5 ms·

> besides a conspiratorial "the NSA needs it to spy on everyone" Besides the real reason? I dunno.

Ajedi32 9y ago
Do you have any specific evidence that the NSA is directly involved in pushing implementation of IME for the purposes of espionage? That's an extraordinary claim; the mere existence of the NSA isn't sufficient evidence that it's true. Yes, the NSA exists. Yes, it's their job to spy on people. And yes, it's perfectly valid to include mass surveillance in your threat model. But these constant, uncorroborated claims that the NSA boogeyman is hiding behind every rock and tree are starting to become quite tiresome.
- rantanplan 9y ago
  > the NSA boogeyman is hiding behind every rock and tree are starting to become quite tiresome. Yeah indeed, they have backdoor-ed every ISP, nation, router, HDD, what-have-you in existence and these people keep telling boogeyman tales. Tsk tsk tsk. How tiresome.
  - Ajedi32 9y ago
    > they have backdoor-ed every ISP, nation, router, HDD, what-have-you in existence This is exactly the kind of hyperbolic nonsense I'm talking about. You can't claim that every HDD in existence has an NSA-installed backdoor installed in it without providing any evidence. If the NSA's capabilities were nearly as extensive as you're claiming, the US wouldn't need to bother maintaining a military. They could just remotely command all of North Korea's computers to shut themselves off, then sit back and wait around for their surrender. I'm not saying mass surveillance isn't a problem, or even that the NSA doesn't have a backdoor installed in IME (I certainly don't have evidence to the contrary); just that people need to stop exaggerating the threat, or making claims about the NSA having compromised any specific system without providing any evidence to back those claims up.
    - rantanplan 9y ago
      https://www.theregister.co.uk/2015/02/17/kaspersky_labs_equation_group/ https://www.theregister.co.uk/2015/02/17/kaspersky_labs_equa... There is an equivalent article from Ars technica, if "theregister" isn't to your liking. As for the evidence on routers and Internet infrastructure, you should pay more attention to leaks of state-sponsored tools, like the equation group leaks and the CIA one.
      - Ajedi32 9y ago
        "possibly tens of thousands of Windows computers" is not anywhere near the same thing as "every HDD in existence".
    - roblabla 9y ago
      Remember when the NSA crippled a standardized CSPRNG ? http://www.reuters.com/article/us-usa-security-nsa-rsa/exclusive-nsa-infiltrated-rsa-security-more-deeply-than-thought-study-idUSBREA2U0TY20140331 http://www.reuters.com/article/us-usa-security-nsa-rsa/exclu... Remember when the US shut down NK's internet ? https://gizmodo.com/so-who-shut-down-north-koreas-internet-1674589139 https://gizmodo.com/so-who-shut-down-north-koreas-internet-1... Remember when the NSA was revealed to have a malware that could infect hard drives, being potentially undetectable ? https://motherboard.vice.com/en_us/article/ypwkwk/the-nsas-undetectable-hard-drive-hack-was-first-demonstrated-a-year-ago https://motherboard.vice.com/en_us/article/ypwkwk/the-nsas-u... Remember PRISM ? How about stuxnet, and the other couple of viruses that are almost surely the NSA's. Sure, those are not backdoors installed by the OEM, rather they are malware that the NSA can use to infect (lots of) systems. But let's not kid ourselves, the NSA does have a ridiculous amount of power, and we have lots of evidence of it. At this point I'd be rather surprised if the NSA haven't hacked my fridge yet somehow.
      - Ajedi32 9y ago
        And I agree, those are some pretty impressive feats. Whenever your threat model includes state actors, it's probably not a bad idea to be paranoid. Let's not carry that paranoia to ridiculous extremes though. _Could_ the NSA have the ability to utilize IME somehow as a means to infect computers? Certainly. Do they _actually_ have that capability? We have no idea. Same goes for your motherboard's firmware, your hard drive's hardware, and any number of other possible vectors. They _could_ be compromised somehow, yes, but let's not claim that any specific motherboard firmware, HDD model, or CPU processor brand definitely _is_ compromised without evidence.
