16 ms·

One way to think of ME is, we all woke up one day and discovered we have had high resolution night vision spy cams installed in our bedrooms. The next realizat

One way to think of ME is, we all woke up one day and discovered we have had high resolution night vision spy cams installed in our bedrooms. The next realization is there is no way to turn them off or remove them. It’s posisble even moving won’t help. And yet we really don’t seem to care much. Lesser issues generate national outrage and high volumes of press coverage. Why? HN may be uniquely positioned to show us the answer. Take a community of people with generally above average interest and/or knowledge in this stuff, and the comments are filled with questions asking what the hell ME even is. Apparently, ME is the perfect combination of opaque, obtuse, and obscure. It’s not rocket science, but complicated enough it’s hard to explain well quickly. It’s easy to be a highly technical person yet never have the need to cross paths with the subject. There has been some press, some activity, but all of that is simultaneously dampened for the same reasons.

inetknght 9y ago
> I think HN is uniquely positioned to show us the answer. Take a community of people with generally above average interest and/or knowledge in this stuff, and the comments are filled with I think it's even more sinister: I would argue that a higher percentage of users on HN might be sworn to secrecy about any knowledge they might have anyway. So you end up with very smart people who're either sworn to secrecy or who aren't; those who aren't are asking questions (and very few have answers, and those answers are partial or incorrect). Those who are can't answer them honestly or fully.
- _jal 9y ago
  In the past discussions of the ME here and elsewhere, there have always been people making self-assured poo-pooing noises about what a trivial nonissue it is, make deceptive claims about exposure, and then dumb claims about how you can't trust any hardware. They never reply to particular questions that might point out how deceptive the arguments are.
  - inetknght 9y ago
    Call them out on it.
  - matthewaveryusa 9y ago
    I'm one of the people that claims you can't trust hardware. Care to elaborate why that's not the case. How does one trust a chip with 14nm transistors? Are you claiming that one can 'simply' decap the chip and examine it with a microscope on a Saturday night? How do I then trust that the chip I have in hand is of the same architecture as the one you decapped and examined?
    - kfrzcode 9y ago
      This is how I feel -> I've treated every device I've had for the last decade as if it were compromised, because who can prove to me otherwise? I certainly don't have the expertise to verify for myself.
    - _jal 9y ago
      You are of course correct that in the general case for threat models above a risk threshold, one cannot trust hardware. But that is not the argument under discussion. The argument being made is that it doesn't matter if the ME is a big fat target, because (f'instance) your NIC could also be a big fat target we just don't know about. That is the argument I am asserting is dumb. And it is obviously dumb; in adversarial contests, you don't leave weaknesses exposed just because you might have other weaknesses[1]. It also ignores the presence of differential threats; I may not care about hypothetical compromised NICs because my use case my not require a network, but need anti-evil-maid defenses. Bottom line: in the context of discussing whether or not the ME is dangerous in the general case, other potential hardware threats are irrelevant, and I believe the argument is one used to intentionally muddy the waters. [1] Putting aside deeper strategies; I'm not going to argue about game theory here.
    - jancsika 9y ago
      You're only responding to the part after "dumb claims," right? And your (valid) refutation of that part in no way implies spending less time reverse engineering and disabling ME, nor being less excited about this tweet. Correct?
- deleted 9y ago
  [deleted]
- engi_nerd 9y ago
  This is what I think, too. My professional knowledge doesn't encompass anything like ME, but occasionally areas I am expert in do come up. Unfortunately I can't honestly do much more than just watch -- I'm afraid that I might give away things I shouldn't without realizing it. I'm sure that I'm far from the only one.
  - sametmax 9y ago
    If you are in this position, you may be able to take secretly actions: - create tools to help fight what you deem contrary to things that are important to you - dispatch leaks in subtitle ways so that humanity is not left in the dark - lead anonymous and discrete community of people sharing your believes, your skills and passion to improve things Be careful. And best of luck.
    - engi_nerd 9y ago
      Late to the party here and I doubt you'll ever see this. But I haven't seen anything that worried me. Besides those NDAs are legally binding promises, I take those seriously.
fragmede 9y ago
