Fingers crossed that this will enable some smart person to completely disable the management engine.
20GB leak of Intel data: whole Git repositories, dev tools, backdoor mentions
31–40 of 476 posts
Re: 20GB leak of Intel data: whole Git repositories, dev tools, backdoor mentions
#32In what ways can an end user of intel processor expect to benefit from this? I'm guessing none, since ever consumer interface is already a standard ... Can anybody chime in?
It would be illegal, but some of that code might help Coreboot development.
> but some of that code might help Coreboot development
Unlikely.
Most projects won't come anywhere near this sort of thing. There may be a possibility of doing clean room implementation, but writing the spec based on stolen IP is the problematic step.
Then again, there is a high chance that none of this will be useful.
Re: 20GB leak of Intel data: whole Git repositories, dev tools, backdoor mentions
#33Intel denies it was hacked: https://twitter.com/TheRegister/status/1291461942624677889
... They're claiming it came from an NDA'd source of IP that's shared with customers.
Given that it _appears_ like there are backdoors in this Firmware code, we can conclude that if there are such backdoors then they were shared with numerous customers.
That really doesn't improve the optics of the breach.
Re: 20GB leak of Intel data: whole Git repositories, dev tools, backdoor mentions
#34Earlier quoted context omitted.
Optimistically, the exposure of backdoors in the firmware may cause Intel to patch and close them. Realistically, Intel will patch the firmware and replace the backdoors with new ones.
Besides the backdoors I mean, I was thinking about performance or usability improvements...
Might finally get certain big PC vendors to consider using AMD which will increase competition and make sure we get better hardware in the future..?
Re: 20GB leak of Intel data: whole Git repositories, dev tools, backdoor mentions
#35> If you find password protected zips in the release the password is probably either "Intel123" or "intel123". This was not set by me or my source, this is how it was aquired from Intel. Can't say I'm surprised, people are lazy. Another large tech company I used to work for commonly used an only-slightly more complex password. But it was never changed, so people who had left the team still could have access to things…
Commonly password protected zips are used to bypass security systems that block all zips with exes in them.
I doubt the encryption was believed to be a security barrier.
Re: 20GB leak of Intel data: whole Git repositories, dev tools, backdoor mentions
#36Earlier quoted context omitted.
Password protection may have been used to bypass antivirus and other filters. While you should treat dumps like this with a lot of suspicion, treat password protected zips with a heaping dose of care as they may have been used to evade automated defenses.
Yes - but not for hostile purposes, but because your own company's antivirus won't let you mail an executable to a colleague.
Usually this. Or in my workplace, an image.
Antivirus are some crazy shit that may trigger on any random action and will teach people to follow the most unsafe procedures without questioning, so they can get anything done.
Re: 20GB leak of Intel data: whole Git repositories, dev tools, backdoor mentions
#37At a previous workplace we had a few places in the code which used the word backdoor. It was not an actual backdoor though, but merely a debugging server that could be enabled and allowed you to inspect internal state during runtime. At some point I removed the word backdoor, fearing it would get to a customer or during an audit someone would misunderstand. :|
Yeah, I think that this is likely the case here from the screenshot.
Judging from the current, in all likelihood it is the opcode that APEI (a part of ACPI) tables write to port 0xB2 in order to invoke firmware services that run in system management mode.
Re: 20GB leak of Intel data: whole Git repositories, dev tools, backdoor mentions
#38Earlier quoted context omitted.
Password protection may have been used to bypass antivirus and other filters. While you should treat dumps like this with a lot of suspicion, treat password protected zips with a heaping dose of care as they may have been used to evade automated defenses.
Yes - but not for hostile purposes, but because your own company's antivirus won't let you mail an executable to a colleague.
Your company's antivirus, or GMail. A binary? A zip with a binary? Nuh-uh.
Re: 20GB leak of Intel data: whole Git repositories, dev tools, backdoor mentions
#39[deleted]
Re: 20GB leak of Intel data: whole Git repositories, dev tools, backdoor mentions
#40Someone in China is smiling