15 ms·
How to become the sole owner of your PC [pdf]
- mashlol 10y agoThe PDF won't open for me on a Nexus 5, doesn't show thru githubs mobile site either. Edit: It worked when I requested the desktop version of github though.
- leppr 10y agoTry https://rawgit.com/ptresearch/me-disablement/master/How%20to%20become%20the%20sole%20owner%20of%20your%20PC.pdf https://rawgit.com/ptresearch/me-disablement/master/How%20to...
- 13of40 10y agoIt crashes chrome on my iPad consistently. But then so does a page of animated gifs.
- adamst85 10y agoLooking at that GitHub page brought my workstation to its knees also... It's not a weak machine either (Desktop i5 with 16GB ram).
- yoo1I 10y agoSigh... chrashes on Chromium on Linux as well. <tinfoil_hat>maybe ME is detecting it and wants to prevent us from knowing about it?!?</tinfoil_hat>
- redcap 10y agoThrashes a bit in Chrome on Windows for me.
- niels_olson 10y agoSo ... is my macbook or Dell server pre-pwned by Intel and re-pwned by the Chinese? What, exactly, am I supposed to be afraid of here?
- tk32 10y agoNothing, as long as you have nothing to hide. :-)
- markokrajnc 10y agoSo if you have business secrets, you will have worries... :-)
- pinkbatman 10y agohttps://en.wikipedia.org/wiki/Nothing_to_hide_argument https://en.wikipedia.org/wiki/Nothing_to_hide_argument
- sidhu1f 10y agoWell, as per the coreboot docs [1], the panic level is only 9000+... [1] https://www.coreboot.org/Binary_situation#Intel https://www.coreboot.org/Binary_situation#Intel
- setra 10y agoJust more evidence that modern CPU designs need to die, and that a libre alternative is required.
- mey 10y agoThere are a few groups out there but nothing I would say is commercially viable. https://en.wikipedia.org/wiki/Open-source_computing_hardware#CPU https://en.wikipedia.org/wiki/Open-source_computing_hardware...
- snaky 10y agoThe vast majority of users are comfortable with status quo. Therefore anyone who would implement and sell their own modern CPU with no 'features' like ME, would sell it by premium price - at least, due the much less target audience - and that will lead to audience shrink yet much more.
- nickpsecurity 10y agoThat's exactly what happened almost every time. Another commenter posted a link to OSS CPU's. Two, LEON3 and SPARCT1/T2, are great CPU's released under GPL. Gaisler had a lot of other I.P. to go with LEON3. Now, tell me what FOSS loving companies brought those to market or have a board to sell me? Anyone? Bueller?
- mappu 10y agoThe Talos Secure Workstation is a libre POWER8. https://www.raptorengineering.com/TALOS/prerelease.php https://www.raptorengineering.com/TALOS/prerelease.php Benchmarks: http://www.phoronix.com/scan.php?page=article&item=talos-workstation&num=1 http://www.phoronix.com/scan.php?page=article&item=talos-wor...
- nickpsecurity 10y agoWhere can I get the full source of POWER8 under GPL or another free license? I thought they were licensing it for money. I'm not sure if it's behavioral or RTL either that they provide. I know very little of it whereas I can download Leon or OpenSPARC of their web sites. I'd go with a version of Leon given Oracle is so sue happy.
- incompatible 10y agoHow about firewalling whatever ports the Intel code may use? If it can't communicate with the Internet, presumably it's not likely to do any harm.
- incompatible 10y agoFirewalling ports for incoming connections and IP addresses for outgoing, I should say.
- woodman 10y agoJust be mindful of the fact that you've only increased the difficulty of an attack, the vulnerability still exists. I've got a lenovo that regularly sends out dhcp broadcasts, despite no dhcp code being on disk - it could just as easily call home with dns (sending recursive requests to the same ip as the last successful user initiated query). The only way to fix a ring -N rootkit is to remove ring -N.
- lucb1e 10y ago> sends out dhcp broadcasts, despite no dhcp code being on disk Woah, that's not just sitting there but actually actively doing stuff while bypassing your kernel. This sounds a lot more scary even though I know nothing about this Lenovo dhcp thing, observing it just makes it a lot more real to me. Do you have any more information on this?
