3 ms·
I scowled when I read about the Intel chip, and I stopped reading when they mentioned USB. Assuming for a moment that there's no hidden backdoor in the Intel c
by na85 10y ago
I scowled when I read about the Intel chip, and I stopped reading when they mentioned USB. Assuming for a moment that there's no hidden backdoor in the Intel chip (which seems exceedingly unlikely from all that I've read regarding IME, not to mention the un-auditable microcode), all this fancy hackery is still going to get pwned by BadUSB.
Secure computing cannot and will not move forward until we have a way to mitigate against this.
- michaelmrose 10y agoI had a very similar thought. Also hdmi can double as ethernet. DVI uses a serial bus to negotiate features if I'm not mistaken. Probably room for exploits over that port too. Seems like using built in input and display and giving up some external ports would be the only reasonable strategy if you were being as serious about physical security as this wants to be.
- nickpsecurity 10y agoYou simply can't have a secure computer if untrustworthy chips are in the TCB. They did say open-source, physically-secure computer. They didn't say the whole thing was secure. The use-case is whatever security you usually have plus tamper-resistant case, drive encryption, better authentication, and whatever Intel's extensions bring to the table. Better than regular computer in terms of defending against many more attack vectors. Assuming design works. Also, such a device can be combined with a secure, open computer to divide risk up among software and physical attacks.
- wiml 10y agoThey address this a bit. Their CPU supports device virtualization and the default OS install dedicates a VM to just the USB ports, and the USB data lines are electrically disconnected from the HCIs when the machine is in locked mode. I'd be more concerned about the wifi and bluetooth chips' firmware.