'Unfixable' security flaw in Intel boot ROM • Hacker News Board

Re: 'Unfixable' security flaw in Intel boot ROM

#51

Post by kelnos » Fri, Mar 13, 2020, 12:02 AM UTC

gowld wrote: post #37

RandomTisk wrote: post #12

Earlier quoted context omitted.

Why do we need ME for that?

Active Management Technology (AMT) is built on top of Intel ME. ME lets a trusted party control the computer without letting every peer control the computer.

I think the point is that all of this can be implemented purely in software that runs at the OS level, or even application level. There's no need to put this in a place where it's difficult to update/patch, and is entirely opaque and user-hostile to the point that the actual end-owner of the hardware can reasonably be sure they know what it does and can control what it does.

In other words: I don't want a backdoor into my system that I can't examine or disable.

Re: 'Unfixable' security flaw in Intel boot ROM

#52

Post by scenethrowaway » Fri, Mar 13, 2020, 1:10 AM UTC

kristofferR wrote: post #44

hannula wrote: post #38

So it seems that the flaw can’t plausibly be exploited by a remote or adjacent attacker or software. So what’s the impact here? Warez scene wreaking havoc with lossless WEB-DLs?

A ton of warez groups (even a lot of P2P ones) already have a Widewine exploit that works for >=1080p anyway, some groups (BLUTONiUM, PETRiFiED ++) even have a 2160p exploit. It's actually quite amazing that the 1080p exploit hasn't leaked and been patched yet, considering how widespread it is.

<=1080p content is typically only protected by code obfuscation. There aren't usually any "exploits", merely a moderately skilled reverse engineering effort - as such, nothing can be patched any time soon.

Re: 'Unfixable' security flaw in Intel boot ROM

#53

Post by pabs3 » Fri, Mar 13, 2020, 1:25 AM UTC

This reminds me of the recent iPhone bootrom vulnerability, which lead to Android on the iPhone:

https://checkra.in/ https://projectsandcastle.org/

Re: 'Unfixable' security flaw in Intel boot ROM

#54

Post by gggmaster » Fri, Mar 13, 2020, 1:43 AM UTC

eatonphil wrote: post #22

The labs team at work wrote a bit [0] about why this is over-hyped (more context in the full post): > Arbitrary code execution is bad! But exploiting this vulnerability requires local access at a minimum, compounded by the attacker needing to exploit a relevant device to gain a foothold on the system. This list of valid footholds is quite limited. For instance, an attacker would need to perform code execution in the…

So this is a good feature for fighting against DRM.

Re: 'Unfixable' security flaw in Intel boot ROM

#55

Post by gggmaster » Fri, Mar 13, 2020, 2:05 AM UTC

gowld wrote: post #37

RandomTisk wrote: post #12

Earlier quoted context omitted.

Why do we need ME for that?

Active Management Technology (AMT) is built on top of Intel ME. ME lets a trusted party control the computer without letting every peer control the computer.

AMT is not available with their Z, B and H chipsets. Leave us with only the downsides.

Re: 'Unfixable' security flaw in Intel boot ROM

#56

Post by dependenttypes » Fri, Mar 13, 2020, 2:54 AM UTC

gowld wrote: post #35

matheusmoreira wrote: post #24

Earlier quoted context omitted.

> When this happens, utter chaos will reign. Utter chaos? I don't think so. > Hardware IDs will be forged Seems like a victory for privacy. Who wants to be tracked via hardware IDs? > digital content will be extracted Any victory over DRM technology is a good thing. The only people shedding any tears will be those in the copyright industry. > data from encrypted hard disks will be decrypted People actually rely on pr…

Anybody who doesn't want their data copied will be shedding tears. Including anybody with private files. You are more than welcome to decline to use DRM if you don't like it. Just don't expect people to give you copies of data they don't want shared by you.

> Anybody who doesn't want their data copied will be shedding tears. Including anybody with private files.

FDE and things like OpenPGP are not broken by this.

> You are more than welcome to decline to use DRM if you don't like it

Or to try and break it.

Re: 'Unfixable' security flaw in Intel boot ROM

#57

Post by dependenttypes » Fri, Mar 13, 2020, 3:00 AM UTC

This is great. It might be able to be used by programs like me cleaner.

Re: 'Unfixable' security flaw in Intel boot ROM

#58

Post by ngneer » Fri, Mar 13, 2020, 4:43 AM UTC

rolph wrote: post #40

hannula wrote: post #38

So it seems that the flaw can’t plausibly be exploited by a remote or adjacent attacker or software. So what’s the impact here? Warez scene wreaking havoc with lossless WEB-DLs?

if intel can manage your machine state remotely [they can with ME] then someone else can as well. corporate customers often have an elevated relationship that retail consumers dont have. There is a different level of trust. I dont trust Intel. I didnt ask for ME and i treat any hardware with ME as an edge device. as far as impact is concerned its possible that clone machines could be manufactured with hardware modifi…

Intel cannot manage your machine remotely with AMT. Your IT department can. See Black Hat talk on ME for details.

https://i.blackhat.com/USA-19/Wednesday/us-19-Hasarfaty-Behi...

Re: 'Unfixable' security flaw in Intel boot ROM

#59

Post by ngneer » Fri, Mar 13, 2020, 4:52 AM UTC

mindslight wrote: post #7

> This is used for things like providing anti-piracy DRM protections, and Internet-of-Things attestation "Internet-of-Things attestation" ?? A poor attempt to stick a refreshing buzzword in front of a fundamentally unwanted user-betraying open-society-undermining technology. Remote attestation does away with the basic foundation of protocols for mediating between mutually-untrusting parties, making it so users must t…

Agreed about the evil of DRM and treacherous computing, but do not conflate the shift in trust to a remote party with the attestation mechanism itself, which can be neutral. The idea behind attestation is that hardware signs a quote regarding that which is running on the device, one that is cryptographically verifiable. Verifiable for what purpose is a separate question.

Re: 'Unfixable' security flaw in Intel boot ROM

#60

Post by castratikron » Fri, Mar 13, 2020, 5:18 AM UTC

mysterydip wrote: post #8

OrangeMango wrote: post #6

Earlier quoted context omitted.

> "maintain physical possession of their platform" That ship has sailed.

What about physical possession before you own it? Will this potentially sour a used/refurbished market?

On the contrary it sounds like the secondhand market is going to be flooded with used laptops very soon...