5 ms·

>Your operating system is being used by Intel to, potentially, take full control of any machine powered by their chips. I would phrase it differently. "Intel

by ksk 9y ago

>Your operating system is being used by Intel to, potentially, take full control of any machine powered by their chips. I would phrase it differently. "Intel has developed a product, which they sell (to anyone), to allow companies to manage their computers so that you can do things like re-image machines remotely, change BIOS settings, etc" I honestly can't understand the mass hysteria around this. As a 'de-facto' sys-admin in a small company, I find this immensely useful.

goalieca 9y ago
This feature is also a security problem. Putting on my engineering hat, this stinks! I understand the needs of IT, but many ´helpful’ IT tools I’ve seen installed over the years on corporate computers have been making things less secure and not more Edit: fixed spellings
- ksk 9y ago
  Yes, this is a valid concern. Certainly, we should be doing more to highlight how the technology works and whether the kind of threats we imagine (remote takeover) are real.
- tetraca 9y ago
  I wouldn't care at all if it would be a separate feature that could be inserted at an IT department's discretion into corporate boxes. They can be the Staasi for all I care; it's their machines for their purposes. But I don't want any such chip on my machines and the only way to essentially get away from it is to fork over $7000 and do all my work on an IBM Power server.
structural 9y ago
Would you find it similarly useful the day after someone else decided to re-image all your machines and then change BIOS password settings to further prevent you from fixing the problem? How about if they then decided to send you a ransom notice that you could regain access to your infrastructure for a particular sum of money? Stuff like this is real and happens all over the world. Businesses would rather not publically admit that they've been owned, either: it's spectacularly bad press. Fortunately, most of the security vulnerabilities that have been abused in this sort of way in the past are patched quickly. But what if it was impossible to patch systems because the vulnerability is baked into firmware? That's the horrifying case that we have here. If exploiting this software (and exploits HAVE ALREADY been published, so it's really just a matter of weaponisation at this point) becomes common, then many sysadmins will be in the unenviable position where someone who can download instructions from the Internet can cause immense damage to their systems and network on any given day. And that's just the tip of the iceberg. Imagining how these systems are very, very likely already being used to conduct digital espionage is similarly disturbing. It's easy to think that "no one would want to conduct espionage against my tiny company in ${small town}", but unfortunately the reality is quite different. https://www.fbi.gov/news/stories/economic-espionage https://www.fbi.gov/news/stories/economic-espionage has some reasonably interesting information about the sort of shenanigans that are routinely undertaken - unfortunately this is just a small example as many instances are not publically discussed.
- ksk 9y ago
  Discussion over security concerns is valid and helpful in moving the conversation forward. Outrage over something we don't even understand doesn't help anyone. Especially when people are presenting a strawman/misrepresenting the details. Computer security requires you to model the threat first, before proposing mitigations/solutions/tradeoffs/etc. Has this been done here? I'm merely asking since I don't know. Questions by themselves might lead us to an interesting path of inquiry, but we should also occasionally ground ourselves so we know what actually happens when the rubber meets the road.
  - structural 9y ago
    It's interesting that this is being discussed again this year, because the critical part of the discussion really happened back in May of this year. https://nvd.nist.gov/vuln/detail/CVE-2017-5689 https://nvd.nist.gov/vuln/detail/CVE-2017-5689 is the CVE in question and existed for ~7 years, permitting exactly the scenarios I postulated to occur given unprivileged access to the network on which the servers reside. There's been some rapid threat modeling done already: for example, for datacenter environments, the impact of this issue is largely mitigated by reducing physical access to this network behind the firewall - https://software.intel.com/en-us/documentation/amt-reference/manageability-ports https://software.intel.com/en-us/documentation/amt-reference... indicates that we can firewall traffic so that only known management computers can access it from outside. (However, one compromised computer in the datacenter can be used as a source to trigger this exploit, so whole-datacenter monitoring/alerting for traffic on these ports is required). The overall risk involved is still fairly high, because this security posture is effectively "remote root-level access for anyone with unprivileged access to the local network".
nickpsecurity 9y ago
"I honestly can't understand the mass hysteria around this." "Mass hysteria?" Consumers thought they were just buying a CPU running what they put on it. Instead, it has a second CPU that can watch or control what they're doing. That CPU has a network stack, web server, and what seems to be hackable software. Intel also won't remove it. There wasn't demand among most individual buyers but this risky setup was forced on them anyway. Being forced to run a backdoored CPU on a hostile Internet just to continue to use x86 applications should create a strong, well-deserved backlash. Business sector is different where there was lots of demand for management capabilities. That means there should be two tiers of products with and without the built-in backdoors. That responds to the expectations of each. The businesses probably also prefer the remote administration itself to be secure. Intel had things available but didn't use them to save about $50k from what I can tell on something that generates billions in revenue. There's a segment of business needing management capabilities that would prefer to buy from a third party offering quality software in event Intel is going to slap some stuff together. Their interests aren't served even though there are such solutions in the PPC and ARM markets esp for embedded. One other thing worth mentioning is that Intel and Microsoft were part of the Trusted Computing Group that were trying to use both CPU and OS modifications to force DRM on consumers for movie and music industry. Lots of their presentations bragged about how Intel's chips, esp with TPM's, might do that. So, it's probably also a conspiracy against consumers by tech companies who must have taken bribes from those who wanted DRM or have some other incentive (eg NSA's BULLRUN or FISA courts). Again, at least on DRM, there was backlash that watered it down a bit where it ended up fragmented such as protected media path in Windows, encryption for HDMI, etc. Do note that there's nothing stopping Intel from setting it up as a general-purpose core that can run user-supplied code which can be a firmware package like ME, a third party alternative which might be FOSS, or nothing at all. Intel forcing it is almost certainly about benefiting them and their scheming partners at everyone's expense instead of a fair, mutually-beneficial offering. People should be mad. They should also boycott any company doing that if they can. In the past, the solution was PowerPC or SPARC since they supported Open Firmware standard. Leon3, a SPARC for embedded, was GPL'd entirely. For high-end, OpenPOWER has open firmware with Raptor Computing Systems planning to deploy them in their Talos line when IBM puts POWER9 on the market.
- 9y ago

