Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Intel ME: The Way of Static Analysis

blog.ptsecurity.com

Post reply on HN
Print view View original

21–29 of 29 posts

Re: Intel ME: The Way of Static Analysis

#21

Post by tptacek »

adtac wrote: post #12
theprotocol wrote: post #10

Am I right to be concerned about this, if only in principle? I don't like having a mysterious embedded chip that can access the network when my computer's off.

Exactly. What is Intel's supposed reason for having such a feature?

The Unix server vendors had these features long before Intel did. Having a common out-of-band management interface is hugely valuable for fleet management.

It's not valuable at all for individual retail consumers; in the long run, SGX probably does for the entire Intel customer based, including retail, pretty much everything that the ME might have done for retail users.

Re: Intel ME: The Way of Static Analysis

#22

Post by jerheinze »

tptacek wrote: post #21
adtac wrote: post #12

Earlier quoted context omitted.

Exactly. What is Intel's supposed reason for having such a feature?

The Unix server vendors had these features long before Intel did. Having a common out-of-band management interface is hugely valuable for fleet management. It's not valuable at all for individual retail consumers; in the long run, SGX probably does for the entire Intel customer based, including retail, pretty much everything that the ME might have done for retail users.

The real question is why there's no way to disable it. Certainly, if it was only for out-of-band management then why can't a retail consumer disable? Saying that it's because it does "hardware initialisation" is a weak response, Intel could've designed it in a way that doesn't do that such as with the very first models of CPUs with ME.

Re: Intel ME: The Way of Static Analysis

#23

Post by moppl »

cyphar wrote: post #18
moppl wrote: post #16

This post seems outdated considering these more recent HN posts: Disabling Intel ME 11 via undocumented mode (ptsecurity.com) https://news.ycombinator.com/item?id=15116719 How to hack a turned-off computer, or running unsigned code in Intel ME (blackhat.com) https://news.ycombinator.com/item?id=15298833 Personally I am extremely curious about the upcoming blackhat presentation. If it is really true this might be very…

Being able to run unsigned code in ME might allow (depending on how the exploit works) for either a replacement of the ME firmware entirely or just doing a disable that exceeds even the HAP bit (and the rest of magic that me_cleaner does to remove different sections of the firmware). But we'll have to wait for the slides, I'm hoping there's something really useful there for the coreboot community.

Well, it might also allow for the ultimate rootkit hack of x86 platforms...

Re: Intel ME: The Way of Static Analysis

#24

Post by tptacek »

jerheinze wrote: post #22
tptacek wrote: post #21

Earlier quoted context omitted.

The Unix server vendors had these features long before Intel did. Having a common out-of-band management interface is hugely valuable for fleet management. It's not valuable at all for individual retail consumers; in the long run, SGX probably does for the entire Intel customer based, including retail, pretty much everything that the ME might have done for retail users.

The real question is why there's no way to disable it. Certainly, if it was only for out-of-band management then why can't a retail consumer disable? Saying that it's because it does "hardware initialisation" is a weak response, Intel could've designed it in a way that doesn't do that such as with the very first models of CPUs with ME.

Was it universally easy to disable the lights-out managers on Unix server platforms 10-15 years ago, or did vendors sometimes omit that feature because only a tiny subset of their customers cared about that?

I'm not saying you shouldn't be able to disable it.

Re: Intel ME: The Way of Static Analysis

#27

Post by cyphar »

jerheinze wrote: post #22
tptacek wrote: post #21

Earlier quoted context omitted.

The Unix server vendors had these features long before Intel did. Having a common out-of-band management interface is hugely valuable for fleet management. It's not valuable at all for individual retail consumers; in the long run, SGX probably does for the entire Intel customer based, including retail, pretty much everything that the ME might have done for retail users.

The real question is why there's no way to disable it. Certainly, if it was only for out-of-band management then why can't a retail consumer disable? Saying that it's because it does "hardware initialisation" is a weak response, Intel could've designed it in a way that doesn't do that such as with the very first models of CPUs with ME.

I would think it's more pertinent to ask "is there an economic reason to allow a retail consumer to disable it". Most people don't know (or care) what Intel ME is, and some enterprises that buy machines with Intel CPUs want the management features. Companies aren't implicitly evil, they just don't have altruistic motives (generally). Which means that likely they didn't see it as having a good ROI. This is not what you or I want to be the case, but even if that were solved -- Intel CPUs have a whole variety of other issues that extend beyond ME.

But all of that is missing the point that there is a way to disable it[1], with the HAP or AltMeDisable bits[2]. It's believed they were added for the US government to be able to disable Intel ME (after hardware initialisation). It's not easy (you have to reflash the firmware) because most vendor firmware doesn't allow "internal" flashing from userspace, but it is doable if you buy a $5 flash programmer and a Raspberry PI.

[1]: https://github.com/corna/me_cleaner [2]: https://github.com/corna/me_cleaner/wiki/HAP-AltMeDisable-bi...

Re: Intel ME: The Way of Static Analysis

#28

Post by jerheinze »

cyphar wrote: post #27
jerheinze wrote: post #22

Earlier quoted context omitted.

The real question is why there's no way to disable it. Certainly, if it was only for out-of-band management then why can't a retail consumer disable? Saying that it's because it does "hardware initialisation" is a weak response, Intel could've designed it in a way that doesn't do that such as with the very first models of CPUs with ME.

I would think it's more pertinent to ask "is there an economic reason to allow a retail consumer to disable it". Most people don't know (or care) what Intel ME is, and some enterprises that buy machines with Intel CPUs want the management features. Companies aren't implicitly evil, they just don't have altruistic motives (generally). Which means that likely they didn't see it as having a good ROI. This is not what yo…

You're contradicting yourself, maintaining that they didn't allow disabling the ME because "nobody cared", and on the other hand that they specifically crafted a way to disable the ME for the US government. If they did for the US government, but hided it for everyone else, then the explanation can't be economical.

Re: Intel ME: The Way of Static Analysis

#29

Post by cyphar »

jerheinze wrote: post #28
cyphar wrote: post #27

Earlier quoted context omitted.

I would think it's more pertinent to ask "is there an economic reason to allow a retail consumer to disable it". Most people don't know (or care) what Intel ME is, and some enterprises that buy machines with Intel CPUs want the management features. Companies aren't implicitly evil, they just don't have altruistic motives (generally). Which means that likely they didn't see it as having a good ROI. This is not what yo…

You're contradicting yourself, maintaining that they didn't allow disabling the ME because "nobody cared", and on the other hand that they specifically crafted a way to disable the ME for the US government. If they did for the US government, but hided it for everyone else, then the explanation can't be economical.

I'm not contradicting myself. The US Government isn't a normal consumer, and they have enough manpower to manually flash their machines (they might even get custom firmware from vendors).

Intel hiding CPU features is nothing new. Especially a feature that requires you to attach a flash programmer to your motherboard in order to use it, because you need to modify the descriptor table.

If you're asking why they didn't make it easier to "disable" Intel ME (it's still used for hardware initialisation), then we go back to economics. And they'd have to co-ordinate with people that write mainboard firmware in order to make sure this feature is available for all machines that have Intel CPUs.

[Just to be clear, I'm also critical of Intel. I just don't understand the view that Intel's decisions are anything other than profit-driven. That's how all companies work.]

Post reply on HN