Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

“We have obtained fully functional JTAG for Intel CSME via USB DCI”

twitter.com

Post reply on HN
Print view View original

391–400 of 413 posts

Re: “We have obtained fully functional JTAG for Intel CSME via USB DCI”

#391

Post by mlvljr »

madez wrote: post #324
mlvljr wrote: post #231

Earlier quoted context omitted.

I heard https://beagleboard.org/black can boot and run Linux w/o any blobs either in bootloader or kernel (provided you're OK with a sub-par screen resolution and not using the onboard GPU) https://news.ycombinator.com/item?id=12584880 and others might have details on WiFi and such

The BeagleBoard X15 seems very interesting. The onboard GPU is definitely a problem though. Why didn't they go for a useable GPU? And no, if it does not have open Mesa drivers, it is not usable. I really wonder why the GPU situation is such a huge mess. Very few are supported by free drivers and the closed drivers are, besides being closed, often of very low quality. Is patent law holding this situation stable? Isn't…

That would be worth an Ask HN, I suspect -- what's the (big) deal with GPU blobs on embeddeds?!

Re: “We have obtained fully functional JTAG for Intel CSME via USB DCI”

#392

Post by [deleted] »

hnuser2357982 wrote: post #216
acqq wrote: post #113

Earlier quoted context omitted.

Previously, explaining what the author of the tweet did months ago: https://www.digitaltrends.com/computing/intel-kaby-lake-skyl... "As shown in the presentation by security researchers Maxim Goryachy and Mark Ermolov, one way of accessing the JTAG debugging interface" "is to use a" "hardware implant" "running Godsurge" "which can exploit the JTAG debugging interface. Originally used by the National Security Agency -…

That we have one more person capable of exploiting this in the wild.

[deleted]

Re: “We have obtained fully functional JTAG for Intel CSME via USB DCI”

#393

Post by MadWombat »

WhitneyLand wrote: post #52

One way to think of ME is, we all woke up one day and discovered we have had high resolution night vision spy cams installed in our bedrooms. The next realization is there is no way to turn them off or remove them. It’s posisble even moving won’t help. And yet we really don’t seem to care much. Lesser issues generate national outrage and high volumes of press coverage. Why? HN may be uniquely positioned to show us th…

> One way to think of ME

I think I am a bit out of the current state of events. Is ME short for management engine? If that is the case, what is the problem with it?

Re: “We have obtained fully functional JTAG for Intel CSME via USB DCI”

#394

Post by unixhero »

collinmanderson wrote: post #369
oroup wrote: post #360

Earlier quoted context omitted.

Given that the ME has full access to the NIC, outbound traffic could be concealed onboard traffic that is already outbound. If the adversary has also compromised network routers, the traffic could be observed and decoded without explicitly being sent anywhere. Similarly inbound control signals could be delivered by modifying inbound traffic that the ME observed and decided. Depending on your throughput needs the sign…

It's still possible to monitor that traffic, especially at the corporate firewall level, or use a Raspberry Pi, or use an old, pre-ME computer. Until there is evidence, this is technically just a government conspiracy theory.

It isn't a conspiracy when the feared idea has been confirmed. There is a separate os running on the cpu to monitor and control each and every single one of new intel machines.

Re: “We have obtained fully functional JTAG for Intel CSME via USB DCI”

#395

Post by anoother »

bobsoap wrote: post #371
Natsu wrote: post #172

Earlier quoted context omitted.

We should start demanding physical shutters for laptop webcams. Does anyone make those yet?

There's been a Kickstarter called Nope for cams for a few years now, they exceeded funding by a large multiple each time. I got the second version a year ago, they are now on version 3 and added a headphone jack blocker. https://www.kickstarter.com/projects/bungajungle/nope-sound-...

Not really sure about the headphone jack blocker; I'm not aware of an OS where the sound source can't be trivially switched in software, even when headphones are plugged in.

The likelihood is that if an attacker has the ability to record audio, they also have the ability to bypass this device.

Re: “We have obtained fully functional JTAG for Intel CSME via USB DCI”

#396

Post by tripzilch »

CompuHacker wrote: post #368
pksadiq wrote: post #363

Earlier quoted context omitted.

> I unplugged the microphone on my daughter's iMac years ago. Please note that a speaker may also act as a microphone if configured so (at software level). This is especially true for speakers/headphones connected via the jack.

It's likely an internal microphone and speaker; the sound card may not support input through that interface. What you're saying can be true for many other modern computers, though.

There was an article (a while ago) showing that at least one major brand of onboard sound cards has undocumented features to switch the audio-out jack port to input. Cheap headphone/earbuds function as a microphone too, so that's a thing. Only if you leave the earbuds plugged in, of course. It can't listen from an empty jack port.

I (personally) think that intelligence/privacy-wise the mic on many devices is a lot more troubling than a camera. Camera is very directional and (again, personally for me) would at most result in embarrassment? While a microphone can record all conversations in a room/appartment, transmit everything with fairly negligible bandwidth, and taping over it won't do much good. You actually need to open the device and disconnect/cut a wire.

