111–120 of 282 posts
Can someone tell me if people have actually spotted the Intel ME doing unauthorized communication? I imagine it should be easy to spot in any network firewall log (note I said network, not OS), and in reality, if it's never been observed to communicate with the outside world without explicitly being told to then do people really need to worry?
Igor Skochinsky (of IDA Hex-Rays fame, among others) has been studying Intel ME for quite some time. He gave a nice talk at Breakpoint summarizing what he'd discovered (slides here [pdf]: https://github.com/skochinsky/papers/blob/master/2014-10%20%... ). Among other things, he finds that ME is capable of running signed Java code which is pushed to the device. Due to the complexity and size of the Java code, it's quit…
ME is capable of running signed Java code How much firmware is in the thing? Is there a whole JVM in there? An OS? That's a lot of attack surface.
That should be able to fit a full Java ME, I think.
Personally I want to buy a laptop that is secure due to travelling to questionable places, I am wondering now whether it will include an Intel CPU in light of this.
Joanna Rutkowska has written a nice paper on the topic, highly recommended: http://blog.invisiblethings.org/papers/2015/x86_harmful.pdf Edit: There's also a talk from 32c3 for those more inclined to watch a video. I am pretty worried ever since I watched that: https://www.youtube.com/watch?v=rcwngbUrZNg (which is why I have researched non-Intel laptop alternatives..cliffnotes: GPUs without BLOBs are hard to find and…
> GPUs without BLOBs are hard to find Any devices without firmware are hard to find. Even if only some have option to upload firmware almost every device on market have closed-source firmware inside it: NICs, USB controllers, hard drives and especially modern SSD, sound cards, etc.
Everything else is a lost cause right now. Keyboards, mice, displays, … Everything is running proprietary firmware blobs.
Earlier quoted context omitted.
You don't have to. Libreboot is available for some Thinkpads. I use an X200s. There are businesses that offer Libreboot flashing services or sell refurbished Laptops with Libreboot installed.
Except libreboot doesn't help. ME executes below BIOS/UEFI.
Earlier quoted context omitted.
> GPUs without BLOBs are hard to find Any devices without firmware are hard to find. Even if only some have option to upload firmware almost every device on market have closed-source firmware inside it: NICs, USB controllers, hard drives and especially modern SSD, sound cards, etc.
NICs exist, occasionally: Atheros Wifi chips work with open-source firmwares. And it shouldn't be too hard to find a GBit ethernet NIC without. Everything else is a lost cause right now. Keyboards, mice, displays, … Everything is running proprietary firmware blobs.
Just wonder how exactly you going to check if hardware have firmware inside it.
I think this is time for AMD or IBM's POWER8/9 to step in. If anything a little good PR vis-a-vis the "rootkit nightmare waiting to happen in your server" would be nice.
See "The World Beyond x86" presentation for a presentation of alternatives, focusing on POWER8: https://raptorengineering.com/TALOS/op_twbx86.php https://static.rpteng.com/TALOS/assets/the_world_beyond_x86....
And it looks like AMD has its own equivalent of ME...
Earlier quoted context omitted.
just like how DVD Encryption ( https://en.wikipedia.org/wiki/Content_Scramble_System ) was never reverse engineered because the key was too difficult to crack ?
CSS is only 40 bits, which is ridiculously easy to crack. 56-bit DES keys are pretty unsafe these days, so you want at least 128 bits if you're talking private keys. If it's using 2048-bit RSA, that's perhaps equivalent to a 256-bit private key. So entirely different ballpark to CSS.
It may be, that Intel didn't plan this as an NSA/XYZ back door - but it doesn't actually matter. What matters is that we know 1) Intel has such technology implemented in allmost all desktops/servers currently running 2) you can access those machines remotely (even over GSM) and perform reads/writes. Example misuse: somebody can put illegal stuff on your machine and then sue you... (Intel has marketed this feature for…
>1) Intel has such technology implemented in allmost all desktops/servers currently running Ever wondered why Google is working on their own CPU?
My question is whether alternatives are secure, such as AMD or ARM? I imagine the ARM architecture to be too scrutinised and low power to get away with that sort of thing? Personally I want to buy a laptop that is secure due to travelling to questionable places, I am wondering now whether it will include an Intel CPU in light of this.
Best usable hardware is old Intel laptops except you want something like MIPS laptop from Lemote.