5 ms·
Exploiting vPro / AMT / any remote access mechanism from any chip maker is hardly a new idea. AMT and AMD's equivalent (don't remember the name) has been a hol
by kakarot 9y ago
Exploiting vPro / AMT / any remote access mechanism from any chip maker is hardly a new idea.
AMT and AMD's equivalent (don't remember the name) has been a holy grail for security researchers and malware authors alike for many years. People have been begging Intel for a very long time to make business-tier chips without remote access capabilities.
For personal computing, at least we have enthusiast chips. For example, my i7 K model lacks the technology.
EDIT: AMD's remote tech is called Platform Security Processor (PSP). Thank you, jacquesm!
- mschuster91 9y agoWho knows if the feature is not still present in silicon but just software-disabled? It's not really new that Intel and AMD do binning to get more yield.
- kakarot 9y agoIt isn't present AFAIK, because Intel cuts corners on enthusiast chips they do not expect to be used in a networked environment in order to save money, and still charge you more than the non-enthusiast counterparts.
- mschuster91 9y agoAh okay. I thought that Intel bins everything from high-grade Xeon to i3 from the same silicon to save costs.
- kakarot 9y agoI couldn't truly say whether Intel bins all of their processors with the same prefab or not, I'm not sure how to find this out either. My working theory however is that since my chip lacks vPRO / AMT and I have not been able to find any indication it exists on the chip even in a dormant state, there may be more than one prefab used for binning. However they could be using the same prefab for all. Thus, "AFAIK".
- rasz 9y agoME is there (ability to execute below ring -1). Go ahead and check it right now, look at lspci/device manager for Management Engine Communications device. Its present on cheapest desktop H81 motherboards, and on highend (at the time) Z87 ones, no matter the cpu.
- kakarot 9y agoI have done that before, and I've just done it again, and I don't get anything. The only thing present on my system related to ME afaik is the MEI linux driver, which is pretty useless without a ME to talk to. According to ARK [0], vPRO is absent. I have done various other system queries and nothing has turned up. Anything else you want me to query? And where do you get this information that ME is present in all chips? Having a motherboard that supports ME is irrelevant, if the chip has no ME. [0] https://ark.intel.com/products/88195/Intel-Core-i7-6700K-Processor-8M-Cache-up-to-4_20-GHz https://ark.intel.com/products/88195/Intel-Core-i7-6700K-Pro...
- zer0tonin 9y agoME is always there even if you don't have any of its features.
- kakarot 9y agoSee my comment here: https://news.ycombinator.com/item?id=14522172 https://news.ycombinator.com/item?id=14522172 Same questions apply to you. This is something I would like to be proved wrong on, as I don't want a false since of security.
- jacquesm 9y ago> don't remember the name PSP: Platform Security Processor
- _jal 9y ago> People have been begging Intel for a very long time to make business-tier chips without remote access capabilities. Yes. But somehow, any time anyone brings up wanting a device without one, people start poo-pooing the idea. "Just don't use it." "That's paranoid." "Just another CVE, yawn." In a ton of discussions over the years, I have yet to hear a single plausible, benign reason for why the ME's 30 minute timer must be impossible to disable by the owner of the chip.
- tremon 9y agoAMD's PSP does not have any remote access mechanism though, and it is powered off along with the processor.