- woodman 10y agoIt has been several years since I dug into it, so I can really only offer keywords: AMT[0], which is a component within ME[1]. Also see https://media.ccc.de/v/30C3_-_5380_-_en_-_saal_2_-_201312291830_-_persistent_stealthy_remote-controlled_dedicated_hardware_malware_-_patrick_stewin https://media.ccc.de/v/30C3_-_5380_-_en_-_saal_2_-_201312291... EDIT: I forgot to mention Computrace, the BIOS anti-theft service. IIRC that interacts with ME. [0] https://en.wikipedia.org/wiki/Intel_Active_Management_Technology https://en.wikipedia.org/wiki/Intel_Active_Management_Techno... [1] https://www.kernel.org/doc/Documentation/misc-devices/mei/mei.txt https://www.kernel.org/doc/Documentation/misc-devices/mei/me...
- keyle 10y agoI've never heard of this before. This feels like science-fiction. You'd think this would have blown over the internet 50 times over? What can 'they' do with this?
- zanny 10y agoIt is like cell phone radios with DMA access. Anything they want, in practice. If you are buying any computer commercially it always has backdoored hardware with a wholly proprietary coprocessor with networking and memory access.
- keyle 10y agoReally??
- lucb1e 10y agoYeah, really. It's relatively well known among free software enthusiasts. The trouble is, what do you do about it?
- imtringued 10y agoYou stop using phones.
- lucb1e 10y agoYeah same with those, I'm quite aware, but I do enjoy the benefits of having wireless internet during the 1.5h commute by public transport every day.
- kecks 10y agoBuy a Libreboot T400? It comes without Intel ME and is FSF-certified: https://minifree.org/product/libreboot-t400/ https://minifree.org/product/libreboot-t400/ It is pretty expensive for the amount of performance you get, but you are getting a fully documented, auditable and free product. It comes with instructions on how to update/build/flash/modify your firmware. You're also supporting the Libreboot project.
- deleted 10y ago[deleted]
- jaytaylor 10y agoDoes anyone know of a tool or even sequence of actual commands to disable the Intel ME AMT functionality? Did I miss it in the slides? I see explanations and low-level temporary/soft-disablement references, but nothing immediately actionable.
- riscy 10y agoThere is no prescribed way to disable it, and it looks like the slides only provide a glimpse of the workarounds/hacks needed to do so. I imagine there's a lot we're missing from this presentation, though, because it looks like there was a demo.
- GranPC 10y agoThe demo is also available in the repository. https://github.com/ptresearch/me-disablement/blob/master/Intel%20ME%20disabling%2C%20PHDays%20VI%20Demo.m4v https://github.com/ptresearch/me-disablement/blob/master/Int...
- dandelion_lover 10y agoOnly for relatively old models, see https://libreboot.org/faq/#intelme https://libreboot.org/faq/#intelme.
- gruez 10y agoLink to the talk?
- ashitlerferad 10y agohttps://github.com/ptresearch/me-disablement/blob/master/Intel%20ME%20disabling,%20PHDays%20VI%20Demo.m4v?raw=true https://github.com/ptresearch/me-disablement/blob/master/Int...
- TheWoodsy 10y agohttp://www.phdays.com/broadcast/ http://www.phdays.com/broadcast/ > Scroll to bottom > Third last > How to Become the Sole Owner of Your PC Talk is ~3.5minutes transcribed live to English. Sadly you're not missing much by just looking at the PDF.
- Samis2001 10y agoWhile I wait patiently for more open hardware designs to become more popular / actually used (Be it SPARC, RISC-V or something else), I wonder what AMD's equivalent functionality is like in comparison to this - I strongly doubt that no equivalent exists for AMD CPUs.
- spash 10y agoFrom https://libreboot.org/faq/#amd https://libreboot.org/faq/#amd # Why is the latest AMD hardware unsupported in libreboot? It is extremely unlikely that any post-2013 AMD hardware will ever be supported in libreboot, due to severe security and freedom issues; so severe, that the libreboot project recommends avoiding all modern AMD hardware. If you have an AMD based system affected by the problems described below, then you should get rid of it as soon as possible. The main issues are as follows: # AMD Platform Security Processor (PSP) This is basically AMD's own version of the Intel Management Engine. It has all of the same basic security and freedom issues, although the implementation is wildly different.
