.csoonline.com/article/3220476/security/researche...

Anybody can shed light on this tool and whether it can mitigate the attack mentioned in the tweet?

Re: “We have obtained fully functional JTAG for Intel CSME via USB DCI”

#374

Post by jamiek88 »

kfrzcode wrote: post #137
cyphar wrote: post #63

Earlier quoted context omitted.

> Anything that has DMA enabled (e.g. Firewire or Thunderbolt) offers an external device direct access to the system RAM that is very difficult to defend against IOMMU effectively solves the "DMA is completely broken" problem, as far as I'm aware. Evil Maid attacks are mostly worrisome because even UEFI cannot protect you against some bootloader attacks (what if you disable UEFI or reflash the firmware and then have…

Oh so....every port on my laptop? Fuck Apple

It's a pity that law was passed that forced people to buy Apple products.

Re: “We have obtained fully functional JTAG for Intel CSME via USB DCI”

#375

Post by washadjeffmad »

fragmede wrote: post #309
dmix wrote: post #203

Earlier quoted context omitted.

> Tape over laptop cameras isn't just a "parents-of-friends" thing Not sure why you took that statement as deriding the practice because some older people are doing it? I noted it merely as an indication of how far the behavioural change has spread as a result of news stories... Of course it's good security hygiene. Not an ideal solution though, as others have already mentioned, compared to a hardware switch or built…

Ah, apologies; The way I read it was that your friends don't but their parents do.

That's funny, because I noticed something during a recent ~10k device audit.

Across the mobile IT we manage, the groups who covered or unplugged their webcams, internal or external, most consistently were middle to older age women, with the least common as women in their 30s or younger. Men covered randomly across all ages, but still less than women. And while they'll cover their laptop camera, most who didn't have a folding case did not also cover their tablet or phone cameras.

I don't know if it's comfort or awareness, but the ones who covered acted like it was common sense, and the ones who didn't hadn't considered it or felt like they weren't likely to be a target of interest. A few women said they chose their laptops because of the physical shutter over the camera.

I don't know if trust in electronics is more generational or age related, but it's definitely a gradient.

Re: “We have obtained fully functional JTAG for Intel CSME via USB DCI”

#376

Post by cmurf »

dm319 wrote: post #359
LeoPanthera wrote: post #308

Earlier quoted context omitted.

I've never tried but Debian has a lengthy (if out of date?) wiki page about running it on Macbooks: https://wiki.debian.org/MacBook https://wiki.debian.org/MacBookPro

The latest macbook pros essentially don't work well with linux. I think wifi isn't a solved issue still, for example.

None of them work well with Linux, despite the Linux folks sometimes bending over backwards to make it work. https://lwn.net/Articles/707616/

All of the Macs I have require binary firmware blobs for WiFi, for the open source driver to work. And even in that case none of them can do even 802.11n. I have to use the proprietary WiFi driver to get 802.11n or 802.11ac. And yes each model varies in this regard, which makes it something of a Choose Your Own Adventure book.

Re: “We have obtained fully functional JTAG for Intel CSME via USB DCI”

#377

Post by rurban »

kakarot wrote: post #109
WhitneyLand wrote: post #52

One way to think of ME is, we all woke up one day and discovered we have had high resolution night vision spy cams installed in our bedrooms. The next realization is there is no way to turn them off or remove them. It’s posisble even moving won’t help. And yet we really don’t seem to care much. Lesser issues generate national outrage and high volumes of press coverage. Why? HN may be uniquely positioned to show us th…

To be fair, many of us noticed the giant camera in the corner a long time ago. ME has been a holy grail in the security researcher community for a long time, frequently the subject of presentations at conventions. And we have been pestering Intel about this since its inception. But the fact is that it doesn't matter how much outrage you or I may have. It will take enterprise-level shifts away from Intel products to g…

I would rather hope that it would take a brave judge or the EU to forbid this spy-device.

Commercially there's no alternative. Enterprises even use Microsoft over Linux/BSD. Why would they get rid of Intel? For Anti-US spying a firewall should be enough.

Re: “We have obtained fully functional JTAG for Intel CSME via USB DCI”

#378

Post by tyingq »

madez wrote: post #333
fragmede wrote: post #86

Earlier quoted context omitted.

> And yet we really don’t seem to care much. I know we're used to "Internet speed" and the tweet happened an entire 24 hours ago, but give it a bit of time before declaring it dead. Wired and Vice need a second to write it up, and see if it hits the mainstream before declaring the issue ignored. Not saying it will get picked up, though I sure hope it does, but as you point out, it's a bit obscure and takes some expla…

Can you use an ARM Chromebook without it constantly leaking data to Google? I tried to use the C201 without Chrome OS, but with libreboot, and Debian with mainline Linux. I didn't succeed.

See https://johnlewis.ie/custom-chromebook-firmware/rom-download...

Doesn't work for every Chromebook, but it does for many. Working fine on my Chrome Box.

Re: “We have obtained fully functional JTAG for Intel CSME via USB DCI”

#379

Post by madez »

em3rgent0rdr wrote: post #356
madez wrote: post #298

Earlier quoted context omitted.

The Librem laptop are not an option because they use Intel chips. Buying Intel products supports and finances their current way. They did not even address the grave accusations. There is no way I can give them money.

When Librem was first announced, I had grave concerns too, and I stuck with my Libreboot computers. However, it was just this past month when they showed proof of concept for their Purism phone running KDE plasma on an ARM board without any firmware/driver blob concerns and also showed how they isolated and disabled the Intel ME that I took them seriously, at which point I ordered a labtop and have been very happy. T…

I don't get how their work on the Purism phone makes their laptop any better. Care to explain the relation?

That one can maybe fix a hardware backdoor in Intel chips does not make buying them any better. Intel does not get my money but should instead get clear-worded, sanctioned letter from the authorities. I think they should be banned from trading and selling their backdoored stuff. I will not buy even old products of them. They messed up big time and don't even explain themselves.

Re: “We have obtained fully functional JTAG for Intel CSME via USB DCI”

#380

Post by lightedman »

CompuHacker wrote: post #368
pksadiq wrote: post #363

Earlier quoted context omitted.

> I unplugged the microphone on my daughter's iMac years ago. Please note that a speaker may also act as a microphone if configured so (at software level). This is especially true for speakers/headphones connected via the jack.

It's likely an internal microphone and speaker; the sound card may not support input through that interface. What you're saying can be true for many other modern computers, though.

"the sound card may not support input through that interface"

All of them do since the capability of auto-sensing sound cards emerged in the earlier 2000s. Those sound cards allowed you to plug a microphone into the speaker jack and it would detect it as a microphone, not a set of speakers. If you have anything that supports AC'97 or newer codec, you're almost guaranteed to have that vulnerability present.

Post reply on HN