5 ms·

I remember the furore when Intel introduced a unique CPU identifier in the Pentium 3. Now they have a microprocessor and OS running as a computer subsystem on e

by leonroy 10y ago

I remember the furore when Intel introduced a unique CPU identifier in the Pentium 3. Now they have a microprocessor and OS running as a computer subsystem on every Intel server and laptop which is able to do pretty much what it likes with your system and people don't bat an eyelid. Don't get me wrong, I love some of the benefits like remote control of my servers, fan speed control, monitoring of temps and voltages etc. but I do think we've given up a LOT of security for the sake of convenience. It wouldn't take much for a well crafted worm or heck a simple script to disrupt a whole network of ME/AMT enabled clients and servers.

vbezhenar 10y ago
Can I even use it to remote control my server? HP have iLO, but it's completely different beast, AFAIK. I've never heard about using Intel ME for servers.
- bonzini 10y ago
  ME is where the IPMI implementation lies. It can be used over the network to monitor sensors, to access the serial port and so on. It also has an HTTP server providing a web interface to the same functionality.
  - anoother 10y ago
    This is false. IPMI is a completely different thing from the Intel ME. It is implemented on a separate chip (bmc) and has its own NIC (usually with its own physical port) AMT on the other hand provides its network functionality by hijacking the host's IP, and siphoning off traffic destined for its ports (16992 and 16993). This is one of the things that makes it scary, and just one of the differences between it and IPMI. Source: I have worked extensively with AMT and built a semi-open-source Python management library for it in a previous job.
  - wang_li 10y ago
    Are you sure of that? One most of the systems I've used with IPMI functionality (oracle and supermicro), the BMC resides in a separate chip with it's own processor and RAM. https://www.thomas-krenn.com/en/wiki/Nuvoton_WPCM450R_IPMI_Chip_with_ATEN-Software https://www.thomas-krenn.com/en/wiki/Nuvoton_WPCM450R_IPMI_C... Oracle uses these: https://www.aspeedtech.com/products.php?fPath=20&rId=376 https://www.aspeedtech.com/products.php?fPath=20&rId=376
- ju-st 10y ago
  Intel AMT (~= IPMI) is a part of the workstation/server ME. It is comparable to iLO but it's used primarly in enterprise and not for servers. If your PC doesn't use an Intel ethernet/wifi chip you're 100% safe from remote execution attacks because AMT only works with Intel chips.
philip142au 10y ago
There will be an AI to take over all these computers.
hannob 10y ago
> but I do think we've given up a LOT of security for the sake of convenience. Worse: There is no reason you couldn't have both. For a start: A simple "off" switch for Intel ME would please a lot of people.
- ComodoHacker 10y ago
  >A simple "off" switch for Intel ME would please a lot of people. But not a corporate security team, of course. It's not that simple.
  - Quequau 10y ago
    Sure it is, it's just that "off" needs to be done by Intel and sold under a different SKU.
    - wang_li 10y ago
      It doesn't even need to be that. Expose it on a header on the motherboard so end users can add/remove a jumper. Same as should be in place for the write enable pin on the system's firmware EEPROM. The fact that the end user has no way to prevent firmware updates on most motherboards is a fucking travesty. Businesses can simply tell their employees to leave it enabled or find another job.
      - shitloadofbooks 10y ago
        But when it gets stolen, the thief just switches the jumper.
    - ComodoHacker 10y ago
      Hardware "off" would be expensive due to low demand. Soft "off" wouldn't be trusted by those who want it "on".
  - geofft 10y ago
    The needs of a corporate security team are the same as the needs of the free-software-loving individual user: the actual owner of the machine needs control over the computing being done on that machine, and someone who has temporary access to the machine, including an authorized non-owner user with physical access or malware that temporarily gets access (even perhaps root access) to the machine before being removed / before the machine is reimaged, should not be able to subvert the computing freedom of the owner of the machine. A corporate security team wants to make sure that whether ME is on or off, it stays that way and can't be flipped by someone with temporary access or by malware. That's exactly what individual end users want too for their computing freedom.
digi_owl 10y ago
Because the CPU ID came at the height of the last big media DRM push, and was seen as tying directly into that. The IME in contrast is pitched at corporate and government systems to allow sysadmins to better manage things. Effectively LOM for the corporate desktop.
ZenoArrow 10y ago
>"and people don't bat an eyelid" There's been quite a bit of controversy over Intel ME, in discussions with those that know about it at least, so I don't think that's a fair assessment. It should have been distributed as an optional, removable hardware dongle. There was no need to bake it into the hardware. Same for AMD PSP as well.
nowaynohow 10y ago
Are you aware that the newer Xeons, and only the Xeons, have such an serial number facility available? Control over this processor identification facility is supposed to be offered as a user-accessible control in UEFI, to "enable, leave disabled but unlocked, and lock disabled". Once "lock disabled", it cannot be enabled back again until a hard reset happens. Also, unlike the Pentium III "processor serial number cpuid", you need to read a MSR to access the new version, so it is supposed to be restricted to the O.S. kernel, which could then either make it available to regular programs or not. It is not easy to find out about it, either: it is hidden in plain sight on the public Intel SDM (the processor's manual). You need to look over all the model-specific MSRs with a magnifying glass until you find it :-) In the end, it boils down to whether your favorite O.S. cares about your privacy or not. It can lock the thing disabled at early boot, denying access to everything other than UEFI.
squarefoot 10y ago
"I remember the furore when Intel introduced a unique CPU identifier in the Pentium 3. Now they have a microprocessor and OS running as a computer subsystem on every Intel server and laptop which is able to do pretty much what it likes with your system and people don't bat an eyelid." 20 years ago most people would have sued anyone revealing to the world what they and their kids are happily telling on Facebook today. Give them some more years and they will pray to have a SWAT team guarding their bedroom when they're sleeping.