> And yet we really don’t seem to care much. I know we're used to "Internet speed" and the tweet happened an entire 24 hours ago, but give it a bit of time before declaring it dead. Wired and Vice need a second to write it up, and see if it hits the mainstream before declaring the issue ignored. Not saying it will get picked up, though I sure hope it does, but as you point out, it's a bit obscure and takes some explaining. Still, there are numerous reports that the Facebook app on your phone listens to every word you say to show you ads for things you were talking aboutm but on HN and other web forums, there are always an element of disbelief. We may believe that it must be something else - correlation to web searches from the same IP, but there's never been proof one way or the other. (A Facebook exec's claim doesn't count as proof.) So there's a section of people that believe they already have high resolution recording devices that we take into to bed. What's one more? (Typing this, very gratefully, from an ARM Chromebook.)
- dmix 9y ago
  Plenty of people were still saying the Snowden revelations were old hat when they came out, we all knew it was happening just didn't have proof, etc. The novelty and seriousness tends to be out-of-whack with the amount of news coverage. It's a poor way to measure the importance of existing news coverage or lack of it for that reason. What matters is that it gets out and incentivizes developers, manufacturers, company policies, and behavioural change. There are plenty of hot news scare pieces after boring security leaks all the time bringing awareness to issues that technical people have known well. For ex, I'm hearing about friends older parents putting tape over their laptop cameras. We love to trash bugs that having marketing brands but these exploits, and more importantly obvious attack surfaces like ME or cellphone modems, often just need the right amount of human-interest story, practical real-life example, and wrapped in good news friendly explanation for regular people to care. It tends to happen a lot more randomly and without a rational order of priority, but it's still happening more and more often. At the end of the day it's always going to come down to the time and effort of a security researcher caring and the tech community putting the effort in to make the journalists care.
  - fragmede 9y ago
d0mine 9y ago
"opaque, obtuse, and obscure" is a red herring. Imagine, Intel were a Russian company. Tomorrow, there would be a simple and clear [screaming] headline similar to "Russians hacked the election" (general public doesn't need to know or understand how the network, computers or elections actually work). The day after tomorrow it would be illegal to buy anything Intel.
- andruby 9y ago
  What do you think the headline about Intel be in Russian media?
  - dmitriid 9y ago
    Most likely they will be quiet because Russia is 100% dependent on foreign technology.
    - igor_filippov 9y ago
      Not the military.
      - ComputerGuru 9y ago
        They must be decades behind, then. I don't think in-house Russian engineering capabilities have been competitive let alone ahead of the consumer electronics curve going back at least a decade in the of fabrication. Maybe when it was 1997 and everything was DIP.
        Ysx 9y ago
        I'll negate this by taking the opposite position, and similarly having no facts or references.
        daurnimator 9y ago
        MCST make stuff used by russian military. see e.g. Elbrus chips https://en.wikipedia.org/wiki/Elbrus-2S%2B https://en.wikipedia.org/wiki/Elbrus-2S%2B
SeanDav 9y ago
> "Apparently, ME is the perfect combination of opaque, obtuse, and obscure. It’s not rocket science, but complicated enough it’s hard to explain well quickly." The way I see it is Intel ME is a processor-level application that has full control of all computer activity and cannot be blocked or disabled and can be accessed and controlled remotely. Would like to hear other people's opinions of what it is.
- criddell 9y ago
  It's a pretty big thing and parts are necessary, parts are useful, parts are scary, and too much of it is shrouded in secrecy.
- pavement 9y ago
  The mnemonic "opaque, obtuse, and obscure" is a valid denotation of targeted qualities, not unlike the qualities targeted for drone activity are related, with the mnemonic "dull, dirty or dangerous." So, the three O's is a good conceptual utility, for understanding the combination of traits that can exploit the realities of human psychology, and explain why no one seems to care about how technical paralysis can stifle apparent relevance. It's not only a means of explaining sneaky cloak and dagger stuff. You could describe lots of niche tech staples with this mnemonic. When something is difficult to explain, that's often enough to derail any casual conversation with simple mental fatigue. Opaque: Any number of qualities can render subject matter opaque. A poorly indexed, large volume of data is opaque, but a recursive function may also be opaque in it's behaviors. Obtuse: Intel ME's position in the stack is placed at a key choke point, requiring highly abstract approaches to utility. In other words, it is obtuse. Obscure: It's readily available, but sequestered as a feature behind interfaces non-technical users rarely visit, without advertising to promote, train or recommend it's use. Is it supposed to be an easter egg? For who?
deleted 9y ago
[deleted]
kakarot 9y ago
To be fair, many of us noticed the giant camera in the corner a long time ago. ME has been a holy grail in the security researcher community for a long time, frequently the subject of presentations at conventions. And we have been pestering Intel about this since its inception. But the fact is that it doesn't matter how much outrage you or I may have. It will take enterprise-level shifts away from Intel products to get them to offer chips without ME.
- kfrzcode 9y ago
  What about AMD? Which chips does the sec-comm recommend for not getting pwnd
