4 ms·

Thw article also mentions removing some non critical binaries and modifying the ME filesystem

by totony 9y ago

eganist 9y ago
My understanding is this step isn't really a necessity but rather was done to prove that ME could be disabled at an extremely low level since the missing binaries would no longer trigger what's effectively a failure condition. Could be wrong. Probably safer to just set the killbit rather than also tamper with ME directly is ultimately my point. That's my risk aversion at work.
- rubatuga 9y ago
  I'm simply intrigued how this bit has managed to elude so many developers and hackers over the years. It's literally an option in an intel software tool, and yet you have people who have vehemently complained about Intel ME for the past few years. I have some serious cognitive dissonance going on right now.
  - dmm 9y ago
    The latest version of ME, 11, uses a x86 processor. That's why the researchers were able to perform this analysis and find the bit to flip. It also doesn't disable ME, just most of it.
    - rubatuga 9y ago
      I see, it appears ME 11 was introduced in September 2015, which means this discovery came about in less than two years.
  - wolfgke 9y ago
    > I'm simply intrigued how this bit has managed to elude so many developers and hackers over the years. Lots of hackers already knew that for many years - I would rather call it "common knowledge". But they had no idea what one could do to change anything about this. Just like "AMD PSP"/"AMD Secure Processor" - it is common knowledge that it exists, but we have no idea what it really does or how one can disable/disarm it. Or baseband processors - you can be pretty sure that there exist backdoors. I always tell people that they should throw away their mobile phones and love to say that they are bugging devices with integrated telephony functions - in this order; and this is true even if we do not assume any evil backdoors - for those reasons I don't own one. But people don't care. Or have you never considered why Intel pushed Wifi so much (Intel Centrino)? Doesn't Wifi (or "accidental" bugs in the chip firmware for it) look like a backdoor that can also be used over an air gap? If you need a further point on this: https://puri.sm/posts/hard-not-soft-kill-switches/ https://puri.sm/posts/hard-not-soft-kill-switches/ Why does the PCISIG M.2 NGFF standard require that a pin has to be pulled high do disable Wifi and Bluetooth? I always tell people that they should avoid Wifi and use ethernet instead. Also to no avail.
    - milcron 9y ago
      Know what's even crazier? If the CPU has the "Intel® Anti-Theft Technology", then the Management Engine has 3G built-in.
      - wmf 9y ago
        It's probably more accurate to say that the ME can communicate with the 3G card if there is one installed.
        milcron 9y ago
        You're right. Unfortunately HN won't let me edit my comment.
- totony 9y ago
  I believe you're right "Once the DID is received, BUP—depending on the mode, which is determined by various factors—either starts IBL processes from InitScript (in normal mode) or hangs in a loop, which it can exit only when it receives a message from the PMC, for example as a result of a request to restart or shut down the system." But I am not sure if those are stopped: "Secondly, it starts a whole string of processes; some of them are hard-coded (SYNCMAN, PM, VFS)," Since the authors only mention that the InitScript/IBL Processes are not started, I assumed the hardcoded ones were started, but could be prevented from loading in the following way: "2. In the CPD section of the FTPR, remove or damage all modules except those required by BUP for startup:"

Thw article also mentions removing some non critical binaries and modifying the ME filesystem

by totony 9y ago

Thw article also mentions removing some non critical binaries and modifying the ME filesystem

My understanding is this step isn't really a necessity but rather was done to prove that ME could be disabled at an extremely low level since the missing binaries would no longer trigger what's effectively a failure condition. Could be wrong. Probably safer to just set the killbit rather than also tamper with ME directly is ultimately my point. That's my risk aversion at work.

rubatuga 9y ago
I'm simply intrigued how this bit has managed to elude so many developers and hackers over the years. It's literally an option in an intel software tool, and yet you have people who have vehemently complained about Intel ME for the past few years. I have some serious cognitive dissonance going on right now.
- dmm 9y ago
  The latest version of ME, 11, uses a x86 processor. That's why the researchers were able to perform this analysis and find the bit to flip. It also doesn't disable ME, just most of it.
  - rubatuga 9y ago
    I see, it appears ME 11 was introduced in September 2015, which means this discovery came about in less than two years.
- wolfgke 9y ago
  > I'm simply intrigued how this bit has managed to elude so many developers and hackers over the years. Lots of hackers already knew that for many years - I would rather call it "common knowledge". But they had no idea what one could do to change anything about this. Just like "AMD PSP"/"AMD Secure Processor" - it is common knowledge that it exists, but we have no idea what it really does or how one can disable/disarm it. Or baseband processors - you can be pretty sure that there exist backdoors. I always tell people that they should throw away their mobile phones and love to say that they are bugging devices with integrated telephony functions - in this order; and this is true even if we do not assume any evil backdoors - for those reasons I don't own one. But people don't care. Or have you never considered why Intel pushed Wifi so much (Intel Centrino)? Doesn't Wifi (or "accidental" bugs in the chip firmware for it) look like a backdoor that can also be used over an air gap? If you need a further point on this: https://puri.sm/posts/hard-not-soft-kill-switches/ https://puri.sm/posts/hard-not-soft-kill-switches/ Why does the PCISIG M.2 NGFF standard require that a pin has to be pulled high do disable Wifi and Bluetooth? I always tell people that they should avoid Wifi and use ethernet instead. Also to no avail.
  - milcron 9y ago
    Know what's even crazier? If the CPU has the "Intel® Anti-Theft Technology", then the Management Engine has 3G built-in.
    - wmf 9y ago
      It's probably more accurate to say that the ME can communicate with the 3G card if there is one installed.
      - milcron 9y ago
        You're right. Unfortunately HN won't let me edit my comment.
totony 9y ago
I believe you're right "Once the DID is received, BUP—depending on the mode, which is determined by various factors—either starts IBL processes from InitScript (in normal mode) or hangs in a loop, which it can exit only when it receives a message from the PMC, for example as a result of a request to restart or shut down the system." But I am not sure if those are stopped: "Secondly, it starts a whole string of processes; some of them are hard-coded (SYNCMAN, PM, VFS)," Since the authors only mention that the InitScript/IBL Processes are not started, I assumed the hardcoded ones were started, but could be prevented from loading in the following way: "2. In the CPD section of the FTPR, remove or damage all modules except those required by BUP for startup:"