4 ms·

An end user of the machine has to take manual steps to specifically enable the functionality for remote management. But if you want to list all the things insid

by ksk 9y ago

An end user of the machine has to take manual steps to specifically enable the functionality for remote management. But if you want to list all the things inside your computer that run a CPU/microcontroller which you don't control, you will have to include USB drives, hard disks, network cards, GPU cards, BIOS/SMM/IPMI, sound cards, web cams, monitors, keyboards, mice, etc, etc. All of these have been demonstrated to be vulnerable to hacking.

AstralStorm 9y ago
Unlike Intel ME, these are all possible to secure in principle. You can replace a vulnerable piece of hardware. You can limit memory and bus access using IOMMU. You can run the drivers in a locked down virtual machine. You can theoretically reverse engineer a driver if required. None of this is possible with Intel ME. Similar with SMM blobs, but these are optional. Firmware is replaceable in at least theory with something like coreboot, and if not, you still have multiple options on various mainboards.
- ksk 9y ago
  Well, I do see a distinction between 'ME has bugs', and 'ME is designed to be insecure and allow remote takeover'. From what I have read, ME requires provisioning to be enabled. Even the so called 'zero touch' provisioning requires you to first reboot the machine, then run a special DHCP server that sends out an Intel certificate. An attacker would have to forge this certificate, which has to be limited to the domain the specific computer exists in, get physical access to the network to run a DHCP server, reboot the machine, and then be able to provision it (if at all).
nickpsecurity 9y ago
"An end user of the machine has to take manual steps to specifically enable the functionality for remote management." Nah, the stuff is already there, running, listening, and able to do things. Your tools enable you to see it doing it or extra functionality on top of the base software. Here's a nice presentation by a team working to replace as much of it as possible to show all the horrors: https://schd.ws/hosted_files/osseu17/84/Replace%20UEFI%20with%20Linux.pdf https://schd.ws/hosted_files/osseu17/84/Replace%20UEFI%20wit... The difference between this and all those peripherals you brought up is that we wanted the peripherals because they were useful to us. They were even publicly advertised in the store or online description of the computer. We neither asked for nor were sold on a pile of software running things like web servers that we couldn't turn off, see, or secure. As in, we already buy security and monitoring products since that matters to us. Yet, we can't even see that software much less secure it. An intentional, unwanted backdoor and hidden OS is different concept from accidental flaws in firmware on peripherals we found useful. Also, we have options with those ranging from not buying the peripheral to using one with little programmability to isolating it with IO/MMU. Not for CPU backdoors. And again, there's other vendors using open firmware showing all this secrecy and lack of user control was totally unnecessary. It's like Intel and AMD have an ulterior motive in not letting us turn off features that were built to support DRM and/or spying.
- ksk 9y ago
  >e stuff is already there, running, listening, and able to do things. I didn't see anything in the presentation that corroborates with what you said. Do you have any other links that show that ME is automatically provisioned/enabled? >The difference between this and all those peripherals you brought up is that we wanted the peripherals because they were useful to us. They were advertised for their features, not for their internal components. No person buying a GPU imagines that malware can reside inside their GPU. Similarly no person buying a USB drive imagines that the USB drive's controller can be reprogrammed to do nefarious things. >Also, we have options with those ranging from not buying the peripheral to using one with little programmability to isolating it with IO/MMU. The point is that you are not aware of all of the places microcrontrollers are hiding currently, which are therefore easier to conceal because nobody (well, almost) is paying attention to them. Intel created a product which they announced to the world, and have released a lot of technical information on. You are insisting that Intel has an ulterior motive without providing any evidence, when far simpler explanations exist that make sense. I'm going to withhold judgement till I see such evidence.
  - ac29 9y ago
    >Do you have any other links that show that ME is automatically provisioned/enabled? I think you are confusing Intel's AMT with the ME. AMT is a ME application, and has to be enabled/provisioned. The ME, in general, can do other things, such as crytographically verifying boot firmware is correctly signed (aka BootGuard/Secure Boot/Verified Boot, and probably other names). Some vendors even allow you to add your own signing keys. Some more info here: https://libreboot.org/faq.html#intelme https://libreboot.org/faq.html#intelme
    - ksk 9y ago
      Yes, I was using the terms carelessly. I'll try to be more mindful :) But I think the AMT technology is what the parent poster was referring to in their original and subsequent comments. >That CPU has a network stack, web server, and what seems to be hackable software. >Nah, the stuff is already there, running, listening, and able to do things. From what I have read, the AMT portion is required to do all of the above. Its the AMT portion that handles the KVM over IP (VNC), Serial over IP, etc.

