4 ms·

Really Intel/Apple/Microsoft should provide an official and reliable way to do this. We see you Intel... with your stinky spies peeping out from the depths of

Really Intel/Apple/Microsoft should provide an official and reliable way to do this. We see you Intel... with your stinky spies peeping out from the depths of our computers....

jordigh 9y ago
I think it's very likely that the order to backdoor all hardware came from the government and Intel decided to market it as some kind of advanced management benefit for the consumer. Evidence in favour is reverse-engineered functions in Intel ME that have NSA's name in them: https://www.bleepingcomputer.com/news/hardware/researchers-find-a-way-to-disable-much-hated-intel-me-component-courtesy-of-the-nsa/ https://www.bleepingcomputer.com/news/hardware/researchers-f... There's no way that both Intel and AMT simultaneously decided to backdoor their hardware out of consumer demand. The order must have come from above. (Okay, sorry, that's as much of a conspiracy theorist as I get to be.)
- deleted 9y ago
  [deleted]
- openasocket 9y ago
  That's a blatant misinterpretation of that article. Here's the main quote: "According to a highly technical blog post, Positive Technologies experts revealed they discovered a hidden bit inside the firmware code, which when flipped (set to "1") it will disable ME after ME has done its job and booted up the main processor. The bit is labelled "reserve_hap" and a nearby comment describes it as "High Assurance Platform (HAP) enable." High Assurance Platform (HAP) is an NSA program that describes a series of rules for running secure computing platforms. Researchers believe Intel has added the ME disabling bit at the behest of the NSA, who needed a method of disabling ME as a security measure for computers running in highly sensitive environments." TL;DR the evidence is that the NSA made Intel give them a way to DISABLE the management engine on their machines, not a backdoor.
  - jordigh 9y ago
    I know, I didn't say that they found an NSA backdoor smoking gun, but it still seems suspicious to me that the NSA got to dictate anything about what should happen in ME. I remain a conspiracy theorist. I really don't see a market demand for all hardware since 2007 to have this built-in by both duopolists.
    - openasocket 9y ago
      So the fact that the NSA doesn't like ME on their machines either is evidence that they put ME on the machines in the first place? Those two things are unrelated at best. The NSA gets to dictate to Intel what it wants in the chips because the US government is an absolutely huge customer. Hell, Intel has an entire subsidiary devoted to selling chips to the federal government (https://washingtontechnology.com/articles/2011/08/30/intel-federal-unit.aspx https://washingtontechnology.com/articles/2011/08/30/intel-f...). And if the NSA says computers must meet these standards to be able to interact with classified data, well then Intel better make it possible for their chips to meet those standards or they stand to lose a lot of money. That's why they get a special kill switch for ME. Which isn't to say that the NSA could use that influence to inject a backdoor. They can't refuse to certify a computer for handling classified information because the manufacturer didn't do something to their other computers.
  - mmjaa 9y ago
    If its good enough for the NSA its good enough for me. I want control over that bit, on my hardware. Why should I not have that? So far, I'm not hearing any good reasons.
    - openasocket 9y ago
      First off, I completely agree. This really should be something you can disable, because often times it isn't used and it increases attack surface. You can control that bit, as shown here: http://blog.ptsecurity.com/2017/08/disabling-intel-me.html http://blog.ptsecurity.com/2017/08/disabling-intel-me.html . Of course, that method isn't documented or officially supported by Intel, and you could brick your machine if you mess up, so that's not exactly what you meant. I think Intel definitely should document it and provide official support. As to why they don't currently, I have some guesses. The first is general lack of interest: it costs money for them to support this new feature for everyone and make sure it plays nicely with everyone's setup, and maybe there isn't enough customer demand for the feature. The second is money: I wouldn't be surprised if they sell their chips to the government with the bit already set in firmware at a markup. Making that easily available to everyone means less money.
mmjaa 9y ago
We need to make Intel hurt for this. I'm losing .. some percentage .. of my power to keep this IME running inside my computer, and yet it serves me no purpose at all. So, at the very least, a class action suit to cover the cost of running it...

