6 ms·

And then the intel ME debacle became widely known and, as usual, the tinfoil hatted among us got to say "told you"

by zdkl 9y ago

vog 9y ago
Small nickpick: The tinfoil hats would have loved to say "told you so", but even they had not predicted the true scale of things. Intel ME is not just some BIOS code, but a separate hardware component that is deeply connected with all CPU actions.
- zdkl 9y ago
  Nitpick to your nitpick: Real tinfoilers have been warning about this since the 80's
  - chii 9y ago
    And do you know what happened to those people?! Nobody knows, of course! They got taken out coz they know to much!
  - LoSboccacc 9y ago
    yeah, remember when people where laughed off when talking abut ECHELON?
    - mason55 9y ago
      Yeah, growing up with ECHELON and Carnivore, the whole Snowden thing didn't surprise me at all. You didn't even need to assume they were doing it, past evidence pointed to the fact the government was 100% spying on everyone already.
throwawayknecht 9y ago
Intel ME was widely known of before BadBIOS. BadBIOS is still nonsense.
- zdkl 9y ago
  True but for this argument, I'd say the specific location of the backdoor isn't the relevant part.
- tr1ck5t3r 9y ago
  BadBios is not nonsense, it uses CPU virtualisation and Hard Drive controllers which appear as USB devices to load first, then runs independent of what ever OS you are running. If your Bios has been compromised then you cant switch off CPU Virtulisation and your Bios looks and feels like the real thing. Any electronic device with chip's that can be updated can store the malware, USB printers, card readers & writers, some keyboards, the list goes on.
  - guipsp 9y ago
    >you cant switch off CPU Virtulisation OK, makes sense >looks and feels like the real thing Not really, because you can't turn off virtualization
    - tr1ck5t3r 9y ago
      >>looks and feels like the real thing >Not really, because you can't turn off virtualization To be clear what I mean is, the bios can be made to look and feel like the real bios when in fact it could be a compromised bios which still shows the manufacturers logo, menu options etc etc. Bottom line is, if someone can make it, someone can modify it. Only getting a SOIC clip hooked up to something like a RaspberryPi to get a copy of the chip code will you possibly be able to tell otherwise. Something like this might get people pointed in the right direction. http://www.win-raid.com/t58f16-Guide-Recover-from-failed-BIOS-flash-using-Raspberry-PI.html http://www.win-raid.com/t58f16-Guide-Recover-from-failed-BIO... One of the other attributes I have seen with this "suite of malware" is its ability to spread over the USB bus. If hit with it and it stops your usb devices including printers, mouse & keyboard, PS/2 mouse and keyboards still work so you can safely shutdown your machines instead of pressing and holding the power button to force a shutdown which can lose work. Lets face it, when looking at how USB works, its a disaster waiting to be exploited when considering how much attention goes into monitoring ethernet traffic. Having spoken with Tomasz the developer of this tool http://desowin.org/usbpcap/ http://desowin.org/usbpcap/ on windows, you only get what windows will show you, so a separate malicious OS using CPU virtualisation could still interfere with the USB bus. One file I've isolated when using partedmagic will not display its entire contents in the included opensource hex editor if its accessed using the hex editors file load method, but if you read the block device sector by sector, you can navigate to where the suspect file is stored and then read the entire contents of the suspect file. There seems to be a sort of magic string which prevents further investigation of suspect files including the ability to dd dev zero block devices which is a nuisance. In all, who ever is behind this is IMO hacking chips so that even if you do a full disk wipe to whatever standard and reinstall the OS, you'll never get rid of it unless you reprogram the chips, it like a complex zero day spread over hardware and software, so in isolation parts look innocent enough but when combined becomes malicious. Its very very clever whoever is behind it and theres not many entities with the resources or knowledge to pull something like this off IMO. Plus when considering the NDA's that exist with chip/cpu/hardware manufacturers, the knowledge at this level is even more restricted. If you want to get lucky, dont always follow industry standard practices, its sometimes the only way to spot the anomalies.
traitormonkey 9y ago
'Tinfoil hat' is a derogatory term designed to intimidate and silence truth-seekers. Given that many so-called 'tinfoil hat' theories about illegal activities within the USG turned out to be true - what would a suitable, equally derogatory, antonym be?