  - krakensden 9y ago
    AMD and ARM have 'TrustZone', which is not the same, but if you don't trust it maybe you're in trouble.
- rurban 9y ago
  I would rather hope that it would take a brave judge or the EU to forbid this spy-device. Commercially there's no alternative. Enterprises even use Microsoft over Linux/BSD. Why would they get rid of Intel? For Anti-US spying a firewall should be enough.
acqq 9y ago
Previously, explaining what the author of the tweet did months ago: https://www.digitaltrends.com/computing/intel-kaby-lake-skylake-pcs-hackable-usb-jtag/amp/ https://www.digitaltrends.com/computing/intel-kaby-lake-skyl... "As shown in the presentation by security researchers Maxim Goryachy and Mark Ermolov, one way of accessing the JTAG debugging interface" "is to use a" "hardware implant" "running Godsurge" "which can exploit the JTAG debugging interface. Originally used by the National Security Agency -- and exposed by Edward Snowden -- Godsurge is malware engineered to hook into a PC’s boot loader to monitor activity. It was originally meant to live on the motherboard and remain completely undetectable outside a forensic investigation." Emphasis mine. But this all was in January: "The claim was made during a presentation" "which showed how hackers could use a cheap device to gain access to a debugging interface embedded in hardware." What's the news now compared to then?
- hnuser2357982 9y ago
  That we have one more person capable of exploiting this in the wild.
  - tedunangst 9y ago
    Who?
    - hnuser2357982 9y ago
      The guy who made the tweet...
      - acqq 9y ago
        No, he's the same guy who made the news in January, Maxim Goryachy.
  - deleted 9y ago
    [deleted]
ransom1538 9y ago
Let's be pragmatic. Does anyone know if ME blockers work? Can you please post one if it does? Can we start a list? Are the destination ips it can be controlled from hard coded, can it be blocked via simple firewall rules? EG tool: https://github.com/corna/me_cleaner https://github.com/corna/me_cleaner List? https://github.com/ransom1538/intel_me_cleaners/ https://github.com/ransom1538/intel_me_cleaners/
- milcron 9y ago
  You can use me_cleaner, and it's better than nothing, but the ME is still required for booting the motherboard.
elif 9y ago
It's not that "we really don't seem to care much" It's that even those of us that care vehemently, have no recourse. It is impossible to fight a secret police state.
- goldenkey 9y ago
  Well with that attitude it is... Part of winning is to even begin to believe you can fight...
  - TheAceOfHearts 9y ago
    There's ongoing work to fight against this, it just takes a very long time because the problem domain is incredibly complex. RISC-V [0] is an open ISA that looks promising. Unfortunately, the privileged instruction set is still a draft, which is important for getting a full modern OS up and running. lowRISC [1] is as non-profit open hardware company that has been working on a fully open RISC-V-based SoC that can run Linux. In their about page they claim it'll be ready this year. There's also the stuff from SiFive. They have an arduino-comparible microcontroller, and have ongoing work for a 64-bit quad-core. I don't think their hardware is open, though. [0] https://en.wikipedia.org/wiki/RISC-V https://en.wikipedia.org/wiki/RISC-V [1] http://www.lowrisc.org http://www.lowrisc.org
whatdidyousay1 9y ago
dear lord ... top comment ... all problems no solutions im guessing you could have told us what ME is or provided a link in the same amount of info that you put in your last paragraph your last paragrah derails the topic to be an exploration in press coverage vs hn comments I hope your hn comment and this hn comment displays what has happened to this forum. Its uninformative , and we have alot of people talking smart but not being smart. HN is entertainment for smart people. Not a research resource any more. Even if that was not the intended consequence
swebs 9y ago
>And yet we really don’t seem to care much. Lesser issues generate national outrage and high volumes of press coverage. Why? From what I noticed recently, issues only generate outrage if they can be blamed on Trump or republicans. Nobody cared about ISPs collecting user data since the early 2010s until republicans reverted a plan to forbid that in the future. Maybe the story would pick up traction if it was peppered with the photos of Trump meeting with Intel's CEO.
ksk 9y ago
>One way to think of ME is, we all woke up one day and discovered we have had high resolution night vision spy cams installed in our bedrooms. Sure, if by one day you mean - for the past 10 years? And if by spy cams you mean - A product with official documentation from the vendor, and similar to other products from other vendors. And these products can be purchased by anyone. You have some valid points, but they are clouded by your sweeping generalizations and needlessly polarizing language.
madez 9y ago
> And yet we really don’t seem to care much. I do care, a lot. I have decided to avoid Intel (and AMD) hardware like the pest. I will not buy any Core iSpyOnYou or AMD equivalent anymore. I'm an advocate of economic and judicial sanctions from the political level against Intel (and AMD). I tell people around me about the problems and explain how it is an issue of privacy, security, national sovereignty, and market power abuse. I'm looking for a desktop computer for my day to day use that comes without compromised hardware. The Raspberry Pi 3 works quite well, but doesnt work without non-free software. I successfully installed Debian onto my A20-OLinuXino-MICRO, but the GUI doesn't start. I'm looking for Hardware without Intel Hardware, without non-free software, mainline Linux support and preferable Debian compatible. The OpenPower system by raptor engineering is simply too expensive. I cannot afford it. Any ideas?
