15 ms·
Intel and ME, and why we should get rid of ME
- DenisM 10y agoI often wonder if the only secure computing and communication these days is an air-gapped computer. The data can be manipulated there and then copied to another computer using... uh... a writeable compact disk? USB drives are hard to trust given how much software is running on them, so... maybe CF cards too?
- Razengan 10y agoInstall a VM on an air-gapped computer, use a guest OS to zip & encrypt the data you want to transfer, dump that zip on a disc, and unpack/decrypt it inside another VM on the destination computer?
- nickpsecurity 10y agoOutgoing, secret data plus incoming, malicious data sharing hardware is where security problems start. Ottela keeps those separate physically. Prevents many types of attack or unnecessary complexity.
- e2e8 10y agoI read somewhere that a transmit only serial connection is a good solution.
- DenisM 10y agoHa... that might just work!
- pdkl95 10y agoYou want data diodes that physically enforce one-way-only data transfer. Tin Foil Chat[1] has a circuit for an opto-isolator based data diode and a discussion of how to use them for secure chat. It's probably not hard to modify these plans for other uses, if the specific guarantees that TFC provides are compatible with your secure computing requirements. [1] https://cs.helsinki.fi/u/oottela/tfc.pdf https://cs.helsinki.fi/u/oottela/tfc.pdf
- jacquesm 10y agoRouting the data through a central IM server is a huge problem, it would still allow one to figure out who is talking to who and when.
- nickpsecurity 10y agoIt's not hard to adapt. He regularly improved it based on our feedback at Schneier's blog. I speculated that a higher bandwidth would allow audio and video using same architecture. It's a great desigm regardless due yo strong confidentiality despite endpoint attacks.
- DenisM 10y agoVery interesting... so one machine for sending data (one-way channel) and another machine fro receiving data (also a one-way channel). That, in combination with a one-way serial port, might just suffice.
- dandelion_lover 10y ago>I often wonder if the only secure computing and communication these days is an air-gapped computer. Some security experts say air-gapping is not the best approach. Consider Qubes OS instead. "How does Qubes OS compare to using a separate physical machine?", https://www.qubes-os.org/tour/ https://www.qubes-os.org/tour/
- DenisM 10y agoNone of that will help if the on-chip (CPU) code is hostile. Once the CPU itself is compromised, preventing connections is the only way to contain the problem.
- boznz 10y agoScary, I did not know this I'm sure Intel has a real good reason for it being there but I would feel much more comfortable with it either not being there or being able to disable it in hardware.
- catnaroek 10y agoI'm not sure what that “good reason” could possibly be.
- ciot1CDM 10y agoFor Intel, it's a enterprise marketing bullet, for the rest of us it's an opportunity to secure our systems the way we want, however that capacity has been denied us. The ideal security mechanism would provide us with a per cpu key from Intel, which we use to update our own user key to the cpu, and only user signed firmware is loaded. The exact mechanism of this can be handled in many ways. Right now, we locked out, and primed for being snooped on without our consent. I like Intel's engineering, but everything else I could do without. And ARM is no better. I'd say worse actually, but I'm not going to defend that. Please, please, AMD do the "right thing" with Zen. Allow us to be in command of our security, so we may delegate it to those we trust with the technical know how, be it OS vendors, or our IT departments, or our own selves.
- mjevans 10y agoI like the idea of a physical reset and wipe everything to factory method; it's OK (and probably more ideal) if it takes a while.
- bubuga 10y agoBootable drives already let you do that, and they exist for decades now. Heck, just access the HD where you boot your OS from and reimage it.
- Natanael_L 10y agoUSB Armory seems to be doing exactly what you ask for with ARM TrustZone. You own the SoC and can set your own master keys.
- rxm 10y agoThere was another thread on ME. At some point ME will get hacked or the golden certificate stolen, at which point someone will have a lot of access. https://news.ycombinator.com/item?id=8813029 https://news.ycombinator.com/item?id=8813029
- imbellish 10y ago> My first thought was that it seems increasingly clear that Stallman has been right all along. The problem is that being philosophically right doesn't always mean being practically right. In order to create the perfect Stallman-esque machine, one would have to design everything from the logic chips up from scratch, because in the end, no third party can be trusted. He says this himself about the Loongson system he uses daily; he considers it a compromise but one heavily weighted in his favor. In short, Stallman has been right all along, but there's little we can do about it from a practical standpoint. Cherry-picked from that thread. I just have to point out this awful slippery-slope argument.