And then the intel ME debacle became widely known and, as usual, the tinfoil hatted among us got to say "told you"

by zdkl 9y ago

And then the intel ME debacle became widely known and, as usual, the tinfoil hatted among us got to say "told you"

vog 9y ago

Small nickpick: The tinfoil hats would have loved to say "told you so", but even they had not predicted the true scale of things. Intel ME is not just some BIOS code, but a separate hardware component that is deeply connected with all CPU actions.

zdkl 9y ago
Nitpick to your nitpick: Real tinfoilers have been warning about this since the 80's
- chii 9y ago
  And do you know what happened to those people?! Nobody knows, of course! They got taken out coz they know to much!
- LoSboccacc 9y ago
  yeah, remember when people where laughed off when talking abut ECHELON?
  - mason55 9y ago
    Yeah, growing up with ECHELON and Carnivore, the whole Snowden thing didn't surprise me at all. You didn't even need to assume they were doing it, past evidence pointed to the fact the government was 100% spying on everyone already.

throwawayknecht 9y ago

Intel ME was widely known of before BadBIOS. BadBIOS is still nonsense.

zdkl 9y ago
True but for this argument, I'd say the specific location of the backdoor isn't the relevant part.
tr1ck5t3r 9y ago
BadBios is not nonsense, it uses CPU virtualisation and Hard Drive controllers which appear as USB devices to load first, then runs independent of what ever OS you are running. If your Bios has been compromised then you cant switch off CPU Virtulisation and your Bios looks and feels like the real thing. Any electronic device with chip's that can be updated can store the malware, USB printers, card readers & writers, some keyboards, the list goes on.
- guipsp 9y ago
  >you cant switch off CPU Virtulisation OK, makes sense >looks and feels like the real thing Not really, because you can't turn off virtualization
  - tr1ck5t3r 9y ago
    >>looks and feels like the real thing >Not really, because you can't turn off virtualization To be clear what I mean is, the bios can be made to look and feel like the real bios when in fact it could be a compromised bios which still shows the manufacturers logo, menu options etc etc. Bottom line is, if someone can make it, someone can modify it. Only getting a SOIC clip hooked up to something like a RaspberryPi to get a copy of the chip code will you possibly be able to tell otherwise. Something like this might get people pointed in the right direction. http://www.win-raid.com/t58f16-Guide-Recover-from-failed-BIOS-flash-using-Raspberry-PI.html http://www.win-raid.com/t58f16-Guide-Recover-from-failed-BIO... One of the other attributes I have seen with this "suite of malware" is its ability to spread over the USB bus. If hit with it and it stops your usb devices including printers, mouse & keyboard, PS/2 mouse and keyboards still work so you can safely shutdown your machines instead of pressing and holding the power button to force a shutdown which can lose work. Lets face it, when looking at how USB works, its a disaster waiting to be exploited when considering how much attention goes into monitoring ethernet traffic. Having spoken with Tomasz the developer of this tool http://desowin.org/usbpcap/ http://desowin.org/usbpcap/ on windows, you only get what windows will show you, so a separate malicious OS using CPU virtualisation could still interfere with the USB bus. One file I've isolated when using partedmagic will not display its entire contents in the included opensource hex editor if its accessed using the hex editors file load method, but if you read the block device sector by sector, you can navigate to where the suspect file is stored and then read the entire contents of the suspect file. There seems to be a sort of magic string which prevents further investigation of suspect files including the ability to dd dev zero block devices which is a nuisance. In all, who ever is behind this is IMO hacking chips so that even if you do a full disk wipe to whatever standard and reinstall the OS, you'll never get rid of it unless you reprogram the chips, it like a complex zero day spread over hardware and software, so in isolation parts look innocent enough but when combined becomes malicious. Its very very clever whoever is behind it and theres not many entities with the resources or knowledge to pull something like this off IMO. Plus when considering the NDA's that exist with chip/cpu/hardware manufacturers, the knowledge at this level is even more restricted. If you want to get lucky, dont always follow industry standard practices, its sometimes the only way to spot the anomalies.

traitormonkey 9y ago

'Tinfoil hat' is a derogatory term designed to intimidate and silence truth-seekers. Given that many so-called 'tinfoil hat' theories about illegal activities within the USG turned out to be true - what would a suitable, equally derogatory, antonym be?