7 ms·
I wonder if this one will come with free backdoors and spyware installed, thanks to the wonderful Intel Management Engine (Intel ME) backdoor. [1][2][3] Intel
by turblety 9y ago
I wonder if this one will come with free backdoors and spyware installed, thanks to the wonderful Intel Management Engine (Intel ME) backdoor. [1][2][3]
Intel (and AMT) keep pushing more and more proprietary code that can not be read, changed or removed. No one knows exactly what it does and it has built in screen and key recording. It's my advice and the advice of privacy advocates that no one should purchase or use any processor made by Intel or AMD until they address these serious issues.
1. https://libreboot.org/faq.html#intel https://libreboot.org/faq.html#intel
2. https://puri.sm/learn/intel-me/ https://puri.sm/learn/intel-me/
3. https://news.ycombinator.com/item?id=14708575 https://news.ycombinator.com/item?id=14708575
- andy_ppp 9y agoDoes anyone here know someone who works on these various management engines? It'd be interesting to see if the security services were involved or if they really were back dooring all computers right? My guess is it's definitely possible but it would have been popped by foreign agencies by now too and there would have been a leak of tools to exploit such devices? I guess maybe it's very tempting to be able to hack any device though so knowing the NSA they are probably for doing this, fuck the consequences?
- turblety 9y agoThere was this floating around a while ago: https://i.redd.it/id88hvysu3ny.png https://i.redd.it/id88hvysu3ny.png
- nowherecat 9y agoWell, this seems quite a bit unsubstantial. If an Intel Employee in that position wanted to leak some real info, i would assume it would be accompanied by something that gives the information some credibility.
- badwolf 9y agoYou mean an anonymous post on 4chan about Obama spying on Trump isn't super credible? Color me shocked...
- nowherecat 9y agoMany people actually need hints like that:-)
- v4n4d1s 9y ago"The stories and information posted here are artistic works of fiction and falsehood. Only a fool would take anything posted here as fact."
- piva00 9y agoYou know the depth of how unrealistic is your advice, right?
- thinkfurther 9y agoDo you know the depths of not taking that advice and what lurks in them? Do you know that if everybody simply took it to heart, there'd be nothing unrealistic about it at all? How many months of abstinence and solidarity would be required to end these practices, or the companies if they so wish? And then that money simply shifts to ethical companies and we actually have a future. Or, we keep pretending it's all so very hard, and don't have one.
- piva00 9y agoYou are asking for the whole of humanity to stop buying some of the most sought after products of modern times from two of the best-selling makers of that industry. I am all in for some philosophical discussion but actually being this detached from reality doesn't make you any good. It's not because you can see the stars that you can reach for them right now... So yes, in summary: it is hard, to the point of impossibility.
- thinkfurther 9y agoPfff. It's the strike breakers that make it hard. Keep that up for a while longer, and it will become a physical impossibility, as any gesture of resistance leads to automatic extermination. Until then? Thanks for nothing.
- justin66 9y ago> Do you know the depths of not taking that advice and what lurks in them? Pretty much everyone can imagine computers being insecure and unreliable, since computers are currently insecure and unreliable.
- fasquoika 9y agoNot to mention that they'd wouldn't be secure and reliable just from removing Intel ME
- lawik 9y agoInteresting. Pragmatically, are there any okay-ish options for consumer-level processors and motherboards that are not Intel or AMD? ARM devices?
- cyphar 9y agoThe Talos II[1], which is a IBM POWER9-based machine. It's a bit more expensive than a standard Intel machine (~$2k for the whole prebuilt machine, a bit less for just the motherboard+CPU). Everything in it is free, including all of the firmware, and the CPU is an open specification. [1]: https://www.raptorcs.com/content/base/products.html https://www.raptorcs.com/content/base/products.html
- baq 9y agoThe backdoor is super useful for large enterprises, don't hope for much.
- rekado 9y agoIt would be more useful for them if it could be controlled at the source level. The management engine would be fine if it were free software and could be replaced. I'm very unhappy with my old Sun servers, for example, because the management system cannot be upgraded and the servers are no longer supported. I'm stuck with proprietary insecure software that I depend on and that I have no way of changing. It's all worse if the insecure outdated software can only be replaced by soldering wires to a chip on the board.
- turblety 9y agoThe issue I have is companies like Google and Puri.sm have asked Intel and AMD for a blank signed blob that completely disables ME but they have refused this. It would take them literally no time at all. This raises all sorts of red flags that something dodgy is going on. If you had the chance to make a supplier who creates millions of chromebooks happy, wouldn't you take every opportunity to help them, especially if it costs you little to no money at all. Obviously there is a big reason why they don't want this backdoor removed.
- luch 9y agohalvar flake (Google P0 security guy) talk a bit about it in the last Black Hat Asia : https://www.youtube.com/watch?v=JCa3PBt4r-k https://www.youtube.com/watch?v=JCa3PBt4r-k. Basically he says that even Google is puny (in terms of production units) in front of Intel or Samsung, and cannot ask for custom firmwares. Hardware security is currently a shit show because of global monopolies/"oligopolies".
- greggyb 9y agoIf Google is tiny in Intel's eyes, who isn't? They operate a top 3 cloud service and have enormous internal data centers as well.
