7 ms·

Scary, I did not know this I'm sure Intel has a real good reason for it being there but I would feel much more comfortable with it either not being there or be

by boznz 10y ago

Scary, I did not know this I'm sure Intel has a real good reason for it being there but I would feel much more comfortable with it either not being there or being able to disable it in hardware.

catnaroek 10y ago
I'm not sure what that “good reason” could possibly be.
- ciot1CDM 10y ago
  For Intel, it's a enterprise marketing bullet, for the rest of us it's an opportunity to secure our systems the way we want, however that capacity has been denied us. The ideal security mechanism would provide us with a per cpu key from Intel, which we use to update our own user key to the cpu, and only user signed firmware is loaded. The exact mechanism of this can be handled in many ways. Right now, we locked out, and primed for being snooped on without our consent. I like Intel's engineering, but everything else I could do without. And ARM is no better. I'd say worse actually, but I'm not going to defend that. Please, please, AMD do the "right thing" with Zen. Allow us to be in command of our security, so we may delegate it to those we trust with the technical know how, be it OS vendors, or our IT departments, or our own selves.
  - mjevans 10y ago
    I like the idea of a physical reset and wipe everything to factory method; it's OK (and probably more ideal) if it takes a while.
    - bubuga 10y ago
      Bootable drives already let you do that, and they exist for decades now. Heck, just access the HD where you boot your OS from and reimage it.
  - Natanael_L 10y ago
    USB Armory seems to be doing exactly what you ask for with ARM TrustZone. You own the SoC and can set your own master keys.
- PeCaN 10y ago
  It's known to be used for DRM.¹ So… not a good reason, but at least it makes sense. Then there's Intel's very likely cozy relationship with the NSA.² ³ ⁴ ⁵ -- ¹ https://libreboot.org/faq/#intelme https://libreboot.org/faq/#intelme See paragraph 6. ² https://plus.google.com/+TheodoreTso/posts/SDcoemc9V3J https://plus.google.com/+TheodoreTso/posts/SDcoemc9V3J ³ http://www.eteknix.com/expert-says-nsa-have-backdoors-built-into-intel-and-amd-processors/ http://www.eteknix.com/expert-says-nsa-have-backdoors-built-... ⁴ http://www.infowars.com/intel-ceo-refuses-to-answer-questions-on-whether-nsa-can-access-processors/ http://www.infowars.com/intel-ceo-refuses-to-answer-question... (Note the NSA slide.) ⁵ https://www.reddit.com/r/IAmA/comments/1ycs5l/hi_reddit_im_brian_krzanich_ceo_of_intel_ask_me/ https://www.reddit.com/r/IAmA/comments/1ycs5l/hi_reddit_im_b... (No hard evidence, but he dodged basically every question related to the NSA.)
  - amluto 10y ago
    > It's known to be used for DRM. Better citation needed. AFAIK the ME has never been used for DRM. It's supposedly used to implement TPM 2.0 aka PTT, but AFAIK that has never been used for DRM either.
    - pdkl95 10y ago
      SGX is the other feature needed for DRM. Just read Intel's own documentation for SGX; it's all about creating a Trusted Computing environment, using the old Palladium/NGSCB sense of "trusted".
    - comex 10y ago
