31–40 of 192 posts
Earlier quoted context omitted.
Well, maybe AMD does at least some security reviewing on their own? /s ARM could be a affordable alternative to x86 if that works for you.
What's the state of x86 emulation on ARM? Using ARM before that might be a dealbreaker. If I remember correctly Microsoft was working on it
Unreal. Kept scrolling and the vulnerabilities kept coming. Most annoying thing is that there isn’t even a real alternative. If I understand it right then AMD chips have pretty much the same thing?
Yep. "Let's put a chip in it" IoT nightmare now applies recursively to chips. Everything is insecure by design. I am really looking forward for either ARM to displace x64 or even better RISC-V. With ARM you have many more vendors so more chance for options, and RISC-V is the ultimate in openness.
Can this vulnerability be used to take over public cloud?
Earlier quoted context omitted.
Who is my vendor if I assembled my computer myself?
The company who built your motherboard
edit: maximum downvotes for a legitimate question, thanks all
$ sudo ./intel_sa00086.py
...
*** Risk Assessment ***
Detection Error: This system may be vulnerable, please install the Intel(R) MEI/TXEI driver (available from your system manufacturer).
...
If you have a Lenovo machine, check Lenovo's security advisory [0] to see if it is affected. Intel has the wrong URL in their link.
Edit: FWIW, the (Linux) tool creates a .log (and .xml) file in the current directory that was slightly more helpful:
$ tail -n 4 SA-00086-cluefire-2017-11-20-21-09-36.log
HECI error: No device with MKHI found[2]
Can't find SPS version in the tool output
Status: HECI_NOT_INSTALLED
Tool Stopped
Error 9460: Unknown or unsupported hardware platform
[0]: https://support.lenovo.com/us/en/product_security/len-17297
[1]: https://en.wikipedia.org/wiki/Host_Embedded_Controller_Inter...
I prefer the wording in Lenovo's security advisory [0]: > "Potential Impact: An attacker could load and execute arbitrary code outside the visibility of the user, operating system, and hypervisor/virtualization platform; resulting in exfiltration of secrets, subtle manipulation of system operation, or denial of service." [0]: https://support.lenovo.com/us/en/product_security/len-17297
Wow all 6th, 7th and 8th gen are all vulnerable along with a bunch of Xeon processors. Even the laptop I am typing this on is vulnerable, this is going to be messy. Plus all the fun vulnerabilities like arbitrary code execution, unauthorized access to privileged content. These must be related to the blackhat talk coming up in December about hacking a turned-off computer and running unsigned code on ME [0]. Yep and th…
Mobile Atoms are affected it seems despite using TXE (SPARC CPU) instead of ME.
I don't see any remote exploits here (other than "attacker with remote admin access..."). Is that correct? Presumably an attacker with remote admin access is already all powerful? Or is the concern that they can backdoor the hardware in an undetectable way, remotely?
A vulnerability where someone can remote control your machine even after you swap out all local storage and install a new OS is another thing entirely.
I almost wish it covered 3rd-5th generation, just to help me push some folks to upgrade.
Unreal. Kept scrolling and the vulnerabilities kept coming. Most annoying thing is that there isn’t even a real alternative. If I understand it right then AMD chips have pretty much the same thing?
Well, maybe AMD does at least some security reviewing on their own? /s ARM could be a affordable alternative to x86 if that works for you.