- Kenji 9y ago
  Your best bet is probably a tablet or smartphone with a fast ARM processor. Those don't have the management engine and can run surprisingly fast.
  - scott_karana 9y ago
    While it's true that they don't have MEs, the basebands in smartphones almost always have direct memory access, and their own proprietary firmware, so the same problems apply :-(
  - madez 9y ago
    As a desktop computer for day to day use? Can I run it without non-free software? Can I natively install Debian with mainline Linux to actually get work done? Can I connect a monitor and other accessory?
  - watersb 9y ago
    Should not trust a phone or tablet. Are the radios off? Are you sure?
- LeoPanthera 9y ago
  Could you not just buy a Macintosh? Macs lack the AMT chip so the ME in the CPU can't do anything.
cirgue 9y ago
> And yet we really don’t seem to care much. Most people do not have any concrete notion about what management engines are. People weren't that skeeved out by Alexa, and that was a pretty easy-to-understand system. There's no way that people will have any kind of personal connection to something that they barely are aware of and don't understand.
throwaway613834 9y ago
> One way to think of ME is, we all woke up one day and discovered we have had high resolution night vision spy cams installed in our bedrooms. Not really how I think of it. Seems more similar to waking up one day and realizing Tesla controls your Tesla car remotely. Or Microsoft can push bad updates Windows. Or Google can push bad updates to Chrome. > And yet we really don’t seem to care much. Lesser issues generate national outrage and high volumes of press coverage. Why? On my end it's because I have not seen a single shred of evidence that it has been used for spying, and because I figure the moment anyone becomes aware of that happening, people would probably find a way to block the network traffic at the router or somewhere else.
- sametmax 9y ago
  The point of ME is that it's invisible. And until then, few people had access to it. Now I can't wait for rogue monero miners to use ME to propagate :)
  - throwaway613834 9y ago
    It doesn't matter if it's visible or invisible. The point is, it cannot go undetected while being used: - If it were to periodically "check in" with an external server to see if it needs to do any kind of spying -- admins would notice the network traffic. - If it needed to be contacted externally to "initiate" any kind of spying at all, that would mean anyone behind a NAT would be safe, and furthermore, the the moment anybody notices such a thing, it would make the headlines and get blocked on networks, so this capability would need to be kept secret and turned off except for ultra-high-value targets... which most people do not view themselves as.
    - wbl 9y ago
      Are you so sure about point 1?
      - throwaway613834 9y ago
        Yes? I'm not claiming every single admin would notice it, I'm just saying some competent admins somewhere would notice it. I hope I'm not proven wrong, but I don't expect to wake up one morning and read "Breaking news: No admin has noticed this strange this IP traffic to Intel/NSA/whatever for the past decade".
palisade 9y ago
I've been warning friends and family about it for years back before it was well known, my first email about it was 2015. Their reaction has been one of three things; you're too paranoid, who cares so what, and stop talking to me. I've always made a variety of suggestions and updates on general security issues, even beyond the Intel ME problem, to friends/family via email. It is not just a matter of apathy. They get violently ill at being told to think about protecting themselves. If you tell them not to put their debit card into an ATM without giving the card reader a tug to see if its real first for example, they'll do it wrong anyway just to spite you. It isn't that giving the tug is hard or that it isn't wise, but they simply do not want you to be right or have to think about it. Admitting that you are right about that one little thing means they have to deal with all the other issues that you brought up as well. There is probably an interesting field of psychology to be researched with just that phenomena alone. I don't think this is just the people I know personally because I've encountered a lot the public who has this mindset as well. It is how we got ourselves into these problems in the first place with no recourse. I stopped sending the emails about a year ago because they asked me to. The reason stated is that no one cares about security and a number of them had already auto-forwarded me to the junk folder. Or, told me they saw my name and would skip my emails and not open them. I don't even feel like bringing it up again now that it is a going concern. They will continue to not care. I find it frustrating. EDIT: I've disabled Intel ME on my machines. I would offer to do it for others but they'd have to acknowledge it's something that concerns them to want that help, and they won't.
MadWombat 9y ago
> One way to think of ME I think I am a bit out of the current state of events. Is ME short for management engine? If that is the case, what is the problem with it?

