3 ms·
Did you follow yesterday's news? The ME is remotely vulnerable, has full control over the machine, and it's not even clear that it can be upgraded in a secure w
by cjbprime 9y ago
Did you follow yesterday's news? The ME is remotely vulnerable, has full control over the machine, and it's not even clear that it can be upgraded in a secure way.
Why wouldn't you be interested in turning it off?
And why would you classify people who'd rather not be running remotely vulnerable code they can't control as "privacy folks"?
- throwaway613834 9y agoI did follow the news about being remotely vulnerable. That's why I said I'd understand the urge to remove the networking stacks. Other vulnerabilities would require local access. > Why wouldn't you be interested in turning it off? I'm not asking why you'd be interested in it, I'm asking why you'd freak out so much about it given X/Y/Z are already true and you can't do anything about them. There's a bit more nuance in my argument than you're giving me credit for here. > And why would you classify people who'd rather not be running remotely vulnerable code they can't control as "privacy folks"? I already excluded the part about remote vulnerability. See first point above.
- ksk 9y ago> The ME is remotely vulnerable, Could you please post a link on that? I read about the AMT bugs, which require the user to manually provision it.
- macns 9y agohttp://cve.circl.lu/cve/CVE-2017-5712 http://cve.circl.lu/cve/CVE-2017-5712 Summary: Buffer overflow in Active Management Technology (AMT) in Intel Manageability Engine Firmware 8.x/9.x/10.x/11.0/11.5/11.6/11.7/11.10/11.20 allows attacker with remote Admin access to the system to execute arbitrary code with AMT execution privilege EDIT: I'm not sure this was the one the GP referring to
- cjbprime 9y agoI was thinking of: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5708 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5708