- pmarreck 10y agohttps://reddit.com/r/StallmanWasRight/ https://reddit.com/r/StallmanWasRight/
- brianwawok 10y agoJust because we list slippery slope as a fallacy, does not mean it never happens like that. Basically Intel owns the desktop and server market. They sneak stuff in that we may not want. What can we do at this point?
- 35bge57dtjku 10y agoCan I just use AMD chips to avoid this?
- anonbanker 10y agoAMD has it's own secret firmware. it was shown off a year or two ago at Chaos, and AMD only allowed the presentation to happen if they had a PR rep onstage.
- daxorid 10y agoIndeed. And even ARM has TrustZone. Our governments own us. Just accept it.
- deleted 10y ago[deleted]
- anonbanker 10y agoTrustZone doesn't really look like Management Engine at all. Are there some documents comparing the two? (Heavily invested in Rockchip/MediaTek chipsets. Less scared of chinese backdoors than FIVE EYES backdoors.)
- ZenoArrow 10y agoYou're right to question this, as TrustZone isn't equivalent to Intel ME. To explain further, here's a comment I made about this before... https://news.ycombinator.com/item?id=11290069 https://news.ycombinator.com/item?id=11290069
- yuhong 10y agoIt does not access the network though.
- spash 10y agoFor the moment, you still can, in a certain way. I've just made another lengthier comment about it elsewhere in the thread [1], before noticing yours which sadly got buried at the very bottom. [1] - https://news.ycombinator.com/item?id=11882626 https://news.ycombinator.com/item?id=11882626
- hornbill 10y agoHow does Intel ME access network? Does it use the IP address assigned to the OS or does it try to get perform DHCP?
- yuhong 10y agoIt has to be configured to enable Intel AMT to do that, and that is if the firmware edition that has the code is installed (which I don't think is always the case). It is useful in enterprises that want remote management. It probably uses DHCP by default.
- hornbill 10y agoI did not find anything about ME in BIOS settings, probably the code is not present as you suggested. I have not seen any DHCP requests from the box.
- unixhero 10y agoMy brand new Thinkpad T550 has an explicit ME config firmware I can enter. PRESS ENTER TO INTERRUPT BOOT -> F1 BIOS, F12 CUSTOM BOOT DEVICE, F9 INTEL ME SETUP I can enter into it but its vital parts are password protected. Even though it is my computer, I cannot configure and control it. Scary. This is not the future I wanted.
- TempleOS 10y agoI have divine right to command INtel. We are placing TempleOS on a ROM in the CPU. God says.... undressing rebind cleverness Emmy navies tumors bellow's average's perception superconductivity's dominated teaching centaur Mulder Saroyan's athletes gelled marker luxuriance's Rotarian role's cam's berg's tipsier equipping Napoleon's humorist biennial's palindromes whistle's lenders crackpot's
- e12e 10y agoIntel remote management with support for using the wireless card is something that got me quite terrified when I first tried on my T420. Basically, no recent intel laptop can ever be secured, unless you physically remove the wireless and wired network card. Intel has a jolly video demoing how to pwn a machine remotely (framed in the positive light of taking control and fixing a boot problem by the it service desk): http://www.intel.com/content/www/us/en/remote-support/remote-support-vpro-easy-operating-system-reimaging-video.html http://www.intel.com/content/www/us/en/remote-support/remote... This is for 6th generation+ cpus, but the systems in older cpus are also quite powerful. And can't really be protected beyond using a password/passphrase. I'm not sure (and probably no-one knows) if there's also a golden key/backdoor. (I wonder if the video is actually narrated by Zach Woods (Donald 'Jared' Dunn from Silicon Valley) - or if it just sounds a bit like that). At any rate, if watching that jolly video doesn't fill you with fear, I'd say you're not sufficiently paranoid.
- noinsight 10y agoThe horrible GUIs are just icing on the cake. It doesn't even take that much to design a passable GUI.
- deleted 10y ago[deleted]
- eeZi 10y agoYou can disable the remote management and the entire embedded network stack though.