- userbinator 10y agoThe PSP is an ARM core with TrustZone technology, built onto the main CPU die. That sounds even worse than ME: Intel Management Engine (ME) is a separate computing environment physically located in the (G)MCH chip. Theoretically, if a third-party can figure out how to make a compatible MCH they can use Intel CPUs without ME, but that is impossible with AMD's design. Then again, developing a compatible MCH would be nontrivial too --- the last truly "open" x86 bus interface was probably Socket 370 (still in use by VIA and others), and the later bus interfaces are such high speed that they require some very expensive signal analysers to even see the communications properly.
- Animats 10y agoHas anyone found a remote attack via the Management Engine yet? It's basically a backdoor; there must be some way to make it do things.
- spash 10y agoThough not a simple remote attack in that sense, AMT has been used by rootkits before: https://en.wikipedia.org/wiki/Intel_Active_Management_Technology#Known_vulnerabilities_and_exploits https://en.wikipedia.org/wiki/Intel_Active_Management_Techno... A nice overview of what AMT and ME is capable of (and has been for the past decade) can be found in libreboot FAQ: https://libreboot.org/faq/#intel https://libreboot.org/faq/#intel
- spydum 10y agoperhaps everyone who finds something disappears? </sarcasm> seriously, AMT is stuff of nightmares. runs even when machine is powered off.
- nickpsecurity 10y agoAMT is the reason I mock anyone here that talks about concerns of backdoors in Intel's RNG's being ridiculous. The whole CPU is backdoored with a backdoor that can run when it's off. Including probably the RNG given debug wires are probably connected to it. Let's not worry about one feature when we have a subversion this big. Biggest irony: they advertise it as a feature for IT management. ;)
- Spooky23 10y agoMy team spent a bunch of time looking at AMT as a management tool -- it adds lots of complexity and accomplishes almost nothing that cannot be done easier a half dozen other ways. The only functionality we saw any real use for was an always on VPN and remote wake up where networks block WoL. The other thing that's even stranger is Absolute Software, a little company nobody has ever heard of who somehow got every OEM to bundle their code in system BIOS for theft recovery since the 90s.
- userbinator 10y ago30 years ago you could buy an IBM PC/AT and it would come with schematics, detailed programming information, and the complete source code listing for the BIOS[1]. There wasn't really anything "hidden", and you really felt like "the sole owner of your PC". The PC became the dominant platform because of this. Now, because of corporate interests[2][3], much of it is officially under a thick layer of red-tape NDAs, and what little else interesting out there comes mainly from leaks (be thankful for East-Asian companies' insecurity...), and there are still plenty of things hidden away. On the the other hand, all of this stuff is documented somewhere; whether that documentation will ever see the light of day is the real question (for anyone reading this who does possess such information: please do the right thing ;-) Especially when it's far easier now than before to distribute lots of data, putting the complete ME programming documentation and maybe even source code online as a download or on a disc to be supplied is entirely feasible. But Intel decided against, leading me to think they really intended it to be a backdoor-ish sort of thing, and that makes me really sad. [1] https://archive.org/details/bitsavers_ibmpcat150ferenceMar84_26847525 https://archive.org/details/bitsavers_ibmpcat150ferenceMar84... [2] http://boingboing.net/2012/01/10/lockdown.html http://boingboing.net/2012/01/10/lockdown.html [3] http://boingboing.net/2012/08/23/civilwar.html http://boingboing.net/2012/08/23/civilwar.html
- 13of40 10y ago> they really intended it to be a backdoor-ish sort of thing Occam's razor says they really just sell a ton of CPUs to huge datacenters and wanted to solve the problem of having to have some tech go out and physically reset a machine when it misbehaves. If you've ever accidentally powered down a machine that's sitting in some lights-out facility in Northern Alabraska, this kind of technology is a godsend. Now I'm not saying I'd bet my hat that it's 100% secure, or that Intel couldn't be thumb-screwed by the feds to use it as a backdoor in some scenario, but it wasn't built from the ground up to be one.
- ragix 10y agoI agree with you on this one. I just see it as in band lights out management.
- 10y ago
- yoo1I 10y agoRelevant, related talk from 32C3 by Joanna Rutkowska https://media.ccc.de/v/32c3-7352-towards_reasonably_trustworthy_x86_laptops#video&t=0 https://media.ccc.de/v/32c3-7352-towards_reasonably_trustwor...
- elijahparker 10y agoI'm looking forward to this being complete: https://www.olimex.com/Products/DIY%20Laptop/ https://www.olimex.com/Products/DIY%20Laptop/ Any ideas what a Chinese ARM chip might have for backdoors?
