5 ms·

That's a blatant misinterpretation of that article. Here's the main quote: "According to a highly technical blog post, Positive Technologies experts revealed t

That's a blatant misinterpretation of that article. Here's the main quote: "According to a highly technical blog post, Positive Technologies experts revealed they discovered a hidden bit inside the firmware code, which when flipped (set to "1") it will disable ME after ME has done its job and booted up the main processor. The bit is labelled "reserve_hap" and a nearby comment describes it as "High Assurance Platform (HAP) enable." High Assurance Platform (HAP) is an NSA program that describes a series of rules for running secure computing platforms. Researchers believe Intel has added the ME disabling bit at the behest of the NSA, who needed a method of disabling ME as a security measure for computers running in highly sensitive environments." TL;DR the evidence is that the NSA made Intel give them a way to DISABLE the management engine on their machines, not a backdoor.

jordigh 9y ago
I know, I didn't say that they found an NSA backdoor smoking gun, but it still seems suspicious to me that the NSA got to dictate anything about what should happen in ME. I remain a conspiracy theorist. I really don't see a market demand for all hardware since 2007 to have this built-in by both duopolists.
- openasocket 9y ago
  So the fact that the NSA doesn't like ME on their machines either is evidence that they put ME on the machines in the first place? Those two things are unrelated at best. The NSA gets to dictate to Intel what it wants in the chips because the US government is an absolutely huge customer. Hell, Intel has an entire subsidiary devoted to selling chips to the federal government (https://washingtontechnology.com/articles/2011/08/30/intel-federal-unit.aspx https://washingtontechnology.com/articles/2011/08/30/intel-f...). And if the NSA says computers must meet these standards to be able to interact with classified data, well then Intel better make it possible for their chips to meet those standards or they stand to lose a lot of money. That's why they get a special kill switch for ME. Which isn't to say that the NSA could use that influence to inject a backdoor. They can't refuse to certify a computer for handling classified information because the manufacturer didn't do something to their other computers.
mmjaa 9y ago
If its good enough for the NSA its good enough for me. I want control over that bit, on my hardware. Why should I not have that? So far, I'm not hearing any good reasons.
- openasocket 9y ago
  First off, I completely agree. This really should be something you can disable, because often times it isn't used and it increases attack surface. You can control that bit, as shown here: http://blog.ptsecurity.com/2017/08/disabling-intel-me.html http://blog.ptsecurity.com/2017/08/disabling-intel-me.html . Of course, that method isn't documented or officially supported by Intel, and you could brick your machine if you mess up, so that's not exactly what you meant. I think Intel definitely should document it and provide official support. As to why they don't currently, I have some guesses. The first is general lack of interest: it costs money for them to support this new feature for everyone and make sure it plays nicely with everyone's setup, and maybe there isn't enough customer demand for the feature. The second is money: I wouldn't be surprised if they sell their chips to the government with the bit already set in firmware at a markup. Making that easily available to everyone means less money.
diabeetusman 9y ago
I interpret that to mean that the NSA said "Add this and give only us a way to turn it off"
- openasocket 9y ago
  So, your comment is as good a place as any to put this. There's a ton of allegations about ME being a backdoor for the NSA or some other government entity, but very little in the way of good evidence, at least that I've seen. Many proponents seem to provide circumstantial evidence or simple accusations as opposed to what I would consider substantial evidence. Here's some examples of solid evidence - Leaked documents either from Intel or the NSA documenting the NSA pressing Intel to provide backdoors, and Intel accepting - One of the APT groups believed to be associated with the US government is found using an ME vulnerability in the wild, before the vulnerability became publicly known - Refusal or extreme reluctance on the part of Intel to fix a discovered vulnerability - A vulnerability which is clearly intentional, like having ME automatically execute any shell script sent over the network signed with a particular certificate or something. Examples of circumstantial, but still quite compelling evidence: - A vulnerability which appears intentional, as in it doesn't require any buffer overflow or shell code injection or abuse of certain registers, but rather seems to be a part of normal operations. - Intel pushes a change to fix an ME vulnerability, but that change simultaneously introduces another vulnerability. - Evidence that Intel, while giving the US government the ability to disable ME, refuses to give such an ability to other large customers (Google, Amazon, other governments, etc.), for any amount of money. Seriously, if someone comes forward with evidence like the above, I'm completely open to accepting the possibility Intel ME is an active backdoor for the US government.
  - platinumrad 9y ago
    Re: Evidence that Intel, while giving the US government the ability to disable ME, refuses to give such an ability to other large customers (Google, Amazon, other governments, etc.), for any amount of money. I'm not intimately familiar with the situation but I heard some chatter a few years ago about Google (which likes to use Coreboot on its Chromebooks) asking Intel for documentation and source code for various firmware components including the IME and being turned down. Researchers recently found an undocumented bit can be set in recent IME versions with a name ("High Assurance Program (HAP)") said to be associated with the US government which disables most functions of the IME.[1] [1] http://blog.ptsecurity.com/2017/08/disabling-intel-me.html http://blog.ptsecurity.com/2017/08/disabling-intel-me.html