by leonroy 10y ago

vbezhenar 10y ago

Can I even use it to remote control my server? HP have iLO, but it's completely different beast, AFAIK. I've never heard about using Intel ME for servers.

bonzini 10y ago
ME is where the IPMI implementation lies. It can be used over the network to monitor sensors, to access the serial port and so on. It also has an HTTP server providing a web interface to the same functionality.
- anoother 10y ago
  This is false. IPMI is a completely different thing from the Intel ME. It is implemented on a separate chip (bmc) and has its own NIC (usually with its own physical port) AMT on the other hand provides its network functionality by hijacking the host's IP, and siphoning off traffic destined for its ports (16992 and 16993). This is one of the things that makes it scary, and just one of the differences between it and IPMI. Source: I have worked extensively with AMT and built a semi-open-source Python management library for it in a previous job.
- wang_li 10y ago
  Are you sure of that? One most of the systems I've used with IPMI functionality (oracle and supermicro), the BMC resides in a separate chip with it's own processor and RAM. https://www.thomas-krenn.com/en/wiki/Nuvoton_WPCM450R_IPMI_Chip_with_ATEN-Software https://www.thomas-krenn.com/en/wiki/Nuvoton_WPCM450R_IPMI_C... Oracle uses these: https://www.aspeedtech.com/products.php?fPath=20&rId=376 https://www.aspeedtech.com/products.php?fPath=20&rId=376
ju-st 10y ago
Intel AMT (~= IPMI) is a part of the workstation/server ME. It is comparable to iLO but it's used primarly in enterprise and not for servers. If your PC doesn't use an Intel ethernet/wifi chip you're 100% safe from remote execution attacks because AMT only works with Intel chips.

philip142au 10y ago

There will be an AI to take over all these computers.

hannob 10y ago

> but I do think we've given up a LOT of security for the sake of convenience. Worse: There is no reason you couldn't have both. For a start: A simple "off" switch for Intel ME would please a lot of people.

ComodoHacker 10y ago
>A simple "off" switch for Intel ME would please a lot of people. But not a corporate security team, of course. It's not that simple.
- Quequau 10y ago
  Sure it is, it's just that "off" needs to be done by Intel and sold under a different SKU.
  - wang_li 10y ago
    It doesn't even need to be that. Expose it on a header on the motherboard so end users can add/remove a jumper. Same as should be in place for the write enable pin on the system's firmware EEPROM. The fact that the end user has no way to prevent firmware updates on most motherboards is a fucking travesty. Businesses can simply tell their employees to leave it enabled or find another job.
    - shitloadofbooks 10y ago
      But when it gets stolen, the thief just switches the jumper.
  - ComodoHacker 10y ago
    Hardware "off" would be expensive due to low demand. Soft "off" wouldn't be trusted by those who want it "on".
- geofft 10y ago
  The needs of a corporate security team are the same as the needs of the free-software-loving individual user: the actual owner of the machine needs control over the computing being done on that machine, and someone who has temporary access to the machine, including an authorized non-owner user with physical access or malware that temporarily gets access (even perhaps root access) to the machine before being removed / before the machine is reimaged, should not be able to subvert the computing freedom of the owner of the machine. A corporate security team wants to make sure that whether ME is on or off, it stays that way and can't be flipped by someone with temporary access or by malware. That's exactly what individual end users want too for their computing freedom.

digi_owl 10y ago

Because the CPU ID came at the height of the last big media DRM push, and was seen as tying directly into that. The IME in contrast is pitched at corporate and government systems to allow sysadmins to better manage things. Effectively LOM for the corporate desktop.

ZenoArrow 10y ago

>"and people don't bat an eyelid" There's been quite a bit of controversy over Intel ME, in discussions with those that know about it at least, so I don't think that's a fair assessment. It should have been distributed as an optional, removable hardware dongle. There was no need to bake it into the hardware. Same for AMD PSP as well.

nowaynohow 10y ago

Are you aware that the newer Xeons, and only the Xeons, have such an serial number facility available? Control over this processor identification facility is supposed to be offered as a user-accessible control in UEFI, to "enable, leave disabled but unlocked, and lock disabled". Once "lock disabled", it cannot be enabled back again until a hard reset happens. Also, unlike the Pentium III "processor serial number cpuid", you need to read a MSR to access the new version, so it is supposed to be restricted to the O.S. kernel, which could then either make it available to regular programs or not. It is not easy to find out about it, either: it is hidden in plain sight on the public Intel SDM (the processor's manual). You need to look over all the model-specific MSRs with a magnifying glass until you find it :-) In the end, it boils down to whether your favorite O.S. cares about your privacy or not. It can lock the thing disabled at early boot, denying access to everything other than UEFI.

squarefoot 10y ago

"I remember the furore when Intel introduced a unique CPU identifier in the Pentium 3. Now they have a microprocessor and OS running as a computer subsystem on every Intel server and laptop which is able to do pretty much what it likes with your system and people don't bat an eyelid." 20 years ago most people would have sued anyone revealing to the world what they and their kids are happily telling on Facebook today. Give them some more years and they will pray to have a SWAT team guarding their bedroom when they're sleeping.