- quickben 9y ago
  That is a very naive view. The Intel IME is far different than 'rock and tree' to an organization of 40k employees and $10B budget tasked with bypassing stuff like the IME.
- mmjaa 9y ago
  You know whats tiresome? Fighting for control over your own hardware. Do you want to live in a free society or not? Because this is not acceptable to a free society.
  - Ajedi32 9y ago
    I don't see how that's related to my comment. I'm not discussing whether IME is a good idea or not, I'm just objecting to the unsubstantiated claim that the NSA is involved in pushing it.
    - mmjaa 9y ago
      Actually: It is quite well substantiated that the NSA has a mandate to usurp, and has factually usurped all technology in its purview, for its purposes - i.e. American information technology corporations, manufacturers, and so on, are bent to its will - it is treasonous for Intel to allow IME to be completely disabled, cf., the Yahoo case against NSA, etc. The fact of secrecy around this issue is the only thing to be doubted. Its no secret to non-Americans/concerned citizens; if you choose to continue to be ignorant, I choose to set you the challenge: go and find out for yourself just how bad it really is with the NSA. (It is atrocious.)
- ksk 9y ago
  Yeah, most likely, IME was developed for a completely legitimate purpose of administering PCs without special software.
- roenxi 9y ago
  The idea of the NSA working with a major components supplier isn't an extraordinary claim. Intel will have a major presence in all sorts data centers of interest to the NSA. If I were an American and believed in what the NSA was doing, I'd want to know what they were doing with their budget if they didn't at least try to get a hardware back door into Intel CPUs. Why waste budget on finding exploits in patchable software when they can go straight to the silicon?
MaxfordAndSons 9y ago
It's absurd to suggest that the NSA is the guiding hand behind the IME. For one thing, the enterprise use cases for the thing are quite obvious, so it's not like the NSA would have had to compel Intel to design and implement it in the first place. And if there weren't a demand for it, there's no way the US government could COMPEL them to make the business decision to undertake a massive change to their core product. Nor could they realistically bribe them to do it, not because the government lacks access to funds to make a sufficient large hypothetical bribe, but because Intel is a huge publicly traded multinational. How many employees do you think worked on the IME? How much money do you think it cost? Maybe the NSA has access to some unaccountable billions to throw; would Intel be able to explain that windfall in its books? Perhaps. But how many people would have to keep quiet in perpetuity about all of this? It just keeps stretching believability the more you think about it, like all conspiracy theories that involve more than a handful of actors.
throw2016 9y ago
Some people seem to be in denial about NSA. The body of evidence about the ties to private industry via programs like Prism and others is overwhelming for anyone with the barest curiosity. Why would Intel go through all the trouble of creating ME or the broke AMD PSP at around the same time? This is hardwired in silicon, is not cheap to do and definitely needs huge business justification to initiate, implement and maintain. What's the business case? Are they charging a premium for these features and disabling it for everyone else as they would if it was actually a 'premium' feature? Are they giving an option to those who don't want it to disable it without ado? No, they are pushing it on everyone. That itself compromises ME. How do we know there is no NSL in effect forcing both Intel and AMD to implement this. Nobody does. But it is an intrusive piece of tech that has complete authority over your PC.