jordigh 9y ago

I know, I didn't say that they found an NSA backdoor smoking gun, but it still seems suspicious to me that the NSA got to dictate anything about what should happen in ME. I remain a conspiracy theorist. I really don't see a market demand for all hardware since 2007 to have this built-in by both duopolists.

openasocket 9y ago
So the fact that the NSA doesn't like ME on their machines either is evidence that they put ME on the machines in the first place? Those two things are unrelated at best. The NSA gets to dictate to Intel what it wants in the chips because the US government is an absolutely huge customer. Hell, Intel has an entire subsidiary devoted to selling chips to the federal government (https://washingtontechnology.com/articles/2011/08/30/intel-federal-unit.aspx https://washingtontechnology.com/articles/2011/08/30/intel-f...). And if the NSA says computers must meet these standards to be able to interact with classified data, well then Intel better make it possible for their chips to meet those standards or they stand to lose a lot of money. That's why they get a special kill switch for ME. Which isn't to say that the NSA could use that influence to inject a backdoor. They can't refuse to certify a computer for handling classified information because the manufacturer didn't do something to their other computers.

mmjaa 9y ago

If its good enough for the NSA its good enough for me. I want control over that bit, on my hardware. Why should I not have that? So far, I'm not hearing any good reasons.

openasocket 9y ago
First off, I completely agree. This really should be something you can disable, because often times it isn't used and it increases attack surface. You can control that bit, as shown here: http://blog.ptsecurity.com/2017/08/disabling-intel-me.html http://blog.ptsecurity.com/2017/08/disabling-intel-me.html . Of course, that method isn't documented or officially supported by Intel, and you could brick your machine if you mess up, so that's not exactly what you meant. I think Intel definitely should document it and provide official support. As to why they don't currently, I have some guesses. The first is general lack of interest: it costs money for them to support this new feature for everyone and make sure it plays nicely with everyone's setup, and maybe there isn't enough customer demand for the feature. The second is money: I wouldn't be surprised if they sell their chips to the government with the bit already set in firmware at a markup. Making that easily available to everyone means less money.

diabeetusman 9y ago

I interpret that to mean that the NSA said "Add this and give only us a way to turn it off"

openasocket 9y ago
So, your comment is as good a place as any to put this. There's a ton of allegations about ME being a backdoor for the NSA or some other government entity, but very little in the way of good evidence, at least that I've seen. Many proponents seem to provide circumstantial evidence or simple accusations as opposed to what I would consider substantial evidence. Here's some examples of solid evidence - Leaked documents either from Intel or the NSA documenting the NSA pressing Intel to provide backdoors, and Intel accepting - One of the APT groups believed to be associated with the US government is found using an ME vulnerability in the wild, before the vulnerability became publicly known - Refusal or extreme reluctance on the part of Intel to fix a discovered vulnerability - A vulnerability which is clearly intentional, like having ME automatically execute any shell script sent over the network signed with a particular certificate or something. Examples of circumstantial, but still quite compelling evidence: - A vulnerability which appears intentional, as in it doesn't require any buffer overflow or shell code injection or abuse of certain registers, but rather seems to be a part of normal operations. - Intel pushes a change to fix an ME vulnerability, but that change simultaneously introduces another vulnerability. - Evidence that Intel, while giving the US government the ability to disable ME, refuses to give such an ability to other large customers (Google, Amazon, other governments, etc.), for any amount of money. Seriously, if someone comes forward with evidence like the above, I'm completely open to accepting the possibility Intel ME is an active backdoor for the US government.
- platinumrad 9y ago
  Re: Evidence that Intel, while giving the US government the ability to disable ME, refuses to give such an ability to other large customers (Google, Amazon, other governments, etc.), for any amount of money. I'm not intimately familiar with the situation but I heard some chatter a few years ago about Google (which likes to use Coreboot on its Chromebooks) asking Intel for documentation and source code for various firmware components including the IME and being turned down. Researchers recently found an undocumented bit can be set in recent IME versions with a name ("High Assurance Program (HAP)") said to be associated with the US government which disables most functions of the IME.[1] [1] http://blog.ptsecurity.com/2017/08/disabling-intel-me.html http://blog.ptsecurity.com/2017/08/disabling-intel-me.html