by ksk 9y ago

goalieca 9y ago

This feature is also a security problem. Putting on my engineering hat, this stinks! I understand the needs of IT, but many ´helpful’ IT tools I’ve seen installed over the years on corporate computers have been making things less secure and not more Edit: fixed spellings

ksk 9y ago
Yes, this is a valid concern. Certainly, we should be doing more to highlight how the technology works and whether the kind of threats we imagine (remote takeover) are real.
tetraca 9y ago
I wouldn't care at all if it would be a separate feature that could be inserted at an IT department's discretion into corporate boxes. They can be the Staasi for all I care; it's their machines for their purposes. But I don't want any such chip on my machines and the only way to essentially get away from it is to fork over $7000 and do all my work on an IBM Power server.

structural 9y ago

Would you find it similarly useful the day after someone else decided to re-image all your machines and then change BIOS password settings to further prevent you from fixing the problem? How about if they then decided to send you a ransom notice that you could regain access to your infrastructure for a particular sum of money? Stuff like this is real and happens all over the world. Businesses would rather not publically admit that they've been owned, either: it's spectacularly bad press. Fortunately, most of the security vulnerabilities that have been abused in this sort of way in the past are patched quickly. But what if it was impossible to patch systems because the vulnerability is baked into firmware? That's the horrifying case that we have here. If exploiting this software (and exploits HAVE ALREADY been published, so it's really just a matter of weaponisation at this point) becomes common, then many sysadmins will be in the unenviable position where someone who can download instructions from the Internet can cause immense damage to their systems and network on any given day. And that's just the tip of the iceberg. Imagining how these systems are very, very likely already being used to conduct digital espionage is similarly disturbing. It's easy to think that "no one would want to conduct espionage against my tiny company in ${small town}", but unfortunately the reality is quite different. https://www.fbi.gov/news/stories/economic-espionage https://www.fbi.gov/news/stories/economic-espionage has some reasonably interesting information about the sort of shenanigans that are routinely undertaken - unfortunately this is just a small example as many instances are not publically discussed.

