3 ms·

I think woodmans argument is that AMT is an active service, you should see network traffic to the management engine and such -- so firewalls/airgaps/SPI should

by spydum 10y ago

I think woodmans argument is that AMT is an active service, you should see network traffic to the management engine and such -- so firewalls/airgaps/SPI should detect and prevent tampering. I think that is a naive view of AMT, it seems far more capable, network management is just one avenue (and it's been proven difficult to comprehensively implement anyways).

nickpsecurity 10y ago
Ahh. I think the hardware parts of my write-up on smartphone risks will help here: https://news.ycombinator.com/item?id=10906999 https://news.ycombinator.com/item?id=10906999 Basically, modern SOC's are mixed-signal systems that have digital, analog, and often RF capabilities. I've imagined, with limited HW knowledge, quite a few attacks on digital subsystems using analog or RF components. HW gurus I know encounter sneaky stuff like that in 3rd party I.P. regularly and have to mitigate it. Most people have no clue it exists. They're mitigating at the networking channel which is a mere abstraction for more complex stuff going on in chip and interface point. You could even embed a radio in the sucker that turned on when it detected a certain signal in a packet header that NIDS certainly wasn't analyzing. Note that NSA TAO catalog includes active attacks with radars that rely on physical materials in counterfeit parts and SOC's with embedded radios hidden in USB connectors. Quite a few attacks at SOC level software people will never see coming.
woodman 10y ago
> ...so firewalls/airgaps/SPI should detect and prevent tampering. I think that is a naive view of AMT... Nope, I'm talking about scale. You'd need to signal (paint with radar, send a packet, dip the power in morse code, put the magic cookie in the root DNS server response, whatever) every target at least once prior to exploitation. But yes, stealth would certainly be a concern that would reduce the value of AMT relative to a factory backdoored RNG.

by spydum 10y ago

nickpsecurity 10y ago

Ahh. I think the hardware parts of my write-up on smartphone risks will help here: https://news.ycombinator.com/item?id=10906999 https://news.ycombinator.com/item?id=10906999 Basically, modern SOC's are mixed-signal systems that have digital, analog, and often RF capabilities. I've imagined, with limited HW knowledge, quite a few attacks on digital subsystems using analog or RF components. HW gurus I know encounter sneaky stuff like that in 3rd party I.P. regularly and have to mitigate it. Most people have no clue it exists. They're mitigating at the networking channel which is a mere abstraction for more complex stuff going on in chip and interface point. You could even embed a radio in the sucker that turned on when it detected a certain signal in a packet header that NIDS certainly wasn't analyzing. Note that NSA TAO catalog includes active attacks with radars that rely on physical materials in counterfeit parts and SOC's with embedded radios hidden in USB connectors. Quite a few attacks at SOC level software people will never see coming.

woodman 10y ago

> ...so firewalls/airgaps/SPI should detect and prevent tampering. I think that is a naive view of AMT... Nope, I'm talking about scale. You'd need to signal (paint with radar, send a packet, dip the power in morse code, put the magic cookie in the root DNS server response, whatever) every target at least once prior to exploitation. But yes, stealth would certainly be a concern that would reduce the value of AMT relative to a factory backdoored RNG.