7 ms·

Money Quote: > When contacted by Microsoft, Intel said the PLATINUM group wasn't using any vulnerability in the Intel AMT SOL interface, but this was another c

Money Quote: > When contacted by Microsoft, Intel said the PLATINUM group wasn't using any vulnerability in the Intel AMT SOL interface, but this was another classic case of bad guys using a technology developed for legitimate purposes to do bad things. Worst excuse ever. "Look guys, at least it's not a backdoor we left on purpose!!!" m(

annnnd 9y ago
This just means that it is broken by design and will probably never be fixed. Nice. Does anyone know about similar AMD vulnerabilities?
- HappyTypist 9y ago
  Yes, AMD chips have almost exactly the same features as Intel ME. The cynic in me thinks that some execs got FISA orders.
  - doubt_me 9y ago
    https://en.wikipedia.org/wiki/Communications_Assistance_for_Law_Enforcement_Act https://en.wikipedia.org/wiki/Communications_Assistance_for_...
    - Karunamon 9y ago
      Applies to telecom companies, not CPU manufacturers.
hellbanner 9y ago
Are there any open hardware computers of comparable computing power? How can the consumer stop someone from exploiting this hack?
- _jal 9y ago
  1) No, not even close. 2) Disconnect from the network. This, of course, won't stop local attacks on the AMT or ME. This is why I've been complaining about the ME forever. Forcing a privileged black-box that can't be disabled in to every CPU is... not suspicious all. Even worse are some implementations. I have a Supermicro all-in-one MB that I used in building a home storage server. It has two gig-ethernet ports. About two months ago, I was rearranging around the machine, and when I plugged it back in, apparently I switched the ethernet port plugged in to the switch to the "primary" interface. And one of the monitors goes off a few minutes later - there's a new network device on my private network. Turns out a web interface to the ME comes up automatically when using the primary NIC - it got a DHCP lease and was happily waiting to be managed - with the default creds ADMIN/ADMIN. I thought that we had that one figured out, but apparently not. Yes, I should have read the manual for the motherboard, but that's beyond absurd. And, I guess, a good reminder to trust nothing.
- CapacitorSet 9y ago
  >How can the consumer stop someone from exploiting this hack? [Remove Intel ME](https://github.com/corna/me_cleaner https://github.com/corna/me_cleaner) to the largest extent possible. I don't know of equivalent tools for AMD, though, which also has similar systems in place.
- mycall 9y ago
  Dense RISC-V will eventually happen, although its supporting chipset will probably have its own vulnerabilities.
- mobilethrow 9y ago
  > Are there any open hardware computers of comparable computing power? IBMs POWER processors are comparable to high-end Xeons and the specifications are entirely open. I'd love to see a new "Talos" effort in light of recent events: https://www.crowdsupply.com/raptor-computing-systems/talos-secure-workstation/updates/the-state-of-owner-controlled-computing-as-talos-winds-down https://www.crowdsupply.com/raptor-computing-systems/talos-s...
- timonovici 9y ago
  We're a long way until free hardware design are a thing, for a more immediate solution, try this: If it's processing power you need, I guess the ASUS KGPE-D16 with Libreboot would to the trick. As a laptop - X200, X200T, T400, T400s, T500, etc. You can find a list of vendors here: https://libreboot.org/suppliers.html https://libreboot.org/suppliers.html

annnnd 9y ago

This just means that it is broken by design and will probably never be fixed. Nice. Does anyone know about similar AMD vulnerabilities?

HappyTypist 9y ago
Yes, AMD chips have almost exactly the same features as Intel ME. The cynic in me thinks that some execs got FISA orders.
- doubt_me 9y ago
  https://en.wikipedia.org/wiki/Communications_Assistance_for_Law_Enforcement_Act https://en.wikipedia.org/wiki/Communications_Assistance_for_...
  - Karunamon 9y ago
    Applies to telecom companies, not CPU manufacturers.

hellbanner 9y ago

Are there any open hardware computers of comparable computing power? How can the consumer stop someone from exploiting this hack?

_jal 9y ago
1) No, not even close. 2) Disconnect from the network. This, of course, won't stop local attacks on the AMT or ME. This is why I've been complaining about the ME forever. Forcing a privileged black-box that can't be disabled in to every CPU is... not suspicious all. Even worse are some implementations. I have a Supermicro all-in-one MB that I used in building a home storage server. It has two gig-ethernet ports. About two months ago, I was rearranging around the machine, and when I plugged it back in, apparently I switched the ethernet port plugged in to the switch to the "primary" interface. And one of the monitors goes off a few minutes later - there's a new network device on my private network. Turns out a web interface to the ME comes up automatically when using the primary NIC - it got a DHCP lease and was happily waiting to be managed - with the default creds ADMIN/ADMIN. I thought that we had that one figured out, but apparently not. Yes, I should have read the manual for the motherboard, but that's beyond absurd. And, I guess, a good reminder to trust nothing.
CapacitorSet 9y ago
>How can the consumer stop someone from exploiting this hack? [Remove Intel ME](https://github.com/corna/me_cleaner https://github.com/corna/me_cleaner) to the largest extent possible. I don't know of equivalent tools for AMD, though, which also has similar systems in place.
mycall 9y ago
Dense RISC-V will eventually happen, although its supporting chipset will probably have its own vulnerabilities.
mobilethrow 9y ago
> Are there any open hardware computers of comparable computing power? IBMs POWER processors are comparable to high-end Xeons and the specifications are entirely open. I'd love to see a new "Talos" effort in light of recent events: https://www.crowdsupply.com/raptor-computing-systems/talos-secure-workstation/updates/the-state-of-owner-controlled-computing-as-talos-winds-down https://www.crowdsupply.com/raptor-computing-systems/talos-s...
timonovici 9y ago
We're a long way until free hardware design are a thing, for a more immediate solution, try this: If it's processing power you need, I guess the ASUS KGPE-D16 with Libreboot would to the trick. As a laptop - X200, X200T, T400, T400s, T500, etc. You can find a list of vendors here: https://libreboot.org/suppliers.html https://libreboot.org/suppliers.html