Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

20GB leak of Intel data: whole Git repositories, dev tools, backdoor mentions

twitter.com

Post reply on HN
Print view View original

171–180 of 476 posts

Re: 20GB leak of Intel data: whole Git repositories, dev tools, backdoor mentions

#171

Post by jopsen »

ccktlmazeltov wrote: post #146
skissane wrote: post #135

Earlier quoted context omitted.

Once I got a complaint from a security auditor that some code was using MD5. It wasn’t being used for any security purpose, just to check whether an autogenerated file had been manually edited. We decided it was easier to do what they wanted than argue with them, so we replaced it with CRC32C. That would have been faster than MD5, but nobody cares about saving a few milliseconds off reading a configuration file at st…

this is hilarious

Makes perfect sense.

Defense in depth, if you can grep the source code and not find any references to md5, then you have quickly verified that the code probably doesn't use md5.

This you can easily verify again later, you can even make a test for it :)

Even if in practice this had no impact, removing md5 usage, will make it harder to accidentally introduce it in the future.

Re: 20GB leak of Intel data: whole Git repositories, dev tools, backdoor mentions

#172

Post by dogma1138 »

johnnyfaehell wrote: post #126
dogma1138 wrote: post #94

Earlier quoted context omitted.

It doesn’t matter if it’s provable or not, most developers won’t risk it especially if they want to keep their jobs or be hireable. If you review the content and publish say a blog post, even without legal repercussions it can impact your ability to be hired in the future since everything you do from that point can be tainted. So if you do look you should keep it quite or publish it under a pen name that you can’t ev…

Say we use the Microsoft Windows code that got leaked, was anyone black listed for that? Also, I would assume other processor companies hire people from other processor companies and everyone all wants the best, most of the basic knowledge would have already made it's way to AMD and other companies.

But that isn’t basic knowledge, if you work in firmware development, embedded, SOC design etc. and your employer or future employers might be competing against Intel in some market segment (which given the sheer amount of products Intel has isn’t an unlikely scenario) I would be very careful about admitting not to mention publishing content based on this leak.

If you work in a completely unrelated field then you don’t need to care as much.

Re: 20GB leak of Intel data: whole Git repositories, dev tools, backdoor mentions

#173

Post by j1elo »

schmichael wrote: post #4
ccurrens wrote: post #2

> If you find password protected zips in the release the password is probably either "Intel123" or "intel123". This was not set by me or my source, this is how it was aquired from Intel. Can't say I'm surprised, people are lazy. Another large tech company I used to work for commonly used an only-slightly more complex password. But it was never changed, so people who had left the team still could have access to things…

Password protection may have been used to bypass antivirus and other filters. While you should treat dumps like this with a lot of suspicion, treat password protected zips with a heaping dose of care as they may have been used to evade automated defenses.

Gmail won't even let you send a JAR file, or a zip you made out of a project where it happens to be a .jar file somewhere deep in some random subdirectory.

Re: 20GB leak of Intel data: whole Git repositories, dev tools, backdoor mentions

#174

Post by formerly_proven »

pizza wrote: post #106
kmeisthax wrote: post #61

Earlier quoted context omitted.

Misappropriating trade secrets for financial gain is a punishable offense, and this data would qualify as a trade secret, at least for as long as it's not general knowledge to everyone or it has yet to be reverse-engineered. Aside from that, much of the data in these files has standard copyright and patent concerns.

OK then, out of curiosity, what are the relevant laws being broken here?

Copyright infringement probably works for them.

Re: 20GB leak of Intel data: whole Git repositories, dev tools, backdoor mentions

#175

Post by heavenlyblue »

Traster wrote: post #112
yelloworangefog wrote: post #73

Earlier quoted context omitted.

Frankly I don't think Intel's track record affords them the privilege of having good faith be assumed with something like this.

Intel employes 100,000 people, and most of them aren't even aware of most of Intel's transgressions, let alone approve of them.

It’s akin to defending Nazis because there were some Nazis who were forced to be Nazis because they couldn’t find a better job.

Re: 20GB leak of Intel data: whole Git repositories, dev tools, backdoor mentions

#176

Post by dathinab »

danw1979 wrote: post #6

The advice to try a password of “Intel123” on any protected files says it all. This organisation genuinely deserves whatever is coming for them.

In my experience password protected files are often password protected for obscure reasons which have nothing to do with the intent of keeping them secret, like:

- prevent anti virus from messing with it

- keep to some obscure regulations wrt. Contacts or law, where is enough if you can argue the data was encrypted.

Re: 20GB leak of Intel data: whole Git repositories, dev tools, backdoor mentions

#177

Post by spijdar »

netsec_burn wrote: post #152
wmf wrote: post #41

Earlier quoted context omitted.

AFAIK the ME is required to initialize the processor so it can never be completely disabled. The best you could do is remove any code beyond necessary initialization which has mostly already been done by me_cleaner.

Or buy a laptop from a manufacturer with the ME inoperable.

The entire ME can't "technically" be disabled on modern Intel silicon. It's essentially the processor that "bootstraps" the whole CPU. Without (cryptographically signed) code running on the ME, the system can never boot.

All the non-necessary bits can be disabled out of the box, however.

Re: 20GB leak of Intel data: whole Git repositories, dev tools, backdoor mentions

#178

Post by lloeki »

ImaCake wrote: post #117
akira2501 wrote: post #100

Earlier quoted context omitted.

A manufacturer wanted to upgrade one of their equipment lines to be more modern. The developers of the original product, both hardware and software, were no longer with the company. Since they just wanted to add some new features on top and present a better rack-based interface to the user, they decided to build a bigger box, put one of the old devices inside the box, then put a modern PC in there, and just link the…

This can't be real... are you serious? It sounds like one of those silly buisness parabels!

It sounds like Dell’s iDRAC somehow. (Not that it is, but iDRAC had me scared more often than not)

Re: 20GB leak of Intel data: whole Git repositories, dev tools, backdoor mentions

#179

Post by restingrobot »

heavenlyblue wrote: post #165
skissane wrote: post #135

Earlier quoted context omitted.

Once I got a complaint from a security auditor that some code was using MD5. It wasn’t being used for any security purpose, just to check whether an autogenerated file had been manually edited. We decided it was easier to do what they wanted than argue with them, so we replaced it with CRC32C. That would have been faster than MD5, but nobody cares about saving a few milliseconds off reading a configuration file at st…

You don’t actually need to listen to auditors. People like you (who can’t be bothered to argue because it’s apparently too hard) is the reason that smartass is still selling their services.

So much this. My company just got done shelling out a ton of money for some asshat to tell me that we can't use http on a dev server.

Re: 20GB leak of Intel data: whole Git repositories, dev tools, backdoor mentions

#180

Post by jug »

pdevr wrote: post #29

Intel denies it was hacked: https://twitter.com/TheRegister/status/1291461942624677889

A guy on reddit claiming to be ex-Intel thinks it looks like material shared with OEM’s and thus a breach of something like a motherboard manufacturer rather than Intel.
Post reply on HN