3 ms·

This cruft doesn't need three letter agencies to exist. Big customers pay for it so it's done. Once it's done, it's easier to leave it there and soft-disable fo

by qb45 10y ago

This cruft doesn't need three letter agencies to exist. Big customers pay for it so it's done. Once it's done, it's easier to leave it there and soft-disable for people who haven't paid for it than to actually build two versions of the chip, with and without this feature. However, speaking of spooks, I heard rumors that either Intel AMT or BIOS or some drivers (don't remember which exactly) is sold to the Chinese market with castrated crypto. Reportedly it's because the Chinese government requires imported crypto to be just strong enough to resist average guy, but not their supercomputers.

snsr 10y ago
Any links re: Chinese requirements or hardware with nerfed crypto?
- qb45 10y ago
  Sorry, I only heard it from someone who heard it from someone who heard it from someone who worked on it. Some googling yielded this, for example: http://www.networkworld.com/article/2331257/lan-wan/encryption-restrictions.html http://www.networkworld.com/article/2331257/lan-wan/encrypti... (2004) http://www.freshfields.com/en/global/Digital/China_rules_on_encryption/ http://www.freshfields.com/en/global/Digital/China_rules_on_... But this only shows that there are some regulations and licensing required, no details unfortunately.
- seanp2k2 10y ago
  It'd be interesting to start buying these un-un-cripple-able CPUs for use domestically, for increased security and maximum irony.
  - qb45 10y ago
    Potentially exploitable or backdoored firmware with weak crypto is no better than potentially exploitable or backdoored firmware with strong crypto, unless you are expert enough to know how to exploit it and then fix. And you probably aren't, considering that this stuff is all secret. And, first of all, I'm not even sure if it was the ME firmware or any firmware at all. Might have been some stupid application you install on Windows. I wouldn't buy security-critical stuff in China. You can bitch all day long about the US, but the fact is, if something like this San Bernadino phone unlock case happened in China, with Chinese phone from Chinese vendor under Chinese jurisdiction, you probably wouldn't even have heard about it.

by qb45 10y ago

snsr 10y ago

Any links re: Chinese requirements or hardware with nerfed crypto?

qb45 10y ago
Sorry, I only heard it from someone who heard it from someone who heard it from someone who worked on it. Some googling yielded this, for example: http://www.networkworld.com/article/2331257/lan-wan/encryption-restrictions.html http://www.networkworld.com/article/2331257/lan-wan/encrypti... (2004) http://www.freshfields.com/en/global/Digital/China_rules_on_encryption/ http://www.freshfields.com/en/global/Digital/China_rules_on_... But this only shows that there are some regulations and licensing required, no details unfortunately.
seanp2k2 10y ago
It'd be interesting to start buying these un-un-cripple-able CPUs for use domestically, for increased security and maximum irony.
- qb45 10y ago
  Potentially exploitable or backdoored firmware with weak crypto is no better than potentially exploitable or backdoored firmware with strong crypto, unless you are expert enough to know how to exploit it and then fix. And you probably aren't, considering that this stuff is all secret. And, first of all, I'm not even sure if it was the ME firmware or any firmware at all. Might have been some stupid application you install on Windows. I wouldn't buy security-critical stuff in China. You can bitch all day long about the US, but the fact is, if something like this San Bernadino phone unlock case happened in China, with Chinese phone from Chinese vendor under Chinese jurisdiction, you probably wouldn't even have heard about it.