- sspiff 9y agoI'm not sure this should be discussed in this thread. Also, I don't know of any alternative that doesn't have large unauditable blobs integrated into the chip. All ARM SoCs come with radio processors that are running a non-trivial piece of software with full access to the system memory, which is responsible for power management, boot sequence and wireless communications. It is by definition network connected. AMD has a technology it calls the Platform Security Processor (PSP for short) which does basically the same thing. To have a processor that doesn't have this kind of technology, you have to give up on decades of advancement in compute power, or buy a very expensive and non-portable POWER8 or POWER9 system.
- turblety 9y agoWhy should a serious backdoor, privacy concerns and ethical problems with a monopolies new product not be discussed in a thread about that product? Not sure I get your point on that. But yeah you are totally right on the alternatives. Nothing quite matches Intel and AMD, and a lot of those ARM SoC's have proprietary code running on their bootloader too. But you can get some processor from 7 years ago that are usable. OpenPOWER is fantastic though and has real potential. There were a few projects out there looking to implement a laptop and personal desktop computer using it, but unfortunatly didn't reach it's funding goals. I think the more people that know about Intel and AMD's shading practices that more funding open hardware projects can get, and maybe in the next few years we can replace Intel and AMD with ethical and open solutions.
- krambo 9y agoI agree, this has to be allowed to be discussed about, it's literally about the product. Haven't heard about OpenPOWER, I hope more people are made aware of alternatives to get funding and spin. There are some ARM processors that live without blobs, I think Olimex produces what they call open-source hardware (OSHW), is this an acceptable product?
- floatboth 9y ago> a lot of those ARM SoC's have proprietary code running on their bootloader too Usually possible to replace that blob! e.g. https://github.com/christinaa/rpi-open-firmware https://github.com/christinaa/rpi-open-firmware for the Raspberry Pi
- wiz21c 9y agoyep. Once everything will be under control, having the freedom to write your own software, especially software that challenges the rules, will be useless...
- dis-sys 9y ago> no one should purchase or use any processor made by Intel or AMD until they address these serious issues. so go back to stone age by stop using all PCs/Servers? nice troll.
- turblety 9y agoHave a look at https://minifree.org/ https://minifree.org/ and a few Chromebooks (obviously with the operating system replaced). There are some options, but yeah it's a big problem that the microprocessor market has been locked up by two monopolies. But I guess people have to make a personal judgement. Is ethics, privacy, freedom more important than a faster processor to run your games on?
- asendra 9y agoSure, because we only use computers to play games on...
- cyphar 9y agoIn addition to MiniFree, there's the Talos II[1] which is an entirely free motherboard and CPU (based on IBM's POWER9). It's a very modern CPU specification, and is also fairly powerful. Currently pre-orders are open. They are a bit pricey (~$2k for a fully prebuilt machine), but if you feel that you want a more powerful CPU that is an option. They also have server offerings. [1]: https://www.raptorcs.com/content/base/products.html https://www.raptorcs.com/content/base/products.html
- jcadam 9y agoBack in the days when a new computer became hopelessly obsolete within 3 years, I would never have considered spending that much. But perhaps now I might :)
- goodroot 9y agoThis is disturbing, to say the least. Given how much effort I've invested in securing myself, it's... disappointing. The rationale, it seems, is that government doesn't count as "someone to be concerned about", from a security point of view. I'm curious about how one would be associated with a particular chip. I understand that key strokes can be logged, TCP/IP can be read; you can be scraped, but ultimately how is their backdoor aware of you so that it doesn't appear to them like needle in a stack of needles. A fascinating and revolting technical conundrum.
- jsudhams 9y agoSo it does affect only Desktop workload right? Because on servers as long as we use virtuals we should be good. Am i right?
- turblety 9y agoNo. Basically the Intel ME is a completely separate ARM processor that's physically stuck onto each Intel Processor. It has direct access to everything the Intel chip does. The memory it's allocating, the hardware commands (ie keyboard, mouse, display), the software running, the processes running. This all happens at a higher level than the actual Intel processor and you have no control over it at all. Basically whatever you run at any level on your Intel chip can be monitored by the Intel ME chip, no matter how many VM's, operating systems, encrypted files/processes you have installed/are using.
- davemp 9y agoIf CPU backdoors exist how has nobody logged network traffic required to abuse them?
- Buge 9y agoMalware is in fact using IME.[1] And remotely exploitable vulnerabilities have been found it in.[2] [1] https://blogs.technet.microsoft.com/mmpc/2017/06/07/platinum-continues-to-evolve-find-ways-to-maintain-invisibility/ https://blogs.technet.microsoft.com/mmpc/2017/06/07/platinum... [2] https://arstechnica.com/information-technology/2017/05/intel-patches-remote-code-execution-bug-that-lurked-in-cpus-for-10-years/ https://arstechnica.com/information-technology/2017/05/intel...
- davemp 9y agoI'm surprised I didn't hear about this until now. It looks like the user had to have enabled AMT, so this isn't exactly conspiracy levels. It is troubling how little priority the computer world gives to proper security models.
- ngneer 9y agoAre you certain that the advice you are giving is suited to the security and privacy objectives of the masses? Also, the management engine is more about the chipset than about the core, which is what the announcement is about.