Re: “We have obtained fully functional JTAG for Intel CSME via USB DCI”

#397

Post by e12e »

tripzilch wrote: post #396
CompuHacker wrote: post #368

Earlier quoted context omitted.

It's likely an internal microphone and speaker; the sound card may not support input through that interface. What you're saying can be true for many other modern computers, though.

There was an article (a while ago) showing that at least one major brand of onboard sound cards has undocumented features to switch the audio-out jack port to input. Cheap headphone/earbuds function as a microphone too, so that's a thing. Only if you leave the earbuds plugged in, of course. It can't listen from an empty jack port. I (personally) think that intelligence/privacy-wise the mic on many devices is a lot mo…

OT: @lightedman you're dead. Apparently due to some heated discussion on the term regression. But from a glance I couldn't find anything that stood out enough to warrant a ban. Might want to send an email and have your account unbanned.

Re: “We have obtained fully functional JTAG for Intel CSME via USB DCI”

#398

Post by e12e »

gargravarr wrote: post #40
nolok wrote: post #32

At first it looks nice "oh now we can get rid of it" but it also opens up a very scary near future security-wise. We've now entered a realm where an attacker could simply plug a device on an usb port of your computer for a few seconds to have it access your cpu's ME through USB JTAG and take over it, allowing him to have full access and control over what you do/read/open/type over the network, without you ever knowin…

The 'evil maid' attack is well known, and states that once someone has physical access to your computer, all bets are off. Anything that has DMA enabled (e.g. Firewire or Thunderbolt) offers an external device direct access to the system RAM that is very difficult to defend against, or they could attach a keylogger or modify your bootloader, basically unleash all manner of havok. USB JTAG is really no different from…

I remember following a tutorial along the lines of:

https://www.howtogeek.com/56538/how-to-remotely-control-your...

A couple of years back, and being absolutely horrified at the remote management available on my second-hand lenovo t420s - including management over wlan.

Sure the features are gated by price/cpu "brand" - but I think it's safe to assume a) this is complex software and will have bugs with security implications b) once it's well enough understood - it seems likely it can be "upgraded" (similar to how you today can eg: replace the bios with coreboot).

The conclusion is that we need new platforms - perhaps power5 will help.

Re: “We have obtained fully functional JTAG for Intel CSME via USB DCI”

#399

Post by hlandau »

zgramana wrote: post #168
daxorid wrote: post #132

Earlier quoted context omitted.

Right. ME does make sense as a feature for sysadmins. Except . . . . Well, can you shed light on the following: 1. Why did your team deem it necessary to deny the end-user the capability to disable this feature? 2. Why did your team decide to enable ME on ALL consumer grade chips? You could have only enabled it on, say, Xeon, as a value-add - exactly like you do for ECC support. You could have made more money this wa…

Having been a sys-admin once upon a time (2006-2008), these answers are straight forward. Servers used to have discrete ME cards which were paid add-ons. Competition in the early 2000s drove these ME cards to be integrated in the motherboard in order to better compete on the low end of the market. I’ve had servers I was only able to remotely fix due to the out of band management interface (more than once). They pain…

The problem isn't the existence of the ME as such. Servers have a BMC which implements similar remote management functionality. People could order servers without BMCs, since they're discrete chips, but they don't.

Even Raptor's high-security Talos II has a BMC; the issue isn't having a BMC, the issue is that it's not owner controlled and it's not auditable.

What's wrong with the ME is that

a) it only accepts Intel-signed code; I can't replace the ME firmware with an implementation (e.g. of remote management functionality) that I trust. I also can't repair vulnerabilities in it without the cooperation of both Intel and the vendor (which is often not forthcoming).

Consider the Authorization header bug in the ME's webserver and multiply it by how many machines you claim use this remote management functionality. That's horrifying.

b) it has DMA access to main memory, which is insane.

Look at the fact that every server nowadays has a BMC, in addition to the ME. On a client device the ME would be used to implement similar functionality, so the BMC is actually a wasteful duplication - but server vendors have to use a BMC because they can't program the ME to implement the remote management functionality they need, because only Intel can program the ME. This is stupid.

Re: “We have obtained fully functional JTAG for Intel CSME via USB DCI”

#400

Post by tmzt »

cjbprime wrote: post #347
jmnicolas wrote: post #210

Earlier quoted context omitted.

But now you have to trust the switch to really deactivate the mic. I'm a recursive paranoiac !

The usual* way to handle this is to have a small LED next to the mic/camera that shows when it's on -- and have it wired up to the device in series, such that it's software-impossible for the device to be powered without the light being on. *: it's what we did on the One Laptop Per Child laptop, and I'm sure others have too.

Thank you for inventing the netbook and showing the ODMs how to make low cost PC notebooks.

Any idea where to get a CLI-from-boot notebook for teaching kids programming and encouraging a hacker ethic?

Post reply on HN