> In a subsystem change that will be detailed in the talk of Intel ME version 11+, a vulnerability was found. Okay, so this effects 11.x, but I wanted to clari

> In a subsystem change that will be detailed in the talk of Intel ME version 11+, a vulnerability was found. Okay, so this effects 11.x, but I wanted to clarify that there seem to always have been circumventions floating around out there. I stumbled on https://www.reddit.com/r/onions/comments/5i6qa3/can_the_nsafbi_use_intel_me_to_defeat_tor_on_95/dbkxlw2/?context=10000 https://www.reddit.com/r/onions/comments/5i6qa3/can_the_nsaf... (mirror: http://archive.is/T8yVz http://archive.is/T8yVz) some months ago. It reads a little like a skiddie (a well-connected one) strutting a bit, and I think some of this person's views on ME as a viable attack vector are slightly careless and un-thought-through, but whoever this person is, they seem to be very confident about some of the things they said, particularly the following quotes (to be completely clear, I've removed first-person references): > [This person] know[s] that at least up to firmware version 8 is traded underground, and version 11 (the latest) is available without difficulty to people who know how to find it. [This person has] access to version 8's signing keys [themselves] ... > It's certainly not common but it is absolutely something that FVEY and related contractors (Raytheon, Leidos, half the people you'll see at ISS, etc) will be able to get their hands on, if they haven't already. > [This person has] an enterprise ThinkPad that proudly boasts having WiMax support, requiring extensive configuration. It was expensive. If you don't have a BMC card (and you do not), then it is not possible to remotely control your system. Even if you did have a BMC, simply having the signing keys and toolchain for the ME would not be sufficient to get in. An attacker would need either a 0day, or your credentials. .....Well then. Oops. > Having the signing key allows nothing more than writing malicious firmware over SPI and allowing it to persist. It's just a little more powerful than the UEFI kits cr4sh can write, and just as easily detectable by reading your flash chip. That's still bad! (And I have no idea who cr4sh is.) > But it's not like you're analyzing your microcode (of which there are likely signing keys being traded as well), which can also be installed on a large number of systems, considering the BIOS functions to load the latest microcode it has into the CPU. The above bit is unrelated, but I couldn't leave it out, because that's worth filing away too (...ouch). -- Sources/past comments: https://news.ycombinator.com/item?id=15187540 https://news.ycombinator.com/item?id=15187540