8 ms·

Can someone explain like I have a degree in computer science from a good university, but opted for a career as a software engineer in some relatively high level

Can someone explain like I have a degree in computer science from a good university, but opted for a career as a software engineer in some relatively high level languages?

drdaeman 9y ago
If I got it right, they got a debugger access to the processor that runs ME, via an USB port. So they can mess with ME (dump its code, analyze it, observe how it runs, modify it live) as they see fit.
- Sharlin 9y ago
  Doesn't help if you don't know what ME is (I didn't). But a sibling comment explained it well.
  - vog 9y ago
    For a very good explaination on that topic, see the following 32C3 presentation: "Towards (reasonably) trustworthy x86 laptops" https://media.ccc.de/v/32c3-7352-towards_reasonably_trustworthy_x86_laptops https://media.ccc.de/v/32c3-7352-towards_reasonably_trustwor... Also, the paper by the author is worth a read: "State considered harmful - A proposal for a stateless laptop" https://blog.invisiblethings.org/papers/2015/state_harmful.pdf https://blog.invisiblethings.org/papers/2015/state_harmful.p...
v4n4d1s 9y ago
I don't understand your question. Please clarify.
- maxhallinan 9y ago
  This is a funny variation on "Explain to me like I'm five years old".
jimmyswimmy 9y ago
I'll give a try. Someone else can correct me later. These guys have used a JTAG f debugging dongle to access the Intel management engine. They can now read every bit of code. Which means that secrets stored within the code including keys and bugs are available to them and anyone who can replicate their work. Since the management engine is in nearly all of Intel chips, we're screwed. AMD have something similar so no help there.
- dm319 9y ago
  Is this seen in ARM?
  - milcron 9y ago
    Some of them have ARM TrustZone. I'm pretty sure that i.MX6 chips are relatively clean. Modern chips are becoming less so.
- _0ffh 9y ago
  "AMD have something similar so no help there" It's probably worse for AMD. For Intel now at least we'll probably get the ability to securely disable everything below ring -1.
  - vog 9y ago
    It's such a pity that there is no real competition in that area. (Unless you go the totally different architectures such as ARM or RISC-V.) AMD had the chance to differentiate from Intel here, instead they blindly immitate the same customer-hostile stunt.
    - microcolonel 9y ago
      I don't want to get too deep into imagination, but the details of the ME/PSP story make it seem like an outside force of some sort is compelling them to add this stuff to their platforms.
dsr_ 9y ago
Intel CPUs have an embedded supervisory CPU called the Management Engine. It can read all of memory, control power states on the main CPU, and generally has super-root privileges on everything. You, an end-user, aren't allowed to program it. The current MEs run a form of Minix. They represent an incredible security and privacy risk, because we don't know what code they run and it is widely believed that the NSA or other intelligence agencies have backdoor access. Remote backdoor access, even: the ME can talk to the network. A JTAG is a standard minimal serial port used for debugging purposes. You'll find them on nearly all embedded devices - routers, phones, TVs, refrigerator controllers... usually appearing as a set of two or three contact points. Sometimes they connect directly to a debugger. In this case, it appears that at least some Intel CPUs have a JTAG on the ME that can be routed through the on-CPU USB handler, and thus physical access to the right USB ports can be used to access the ME.
- metalliqaz 9y ago
  Also that since they have JTAG debugging access, they have unrestricted access to the normally hidden processor, meaning they can disassemble it, peer into memory, and probably find a method of permanently disabling the ME.
  - kevin_b_er 9y ago
    And if they can access it without hardware modifications it means any USB device has super-root access to the machine. And then it would mean you can't block it unless you don't connect USB device. I suspect they fiddled with something to get access, however. Attached something to motherboard or similar.
- kinleyd 9y ago
  Thank you for that great explanation.
- quickben 9y ago
  To add, and maybe the others can correct me if I'm wrong: Intel ME can be controlled remotely if you have an Intel lan card, even if the main cpu is off, but the motherboard is powered on. It goes from there and gets worse is my understanding.
Sharlin 9y ago
Yeah, this is just TLA overload.
jcims 9y ago
There's a computer in your computer so your computer can computer while you computer. These guys just found the keyboard.
- petecooper 9y ago
  That's…a really good single-sentence explanation. Thank you!
- stephengillie 9y ago
  "The remote session is coming from inside the laptop!"
- berbec 9y ago
  It needed to be done: https://i.imgflip.com/1z5rcw.jpg https://i.imgflip.com/1z5rcw.jpg
inetknght 9y ago
I'm going to assume "relatively high level languages" are for example Python, Ruby, C#, Javascript... Imagine that you have your high level program. When you execute it, it goes through a just-in-time compilation (whether that's script parsing or bytecode conversion, or actual compilation, or whatever) before reaching the CPU which actually executes your code. Now imagine that your interpreter has the capability of reading and monitoring everything you do. Nothing wrong with that, it's supposed to do that, it's how it works. But imagine if it had an exposed, unlogged, unmonitored, API which allowed a third party to be able to interact with whatever you do. Say that it's there "for debugging purposes". You want to encrypt an HTTPS session? This API allows them to grab your key without ever notifying you. Or, even if you use custom encryption, it allows them to grab your specific instructions and the data used in processing to reverse your encryption. It allows a remote party to inject their own flow of execution into your program. So you're sitting there waiting for the next user event to occur in your event loop while, instead, the interpreter simply handed the whole event loop to a third party. They could inject user events for you to process that the user never actually performed; they could modify data in ways that you can never detect. Except that it's not the interpreter. It's a side-channel, an additional hidden core on your CPU (it's actually a completely hidden and separate secondary CPU). Your processor still runs and executes your code. But another processor is simultaneously running and executing its own code with its own RAM that you can't access. It has access to your RAM as if it were a file open on your hard disk. You can't disable it. You can't interact with it. It's even running when your computer is "shut off". If there's power on the motherboard, then this hidden processor is running. That, in a nutshell, is Intel ME... ... This sounds _really_ paranoid and alarmist. But it's not all bad. Intel has usually done really well with "security through obscurity" in this case and there aren't many known exploits for Intel ME. That said, those that do or could exist, gain all of the capabilities of Intel ME. Most people consider "game over" for physical access anyway, so I'm not sure that pwning it with physical access is a new problem; instead it's a secret basement in a bank; it's only a problem if someone figures out it's there and starts digging a tunnel to it. Also, remember that a lot of motherboards these days come with built-in wifi or bluetooth adaptors. Intel ME has access to those too; you can't just rely on an upstream firewall for your physical ethernet. With the right (wrong?) exploit, all it takes is an adversary to be within directional antenna distance (which is actually really far) to be able to pwn your system. The best way to prevent abuse over that channel is to physically break the antenna connection (lol warranty voided because you've damaged your motherboard).

