5 ms·
You'd think if the ME truly wasn't nefarious that Intel would offer chips without it and capitalize on the extra features in the enterprise market. I've yet to
by mikeokner 9y ago
You'd think if the ME truly wasn't nefarious that Intel would offer chips without it and capitalize on the extra features in the enterprise market. I've yet to encounter anyone who actually wants it.
- monocasa 9y agoIt's in part used for DRM. You've probably used it if you've watched BluRays or Netflix over 720p.
- 0xFFC 9y agoI am genuinely asking, how intel ME is related to watching movies in Netflix? Would you mind to elaborate a little bit?
- monocasa 9y agoAFAIU, it's used in the HDCP encryption negotiation.
- sofaofthedamned 9y agoYup. There's also rumours it holds the secure enclave equivalent, so getting root into this means you're double fucked: https://twitter.com/mjg59/status/932730696614813696 https://twitter.com/mjg59/status/932730696614813696
- Groxx 9y agoGiven Intel's announcement: https://security-center.intel.com/advisory.aspx?intelid=INTEL-SA-00086 https://security-center.intel.com/advisory.aspx?intelid=INTE... >Based on the items identified through the comprehensive security review, an attacker could gain unauthorized access to platform, Intel® ME feature, and 3rd party secrets protected by the Intel® Management Engine (ME), Intel® Server Platform Service (SPS), or Intel® Trusted Execution Engine (TXE). It seems like there's a reasonable chance of that being the case.
- freedomben 9y agoLink to Intel's announcement isn't working. Might be a server-side issue ¯\_(ツ)_/¯
- Fnoord 9y agoApparently it needs to have appended &languageid=en-fr to work [1] [1] https://security-center.intel.com/advisory.aspx?intelid=INTEL-SA-00086&languageid=en-fr https://security-center.intel.com/advisory.aspx?intelid=INTE...
- pgeorgi 9y agoIt's also a convenient place to put in all the things they don't want to hard wire. Which gets more every day. Need to maintain crypto keys for SGX enclave memory? Do it in the ME. Need to do some extra stuff on suspend/resume? Do it in the ME. Not sure if any other special handling might require updates at a later date? Do it in the ME. ... There's no need for nefarious purposes to explain why the ME isn't optional anymore - it's just more convenient.
- srcmap 9y agoNeed to add/remove/read system's crypto keys, Do it in ME. Need to monitor/hack the computer when the users think it is "power off", Do it in ME. Need to add other "features" to the system in the future, Do it in ME.
- pgeorgi 9y agoThose are the concerns around the ME. But those motivations aren't necessary to explain the presence of the ME. Occam's razor and all that.
- colejohnson66 9y agoI say it also has to do with them just not caring about what their users want. You’re still gonna buy an x86 processor and AMD has their own ME-like tool too. What are you gonna do, run your desktop on ARM or RISC-V?
- cturner 9y agoWould be good to have a low performance riscv motherboard with something like a PCI bus. Then, run an x86 daughter card. Early arm systems (acorn RISC pc) could house a 486 daughter card like this, and you could run Windows on it in a box. Have one at home.
- drvdevd 9y agoSadly, the main reason IMO this isn't possible is not just that desktop software is designed for the x86 instruction set, but that it's designed for lots of RAM and CPU usage, when it could be slimmer.
- prophesi 9y agoAnd even with ARM (I'm not familiar with RISC-V), you're likely going to have binary blobs for critical drivers.
- AstralStorm 9y agoWorse, in Qualcomm chips you have essentially the same OS as in AMD "Secure" Processor. Trustonic TEE OS. Handling ARM "Trust"Zone.
- ksk 9y ago>I say it also has to do with them just not caring about what their users want. Why are people buying their products?
- colejohnson66 9y agoBecause the only alternative is AMD, who, until Ryzen, was lacking in performance quite a bit.
- tyingq 9y ago> I've yet to encounter anyone who actually wants it Ignoring the security concerns, the remote access, imaging, etc, are actually pretty nice. Better done than most 3rd party IPMI implementations. If it were open and documented , and able to be turned off, it has value.
- ksk 9y agoI want it. Wearing multiple hats at a small company, I have to occasionally reimage machines and this would make it very useful for me.
- Oribi 9y agoYou've already got it! If you are reimaging physical machines, most server class machines have IPMI features that allow reimaging.
- tscs37 9y agoSeveral corporations use it for Lights-Out management or on laptops to ensure data security compliance. The things for which you actually want a backdoor in your server to control it from. Maybe even in the face of an attacker who has gained full control of both software and hardware.
- freedomben 9y agoI would love a potential employer/recruiter to woo me with, "Your choice of non-backdoor-ed laptop that respects your privacy." I would at least give them a phone call for that line.
- mattnewton 9y agoWhat is private about a company laptop? Your own laptop shouldn’t be backdoored, but I think it’s irrational to expect the a laptop owned by the company won’t be managed by that company.
- freedomben 9y agoI don't expect it. That's why if a company offered it to me I would be impressed. It would speak volumes that they: A) Trust their employees B) Respect my privacy C) Aren't paternalistic