inetknght 9y ago

> I think HN is uniquely positioned to show us the answer. Take a community of people with generally above average interest and/or knowledge in this stuff, and the comments are filled with I think it's even more sinister: I would argue that a higher percentage of users on HN might be sworn to secrecy about any knowledge they might have anyway. So you end up with very smart people who're either sworn to secrecy or who aren't; those who aren't are asking questions (and very few have answers, and those answers are partial or incorrect). Those who are can't answer them honestly or fully.

_jal 9y ago
In the past discussions of the ME here and elsewhere, there have always been people making self-assured poo-pooing noises about what a trivial nonissue it is, make deceptive claims about exposure, and then dumb claims about how you can't trust any hardware. They never reply to particular questions that might point out how deceptive the arguments are.
- inetknght 9y ago
  Call them out on it.
- matthewaveryusa 9y ago
  I'm one of the people that claims you can't trust hardware. Care to elaborate why that's not the case. How does one trust a chip with 14nm transistors? Are you claiming that one can 'simply' decap the chip and examine it with a microscope on a Saturday night? How do I then trust that the chip I have in hand is of the same architecture as the one you decapped and examined?
  - kfrzcode 9y ago
    This is how I feel -> I've treated every device I've had for the last decade as if it were compromised, because who can prove to me otherwise? I certainly don't have the expertise to verify for myself.
  - _jal 9y ago
    You are of course correct that in the general case for threat models above a risk threshold, one cannot trust hardware. But that is not the argument under discussion. The argument being made is that it doesn't matter if the ME is a big fat target, because (f'instance) your NIC could also be a big fat target we just don't know about. That is the argument I am asserting is dumb. And it is obviously dumb; in adversarial contests, you don't leave weaknesses exposed just because you might have other weaknesses[1]. It also ignores the presence of differential threats; I may not care about hypothetical compromised NICs because my use case my not require a network, but need anti-evil-maid defenses. Bottom line: in the context of discussing whether or not the ME is dangerous in the general case, other potential hardware threats are irrelevant, and I believe the argument is one used to intentionally muddy the waters. [1] Putting aside deeper strategies; I'm not going to argue about game theory here.
  - jancsika 9y ago
    You're only responding to the part after "dumb claims," right? And your (valid) refutation of that part in no way implies spending less time reverse engineering and disabling ME, nor being less excited about this tweet. Correct?
deleted 9y ago
[deleted]
engi_nerd 9y ago
This is what I think, too. My professional knowledge doesn't encompass anything like ME, but occasionally areas I am expert in do come up. Unfortunately I can't honestly do much more than just watch -- I'm afraid that I might give away things I shouldn't without realizing it. I'm sure that I'm far from the only one.
- sametmax 9y ago
  If you are in this position, you may be able to take secretly actions: - create tools to help fight what you deem contrary to things that are important to you - dispatch leaks in subtitle ways so that humanity is not left in the dark - lead anonymous and discrete community of people sharing your believes, your skills and passion to improve things Be careful. And best of luck.
  - engi_nerd 9y ago
    Late to the party here and I doubt you'll ever see this. But I haven't seen anything that worried me. Besides those NDAs are legally binding promises, I take those seriously.

fragmede 9y ago

> And yet we really don’t seem to care much. I know we're used to "Internet speed" and the tweet happened an entire 24 hours ago, but give it a bit of time before declaring it dead. Wired and Vice need a second to write it up, and see if it hits the mainstream before declaring the issue ignored. Not saying it will get picked up, though I sure hope it does, but as you point out, it's a bit obscure and takes some explaining. Still, there are numerous reports that the Facebook app on your phone listens to every word you say to show you ads for things you were talking aboutm but on HN and other web forums, there are always an element of disbelief. We may believe that it must be something else - correlation to web searches from the same IP, but there's never been proof one way or the other. (A Facebook exec's claim doesn't count as proof.) So there's a section of people that believe they already have high resolution recording devices that we take into to bed. What's one more? (Typing this, very gratefully, from an ARM Chromebook.)