- snaky 10y agoAnything.
- dingle_thunk 10y agoSeems like if I really want to know what's going on at that level, I should really use something more simple, like a raspberry pi...
- technomancy 10y agoWhy would you switch to a system that relies on NDA-protected chips when there are free ones available like the BeagleBone?
- dingle_thunk 10y agoIs a BeagleBone like a raspberry pi? :)
- King-Aaron 10y agoSo, forgive me for this probably being an oversimplification, but is this the same sort of thing as the old Clipper Chips? https://en.wikipedia.org/wiki/Clipper_chip https://en.wikipedia.org/wiki/Clipper_chip
- khedoros 10y agoAs I understand it, the clipper chip was a combined encryption accelerator and key escrow device, with the escrow basically working as a government backdoor. The Intel Management Engine is another computer in your computer, running its own OS, and able to see everything your computer is doing, and modify it, including things like network transfers.
- kriro 10y agoThere's always the non x86 path. I have recently purchased a pi-top which is basically a 3d-printed laptop case + laptop battery + keyboard + display + raspberry pi 3. The keyboard could be better and I'll swap out the pi for a beagle bone black (pi comes with a binary blob) but it's a surprisingly useful package. I only bought it to experiment a bit with ARM assembly on the go but it's actually powerful enough for a lot of day to day stuff (mail, surfing, libre office, programming). Not great but good enough. Of course you have to be willing to trade speed and availability of some programs for that control but in theory a beagle bone + input and output devices is a nice little open machine for a lot of day to day stuff.
- notalaser 10y agoARM isn't a lot better. It helps that the (relatively simple) boards have the schematics available, but most platforms require binary blobs and there are few of them that don't have a bunch of useful information tucked away behind a gazillion NDAs. The various warts in the implementation (e.g. no BIOS, so there's quite some effort going just into making something boot on a new ARM board) and the non-standard, or just closed source-dependent, augmentations that are required in order to make an ARM CPU do anything breathtaking (PowerVR and Mali, TI's EVEs) also mean that, at least if you're using Linux, you're often living outside the mainline kernel. I have very few kind words to say about some of the code that I've seen in manufacturers' kernel trees, especially on let's-pump-two-more-cores-before-next-years-mobile-world-so-that-we-can-play-a-demo-that-looks-exactly-like-last-year-except-salespeople-are-gasping-for-some-reason, the ancient Indian name by which ARM is also known in some places. I would rather not have useful/important data reside on devices which run that stuff.
- kriro 10y agoI have admittedly not investigated it very deeply but the Beagle Bone Black seems good enough with compromises. AFAIK it will boot without a blob but contains one for the GPU (PowerVR). The device will run non-OpenGL stuff fine and I believe there is some progress on reverse engineering an open driver. There's armv7 (am335x) from OpenBSD which is my base indicator that it's at least somehow usable without any blobs. I'll yield to more informed people but searching a reasonably useful and completely open (I guess I can live without HDL for everything but it would be nice) machine has been a quest I go on every now and then. ARM seems to be the best (and most affordable) bet. I'll gladly take other suggestions as the whole ARM licensing model doesn't really sit well with me.
- casca 10y agoDirect link to the PDF: https://raw.githubusercontent.com/ptresearch/me-disablement/e089b0e583070bc9a87b2d8e27ad7a9b0275f374/How%20to%20become%20the%20sole%20owner%20of%20your%20PC.pdf https://raw.githubusercontent.com/ptresearch/me-disablement/...
- Qantourisc 10y agoMaybe we should all flash our Intel cpu, claim warranty, and keep the next cpu. Initial support will have to RMA it under "The computer is broken it shuts down after 40 secs!".
- 4ad 10y agoHow would that solve anything? (Not that you could claim warranty anyway.)
- markel777 10y agoThe best way to disable intel ME is to reflash you system with ME FW in Manufacture mode (if your system isn't not already in the mode) and than use ME runtime disable command (can be sent by me-tools https://github.com/skochinsky/me-tools https://github.com/skochinsky/me-tools) at each boot
- deleted 10y ago[deleted]
- naveen99 10y agoIt's only a matter of time. Once computer technology stabilizes, it will become commodity, well documented etc. you can already make completely open breadboards, that are more powerful than 50 year old computers. Might be several decades though.