4 ms·
> For obvious reasons we couldn’t publish what we found It's not obvious to me why anyone not under an NSL or NDA would sit on this vulnerability for 5 years a
by Sephr 9y ago
> For obvious reasons we couldn’t publish what we found
It's not obvious to me why anyone not under an NSL or NDA would sit on this vulnerability for 5 years and wait until it's actively being exploited in the wild before public disclosure.
It's extremely negligent to global security for SemiAccurate to not immediately publicly disclose the vulnerability 5 years ago after Intel refused to fix it. Of course this is ignoring the root of the problem, which is that the US government has deeply compromised Intel since the very first security management interfaces were added to Intel chips in the early 90s.
The real solution to the root issue is legislation that forces security disclose timelines of 90 days or less for government-found vulnerabilities, and prevents the stockpiling of vulnerability exploit kits.
- dantiberian 9y agoThis was my thought too as I read it. If they didn't feel they could handle the disclosure, Google Project Zero could have been a good recipient to report to Intel.
- Animats 9y agoThat seems strange. Since it's a security hole you can exploit on your very own Intel computer, there's no issue about "hacking" into someone else's system. Researching this is legally safe. There should have been a Defcon talk and a CERT advisory years ago.
- wmf 9y agoOne wonders if they knew of this particular vulnerability 5 years ago or they just knew that there must be vulnerabilities lurking in the ME somewhere.
- gtirloni 9y agoIt gets more confusing because Intel is crediting Maksim Malyutin from Embedi: https://security-center.intel.com/advisory.aspx?intelid=INTEL-SA-00075&languageid=en-fr https://security-center.intel.com/advisory.aspx?intelid=INTE... Intel would like to thank Maksim Malyutin from Embedi for reporting this issue and working with us on coordinated disclosure.
- jacquesm 9y agoI interpret that as SA got wind something like this was going down, guessed some of the details and possibly forced Intel to disclose but they didn't actually find anything themselves nor do they have the details. Which explains why Intel credits someone else and they overplayed their hand by claiming that either ME or VPro are breached when it really is AMT. (Bad enough...)