dmix 9y ago
Plenty of people were still saying the Snowden revelations were old hat when they came out, we all knew it was happening just didn't have proof, etc. The novelty and seriousness tends to be out-of-whack with the amount of news coverage. It's a poor way to measure the importance of existing news coverage or lack of it for that reason. What matters is that it gets out and incentivizes developers, manufacturers, company policies, and behavioural change. There are plenty of hot news scare pieces after boring security leaks all the time bringing awareness to issues that technical people have known well. For ex, I'm hearing about friends older parents putting tape over their laptop cameras. We love to trash bugs that having marketing brands but these exploits, and more importantly obvious attack surfaces like ME or cellphone modems, often just need the right amount of human-interest story, practical real-life example, and wrapped in good news friendly explanation for regular people to care. It tends to happen a lot more randomly and without a rational order of priority, but it's still happening more and more often. At the end of the day it's always going to come down to the time and effort of a security researcher caring and the tech community putting the effort in to make the journalists care.
- fragmede 9y ago

d0mine 9y ago

"opaque, obtuse, and obscure" is a red herring. Imagine, Intel were a Russian company. Tomorrow, there would be a simple and clear [screaming] headline similar to "Russians hacked the election" (general public doesn't need to know or understand how the network, computers or elections actually work). The day after tomorrow it would be illegal to buy anything Intel.

andruby 9y ago
What do you think the headline about Intel be in Russian media?
- dmitriid 9y ago
  Most likely they will be quiet because Russia is 100% dependent on foreign technology.
  - igor_filippov 9y ago
    Not the military.
    - ComputerGuru 9y ago
      They must be decades behind, then. I don't think in-house Russian engineering capabilities have been competitive let alone ahead of the consumer electronics curve going back at least a decade in the of fabrication. Maybe when it was 1997 and everything was DIP.
      - Ysx 9y ago
        I'll negate this by taking the opposite position, and similarly having no facts or references.
      - daurnimator 9y ago
        MCST make stuff used by russian military. see e.g. Elbrus chips https://en.wikipedia.org/wiki/Elbrus-2S%2B https://en.wikipedia.org/wiki/Elbrus-2S%2B

SeanDav 9y ago

> "Apparently, ME is the perfect combination of opaque, obtuse, and obscure. It’s not rocket science, but complicated enough it’s hard to explain well quickly." The way I see it is Intel ME is a processor-level application that has full control of all computer activity and cannot be blocked or disabled and can be accessed and controlled remotely. Would like to hear other people's opinions of what it is.

criddell 9y ago
It's a pretty big thing and parts are necessary, parts are useful, parts are scary, and too much of it is shrouded in secrecy.
pavement 9y ago
The mnemonic "opaque, obtuse, and obscure" is a valid denotation of targeted qualities, not unlike the qualities targeted for drone activity are related, with the mnemonic "dull, dirty or dangerous." So, the three O's is a good conceptual utility, for understanding the combination of traits that can exploit the realities of human psychology, and explain why no one seems to care about how technical paralysis can stifle apparent relevance. It's not only a means of explaining sneaky cloak and dagger stuff. You could describe lots of niche tech staples with this mnemonic. When something is difficult to explain, that's often enough to derail any casual conversation with simple mental fatigue. Opaque: Any number of qualities can render subject matter opaque. A poorly indexed, large volume of data is opaque, but a recursive function may also be opaque in it's behaviors. Obtuse: Intel ME's position in the stack is placed at a key choke point, requiring highly abstract approaches to utility. In other words, it is obtuse. Obscure: It's readily available, but sequestered as a feature behind interfaces non-technical users rarely visit, without advertising to promote, train or recommend it's use. Is it supposed to be an easter egg? For who?

deleted 9y ago

[deleted]

kakarot 9y ago

To be fair, many of us noticed the giant camera in the corner a long time ago. ME has been a holy grail in the security researcher community for a long time, frequently the subject of presentations at conventions. And we have been pestering Intel about this since its inception. But the fact is that it doesn't matter how much outrage you or I may have. It will take enterprise-level shifts away from Intel products to get them to offer chips without ME.

kfrzcode 9y ago
What about AMD? Which chips does the sec-comm recommend for not getting pwnd
- krakensden 9y ago
  AMD and ARM have 'TrustZone', which is not the same, but if you don't trust it maybe you're in trouble.
rurban 9y ago
I would rather hope that it would take a brave judge or the EU to forbid this spy-device. Commercially there's no alternative. Enterprises even use Microsoft over Linux/BSD. Why would they get rid of Intel? For Anti-US spying a firewall should be enough.