Really Intel/Apple/Microsoft should provide an official and reliable way to do this. We see you Intel... with your stinky spies peeping out from the depths of our computers....

jordigh 9y ago

I think it's very likely that the order to backdoor all hardware came from the government and Intel decided to market it as some kind of advanced management benefit for the consumer. Evidence in favour is reverse-engineered functions in Intel ME that have NSA's name in them: https://www.bleepingcomputer.com/news/hardware/researchers-find-a-way-to-disable-much-hated-intel-me-component-courtesy-of-the-nsa/ https://www.bleepingcomputer.com/news/hardware/researchers-f... There's no way that both Intel and AMT simultaneously decided to backdoor their hardware out of consumer demand. The order must have come from above. (Okay, sorry, that's as much of a conspiracy theorist as I get to be.)

deleted 9y ago
[deleted]
openasocket 9y ago
That's a blatant misinterpretation of that article. Here's the main quote: "According to a highly technical blog post, Positive Technologies experts revealed they discovered a hidden bit inside the firmware code, which when flipped (set to "1") it will disable ME after ME has done its job and booted up the main processor. The bit is labelled "reserve_hap" and a nearby comment describes it as "High Assurance Platform (HAP) enable." High Assurance Platform (HAP) is an NSA program that describes a series of rules for running secure computing platforms. Researchers believe Intel has added the ME disabling bit at the behest of the NSA, who needed a method of disabling ME as a security measure for computers running in highly sensitive environments." TL;DR the evidence is that the NSA made Intel give them a way to DISABLE the management engine on their machines, not a backdoor.
- jordigh 9y ago
  I know, I didn't say that they found an NSA backdoor smoking gun, but it still seems suspicious to me that the NSA got to dictate anything about what should happen in ME. I remain a conspiracy theorist. I really don't see a market demand for all hardware since 2007 to have this built-in by both duopolists.
  - openasocket 9y ago
    So the fact that the NSA doesn't like ME on their machines either is evidence that they put ME on the machines in the first place? Those two things are unrelated at best. The NSA gets to dictate to Intel what it wants in the chips because the US government is an absolutely huge customer. Hell, Intel has an entire subsidiary devoted to selling chips to the federal government (https://washingtontechnology.com/articles/2011/08/30/intel-federal-unit.aspx https://washingtontechnology.com/articles/2011/08/30/intel-f...). And if the NSA says computers must meet these standards to be able to interact with classified data, well then Intel better make it possible for their chips to meet those standards or they stand to lose a lot of money. That's why they get a special kill switch for ME. Which isn't to say that the NSA could use that influence to inject a backdoor. They can't refuse to certify a computer for handling classified information because the manufacturer didn't do something to their other computers.
- mmjaa 9y ago
  If its good enough for the NSA its good enough for me. I want control over that bit, on my hardware. Why should I not have that? So far, I'm not hearing any good reasons.
  - openasocket 9y ago
    First off, I completely agree. This really should be something you can disable, because often times it isn't used and it increases attack surface. You can control that bit, as shown here: http://blog.ptsecurity.com/2017/08/disabling-intel-me.html http://blog.ptsecurity.com/2017/08/disabling-intel-me.html . Of course, that method isn't documented or officially supported by Intel, and you could brick your machine if you mess up, so that's not exactly what you meant. I think Intel definitely should document it and provide official support. As to why they don't currently, I have some guesses. The first is general lack of interest: it costs money for them to support this new feature for everyone and make sure it plays nicely with everyone's setup, and maybe there isn't enough customer demand for the feature. The second is money: I wouldn't be surprised if they sell their chips to the government with the bit already set in firmware at a markup. Making that easily available to everyone means less money.

mmjaa 9y ago

We need to make Intel hurt for this. I'm losing .. some percentage .. of my power to keep this IME running inside my computer, and yet it serves me no purpose at all. So, at the very least, a class action suit to cover the cost of running it...