Do you have any specific evidence that the NSA is directly involved in pushing implementation of IME for the purposes of espionage? That's an extraordinary claim; the mere existence of the NSA isn't sufficient evidence that it's true. Yes, the NSA exists. Yes, it's their job to spy on people. And yes, it's perfectly valid to include mass surveillance in your threat model. But these constant, uncorroborated claims that the NSA boogeyman is hiding behind every rock and tree are starting to become quite tiresome.

rantanplan 9y ago
> the NSA boogeyman is hiding behind every rock and tree are starting to become quite tiresome. Yeah indeed, they have backdoor-ed every ISP, nation, router, HDD, what-have-you in existence and these people keep telling boogeyman tales. Tsk tsk tsk. How tiresome.
- Ajedi32 9y ago
  > they have backdoor-ed every ISP, nation, router, HDD, what-have-you in existence This is exactly the kind of hyperbolic nonsense I'm talking about. You can't claim that every HDD in existence has an NSA-installed backdoor installed in it without providing any evidence. If the NSA's capabilities were nearly as extensive as you're claiming, the US wouldn't need to bother maintaining a military. They could just remotely command all of North Korea's computers to shut themselves off, then sit back and wait around for their surrender. I'm not saying mass surveillance isn't a problem, or even that the NSA doesn't have a backdoor installed in IME (I certainly don't have evidence to the contrary); just that people need to stop exaggerating the threat, or making claims about the NSA having compromised any specific system without providing any evidence to back those claims up.
  - rantanplan 9y ago
    https://www.theregister.co.uk/2015/02/17/kaspersky_labs_equation_group/ https://www.theregister.co.uk/2015/02/17/kaspersky_labs_equa... There is an equivalent article from Ars technica, if "theregister" isn't to your liking. As for the evidence on routers and Internet infrastructure, you should pay more attention to leaks of state-sponsored tools, like the equation group leaks and the CIA one.
    - Ajedi32 9y ago
      "possibly tens of thousands of Windows computers" is not anywhere near the same thing as "every HDD in existence".
  - roblabla 9y ago
    Remember when the NSA crippled a standardized CSPRNG ? http://www.reuters.com/article/us-usa-security-nsa-rsa/exclusive-nsa-infiltrated-rsa-security-more-deeply-than-thought-study-idUSBREA2U0TY20140331 http://www.reuters.com/article/us-usa-security-nsa-rsa/exclu... Remember when the US shut down NK's internet ? https://gizmodo.com/so-who-shut-down-north-koreas-internet-1674589139 https://gizmodo.com/so-who-shut-down-north-koreas-internet-1... Remember when the NSA was revealed to have a malware that could infect hard drives, being potentially undetectable ? https://motherboard.vice.com/en_us/article/ypwkwk/the-nsas-undetectable-hard-drive-hack-was-first-demonstrated-a-year-ago https://motherboard.vice.com/en_us/article/ypwkwk/the-nsas-u... Remember PRISM ? How about stuxnet, and the other couple of viruses that are almost surely the NSA's. Sure, those are not backdoors installed by the OEM, rather they are malware that the NSA can use to infect (lots of) systems. But let's not kid ourselves, the NSA does have a ridiculous amount of power, and we have lots of evidence of it. At this point I'd be rather surprised if the NSA haven't hacked my fridge yet somehow.
    - Ajedi32 9y ago
      And I agree, those are some pretty impressive feats. Whenever your threat model includes state actors, it's probably not a bad idea to be paranoid. Let's not carry that paranoia to ridiculous extremes though. _Could_ the NSA have the ability to utilize IME somehow as a means to infect computers? Certainly. Do they _actually_ have that capability? We have no idea. Same goes for your motherboard's firmware, your hard drive's hardware, and any number of other possible vectors. They _could_ be compromised somehow, yes, but let's not claim that any specific motherboard firmware, HDD model, or CPU processor brand definitely _is_ compromised without evidence.
quickben 9y ago
That is a very naive view. The Intel IME is far different than 'rock and tree' to an organization of 40k employees and $10B budget tasked with bypassing stuff like the IME.
mmjaa 9y ago
You know whats tiresome? Fighting for control over your own hardware. Do you want to live in a free society or not? Because this is not acceptable to a free society.
- Ajedi32 9y ago
  I don't see how that's related to my comment. I'm not discussing whether IME is a good idea or not, I'm just objecting to the unsubstantiated claim that the NSA is involved in pushing it.
  - mmjaa 9y ago
    Actually: It is quite well substantiated that the NSA has a mandate to usurp, and has factually usurped all technology in its purview, for its purposes - i.e. American information technology corporations, manufacturers, and so on, are bent to its will - it is treasonous for Intel to allow IME to be completely disabled, cf., the Yahoo case against NSA, etc. The fact of secrecy around this issue is the only thing to be doubted. Its no secret to non-Americans/concerned citizens; if you choose to continue to be ignorant, I choose to set you the challenge: go and find out for yourself just how bad it really is with the NSA. (It is atrocious.)
ksk 9y ago
Yeah, most likely, IME was developed for a completely legitimate purpose of administering PCs without special software.
roenxi 9y ago
The idea of the NSA working with a major components supplier isn't an extraordinary claim. Intel will have a major presence in all sorts data centers of interest to the NSA. If I were an American and believed in what the NSA was doing, I'd want to know what they were doing with their budget if they didn't at least try to get a hardware back door into Intel CPUs. Why waste budget on finding exploits in patchable software when they can go straight to the silicon?

MaxfordAndSons 9y ago

It's absurd to suggest that the NSA is the guiding hand behind the IME. For one thing, the enterprise use cases for the thing are quite obvious, so it's not like the NSA would have had to compel Intel to design and implement it in the first place. And if there weren't a demand for it, there's no way the US government could COMPEL them to make the business decision to undertake a massive change to their core product. Nor could they realistically bribe them to do it, not because the government lacks access to funds to make a sufficient large hypothetical bribe, but because Intel is a huge publicly traded multinational. How many employees do you think worked on the IME? How much money do you think it cost? Maybe the NSA has access to some unaccountable billions to throw; would Intel be able to explain that windfall in its books? Perhaps. But how many people would have to keep quiet in perpetuity about all of this? It just keeps stretching believability the more you think about it, like all conspiracy theories that involve more than a handful of actors.

throw2016 9y ago

Some people seem to be in denial about NSA. The body of evidence about the ties to private industry via programs like Prism and others is overwhelming for anyone with the barest curiosity. Why would Intel go through all the trouble of creating ME or the broke AMD PSP at around the same time? This is hardwired in silicon, is not cheap to do and definitely needs huge business justification to initiate, implement and maintain. What's the business case? Are they charging a premium for these features and disabling it for everyone else as they would if it was actually a 'premium' feature? Are they giving an option to those who don't want it to disable it without ado? No, they are pushing it on everyone. That itself compromises ME. How do we know there is no NSL in effect forcing both Intel and AMD to implement this. Nobody does. But it is an intrusive piece of tech that has complete authority over your PC.