      PAVP (Protected Audio-Video Path, which has gone by other names), as described in the FAQ entry, is a real thing, albeit without any public documentation whatsoever other than acknowledging that it exists - implemented in ME and used by some commercial video DRM implementations. Not sure what kind of citation you want, but it's briefly mentioned in this presentation about reverse engineering ME: https://www.slideshare.net/mobile/codeblue_jp/igor-skochinsky-enpub https://www.slideshare.net/mobile/codeblue_jp/igor-skochinsk...
    - ogn3rd 10y ago
- drdaeman 10y ago
  Well, having a KVM that one can use to remotely connect to their machines is a good reason (if we leave the statement at this level and assume that everything is done in the best interests of the end-users, by their informed demand). For example, having IPMI with serial console access or a full-fledged VNC on HP iLO on servers proved to be really useful on different occasions, where I was able to fix the boot-level problems remotely rather than having to drive for an hour to visit the server. Remote access is of less importance with desktops - and even less with laptops - as in most cases user is physically present, but still I had a few cases where I regretted not having a way to remotely connect to my machine at home (it had failed after a power outage), while I was on the road. I'd say, the very core idea isn't really bad. Intel's implementation is terrible.
  - catnaroek 10y ago
    I don't have much of a need for this feature, but I see your point.
  - zrm 10y ago
    If you want this there is no reason the software needs to be embedded in the hardware. Install a hypervisor with remote access, install the other OS in a VM and you have all the same capabilities through the hypervisor, but now you can inspect or improve the hypervisor and update it when it's vulnerable.
    - drdaeman 10y ago
      The whole point of a independent hardware KVM is that it's autonomous - no matter which state the software (and unrelated hardware) is in, you can still access the system and try to recover. But, sure, I fully agree about the need of such system being an open platform that user can audit, update and control - rather than a black box. (Well, if there is a platform at all - a simplest external IP KVM could be a very dumb hardware box with the only software being an extremely primitive TCP/IP stack.) Added: Anecdote: In early 2000s, some company I know of, had quite simplest remote access tools - DIY remote reboot devices made of externally-powered Realtek network cards. Sending a WoL packet to a known MAC (on a well-isolated network) would forcibly power-cycle the connected machine or router. No amount of fancy software solutions would bring a well-hung host back online. ;)
zmanian 10y ago
I'm entirely convinced that Intel would undermine the entire trusted computer over some relatively hairbrained ideas about new revenue sources. Intel needs to give us an alternative.
redtuesday 10y ago
Just wanted to point out that there is a petition to release a ME less CPU: https://puri.sm/posts/petition-for-intel-to-release-an-me-less-cpu-design/ https://puri.sm/posts/petition-for-intel-to-release-an-me-le... Doubt that will change anything (willingness, price for probably new masks etc. etc.) but it would certainly be nice.

