Intel platforms from 2008 onwards have a remotely exploitable security hole

Post by unexistance » Tue, May 02, 2017, 2:34 AM UTC

jackhack wrote: post #2

>>every Intel platform with AMT, ISM, and SBT from Nehalem in 2008 to Kaby Lake in 2017 has a remotely exploitable security hole in the ME (Management Engine) not CPU firmware. >>there is literally no Intel box made in the last 9+ years that isn’t at risk >>SemiAccurate has been begging Intel to fix this issue for literally years Am I the only one who is so cynical to think it must have been deliberate? Intel draggin…

Post by cynix » Tue, May 02, 2017, 3:58 AM UTC

wmf wrote: post #114

dom0 wrote: post #38

Earlier quoted context omitted.

OEMs are not involved at all with ME afaik, it's exculusively controlled by Intel.

OEMs have to ship ME firmware updates; Intel has no way to get them to you directly.

Post by Roritharr » Tue, May 02, 2017, 5:23 AM UTC

inetknght wrote: post #172

frik wrote: post #71

Earlier quoted context omitted.

Let's hope one of the other CPU manufacturers (e.g. AMD) starts supporting LibreBoot and allows to officially disable the ME-equivalent hardware feature, so that Intel get's forced by market-pressur to follow. Intel needs more competition - thanks to AMD latest new 8-core CPU Intel got forced to release a new CPU the had in their basement for years - suddently it's possible for them to release i7 notebook CPUs with m…

> release i7 notebook CPUs with more then two cores U-series i7s have two cores. HQ-series i7s have four cores. Both are mobile CPUs. Remember though that more cores generally means more power consumption which generally means less wallclock time on battery power.

Post by SkyMarshal » Tue, May 02, 2017, 6:31 AM UTC

mschuster91 wrote: post #156

BrainInAJar wrote: post #140

Earlier quoted context omitted.

If the verilog to the chip isn't open, you can't trust it. Stallman is dangerously wrong on this point.

Somewhere you have to externalize trust. What use is the open HDL code for a chip if you cannot be sure someone down in the manufacturing chain hasn't... modified it? Certainly this kind of attack is not your average script kiddy but nation-level instead, but I wouldn't put it past the NSA to pull this off.

Post by DrPizza » Tue, May 02, 2017, 7:05 PM UTC

tyingq wrote: post #167

DrPizza wrote: post #61

Earlier quoted context omitted.

It isn't on all hardware. Intel has two ME firmwares, a small one for consumer systems, and a big one for corporate/enterprise systems. The small one does not (or at least, should not; is not supposed to) include the remote management features. In other words, the separation that you describe exists. Systems with the full firmware sport things such as the vPro branding, and only certain combinations of CPU and chipse…

I'd be careful with assumptions on what "consumer hardware" means. There are desktops, NUC units, etc, that shipped with i5 and i7 chips that had vPro.