- ZenoArrow 10y agoThat's not so easy to do. To get a sense of what's required... https://software.intel.com/en-us/forums/intel-business-client-software-development/topic/563988 https://software.intel.com/en-us/forums/intel-business-clien... Plus, even you disable it there's still room for exploits, previous versions of Intel AMT have had exploits. Check out the 'Known vulnerabilities and exploits' section of the Intel AMT Wikipedia page: https://en.m.wikipedia.org/wiki/Intel_Active_Management_Technology https://en.m.wikipedia.org/wiki/Intel_Active_Management_Tech...
- _yosefk 10y agoPrediction: over time, there will remain no commercially significant high-end chips without this sort of a "security subsystem." Recommending ARM, PowerPC or other architectures over x86 as the FSF suggests will not get you very far because the problem (or as chip vendors call it, the solution) is not in the ISA, it's in the chip, and every chip vendor making the sort of chip that can power a general-purpose computer will end up being this way. Of course in practice, as long as say Linux runs on the machine, the existence of the ME or the like is almost inconsequential for the user, because you run the same software, and there's never a shortage of security vulnerabilities right there in the OS and the userspace software. In terms of the impact on the number of vulnerabilities, eliminating C and C++ would go way further than eliminating black box "security" hardware, just because the huge amount of C and C++ code, much of it written hastily and committed the moment it "runs on my machine", presents a much larger attack surface than the black box hardware + software system. But of course the FSF will never recommend ditching C and C++.
- joosters 10y agoWell done for turning an unrelated issue into a C++ rant!
- _yosefk 10y agoDo you think the keylogger running on your and my machine came in by exploiting the ME or a C buffer overflow somewhere in the OS or userspace code that sister claims you "control"?
- reality_czech 10y ago"Luckily," we don't have to choose between being afraid of firmware and afraid of C and C++. The shitty Management Engine and other firmware code will be written in C or C++ by terrible coders. The UEFI source code is over 7000 files and 100 MB of code, according to Matthew Garret: https://www.linux.com/learn/uefi-secure-boot-big-hassle-questionable-benefit https://www.linux.com/learn/uefi-secure-boot-big-hassle-ques... . And it can continue running once the OS has booted now (a great "feature" that was missing from the BIOS, right?)
- hueving 10y ago>Libreboot X200 laptop Is this laptop the top of the line spec-wise that you can buy which is free from this trash?
- scopecreep 10y agoYep, nothing past 2008 will be supported. Which means that while this is nice and all, I got crap to be doing. It already takes Visual Studio 3 hours to "repair" itself once a month when it stops working, and that's on a machine that would have been a supercomputer in 2008.
- brianwawok 10y agoSounds like a good reason to not use Visual Studio
- comex 10y agoDepends what you mean by "laptop". According to [1], the fastest processor that shipped with an X200 is the Intel T9600. Checking Geekbench, today's top-of-the-line 64-bit ARM phablets seem to have significantly higher CPU performance (both single and multi-core), and an equal amount of RAM. AFAIK, those devices don't have anything like Intel ME; they do typically have a hypervisor running above the Linux kernel, but it should be possible to replace it if the bootloader is unlocked. I think. If someone comes out with an ARM64 Chromebook in the near future, that might be a good device to target for fully-free system efforts. [1] https://support.lenovo.com/us/en/documents/migr-73156 https://support.lenovo.com/us/en/documents/migr-73156
- spash 10y agoSemi-hijacking your question to mention the other side of the pond too, which many people do not seem to know about and I run into this issue quite regularly. While the laptop situation is indeed pretty bad (the X200 is probably as best as you can get here), for people looking for a modern workstation, AMD's current FX processor lineup is still free from this trash. Past the 2013 designs (Family 16h [1]) AMD includes their own equivalent of Intel's ME called PSP [2], so presumably the upcoming Zen is going to be heavily backdoored too. Now, you can still buy an 8-core/4 GHz+ AMD Vishera [3] generation (which is the "current" FX), add a motherboard with ECC support (in a stark contrast to Intel, all AMD FX processors fully support ECC memory and for example ASUS sells a number of AMD motherboards with ECC support) and build yourself a workstation that will easily last for another decade, possibly longer (you can always buy a motherboard or two of your favourite model as a backup for the times when they finally disappear from the market). All FX processors are factory unlocked [4] and can be pushed much farther past their design specs with decent cooling, adding another bit to their possible usefulness over the long term. Some more (random) reading on the subject of avoiding AMD PSP and Intel ME: http://hollaforums.com/thread/557954/technology/uncorrectable-freedom-and-security-issues-on-x86.html http://hollaforums.com/thread/557954/technology/uncorrectabl... - [1] - https://en.wikipedia.org/wiki/List_of_AMD_CPU_microarchitectures https://en.wikipedia.org/wiki/List_of_AMD_CPU_microarchitect... [2] - https://libreboot.org/faq/#amd https://libreboot.org/faq/#amd [3] - https://en.wikipedia.org/wiki/List_of_AMD_FX_microprocessors#Piledriver-based https://en.wikipedia.org/wiki/List_of_AMD_FX_microprocessors... [4] - http://www.techpowerup.com/153445/amd-unlocked-fx-processors-announced http://www.techpowerup.com/153445/amd-unlocked-fx-processors...
