Intel patches new ME vulnerabilities • Hacker News Board

Re: Intel patches new ME vulnerabilities

#211

Post by deforciant » Sun, Jul 22, 2018, 9:02 PM UTC

iknowverylittle wrote: post #112

rectang wrote: post #90

Earlier quoted context omitted.

Certainly if the lifespan of Intel chips turns out to be much shorter than the marketplace expected (because Intel is unable to provide security updates), that affects the value of Intel products and ought to inform future buying decisions. Whether it is the unfortunate materialization of Spectre-style bugs or the deliberately insecure-by-design ME, Intel's inability to support its products is dismaying.

So, what's AMD doing these days? I'm hesitant to switch to AMD since Intel internal graphics play nicely with Linux. However that kind of doesn't matter if my machine isn't mine.

I have recently built a machine with Ryzen 2700X & geforce gtx 1050ti (GPU is required as Ryzen doesn't have an internal one but there are plenty of cheaper ones like mine), running Ubuntu and it's just fantastic. Docker builds, compilation takes seconds as compared to my macbook which has i7. Plus there's no overheating issues when I am running Kubernetes all the time and I can still code.

TL;DR Ryzen 2700X is great value for money, would recommend it any day :)

Re: Intel patches new ME vulnerabilities

#212

Post by monocasa » Sun, Jul 22, 2018, 9:06 PM UTC

std_throwaway wrote: post #72

I don't want a patch. I don't use that thing for anything. I want them to disable that thing by default! Leaving those backdoors open in older products should lead to a recall because the flaw was there all along.

You do use it. AFAIK, the ME handles power management, legacy backwards compatibility, and all sorts of other random chipset stuff you don't necessarily want to expose to the main cores, in addition to the DRM and remote administration capabilities.

Re: Intel patches new ME vulnerabilities

#213

Post by Kliment » Sun, Jul 22, 2018, 9:09 PM UTC

chasil wrote: post #66

kawsper wrote: post #32

Earlier quoted context omitted.

There are no official ways of disabling the ME. The Coreboot project and the Hardenedlinux project have worked on it, and here are some resources on their progress: https://hardenedlinux.github.io/firmware/2016/11/17/neutrali... https://www.coreboot.org/Intel_Management_Engine And here is a general writeup on the Intel chips and their "features": https://libreboot.org/faq.html#intel If Intel aren't going to patch old…

There is a Python script that can take a BIOS image (either from a vendor or scanned from a running system) and remove all ME components that are not absolutely required to operate the CPU. I have never tried it. https://github.com/corna/me_cleaner

Worked for me on two machines, no ill effects at all

Re: Intel patches new ME vulnerabilities

#214

Post by valgaze » Sun, Jul 22, 2018, 9:12 PM UTC

std_throwaway wrote: post #72

I don't want a patch. I don't use that thing for anything. I want them to disable that thing by default! Leaving those backdoors open in older products should lead to a recall because the flaw was there all along.

(2017) You might be able to: https://www.csoonline.com/article/3220476/security/researche...

https://github.com/ptresearch/unME11

Re: Intel patches new ME vulnerabilities

#215

Post by arendtio » Sun, Jul 22, 2018, 9:28 PM UTC

Someone wants to speculate on what would happen if intel would open source their ME as a reaction to this?

Re: Intel patches new ME vulnerabilities

#216

Post by ajross » Sun, Jul 22, 2018, 9:41 PM UTC

flafla2 wrote: post #83

ajross wrote: post #61

Earlier quoted context omitted.

No, this is a firmware bug. It just happens to be firmware that runs on the ME and not the main cores. The code is stored externally to the CPU along with the BIOS, and looks like it's being patched via a BIOS update.

The bug was part of the IME’s built in HTTP server, which is what the parent was alluding to.

Sure, but that's "in our CPUs" in, kinda, exactly the same way that nginx is. It's a microcontroller. It's not like the hardware implemented an HTTP server.

Re: Intel patches new ME vulnerabilities

#217

Post by RaleyField » Sun, Jul 22, 2018, 9:47 PM UTC

lurker456 wrote: post #51

Does this affect ME or ME with AMT enabled ? The article talks about ME but it's AMT that runs the http server.

Neither does Intel's advisory (which is something we have come to expect from Intel - complete nonchalant disregard for details/quality/security/customers).

They could specify whether I'm good with AMT turned off or they went extra stupid and AMT processes packets even when it's off. My bet is on the later because otherwise they'd say to disable AMT otherwise. My next processor will be AMD.

Re: Intel patches new ME vulnerabilities

#218

Post by RaleyField » Sun, Jul 22, 2018, 9:59 PM UTC

arnaudsm wrote: post #152

I'm surprised by the lack of media coverage: Intel is deliberately leaving billions of CPUs vulnerable. For a $200 billion company, refusing to spend some ressources to patch all generations is irresponsible. Think of how many governments still use <2012 CPUs.

The greed and irresponsibility is boundless. They could set aside 10 billion and have excellent security. 1 billion could have bought thousand phds digging through their processors and I bet they could dig out boneheaded flaws like Spectre.

Out of band management is fine, but have it completely disabled by default, have it run on co-processor optimized for security, not speed, in language optimized for security, not speed and when it's on have it filter all packets that aren't signed to unique secret key. Basic stuff.

Re: Intel patches new ME vulnerabilities

#219

Post by solarkraft » Sun, Jul 22, 2018, 10:10 PM UTC

monocasa wrote: post #212

std_throwaway wrote: post #72

I don't want a patch. I don't use that thing for anything. I want them to disable that thing by default! Leaving those backdoors open in older products should lead to a recall because the flaw was there all along.

You do use it. AFAIK, the ME handles power management, legacy backwards compatibility, and all sorts of other random chipset stuff you don't necessarily want to expose to the main cores, in addition to the DRM and remote administration capabilities.

But why can't I disable the remote administration capabilities?

Re: Intel patches new ME vulnerabilities

#220

Post by TomMarius » Sun, Jul 22, 2018, 10:26 PM UTC

ebikelaw wrote: post #168

brudgers wrote: post #108

Earlier quoted context omitted.

The ordinary life cycle of an Intel CPU is the five t̶h̶r̶e̶e̶ year depreciation schedule in the US tax system. The life cycle for Intel's most important customers is less and is based on operating cost in large data centers and these are driven by density, throughput, and energy utilization. Traditionally this has been two years or less as reflected in Intel's tick-tock iteration strategy. The critical life cycle fo…

This is not in accordance with my experience. The life of an Intel platform in a datacenter is more like 7-10 years.

What insurance comapny insures that? What company offers SLAs like that? I want in on that deal!