acqq 9y ago

Previously, explaining what the author of the tweet did months ago: https://www.digitaltrends.com/computing/intel-kaby-lake-skylake-pcs-hackable-usb-jtag/amp/ https://www.digitaltrends.com/computing/intel-kaby-lake-skyl... "As shown in the presentation by security researchers Maxim Goryachy and Mark Ermolov, one way of accessing the JTAG debugging interface" "is to use a" "hardware implant" "running Godsurge" "which can exploit the JTAG debugging interface. Originally used by the National Security Agency -- and exposed by Edward Snowden -- Godsurge is malware engineered to hook into a PC’s boot loader to monitor activity. It was originally meant to live on the motherboard and remain completely undetectable outside a forensic investigation." Emphasis mine. But this all was in January: "The claim was made during a presentation" "which showed how hackers could use a cheap device to gain access to a debugging interface embedded in hardware." What's the news now compared to then?

hnuser2357982 9y ago
That we have one more person capable of exploiting this in the wild.
- tedunangst 9y ago
  Who?
  - hnuser2357982 9y ago
    The guy who made the tweet...
    - acqq 9y ago
      No, he's the same guy who made the news in January, Maxim Goryachy.
- deleted 9y ago
  [deleted]

ransom1538 9y ago

Let's be pragmatic. Does anyone know if ME blockers work? Can you please post one if it does? Can we start a list? Are the destination ips it can be controlled from hard coded, can it be blocked via simple firewall rules? EG tool: https://github.com/corna/me_cleaner https://github.com/corna/me_cleaner List? https://github.com/ransom1538/intel_me_cleaners/ https://github.com/ransom1538/intel_me_cleaners/

milcron 9y ago
You can use me_cleaner, and it's better than nothing, but the ME is still required for booting the motherboard.

elif 9y ago

It's not that "we really don't seem to care much" It's that even those of us that care vehemently, have no recourse. It is impossible to fight a secret police state.

goldenkey 9y ago
Well with that attitude it is... Part of winning is to even begin to believe you can fight...
- TheAceOfHearts 9y ago
  There's ongoing work to fight against this, it just takes a very long time because the problem domain is incredibly complex. RISC-V [0] is an open ISA that looks promising. Unfortunately, the privileged instruction set is still a draft, which is important for getting a full modern OS up and running. lowRISC [1] is as non-profit open hardware company that has been working on a fully open RISC-V-based SoC that can run Linux. In their about page they claim it'll be ready this year. There's also the stuff from SiFive. They have an arduino-comparible microcontroller, and have ongoing work for a 64-bit quad-core. I don't think their hardware is open, though. [0] https://en.wikipedia.org/wiki/RISC-V https://en.wikipedia.org/wiki/RISC-V [1] http://www.lowrisc.org http://www.lowrisc.org

whatdidyousay1 9y ago

dear lord ... top comment ... all problems no solutions im guessing you could have told us what ME is or provided a link in the same amount of info that you put in your last paragraph your last paragrah derails the topic to be an exploration in press coverage vs hn comments I hope your hn comment and this hn comment displays what has happened to this forum. Its uninformative , and we have alot of people talking smart but not being smart. HN is entertainment for smart people. Not a research resource any more. Even if that was not the intended consequence

swebs 9y ago

>And yet we really don’t seem to care much. Lesser issues generate national outrage and high volumes of press coverage. Why? From what I noticed recently, issues only generate outrage if they can be blamed on Trump or republicans. Nobody cared about ISPs collecting user data since the early 2010s until republicans reverted a plan to forbid that in the future. Maybe the story would pick up traction if it was peppered with the photos of Trump meeting with Intel's CEO.

ksk 9y ago

>One way to think of ME is, we all woke up one day and discovered we have had high resolution night vision spy cams installed in our bedrooms. Sure, if by one day you mean - for the past 10 years? And if by spy cams you mean - A product with official documentation from the vendor, and similar to other products from other vendors. And these products can be purchased by anyone. You have some valid points, but they are clouded by your sweeping generalizations and needlessly polarizing language.

madez 9y ago

> And yet we really don’t seem to care much. I do care, a lot. I have decided to avoid Intel (and AMD) hardware like the pest. I will not buy any Core iSpyOnYou or AMD equivalent anymore. I'm an advocate of economic and judicial sanctions from the political level against Intel (and AMD). I tell people around me about the problems and explain how it is an issue of privacy, security, national sovereignty, and market power abuse. I'm looking for a desktop computer for my day to day use that comes without compromised hardware. The Raspberry Pi 3 works quite well, but doesnt work without non-free software. I successfully installed Debian onto my A20-OLinuXino-MICRO, but the GUI doesn't start. I'm looking for Hardware without Intel Hardware, without non-free software, mainline Linux support and preferable Debian compatible. The OpenPower system by raptor engineering is simply too expensive. I cannot afford it. Any ideas?

