4 ms·

If an Intel employee go broke and sell privates cryptography keys and IME documentation to a hackers group, how many computer have to be replaced in the world ?

If an Intel employee go broke and sell privates cryptography keys and IME documentation to a hackers group, how many computer have to be replaced in the world ? Security by obscurity has never worked in long term.

AstralStorm 9y ago
Technically, from what we know ME firmware is flashable and possible to update except baked in private keys to verify signature. Of course, it is still a single point of failure, would be much nicer if Intel provided documentation on chipset and CPU init as well as a way to replace those keys. (Say, hardware switch to enable write pin on some EEPROM.) The big trouble is the huge attack surface of the vPro not running in magic unsupported "trusted mode" while not being properly audited is trouble. Likewise blobs like SINIT used for TPM and SecureBoot initialization.
- oneweekwonder 9y ago
  > Technically, from what we know ME firmware is flashable and possible to update And it might be running Minix3[0] which is amazing for me. But man it sucks to think there is a *nix machine next to my machine I have no control over. Some might mention SSD fw, but does it have a known serial over LAN vulnerability[1]. Wikipedia also cite a elevation of privilege bug[2]. I'm so glad I'm not a IT manager. [0]: http://blog.ptsecurity.com/2017/04/intel-me-way-of-static-analysis.html http://blog.ptsecurity.com/2017/04/intel-me-way-of-static-an... [1]: https://www.scmagazineuk.com/platinum-hackers-exploit-intel-amt-sol-for-secure-cc-communications/article/667477/ https://www.scmagazineuk.com/platinum-hackers-exploit-intel-... [2]: https://en.wikipedia.org/wiki/Intel_Active_Management_Technology#cite_note-intel1-12 https://en.wikipedia.org/wiki/Intel_Active_Management_Techno... ps. If anybody have some info of the minix in ME. Please drop me a message.
- deleted 9y ago
  [deleted]
sebazzz 9y ago
Pretty sure the private is provided by a HSM, you can't steal that.
- jlgaddis 9y ago
  Until a while ago we assumed the ME was safe too.

AstralStorm 9y ago

Technically, from what we know ME firmware is flashable and possible to update except baked in private keys to verify signature. Of course, it is still a single point of failure, would be much nicer if Intel provided documentation on chipset and CPU init as well as a way to replace those keys. (Say, hardware switch to enable write pin on some EEPROM.) The big trouble is the huge attack surface of the vPro not running in magic unsupported "trusted mode" while not being properly audited is trouble. Likewise blobs like SINIT used for TPM and SecureBoot initialization.

oneweekwonder 9y ago
> Technically, from what we know ME firmware is flashable and possible to update And it might be running Minix3[0] which is amazing for me. But man it sucks to think there is a *nix machine next to my machine I have no control over. Some might mention SSD fw, but does it have a known serial over LAN vulnerability[1]. Wikipedia also cite a elevation of privilege bug[2]. I'm so glad I'm not a IT manager. [0]: http://blog.ptsecurity.com/2017/04/intel-me-way-of-static-analysis.html http://blog.ptsecurity.com/2017/04/intel-me-way-of-static-an... [1]: https://www.scmagazineuk.com/platinum-hackers-exploit-intel-amt-sol-for-secure-cc-communications/article/667477/ https://www.scmagazineuk.com/platinum-hackers-exploit-intel-... [2]: https://en.wikipedia.org/wiki/Intel_Active_Management_Technology#cite_note-intel1-12 https://en.wikipedia.org/wiki/Intel_Active_Management_Techno... ps. If anybody have some info of the minix in ME. Please drop me a message.
deleted 9y ago
[deleted]

sebazzz 9y ago

Pretty sure the private is provided by a HSM, you can't steal that.

jlgaddis 9y ago
Until a while ago we assumed the ME was safe too.