Can someone explain like I have a degree in computer science from a good university, but opted for a career as a software engineer in some relatively high level languages?

drdaeman 9y ago

If I got it right, they got a debugger access to the processor that runs ME, via an USB port. So they can mess with ME (dump its code, analyze it, observe how it runs, modify it live) as they see fit.

Sharlin 9y ago
Doesn't help if you don't know what ME is (I didn't). But a sibling comment explained it well.
- vog 9y ago
  For a very good explaination on that topic, see the following 32C3 presentation: "Towards (reasonably) trustworthy x86 laptops" https://media.ccc.de/v/32c3-7352-towards_reasonably_trustworthy_x86_laptops https://media.ccc.de/v/32c3-7352-towards_reasonably_trustwor... Also, the paper by the author is worth a read: "State considered harmful - A proposal for a stateless laptop" https://blog.invisiblethings.org/papers/2015/state_harmful.pdf https://blog.invisiblethings.org/papers/2015/state_harmful.p...

v4n4d1s 9y ago

I don't understand your question. Please clarify.

maxhallinan 9y ago
This is a funny variation on "Explain to me like I'm five years old".

jimmyswimmy 9y ago

I'll give a try. Someone else can correct me later. These guys have used a JTAG f debugging dongle to access the Intel management engine. They can now read every bit of code. Which means that secrets stored within the code including keys and bugs are available to them and anyone who can replicate their work. Since the management engine is in nearly all of Intel chips, we're screwed. AMD have something similar so no help there.

dm319 9y ago
Is this seen in ARM?
- milcron 9y ago
  Some of them have ARM TrustZone. I'm pretty sure that i.MX6 chips are relatively clean. Modern chips are becoming less so.
_0ffh 9y ago
"AMD have something similar so no help there" It's probably worse for AMD. For Intel now at least we'll probably get the ability to securely disable everything below ring -1.
- vog 9y ago
  It's such a pity that there is no real competition in that area. (Unless you go the totally different architectures such as ARM or RISC-V.) AMD had the chance to differentiate from Intel here, instead they blindly immitate the same customer-hostile stunt.
  - microcolonel 9y ago
    I don't want to get too deep into imagination, but the details of the ME/PSP story make it seem like an outside force of some sort is compelling them to add this stuff to their platforms.