- SFJulie 10y agoProblem of security product is their designers often do shitty code with design flaw with very high privileges. But be assured every thing is fine since for security reasons you cannot see their code.
- MichaelGG 10y agoHow is this enabled though? Sounds like ILO/DRAC/etc., if a bit more capable. But if it's not turned on, is it that big of a deal? If we assume Intel is malicious, they hardly need a platform like ME to do harm. And isn't this kind of stuff only available on the more expensive systems? Because they include this to sell to enterprise help desks, right? I dislike articles that seem set to spin something. At least explain the plausible or documented reasons, then show why it's bad.
- Kliment 10y agoDon't assume malice in this case, assume incompetence. And ME is on basically every intel processor made in the past 8 years
- dlmetcalf 10y agoHow can you know it's turned off? Remotely accessible Zero Touch Config used to stay enabled, even when it claimed "Active Management Technology: Disabled" in BIOS. PoC was shown with free Intel SCS Console and a trivially acquired certificate. ME & AMT have become common on consumer gear, laptops, etc. and Intel chip, chipset & nics are a common combination. The attack surface is also huge for anyone intent on compromising it.
- dlmetcalf 10y agoWow, no one here has mentioned Johanna Rutkovska's (Invisible Things Lab & QubesOS), "Intel x86 Considered Harmful"? http://blog.invisiblethings.org/papers/2015/x86_harmful.pdf http://blog.invisiblethings.org/papers/2015/x86_harmful.pdf http://blog.invisiblethings.org/2015/10/27/x86_harmful.html http://blog.invisiblethings.org/2015/10/27/x86_harmful.html Essential reading!! https://www.youtube.com/watch?v=rcwngbUrZNg https://www.youtube.com/watch?v=rcwngbUrZNg
- dlmetcalf 10y agoSeriously, watch this ^. It's pretty much the canonical coverage of the topic.
- dcposch 10y agoJoanna is a hero. Also, I would give anything for a clean slate design that prioritized simplicity and transparency. We've been layering complicated crap under and on top of older complicated crap for so long that even professional engineers no longer understand exactly what happens when you push the power button. As long as that is true, we will never be secure.
- dlmetcalf 10y agoTotally agree. She's brilliant. Deepest respect to her. One of the extremely few people with genuine understanding of hardware security, who's working on the side of users & humanity. The first time I read her work, I was floored that I hadn't known of her earlier.
- dlmetcalf 10y agoI hope these guys get lots of orders and prices fall (Raptor's Talos Secure Workstation): https://www.raptorengineering.com/TALOS/prerelease.php https://www.raptorengineering.com/TALOS/prerelease.php With Google having ported all their software to Power8, I'm looking forward to more economies of scale kicking on.
- edwintorok 10y agoI hope they get sufficient preorders so they can start manufacturing it. I currently have a 125W TDP AMD processor with "just" 8 cores, looking forward to a Power8 workstation that should have 64 logical CPU cores at 130W TDP [1] and avoids the Intel ME/AMD PSP trap. [1] https://www.raptorengineering.com/TALOS/faq.php https://www.raptorengineering.com/TALOS/faq.php
- BuildTheRobots 10y agoIt looks great, except it has a ASpeed AST2400 BMC on the board which seems to do video and usb over IP etc (edit: eg it ties into networking, pci, usb, memory)... Unless the firmware running on the BMC is going to be open source, I fail to see how it helps.
