Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Secrets of Intel Management Engine – Hidden code in your chipset

slideshare.net

Post reply on HN
Print view View original

31–40 of 64 posts

Re: Secrets of Intel Management Engine – Hidden code in your chipset

#31

Post by morganvachon »

dublinben wrote: post #25
morganvachon wrote: post #20

Earlier quoted context omitted.

Thanks for that, I'll have to look into that device and see what it's all about. Edit: So it's an off the shelf Thinkpad X60 with fully open source software? I thought that was something he was wary of, given his stance on Intel's partially closed designs. Also, wouldn't the TPM chip be an obstacle given the privacy concerns surrounding it raised by RMS himself?[1] From what I saw from the gluglug website, there is n…

From my understanding, you can disable the TPM by removing the kernel driver and any other drivers. The X60 is the last Thinkpad model in which it lives in a separate chip.

Is it really disabled though? The hardware is still there unless you extract the chip itself. For example, Intel's AMT exists at a level so far below the software and UEFI/BIOS that you can have just power and Ethernet/wifi plugged into the board, and it will "phone home" if it is configured to. Boards with GSM modules can even be controlled remotely via SMS commands.

I realize that TPM and AMT are completely different animals, but AMT shows us that a low level "security" device on board can potentially mean compromised privacy and loss of control.

Re: Secrets of Intel Management Engine – Hidden code in your chipset

#32

Post by pgeorgi »

morganvachon wrote: post #20
pakled_engineer wrote: post #17

Earlier quoted context omitted.

rms doesn't have the Loongson netbook anymore, he rolls with a Gluglug X60 now I believe.

Thanks for that, I'll have to look into that device and see what it's all about. Edit: So it's an off the shelf Thinkpad X60 with fully open source software? I thought that was something he was wary of, given his stance on Intel's partially closed designs. Also, wouldn't the TPM chip be an obstacle given the privacy concerns surrounding it raised by RMS himself?[1] From what I saw from the gluglug website, there is n…

The TPM can be fully controlled by the user (or ignored altogether).

Much misinformation about the TPM stems from the Anderson paper, which mixed up real TPM implementation and then-future Palladium concepts and claimed that this all runs in contemporary TPM chips.

In reality, TPM is a chip with (rather slow) crypto functionality and a reasonable secure storage whose content can be "sealed" to certain system states. That state information is pushed to the TPM by the host system, since the TPM is a fully passive component. (Exception: new Intel chipsets feature 'Boot Guard' where the chipset pushes some root trust information to the TPM in a way that code on the CPU can't modify - but the TPM is still passive)

If you control the firmware, you can build a reasonably secure environment using the TPM. But coreboot (or its libreboot distribution) by default don't even do that with the TPM.

Re: Secrets of Intel Management Engine – Hidden code in your chipset

#33

Post by pgeorgi »

cm3 wrote: post #23

Is it part of vPro or available in every cpu? Can it be disabled like TSX?

The ME is on _every_ CPU, and you can't easily disable it (there are ways, but it's unclear how much really shuts down, and you might lose power management features).

vPro is merely the larger ME firmware: The small one is 1.5-2MB, the vPro one is 5-7. A non-vPro mainboard probably comes without a SOAP-capable webserver (although I wonder what they need 1.5MB of code for), but the chip to run it is all there.

Re: Secrets of Intel Management Engine – Hidden code in your chipset

#34

Post by venomsnake »

WhitneyLand wrote: post #11

tldr: Intel's remote management capabilities are obscurely baked into every chipset. The ME has out of band access to the network card and main memory. Since ME also has its own flashable memory in principle a machine could be compromised in a nearly undetectable way. The presentation shows that a lot of interesting details of ME have been brought to light but it has also withstood a first round of attacks. No rootki…

Lets just hope that intel security teams are better than Sony Pictures' ones.

After the sony hack ... lets say that I feel less secure about anything.

Re: Secrets of Intel Management Engine – Hidden code in your chipset

#35

Post by sinetek »

throwaway2048 wrote: post #15
morganvachon wrote: post #8

Earlier quoted context omitted.

> My first thought was that it seems increasingly clear that Stallman has been right all along. The problem is that being philosophically right doesn't always mean being practically right. In order to create the perfect Stallman-esque machine, one would have to design everything from the logic chips up from scratch, because in the end, no third party can be trusted. He says this himself about the Loongson system he u…

We can certainly do a lot better than this, an attitude of "unless its perfect its futile to even try" is defeatist bullshit, and not what Stallman endorses at all.

there's plenty we can do. Bunnie's Novena laptop is a great example of moving in the right direction. It all depends on speed I guess; you could have a completely open hardware laptop using an FPGA, but speed would be an issue for sure

Re: Secrets of Intel Management Engine – Hidden code in your chipset

#36

Post by edmccard »

userbinator wrote: post #10
icarusmad wrote: post #9

ARC[1], not SPARC. It evolved from the SuperFX chip used in some SNES games. [1]: http://en.wikipedia.org/wiki/ARC_International

The earlier ME versions used an ARC. The later ones use a SPARC. Look at slide 50.

Slide 16 says that ME v1.x used an ARCTangent-A4 and that ME v2.x uses an ARC 600.

Re: Secrets of Intel Management Engine – Hidden code in your chipset

#37

Post by sounds »

cm3 wrote: post #23

Is it part of vPro or available in every cpu? Can it be disabled like TSX?

The real question is, what happens if you flash a custom BIOS that just ignores the ME?

Intel chips up to (I think) 2006 would happily boot without the ME enabled ("ME optional").

Intel's newer chipsets have a watchdog in the ME hardware which will reset the main CPU if the ME is not initialized by the BIOS ("ME mandatory").

Combined with the as-of-yet unbroken RSA signature on any ME firmware, this has some pretty astounding implications.

Re: Secrets of Intel Management Engine – Hidden code in your chipset

#38

Post by sp332 »

sinetek wrote: post #35
throwaway2048 wrote: post #15

Earlier quoted context omitted.

We can certainly do a lot better than this, an attitude of "unless its perfect its futile to even try" is defeatist bullshit, and not what Stallman endorses at all.

there's plenty we can do. Bunnie's Novena laptop is a great example of moving in the right direction. It all depends on speed I guess; you could have a completely open hardware laptop using an FPGA, but speed would be an issue for sure

The Novena has a quad-core Cortex A9 as well as the FPGA. A lot of people who buy it probably won't use the FPGA at all. In fact, the Spartan-6 FPGA might have more secrets than the CPU.

Re: Secrets of Intel Management Engine – Hidden code in your chipset

#40

Post by cm3 »

pgeorgi wrote: post #33
cm3 wrote: post #23

Is it part of vPro or available in every cpu? Can it be disabled like TSX?

The ME is on _every_ CPU, and you can't easily disable it (there are ways, but it's unclear how much really shuts down, and you might lose power management features). vPro is merely the larger ME firmware: The small one is 1.5-2MB, the vPro one is 5-7. A non-vPro mainboard probably comes without a SOAP-capable webserver (although I wonder what they need 1.5MB of code for), but the chip to run it is all there.

Oh no. I thought I could select the right chip like you can do to dodge TSX and HT.

What if I get an AMD CPU? Do those also have an IPMI in disguise inside the CPU package wired to a network interface?

Post reply on HN