ksk 9y ago
Discussion over security concerns is valid and helpful in moving the conversation forward. Outrage over something we don't even understand doesn't help anyone. Especially when people are presenting a strawman/misrepresenting the details. Computer security requires you to model the threat first, before proposing mitigations/solutions/tradeoffs/etc. Has this been done here? I'm merely asking since I don't know. Questions by themselves might lead us to an interesting path of inquiry, but we should also occasionally ground ourselves so we know what actually happens when the rubber meets the road.
- structural 9y ago
  It's interesting that this is being discussed again this year, because the critical part of the discussion really happened back in May of this year. https://nvd.nist.gov/vuln/detail/CVE-2017-5689 https://nvd.nist.gov/vuln/detail/CVE-2017-5689 is the CVE in question and existed for ~7 years, permitting exactly the scenarios I postulated to occur given unprivileged access to the network on which the servers reside. There's been some rapid threat modeling done already: for example, for datacenter environments, the impact of this issue is largely mitigated by reducing physical access to this network behind the firewall - https://software.intel.com/en-us/documentation/amt-reference/manageability-ports https://software.intel.com/en-us/documentation/amt-reference... indicates that we can firewall traffic so that only known management computers can access it from outside. (However, one compromised computer in the datacenter can be used as a source to trigger this exploit, so whole-datacenter monitoring/alerting for traffic on these ports is required). The overall risk involved is still fairly high, because this security posture is effectively "remote root-level access for anyone with unprivileged access to the local network".

nickpsecurity 9y ago

"I honestly can't understand the mass hysteria around this." "Mass hysteria?" Consumers thought they were just buying a CPU running what they put on it. Instead, it has a second CPU that can watch or control what they're doing. That CPU has a network stack, web server, and what seems to be hackable software. Intel also won't remove it. There wasn't demand among most individual buyers but this risky setup was forced on them anyway. Being forced to run a backdoored CPU on a hostile Internet just to continue to use x86 applications should create a strong, well-deserved backlash. Business sector is different where there was lots of demand for management capabilities. That means there should be two tiers of products with and without the built-in backdoors. That responds to the expectations of each. The businesses probably also prefer the remote administration itself to be secure. Intel had things available but didn't use them to save about $50k from what I can tell on something that generates billions in revenue. There's a segment of business needing management capabilities that would prefer to buy from a third party offering quality software in event Intel is going to slap some stuff together. Their interests aren't served even though there are such solutions in the PPC and ARM markets esp for embedded. One other thing worth mentioning is that Intel and Microsoft were part of the Trusted Computing Group that were trying to use both CPU and OS modifications to force DRM on consumers for movie and music industry. Lots of their presentations bragged about how Intel's chips, esp with TPM's, might do that. So, it's probably also a conspiracy against consumers by tech companies who must have taken bribes from those who wanted DRM or have some other incentive (eg NSA's BULLRUN or FISA courts). Again, at least on DRM, there was backlash that watered it down a bit where it ended up fragmented such as protected media path in Windows, encryption for HDMI, etc. Do note that there's nothing stopping Intel from setting it up as a general-purpose core that can run user-supplied code which can be a firmware package like ME, a third party alternative which might be FOSS, or nothing at all. Intel forcing it is almost certainly about benefiting them and their scheming partners at everyone's expense instead of a fair, mutually-beneficial offering. People should be mad. They should also boycott any company doing that if they can. In the past, the solution was PowerPC or SPARC since they supported Open Firmware standard. Leon3, a SPARC for embedded, was GPL'd entirely. For high-end, OpenPOWER has open firmware with Raptor Computing Systems planning to deploy them in their Talos line when IBM puts POWER9 on the market.

9y ago