6 ms·
Intel ME is frequently featured here on HN, but the general population is completely clueless. This is quite possibly the worst and most widespread computing v
by brndnmtthws 9y ago
Intel ME is frequently featured here on HN, but the general population is completely clueless.
This is quite possibly the worst and most widespread computing vulnerability that has ever existed, and it's likely that Intel will just maintain the status quo until there's some sort of black swan event.
- jjawssd 9y agoWhat is harmed most directly by publicizing Intel ME vulnerabilities? Is it in the interest of this entity to restrict the publication of Intel ME vulnerabilities to the general public? How does the general public obtain information on a day to day basis? Who runs the mass media? Is the mass media affected by this entity? Is the mass media narrative influenced by this particular entity?
- yread 9y agoWorst vulnerability ever? AMT has to be enabled, attacker has to know AMT password, BIOS password and BIOS has to be misconfigured. I understand clickbait hyperbole and appeal to emotions are good for getting eyeballs but lets keep some perspective. Remember heartbleed, conflicker or blaster?
- jstanley 9y agoME is running regardless of those things.
- ajross 9y agoBut not vulnerable. This is like saying a local root exploit is the Worst Vulnerability Ever in a system that was correctly firewalled from its earliest implementations. "Worst" implies harm, not just potential. It doesn't get to be The Worst until something happens, no matter how much it offends your personal design sensibilities or confirms your conspiracy priors.
- ptero 9y agoSorry, but "running but not vulnerable" is not nearly good enough nowadays. This means that a real exploit (e.g., via yet another insert-your-favorite-spooky-agency tool leak) can be quickly scaled to a large fraction of computers worldwide. If you are saying that when assessing the vulnerabilities, potential harm is not important, only actual is, would you feel that putting remotely activated bombs on all planes is not a major vulnerability as long as no one has a password?
- ksk 9y ago>Sorry, but "running but not vulnerable" is not nearly good enough nowadays. What does that mean practically? What you said applies to every networked device and tech. All routers, all computers, all OSs, all voip phones, etc, etc are 'one vulnerability away'. from total compromise.
- jstanley 9y agoNormally you only run things if you think they are useful, and you are cognizant of the risk. It's very hard to avoid running ME even if you believe it's actively harmful.
- ksk 9y agoThat is a good point. I suppose you could mitigate that if you were building new systems and used AMD products.
- brndnmtthws 9y agoAMD has its own equivalent of ME also.
- xkarga00 9y agoHow do you know that AMD does not run its own version of ME? The only viable solution I see is open hardware.
- benevol 9y ago> Intel will just maintain the status quo until there's some sort of black swan event. I absolutely hate Intel and AMD for sabotaging their customers like that. Please people, get to that black swan event ASAP.
- Filligree 9y agoIf we're unlucky, the 'black swan event' will be something along the likes of Pluto's Kiss. Imagine a Morris worm equivalent, but which bricks the computers it infects after destroying the filesystem. Even if everyone has backups of everything, offline, it'll be years before all the destroyed computers can actually be replaced. This isn't a scenario I want to happen for real.
- LeoPanthera 9y agoOn the plus side, you can probably guarantee it would only ever happen once.
- Zopieux 9y agoHaha, no, you can't. Since when do humans learn from their mistakes?
- knowaveragejoe 9y agoNot infrequently, but it's in vogue to hold the belief that they don't.
- abecedarius 9y agoYou could do some much more interesting things with a hack than wiping and bricking a bunch of computers, even if the bricking part is doable.
- madez 9y agoI also hate Intel and AMD for that, but I think they'd prefer we didn't hate them. I conclude that there are big reasons to still do what we hate them for. I'm afraid even a black swan event wouldn't make those reasons go away. What I think needs to happen is for other countries to realize this issue is a matter of national security, and to fund development of alternatives.
- eggoa 9y agoYes, but I don't think it's a black swan if you're waiting for it.
- brndnmtthws 9y agoTrue, but I meant for all of those who aren't prepared for or aware of this issue.
- one_redolent 9y agoThis seems to be the status quo when it comes to digital security in general. There isn't enough penalty for massive breaches, even stocks seem to rarely take a hit when a company has a huge security blunder.
- joe_the_user 9y ago"This is quite possibly the worst and most widespread computing vulnerability that has ever existed." The problem is to make that true, you have to carefully phrase the situation as "this has the potential to give rise to the worst, bad .... etc". And that's the thing. Ignoring this ranks along attitudes like "that cement pool of mining tails right above town is quite sturdy", "we just need a little time to reduce our carbon emissions..." and "we shouldn't kill the IoT with too much regulation..." etc If X isn't a problem right now!, then it seems like X is going to get about zero attention from a world swimming in things that are a problem right now. And that too is going to give rise to further problems down the road, to say the least.
- Crontab 9y ago> Intel ME is frequently featured here on HN, but the general population is completely clueless. That's what they want: a backdoor advertised as a feature.