Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Neutralize ME Firmware on SandyBridge and IvyBridge Platforms

hardenedlinux.org

Post reply on HN
Print view View original

31–40 of 81 posts

Re: Neutralize ME Firmware on SandyBridge and IvyBridge Platforms

#31

Post by feld »

dsp1234 wrote: post #10
TD-Linux wrote: post #5

Earlier quoted context omitted.

How much are you willing to pay for it? There's the Talos Secure Workstation, which has no such ME firmware (but costs ~$4.5k) [1]. A RISC-V desktop is pretty far out. There is an Arduino style microcontroller being made in silicon, though [2]. [1] https://www.crowdsupply.com/raptor-computing-systems/talos-s... [2] https://www.crowdsupply.com/onchip/open-v

Note that it looks like they may not make their goal. It ends on Dec 15th, and they only have about 10% raised ($344,310 raised of $3,700,000 goal)

It's only 32bit. This is not something I'm interested in funding. If it was 64bit or the 128bit version of RISC-V it would be more alluring.

Re: Neutralize ME Firmware on SandyBridge and IvyBridge Platforms

#32

Post by tedunangst »

kevin_b_er wrote: post #7
tedunangst wrote: post #6

What if I like using the integrated NIC?

The NIC permits remote access to the Intel rootkit, you probably don't want to use the NIC.

If the solution to ME stealing my secrets is simply "don't plug in a network cable" then that's a lot simpler and I'm not going to bother with the potential brick making. Why go through all this and still not have a working computer?

Re: Neutralize ME Firmware on SandyBridge and IvyBridge Platforms

#33

Post by [deleted] »

nitrogen wrote: post #24
yuhong wrote: post #22

Earlier quoted context omitted.

AFAIK the remote network access ("AMT") has to be specifically enabled.

Some of the paranoia around ME is the possibility of undocumented commands or magic byte sequences in software or via network interface that give an attacker invisible control of the ME without the user enabling AMT. The NIC is probably still powered and active for WoL. It's also conceivable that a state-level adversary could have hidden arbitrary DMA instructions in a NIC firmware, that only activate with a signed r…

[deleted]

Re: Neutralize ME Firmware on SandyBridge and IvyBridge Platforms

#34

Post by devereaux »

wmf wrote: post #27
phantom_oracle wrote: post #19

Has Intel ever commented about this issue of removing ME? Surely, at least 1 Intel staffer reads HN and they must have discussed this internally. Unless they just brush this off as negligible (a couple thousand paranoid/"extremist" users) ?

Their discussion may have consisted of "too bad these extremists don't realize that the ME is harmless if you don't have an Intel NIC".

There is a device visible on the PCI bus. How hard is it to imagine that userland programs could somehow pass requests to that device, and have the ME do bad things to the CPU or the RAM?

How hard is it to imagine some special string in RAM could trigger the ME in a similar way? (so many CPU instructions - I would be surprised if there wasn't one to talk to the ME)

Exploits and vulnerability are mitigated by proper analysis and ecological diversity.

Here we have an attack channel present of every single Intel based computer, regardless of the CPU.

Call me an extremist if you want, but this is far from harmless.

Re: Neutralize ME Firmware on SandyBridge and IvyBridge Platforms

#36

Post by wolfgke »

loeg wrote: post #29
wolfgke wrote: post #28

Earlier quoted context omitted.

> How much are you willing to pay for it? Wrong question. Correct question would be: "How much are you willing and able to pay for it?" (for me it much more strongly fails because of the second criterion).

If you're willing to pay more than you're able to, I think you need to reevaluate your approach to personal finance first.

Thanks, but I believe my approach to personal finance is quite right and responsible. This does not contradict the fact that there are things that I am willing to pay for, but not able to. Exactly because my approach to personal finance is responsible, I don't spend money in this situation.

Re: Neutralize ME Firmware on SandyBridge and IvyBridge Platforms

#37

Post by kuschku »

wmf wrote: post #27
phantom_oracle wrote: post #19

Has Intel ever commented about this issue of removing ME? Surely, at least 1 Intel staffer reads HN and they must have discussed this internally. Unless they just brush this off as negligible (a couple thousand paranoid/"extremist" users) ?

Their discussion may have consisted of "too bad these extremists don't realize that the ME is harmless if you don't have an Intel NIC".

So that’s why my Intel NIC never really worked well, and two devices showed up in my router as connected?

Re: Neutralize ME Firmware on SandyBridge and IvyBridge Platforms

#38

Post by kuschku »

sounds wrote: post #14
dsp1234 wrote: post #9

Earlier quoted context omitted.

Just reboot after neutralization. "With ME neutralized, the MEI interface disappears from the PCI bus, and the integrated NIC ceases to work, but will resume to work after a reboot."

The phrasing there is confusing. Does the NIC break because the ME is neutralized? Then rebooting again with the ME neutralized will break the NIC again. Why would the NIC only break once after the ME is neutralized? The system is started from a fully powered-off state after the ME firmware is updated. Maybe the NIC has some sort of non-volatile state that gets updated when the ME fails to initialize, and then the NI…

It seems to be that the ME takes exclusive control of the NIC, and controls it.

After a reboot, the NIC starts without the ME ever taking control of it, so it works.

Re: Neutralize ME Firmware on SandyBridge and IvyBridge Platforms

#39

Post by loeg »

wolfgke wrote: post #36
loeg wrote: post #29

Earlier quoted context omitted.

If you're willing to pay more than you're able to, I think you need to reevaluate your approach to personal finance first.

Thanks, but I believe my approach to personal finance is quite right and responsible. This does not contradict the fact that there are things that I am willing to pay for, but not able to. Exactly because my approach to personal finance is responsible, I don't spend money in this situation.

I think we must understand the word "willing" differently.

Re: Neutralize ME Firmware on SandyBridge and IvyBridge Platforms

#40

Post by kevin_b_er »

yuhong wrote: post #22
kevin_b_er wrote: post #11

rootkit is defined by google search as "a set of software tools that enable an unauthorized user to gain control of a computer system without being detected." * A set of software tools: Check * Unauthorized user: Check Caveat: user is not authorized by you, but by someone else (Intel) * Gain control of a computer system without being detected. Can access your machine while it appears to be "powered off" but plugged i…

AFAIK the remote network access ("AMT") has to be specifically enabled.

http://people.kth.se/~maguire/DEGREE-PROJECT-REPORTS/100402-...

PDF Page 66

This attack could be used indefinite times to compromise the Intel’s AMT remote provisioning process and subverts the security of the non configured PCs that include the AMT functionality even while it is disabled within the BIOS configuration as presented in section 3.7.6.

AMT is always active, even if you've set it to "Disabled" and can be remotely activated. Again, without your authorization.

Post reply on HN