5 ms·
No amount of EFI rootkit detection will ever remove the possibility that malicious code is running inside the Intel Management Engine (ME), because code inside
by trendia 10y ago
No amount of EFI rootkit detection will ever remove the possibility that malicious code is running inside the Intel Management Engine (ME), because code inside the ME would run side-by-side with the bootloader and with unlimited permissions.
Unless Intel provides source code for the ME, it is impossible to 100% know whether unauthorized code is running.
- Kwastie 10y agoSomeone at https://puri.sm https://puri.sm almost completely removed the ME. https://puri.sm/posts/neutralizing-intel-management-engine-on-librem-laptops/ https://puri.sm/posts/neutralizing-intel-management-engine-o...
- bobcallme 10y agoWhat's with the free advertising? They were not the ones to do the original work with coreboot or removing the non important parts of the ME. If anything, Purism has lied, taken credit for other peoples work and given people a false sense of "privacy" and "security". "Almost completely removed the ME" is not good enough and there is way too much room to do malicious things.
- deleted 10y ago[deleted]
- Relys 10y ago.
- jjawssd 10y agoWhat's your point? Is it that exploit developers are not compensated financially for their work? Exploit developers should find a better business model than their current one. This guy was able to take freely available exploit knowledge and monetize it. If the parties responsible for creating the exploit feel they have some sort of IP claim against them, they should sue. If exploit developers wish to release exploit details for free then the best they can wish for is charity.
- bobcallme 10y agoYou missed the point. It is all about giving credit to those who do the work and make discoveries. It is in poor taste to exploit people in the case of taking their work and not giving any credit to those that made their business model possible.
- deleted 10y ago[deleted]
- mike-cardwell 10y agoEven if Intel gave you the source code, you still wouldn't know if there was any unauthorised code running.
- Taek 10y agoReproducible builds is a very important part of knowing you are secure, and in the absence of that at least being able to flash on your own compilation.
- hdhzy 10y agoWell even with reproducible builds how do you check what actually is running there? That'd be the ME reporting "I'm running version X" without a way to really verify it. Also if you flashed it you cannot be 100% sure there is no other component that is still running a rootkit.
- schoen 10y agoGood analysis of this issue in Halvar Flake's https://www.slideshare.net/hashdays/why-johnny-cant-tell-if-he-is-compromised https://www.slideshare.net/hashdays/why-johnny-cant-tell-if-... ("Why Johnny can't tell if he is compromised").
- ams6110 10y agoOr Ken Thompsons's Reflections on Trusting Trust.
- deleted 10y ago[deleted]
- sschueller 10y agoIs there any reason Intel would not open source that code? It not like it will run on other hardware?