dsr_ 9y ago

Intel CPUs have an embedded supervisory CPU called the Management Engine. It can read all of memory, control power states on the main CPU, and generally has super-root privileges on everything. You, an end-user, aren't allowed to program it. The current MEs run a form of Minix. They represent an incredible security and privacy risk, because we don't know what code they run and it is widely believed that the NSA or other intelligence agencies have backdoor access. Remote backdoor access, even: the ME can talk to the network. A JTAG is a standard minimal serial port used for debugging purposes. You'll find them on nearly all embedded devices - routers, phones, TVs, refrigerator controllers... usually appearing as a set of two or three contact points. Sometimes they connect directly to a debugger. In this case, it appears that at least some Intel CPUs have a JTAG on the ME that can be routed through the on-CPU USB handler, and thus physical access to the right USB ports can be used to access the ME.

metalliqaz 9y ago
Also that since they have JTAG debugging access, they have unrestricted access to the normally hidden processor, meaning they can disassemble it, peer into memory, and probably find a method of permanently disabling the ME.
- kevin_b_er 9y ago
  And if they can access it without hardware modifications it means any USB device has super-root access to the machine. And then it would mean you can't block it unless you don't connect USB device. I suspect they fiddled with something to get access, however. Attached something to motherboard or similar.
kinleyd 9y ago
Thank you for that great explanation.
quickben 9y ago
To add, and maybe the others can correct me if I'm wrong: Intel ME can be controlled remotely if you have an Intel lan card, even if the main cpu is off, but the motherboard is powered on. It goes from there and gets worse is my understanding.

Sharlin 9y ago

Yeah, this is just TLA overload.

jcims 9y ago

There's a computer in your computer so your computer can computer while you computer. These guys just found the keyboard.

petecooper 9y ago
That's…a really good single-sentence explanation. Thank you!
stephengillie 9y ago
"The remote session is coming from inside the laptop!"
berbec 9y ago
It needed to be done: https://i.imgflip.com/1z5rcw.jpg https://i.imgflip.com/1z5rcw.jpg

inetknght 9y ago

I'm going to assume "relatively high level languages" are for example Python, Ruby, C#, Javascript... Imagine that you have your high level program. When you execute it, it goes through a just-in-time compilation (whether that's script parsing or bytecode conversion, or actual compilation, or whatever) before reaching the CPU which actually executes your code. Now imagine that your interpreter has the capability of reading and monitoring everything you do. Nothing wrong with that, it's supposed to do that, it's how it works. But imagine if it had an exposed, unlogged, unmonitored, API which allowed a third party to be able to interact with whatever you do. Say that it's there "for debugging purposes". You want to encrypt an HTTPS session? This API allows them to grab your key without ever notifying you. Or, even if you use custom encryption, it allows them to grab your specific instructions and the data used in processing to reverse your encryption. It allows a remote party to inject their own flow of execution into your program. So you're sitting there waiting for the next user event to occur in your event loop while, instead, the interpreter simply handed the whole event loop to a third party. They could inject user events for you to process that the user never actually performed; they could modify data in ways that you can never detect. Except that it's not the interpreter. It's a side-channel, an additional hidden core on your CPU (it's actually a completely hidden and separate secondary CPU). Your processor still runs and executes your code. But another processor is simultaneously running and executing its own code with its own RAM that you can't access. It has access to your RAM as if it were a file open on your hard disk. You can't disable it. You can't interact with it. It's even running when your computer is "shut off". If there's power on the motherboard, then this hidden processor is running. That, in a nutshell, is Intel ME... ... This sounds _really_ paranoid and alarmist. But it's not all bad. Intel has usually done really well with "security through obscurity" in this case and there aren't many known exploits for Intel ME. That said, those that do or could exist, gain all of the capabilities of Intel ME. Most people consider "game over" for physical access anyway, so I'm not sure that pwning it with physical access is a new problem; instead it's a secret basement in a bank; it's only a problem if someone figures out it's there and starts digging a tunnel to it. Also, remember that a lot of motherboards these days come with built-in wifi or bluetooth adaptors. Intel ME has access to those too; you can't just rely on an upstream firewall for your physical ethernet. With the right (wrong?) exploit, all it takes is an adversary to be within directional antenna distance (which is actually really far) to be able to pwn your system. The best way to prevent abuse over that channel is to physically break the antenna connection (lol warranty voided because you've damaged your motherboard).