Kenji 9y ago
Your best bet is probably a tablet or smartphone with a fast ARM processor. Those don't have the management engine and can run surprisingly fast.
- scott_karana 9y ago
  While it's true that they don't have MEs, the basebands in smartphones almost always have direct memory access, and their own proprietary firmware, so the same problems apply :-(
- madez 9y ago
  As a desktop computer for day to day use? Can I run it without non-free software? Can I natively install Debian with mainline Linux to actually get work done? Can I connect a monitor and other accessory?
- watersb 9y ago
  Should not trust a phone or tablet. Are the radios off? Are you sure?
LeoPanthera 9y ago
Could you not just buy a Macintosh? Macs lack the AMT chip so the ME in the CPU can't do anything.

cirgue 9y ago

> And yet we really don’t seem to care much. Most people do not have any concrete notion about what management engines are. People weren't that skeeved out by Alexa, and that was a pretty easy-to-understand system. There's no way that people will have any kind of personal connection to something that they barely are aware of and don't understand.

throwaway613834 9y ago

> One way to think of ME is, we all woke up one day and discovered we have had high resolution night vision spy cams installed in our bedrooms. Not really how I think of it. Seems more similar to waking up one day and realizing Tesla controls your Tesla car remotely. Or Microsoft can push bad updates Windows. Or Google can push bad updates to Chrome. > And yet we really don’t seem to care much. Lesser issues generate national outrage and high volumes of press coverage. Why? On my end it's because I have not seen a single shred of evidence that it has been used for spying, and because I figure the moment anyone becomes aware of that happening, people would probably find a way to block the network traffic at the router or somewhere else.

sametmax 9y ago
The point of ME is that it's invisible. And until then, few people had access to it. Now I can't wait for rogue monero miners to use ME to propagate :)
- throwaway613834 9y ago
  It doesn't matter if it's visible or invisible. The point is, it cannot go undetected while being used: - If it were to periodically "check in" with an external server to see if it needs to do any kind of spying -- admins would notice the network traffic. - If it needed to be contacted externally to "initiate" any kind of spying at all, that would mean anyone behind a NAT would be safe, and furthermore, the the moment anybody notices such a thing, it would make the headlines and get blocked on networks, so this capability would need to be kept secret and turned off except for ultra-high-value targets... which most people do not view themselves as.
  - wbl 9y ago
    Are you so sure about point 1?
    - throwaway613834 9y ago
      Yes? I'm not claiming every single admin would notice it, I'm just saying some competent admins somewhere would notice it. I hope I'm not proven wrong, but I don't expect to wake up one morning and read "Breaking news: No admin has noticed this strange this IP traffic to Intel/NSA/whatever for the past decade".

palisade 9y ago

I've been warning friends and family about it for years back before it was well known, my first email about it was 2015. Their reaction has been one of three things; you're too paranoid, who cares so what, and stop talking to me. I've always made a variety of suggestions and updates on general security issues, even beyond the Intel ME problem, to friends/family via email. It is not just a matter of apathy. They get violently ill at being told to think about protecting themselves. If you tell them not to put their debit card into an ATM without giving the card reader a tug to see if its real first for example, they'll do it wrong anyway just to spite you. It isn't that giving the tug is hard or that it isn't wise, but they simply do not want you to be right or have to think about it. Admitting that you are right about that one little thing means they have to deal with all the other issues that you brought up as well. There is probably an interesting field of psychology to be researched with just that phenomena alone. I don't think this is just the people I know personally because I've encountered a lot the public who has this mindset as well. It is how we got ourselves into these problems in the first place with no recourse. I stopped sending the emails about a year ago because they asked me to. The reason stated is that no one cares about security and a number of them had already auto-forwarded me to the junk folder. Or, told me they saw my name and would skip my emails and not open them. I don't even feel like bringing it up again now that it is a going concern. They will continue to not care. I find it frustrating. EDIT: I've disabled Intel ME on my machines. I would offer to do it for others but they'd have to acknowledge it's something that concerns them to want that help, and they won't.

MadWombat 9y ago

> One way to think of ME I think I am a bit out of the current state of events. Is ME short for management engine? If that is the case, what is the problem with it?