by ksk 9y ago

AstralStorm 9y ago

Unlike Intel ME, these are all possible to secure in principle. You can replace a vulnerable piece of hardware. You can limit memory and bus access using IOMMU. You can run the drivers in a locked down virtual machine. You can theoretically reverse engineer a driver if required. None of this is possible with Intel ME. Similar with SMM blobs, but these are optional. Firmware is replaceable in at least theory with something like coreboot, and if not, you still have multiple options on various mainboards.

ksk 9y ago
Well, I do see a distinction between 'ME has bugs', and 'ME is designed to be insecure and allow remote takeover'. From what I have read, ME requires provisioning to be enabled. Even the so called 'zero touch' provisioning requires you to first reboot the machine, then run a special DHCP server that sends out an Intel certificate. An attacker would have to forge this certificate, which has to be limited to the domain the specific computer exists in, get physical access to the network to run a DHCP server, reboot the machine, and then be able to provision it (if at all).

nickpsecurity 9y ago

"An end user of the machine has to take manual steps to specifically enable the functionality for remote management." Nah, the stuff is already there, running, listening, and able to do things. Your tools enable you to see it doing it or extra functionality on top of the base software. Here's a nice presentation by a team working to replace as much of it as possible to show all the horrors: https://schd.ws/hosted_files/osseu17/84/Replace%20UEFI%20with%20Linux.pdf https://schd.ws/hosted_files/osseu17/84/Replace%20UEFI%20wit... The difference between this and all those peripherals you brought up is that we wanted the peripherals because they were useful to us. They were even publicly advertised in the store or online description of the computer. We neither asked for nor were sold on a pile of software running things like web servers that we couldn't turn off, see, or secure. As in, we already buy security and monitoring products since that matters to us. Yet, we can't even see that software much less secure it. An intentional, unwanted backdoor and hidden OS is different concept from accidental flaws in firmware on peripherals we found useful. Also, we have options with those ranging from not buying the peripheral to using one with little programmability to isolating it with IO/MMU. Not for CPU backdoors. And again, there's other vendors using open firmware showing all this secrecy and lack of user control was totally unnecessary. It's like Intel and AMD have an ulterior motive in not letting us turn off features that were built to support DRM and/or spying.

ksk 9y ago
>e stuff is already there, running, listening, and able to do things. I didn't see anything in the presentation that corroborates with what you said. Do you have any other links that show that ME is automatically provisioned/enabled? >The difference between this and all those peripherals you brought up is that we wanted the peripherals because they were useful to us. They were advertised for their features, not for their internal components. No person buying a GPU imagines that malware can reside inside their GPU. Similarly no person buying a USB drive imagines that the USB drive's controller can be reprogrammed to do nefarious things. >Also, we have options with those ranging from not buying the peripheral to using one with little programmability to isolating it with IO/MMU. The point is that you are not aware of all of the places microcrontrollers are hiding currently, which are therefore easier to conceal because nobody (well, almost) is paying attention to them. Intel created a product which they announced to the world, and have released a lot of technical information on. You are insisting that Intel has an ulterior motive without providing any evidence, when far simpler explanations exist that make sense. I'm going to withhold judgement till I see such evidence.
- ac29 9y ago
  >Do you have any other links that show that ME is automatically provisioned/enabled? I think you are confusing Intel's AMT with the ME. AMT is a ME application, and has to be enabled/provisioned. The ME, in general, can do other things, such as crytographically verifying boot firmware is correctly signed (aka BootGuard/Secure Boot/Verified Boot, and probably other names). Some vendors even allow you to add your own signing keys. Some more info here: https://libreboot.org/faq.html#intelme https://libreboot.org/faq.html#intelme
  - ksk 9y ago
    Yes, I was using the terms carelessly. I'll try to be more mindful :) But I think the AMT technology is what the parent poster was referring to in their original and subsequent comments. >That CPU has a network stack, web server, and what seems to be hackable software. >Nah, the stuff is already there, running, listening, and able to do things. From what I have read, the AMT portion is required to do all of the above. Its the AMT portion that handles the KVM over IP (VNC), Serial over IP, etc.