3 ms·
Do you think the keylogger running on your and my machine came in by exploiting the ME or a C buffer overflow somewhere in the OS or userspace code that sister
by _yosefk 10y ago
Do you think the keylogger running on your and my machine came in by exploiting the ME or a C buffer overflow somewhere in the OS or userspace code that sister claims you "control"?
- reality_czech 10y ago"Luckily," we don't have to choose between being afraid of firmware and afraid of C and C++. The shitty Management Engine and other firmware code will be written in C or C++ by terrible coders. The UEFI source code is over 7000 files and 100 MB of code, according to Matthew Garret: https://www.linux.com/learn/uefi-secure-boot-big-hassle-questionable-benefit https://www.linux.com/learn/uefi-secure-boot-big-hassle-ques... . And it can continue running once the OS has booted now (a great "feature" that was missing from the BIOS, right?)
- yuhong 10y agoIntel ME is a blob written by Intel however and all OEMs uses the same one. I'd bet on UEFI code being worse than the Intel ME firmware.
- reality_czech 10y agoIsn't this kind of like arguing over which brand of hot dog has more pink slime and factory floor sweepings? They all do. Anyway, ME is likely to be a much higher value target for hackers. A compromise there would compromise millions of PCs, whereas a UEFI hack would be specific to one vendor.
- yuhong 10y agoObviously, but UEFI tends to cause more of the practical problems and attacks, including non-security ones and DoS attacks (some of which is easy to do under Windows).