by boznz 10y ago

Scary, I did not know this I'm sure Intel has a real good reason for it being there but I would feel much more comfortable with it either not being there or being able to disable it in hardware.

catnaroek 10y ago

I'm not sure what that “good reason” could possibly be.

ciot1CDM 10y ago
For Intel, it's a enterprise marketing bullet, for the rest of us it's an opportunity to secure our systems the way we want, however that capacity has been denied us. The ideal security mechanism would provide us with a per cpu key from Intel, which we use to update our own user key to the cpu, and only user signed firmware is loaded. The exact mechanism of this can be handled in many ways. Right now, we locked out, and primed for being snooped on without our consent. I like Intel's engineering, but everything else I could do without. And ARM is no better. I'd say worse actually, but I'm not going to defend that. Please, please, AMD do the "right thing" with Zen. Allow us to be in command of our security, so we may delegate it to those we trust with the technical know how, be it OS vendors, or our IT departments, or our own selves.
- mjevans 10y ago
  I like the idea of a physical reset and wipe everything to factory method; it's OK (and probably more ideal) if it takes a while.
  - bubuga 10y ago
    Bootable drives already let you do that, and they exist for decades now. Heck, just access the HD where you boot your OS from and reimage it.
- Natanael_L 10y ago
  USB Armory seems to be doing exactly what you ask for with ARM TrustZone. You own the SoC and can set your own master keys.
PeCaN 10y ago
It's known to be used for DRM.¹ So… not a good reason, but at least it makes sense. Then there's Intel's very likely cozy relationship with the NSA.² ³ ⁴ ⁵ -- ¹ https://libreboot.org/faq/#intelme https://libreboot.org/faq/#intelme See paragraph 6. ² https://plus.google.com/+TheodoreTso/posts/SDcoemc9V3J https://plus.google.com/+TheodoreTso/posts/SDcoemc9V3J ³ http://www.eteknix.com/expert-says-nsa-have-backdoors-built-into-intel-and-amd-processors/ http://www.eteknix.com/expert-says-nsa-have-backdoors-built-... ⁴ http://www.infowars.com/intel-ceo-refuses-to-answer-questions-on-whether-nsa-can-access-processors/ http://www.infowars.com/intel-ceo-refuses-to-answer-question... (Note the NSA slide.) ⁵ https://www.reddit.com/r/IAmA/comments/1ycs5l/hi_reddit_im_brian_krzanich_ceo_of_intel_ask_me/ https://www.reddit.com/r/IAmA/comments/1ycs5l/hi_reddit_im_b... (No hard evidence, but he dodged basically every question related to the NSA.)
- amluto 10y ago
  > It's known to be used for DRM. Better citation needed. AFAIK the ME has never been used for DRM. It's supposedly used to implement TPM 2.0 aka PTT, but AFAIK that has never been used for DRM either.
  - pdkl95 10y ago
    SGX is the other feature needed for DRM. Just read Intel's own documentation for SGX; it's all about creating a Trusted Computing environment, using the old Palladium/NGSCB sense of "trusted".
  - comex 10y ago
    PAVP (Protected Audio-Video Path, which has gone by other names), as described in the FAQ entry, is a real thing, albeit without any public documentation whatsoever other than acknowledging that it exists - implemented in ME and used by some commercial video DRM implementations. Not sure what kind of citation you want, but it's briefly mentioned in this presentation about reverse engineering ME: https://www.slideshare.net/mobile/codeblue_jp/igor-skochinsky-enpub https://www.slideshare.net/mobile/codeblue_jp/igor-skochinsk...
  - ogn3rd 10y ago
drdaeman 10y ago
Well, having a KVM that one can use to remotely connect to their machines is a good reason (if we leave the statement at this level and assume that everything is done in the best interests of the end-users, by their informed demand). For example, having IPMI with serial console access or a full-fledged VNC on HP iLO on servers proved to be really useful on different occasions, where I was able to fix the boot-level problems remotely rather than having to drive for an hour to visit the server. Remote access is of less importance with desktops - and even less with laptops - as in most cases user is physically present, but still I had a few cases where I regretted not having a way to remotely connect to my machine at home (it had failed after a power outage), while I was on the road. I'd say, the very core idea isn't really bad. Intel's implementation is terrible.
- catnaroek 10y ago
  I don't have much of a need for this feature, but I see your point.
- zrm 10y ago
  If you want this there is no reason the software needs to be embedded in the hardware. Install a hypervisor with remote access, install the other OS in a VM and you have all the same capabilities through the hypervisor, but now you can inspect or improve the hypervisor and update it when it's vulnerable.
  - drdaeman 10y ago
    The whole point of a independent hardware KVM is that it's autonomous - no matter which state the software (and unrelated hardware) is in, you can still access the system and try to recover. But, sure, I fully agree about the need of such system being an open platform that user can audit, update and control - rather than a black box. (Well, if there is a platform at all - a simplest external IP KVM could be a very dumb hardware box with the only software being an extremely primitive TCP/IP stack.) Added: Anecdote: In early 2000s, some company I know of, had quite simplest remote access tools - DIY remote reboot devices made of externally-powered Realtek network cards. Sending a WoL packet to a known MAC (on a well-isolated network) would forcibly power-cycle the connected machine or router. No amount of fancy software solutions would bring a well-hung host back online. ;)

zmanian 10y ago

I'm entirely convinced that Intel would undermine the entire trusted computer over some relatively hairbrained ideas about new revenue sources. Intel needs to give us an alternative.

redtuesday 10y ago

Just wanted to point out that there is a petition to release a ME less CPU: https://puri.sm/posts/petition-for-intel-to-release-an-me-less-cpu-design/ https://puri.sm/posts/petition-for-intel-to-release-an-me-le... Doubt that will change anything (willingness, price for probably new masks etc. etc.) but it would certainly be nice.