- dlmetcalf 10y agoDoes this cover your concerns? Open-toolchain FPGAs Blob-free operation - Fully libre (open-source) IBM OPAL primary firmware w/ PetitBoot interface - Fully libre (open-source) OpenBMC secondary (IPMI / OoBM) firmware NO signing keys preventing firmware modification
- BuildTheRobots 10y agoGets most of the way there, though I'm confused as to the wording on the BSC. "Fully libre OpenBMC _secondary_ firmware". Still slightly worried as to the meaning of Secondary firmware; almost makes me think the BSC has non-libre _primary_ firmware on there too.
- Qantourisc 10y agoIntel should supply a ME bricking firmware !
- ogn3rd 10y agoturning it off required a special cpu with the right fuses blown, along with a special firmware version. it's baked into the cpu logic.
- mrob 10y agoI don't see how getting rid of the ME helps. If you don't trust Intel then you don't trust Intel. They can backdoor the main CPU as easily as they can backdoor the ME. The only true solution is an Open Source Hardware CPU, and some means of verifying that the hardware matches the HDL. There are already Open Source CPU designs, but the verification is more difficult. Even if you use a big enough process node that you can decap it and inspect it optically (eg. using similar techniques as used with http://visual6502.org/ http://visual6502.org/ ), there is still the possibility of dopant-level backdoors which are much harder to detect: http://sharps.org/wp-content/uploads/BECKER-CHES.pdf http://sharps.org/wp-content/uploads/BECKER-CHES.pdf
- dandelion_lover 10y ago>If you don't trust Intel then you don't trust Intel. Security is not a boolean. It's a price to own you. By removing Intel ME you increase this price.
- dlmetcalf 10y agoRISC-V architectures hold the most promise there AFAIAA. BSD-licensed, cutting-edge architecture and it's got the right backers. FreeBSD is already ported to it. There'll be a range silicon implementations. Cambridge's lowRISC is likely to be the first SoC, with design completing this year.
- ashitlerferad 10y agoThe backers will probably be making proprietary implementations with ME-style backdoors.
- dlmetcalf 10y agoNo doubt some of the bigger ones probably will. When it's BSD (not bound by restrictive commercial licensing agreements) though, it massively lowers the barriers to entry for manufacturers who will offer security. Anyway, here's an entirely open source one you can inspect: http://www.lowrisc.org/ http://www.lowrisc.org/. Put it on an FPGA if you want.
- pmarreck 10y agoAfter the demise of PowerPC in the general computing space, what did you expect would come of Intel hegemony? BS like this. An invisible, all powerful, potentially hackable layer between the chip core and the OS sold as something to ease remote administration and enforce DRM.
- gpvos 10y agoDoes ME still access the network if you don't connect anything to the Intel network card, but use a different network card instead?
- orik 10y agoBLK overclocking non-k sky lake chips disables ME. You loose out on some power saving/voltage throttling features as well as avx2 instructions, but if you're worried about security ME is disabled.
- lfam 10y agoCan you provide a reference for this?
- deleted 10y ago[deleted]
- omphalos 10y agoIt's remarkable how a company with so many resources can make something so poorly designed.
- slasaus 10y agoFWIW, there is a petition for Intel to Release an ME-less CPU design: https://puri.sm/posts/petition-for-intel-to-release-an-me-less-cpu-design/ https://puri.sm/posts/petition-for-intel-to-release-an-me-le...
- uudecode 10y agoGenerally, do development boards have ME, too?
- microcolonel 10y agoI look forward to the variety of vendors who will offer RISC-V chips in the coming decade. I love Intel's approach to graphics and other drivers on Linux, they've been very helpful, and their products do often work well; however I don't think that I can bear the societal cost of something as misguided as the Management Engine. I'm perfectly happy to miss out on DRM'd consumer content on my workstation; I'm not happy to miss out on decent security principles.
- csense 10y agoAnyone know if AMD suffers from a similar "feature"?
- deleted 10y ago[deleted]