Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Intel platforms from 2008 onwards have a remotely exploitable security hole

semiaccurate.com

Post reply on HN
Print view View original

21–30 of 190 posts

Re: Intel platforms from 2008 onwards have a remotely exploitable security hole

#21

Post by tomku »

resoluteteeth wrote: post #16
_wmd wrote: post #8

Zero details and zero cross references, zero mentions on Google and zero mentions in any security list I'm on. Charlie blowing nonsensical steam yet again?

The article implies that they have been privately trying to get Intel to fix it, so there is no reason it would have been mentioned publicly anywhere. Now a patch is coming out but Intel is still trying to keep it quiet, so he's trying to warn people disable AMT and be ready to apply patches ASAP. Presumably he didn't even want to disclose the existence of the vulnerability publicly until there was some sort of fix,…

If Charlie was a security researcher and SemiAccurate was a well-regarded security firm, I would not expect details or cross-references or mentions on security lists. Charlie is not a security researcher, he's a journalist, and SemiAccurate is the tech equivalent of a supermarket tabloid. He is not a credible primary source for anything security-related, particularly given SemiAccurate's reputation for publishing rumors as facts.

None of that means he's necessarily wrong, just that you should be very careful about believing his claims without supporting evidence. A lot of people here on HN have thought that a remote ME exploit was only a matter of time, so an article claiming to validate that belief will not get as much skepticism as it should.

Re: Intel platforms from 2008 onwards have a remotely exploitable security hole

#23

Post by LeifCarrotson »

lurker456 wrote: post #5

Great news that this finally came to light. After learning about remote management capabilities I've always suspected it had holes. Large attack surface, any exploit would have a high value, and closed source. Perhaps one day we'll be able to buy CPU's without this "feature". I'm betting AMD and ARM are in the same boat.

> After learning about remote management capabilities I've always suspected it had holes. Large attack surface, any exploit would have a high value, and closed source.

Even after reading this, I'm still not convinced it does have holes. It's so high value (pervasive, incredibly powerful, and old) that if it were possible a bad actor would have used it. The spectrum of possibilities is small:

    1. The hole does not exist, but SemiAccurate thinks it does.
    2. It exists, but only SA has discovered it.
    3. SA discovered it along with a few bad actors, who are using it surreptitiously and haven't been caught.
    4. It's being used all over the place, it's a widely acknowledged security disaster.
We're not in state 4. The article suggests we're in 2 or 3. 2 seems unlikely - SA does not have special abilities that transcend those of other security research firms. 3 seems especially unlikely: with this much power available, and with the hole being patchable, could they resist using it? Which leaves option 1.

Re: Intel platforms from 2008 onwards have a remotely exploitable security hole

#24

Post by tomku »

LeifCarrotson wrote: post #23
lurker456 wrote: post #5

Great news that this finally came to light. After learning about remote management capabilities I've always suspected it had holes. Large attack surface, any exploit would have a high value, and closed source. Perhaps one day we'll be able to buy CPU's without this "feature". I'm betting AMD and ARM are in the same boat.

> After learning about remote management capabilities I've always suspected it had holes. Large attack surface, any exploit would have a high value, and closed source. Even after reading this, I'm still not convinced it does have holes. It's so high value (pervasive, incredibly powerful, and old) that if it were possible a bad actor would have used it . The spectrum of possibilities is small: 1. The hole does not exi…

SemiAccurate isn't a security research firm, it's a tech news blog. There's basically no chance that they've discovered anything. If there's an exploit, they would've had to have heard about it from either a source inside Intel or an actual security researcher of some kind.

Re: Intel platforms from 2008 onwards have a remotely exploitable security hole

#26

Post by devy » 

   Security is a cost center and most OEMs run on margins too thin 
   to bother with security patches even if they cared. Most simply don’t care.
I think that sums up pretty well why downstream vendors are treating security casually. So the billion dollar question is, how do we fix this, as a tech community?

Re: Intel platforms from 2008 onwards have a remotely exploitable security hole

#27

Post by fulafel »

LeifCarrotson wrote: post #23
lurker456 wrote: post #5

Great news that this finally came to light. After learning about remote management capabilities I've always suspected it had holes. Large attack surface, any exploit would have a high value, and closed source. Perhaps one day we'll be able to buy CPU's without this "feature". I'm betting AMD and ARM are in the same boat.

> After learning about remote management capabilities I've always suspected it had holes. Large attack surface, any exploit would have a high value, and closed source. Even after reading this, I'm still not convinced it does have holes. It's so high value (pervasive, incredibly powerful, and old) that if it were possible a bad actor would have used it . The spectrum of possibilities is small: 1. The hole does not exi…

There are many high profile targets where "if it were possible a bad actor would have used it" has been proven false. See recent publicity about vulnerabilities in printers, antivirus products, etc.

Re: Intel platforms from 2008 onwards have a remotely exploitable security hole

#28

Post by thraway2016 »

devy wrote: post #26

Security is a cost center and most OEMs run on margins too thin to bother with security patches even if they cared. Most simply don’t care. I think that sums up pretty well why downstream vendors are treating security casually. So the billion dollar question is, how do we fix this, as a tech community?

This is an unpopular position, but approaches like BrickerBot are likely to be effective.
Post reply on HN