6 ms·
In case you haven't already used the following, please note that the NSA had an undocumented "backdoor" included which "disables" the ME. (Man, oh man, I wish I
by sounds 9y ago
In case you haven't already used the following, please note that the NSA had an undocumented "backdoor" included which "disables" the ME. (Man, oh man, I wish I was making this stuff up.)
http://blog.ptsecurity.com/2017/08/disabling-intel-me.html http://blog.ptsecurity.com/2017/08/disabling-intel-me.html
I put quotes around "disables" because the ME is not fully disabled. The blog's analysis does show how it is in a "safe" state, i.e. forced to ignore the outside world very early in its code path. Also, not likely to brick your computer, assuming unscrewing your case and using a SPI flash programmer hasn't already bricked your computer.
Edit: "backdoor" in quotes too.
- deleted 9y ago[deleted]
- cyphar 9y agoYou can do this fairly easily with me_cleaner[1] which also does a lot of other disarming of ME. [1]: https://github.com/corna/me_cleaner https://github.com/corna/me_cleaner
- sounds 9y agoI found the relevant flags: --soft-disable-only and --soft-disable https://github.com/corna/me_cleaner/commit/d5705b62f802fdf1cf16b6a007946e7e775f2c63 https://github.com/corna/me_cleaner/commit/d5705b62f802fdf1c...
- loeg 9y agoYou should also put "backdoor" in quotes. It's not a backdoor in any meaningful sense; it's just an undocumented setting that allows them to (mostly) disable the ME on their machines.
- std_throwaway 9y agoIt's quite the opposite of a backdoor. It's "locking" their own backdoor that probably stands wide open on everbody elses house.
- vog 9y agoOn the other hand, I like the irony of a backdoor having a backdoor.
- nasredin 9y agoIt's backdoors all the way down!
- DonHopkins 9y ago"cat flap"
- vog 9y ago... which itself contains a flap for mice.
- daveheq 9y agoHow do we hack our computers to be secure?
- edaemon 9y agoThat's also from Positive Technologies, the people giving the presentation at Black Hat.
- tomxor 9y agocmon, too much miss-information to ignore you... the ability to remove the firmware partitions is in no way or form a "backdoor", also you don't need an SPI programmer to perform the mod and the number of partitions you can remove depend on the version.
- dmichulke 9y agoIf there is a "safe" state, there's also an "unsafe" state and it was obviously introduced knowing it might be unsafe, otherwise there'd be no "safe" state. Long story short, it's not a backdoor but a key to a backdoor which implies there is a backdoor.
- TeMPOraL 9y agoME is the backdoor - it's unsafe by default meaning it can be used to inspect/control your machine remotely. That, AFAIK, is it's primary and stated function!
- lima 9y agoFalse. ME by itself does not do any remote communication whatsoever. Zero external attack surface. Different story for vPro, but you can disable it. It's a great place, however, to gain persistence after an initial compromise as the talk shows.
- sounds 9y agoDo you have proof that the ME does not do any remote communication and has zero attack surface? Be sure to include "internal" attack surfaces that may be accessible from malware in ring 0.
- lima 9y agoI was talking about the external attack surface, and there's absolutely no indication that ME has any such attack surface as far as software vulnerabilities go. They could have built a deliberate backdoor into the network code, but that's highly unlikely. It obviously has a lot of internal attack surface, which is bad enough.
- dmichulke 9y agoI also assume it's the backdoor but with this piece of info (there is a "safe" state") the Intel people cannot legally claim they didn't know it was unsafe, so stupidity is ruled out (as in the saying never attribute to malevolence ...) The last missing piece is now whether ME was actively put there to enable a few agencies to gain unauthorized access.
- yuhong 9y agoThis reminds me of how no one cared about 40-bit crypto in the 1990s because only the NSA can break it, to take one example. Even Snowden's NSA leaks are often relatively old. This is part of why I dislike the debt-based economy. The more money the NSA spends, the more government debt is created.