Intel platforms from 2008 onwards have a remotely exploitable security hole

Post by yread » Mon, May 01, 2017, 6:54 PM UTC

frik wrote: post #71

AdmiralAsshat wrote: post #10

The short version is that every Intel platform with AMT, ISM, and SBT from Nehalem in 2008 to Kaby Lake in 2017 has a remotely exploitable security hole in the ME (Management Engine) not CPU firmware. We knew this would happen. We knew that the Management Engine was a backdoor, and we knew it was only a matter of time before someone would figure out how to exploit it. This is exactly the reason why Libreboot exists (…

Let's hope one of the other CPU manufacturers (e.g. AMD) starts supporting LibreBoot and allows to officially disable the ME-equivalent hardware feature, so that Intel get's forced by market-pressur to follow. Intel needs more competition - thanks to AMD latest new 8-core CPU Intel got forced to release a new CPU the had in their basement for years - suddently it's possible for them to release i7 notebook CPUs with m…

Post by wmf » Mon, May 01, 2017, 6:59 PM UTC

mediocrejoker wrote: post #79

na85 wrote: post #32

Earlier quoted context omitted.

Credibility issues of the author/website aside, I actually hope this is true, and I hope it's catastrophic for Intel. Maybe then we'll finally see hardware companies taking security seriously.

I'm not familiar with the author. Can you elaborate on the credibility issues?

Post by wmf » Mon, May 01, 2017, 7:03 PM UTC

Slackwise wrote: post #98

codedokode wrote: post #88

Earlier quoted context omitted.

I think the problem is not that this technology exists but rather that the operation of this engine is not transparent, the user cannot examine or disable the software in this engine, cannot write his own software.

IME should exist on an external TPM chip so it's only for those that want it, like enterprises. I really don't understand why the would just shove it into every chipset out there. I understand it needs to get its claws all over the system, but the core should be external and optional.

Post by wmf » Mon, May 01, 2017, 7:06 PM UTC

eberkund wrote: post #109

davidgerard wrote: post #76

Earlier quoted context omitted.

It's a semiconductor news site.

Semiconductor Accurate? Doesn't really sound right grammatically, also the arrows missing the target in their logo lead me to believe half accurate was how they intended the name to be interpreted.

Post by freehunter » Mon, May 01, 2017, 7:36 PM UTC

mike_hearn wrote: post #75

freehunter wrote: post #58

Earlier quoted context omitted.

The fact that people can stay behind platforms, companies, and technologies that are proven to be so inherently insecure that they can never be trusted just boggles my mind. Adobe Flash has a new zero-day every week, but we were saddled with it for years past when it should have been retired because some people didn't want HTML5 to have feature-parity with Flash. Java has a new zero-day every week but we're stuck wit…

Java has a new zero-day every week No it doesn't. The last one was in 2015. Before that I think there was a two year gap to the prior one. Zero days in Java are actually very rare these days. That doesn't mean bugs are rare - like any large piece of software Java gets regular security patches, but those are flaws found by the developers themselves rather than attackers, so they aren't zero days.