3 ms·

The first section is weird: it compares random opinions from random social websites with another semi-random one from Hacker News (from someone who says it work

by wilun 9y ago

The first section is weird: it compares random opinions from random social websites with another semi-random one from Hacker News (from someone who says it worked on it, but we don't even now at which level, and the "I think I would have known" part strongly make me think he actually would not have...), and lets conclude that secret services never had any stake in the design. The unmarketed HAP bit is actually evidence they either can do some hack leveraging it, or at least are worried other services can or will become able to. The theory that the complete subsystem would have been kept secret if it was of interest for secret services is also highly laughable. Especially when it is well known how they regularly leverage other marketed management/sideband services, for example in telecom equipment, to do their espionage operations.

nickpsecurity 9y ago
Systems going back to the first one, SCOMP (1985), NSA certified as secure had to mediate and pentest all software in the system. That includes firmware with SCOMP also having an IOMMU. The typical practice of high-assurance security in the 2000's was using separation kernels or ASIC's to force all input from untrusted subjects to be mediated on every access to a privileged component against a precise, security policy. From Orange Book onto Common Criteria, the fears about malicious management meant they usually put in a dedicated serial port for local, authenticated access to admin functions. Remote admin would need a serial or kvm switch with some security on it depending on what remote meant. If it was long-distance, there would likely be a Type 1 encryptor for link or IP layer. Yeah, they've known it was a vulnerability for some time. Such a thing wasn't even allowed in secure systems with so-called "High Assurance Platform" being an attempt to mitigate risks in insecure boxes they know market will buy anyway. Stuff like SELinux Trusted Solaris, and so on go here. Recently, for SIGINT and/or politics, NSA is doing 90-day evaluations of COTS products to replace secure, Type-1 gear. The Assurance part that I saw had same requirements as EAL1: so low nobody certified to it to avoid being laughed at. I can only assume bringing in lowest grade stuff across whole DOD when medium assurance is already marketed is a BULLRUN-style subversion to boost surveillance. We don't need smart enemies with these kind of "Defense" policies.
wanderingjew 9y ago
As one of the authors referenced in the 'myths' section of the talk (the ME can do anything...), I have to disagree with the actual danger of the ME. It is connected directly to system memory, and from there you can actually do anything. It's like saying "I have a car and can drive 20 miles, but being able to drive 2000 miles is impossible." Saying everything in impossible when you own the system memory is just a failure of imagination.
pasbesoin 9y ago
Regarding keeping secrets, if that's one's perspective and belief. I think the whole thing would be too big to hide. So, you give it a legitimate purpose, and keep its subversion to yourself. In reality, Intel was able to market it legitimately for its features. May well have needed to, in the face of competition. But what may have been discussed in back rooms, with other interests -- ones that can't be ignored, and that also represent a big chunk of business? (Both purchases, and influence on trade, surveillance, and any number of other factors that affect one's business.) Anyway, I think a whole processing subsystem would be too big and obvious to hide. Hiding functionality within it? Quite plausible. And we have precedents, in this regard. (Fiber trunk and other splitting/tapping, e.g. the "ATT room"; the Clipper Chip agenda; weakening of NIST encryption standards; the scope of "inadvertant" domestic data collection;...)

by wilun 9y ago

nickpsecurity 9y ago

Systems going back to the first one, SCOMP (1985), NSA certified as secure had to mediate and pentest all software in the system. That includes firmware with SCOMP also having an IOMMU. The typical practice of high-assurance security in the 2000's was using separation kernels or ASIC's to force all input from untrusted subjects to be mediated on every access to a privileged component against a precise, security policy. From Orange Book onto Common Criteria, the fears about malicious management meant they usually put in a dedicated serial port for local, authenticated access to admin functions. Remote admin would need a serial or kvm switch with some security on it depending on what remote meant. If it was long-distance, there would likely be a Type 1 encryptor for link or IP layer. Yeah, they've known it was a vulnerability for some time. Such a thing wasn't even allowed in secure systems with so-called "High Assurance Platform" being an attempt to mitigate risks in insecure boxes they know market will buy anyway. Stuff like SELinux Trusted Solaris, and so on go here. Recently, for SIGINT and/or politics, NSA is doing 90-day evaluations of COTS products to replace secure, Type-1 gear. The Assurance part that I saw had same requirements as EAL1: so low nobody certified to it to avoid being laughed at. I can only assume bringing in lowest grade stuff across whole DOD when medium assurance is already marketed is a BULLRUN-style subversion to boost surveillance. We don't need smart enemies with these kind of "Defense" policies.

wanderingjew 9y ago

As one of the authors referenced in the 'myths' section of the talk (the ME can do anything...), I have to disagree with the actual danger of the ME. It is connected directly to system memory, and from there you can actually do anything. It's like saying "I have a car and can drive 20 miles, but being able to drive 2000 miles is impossible." Saying everything in impossible when you own the system memory is just a failure of imagination.

pasbesoin 9y ago

Regarding keeping secrets, if that's one's perspective and belief. I think the whole thing would be too big to hide. So, you give it a legitimate purpose, and keep its subversion to yourself. In reality, Intel was able to market it legitimately for its features. May well have needed to, in the face of competition. But what may have been discussed in back rooms, with other interests -- ones that can't be ignored, and that also represent a big chunk of business? (Both purchases, and influence on trade, surveillance, and any number of other factors that affect one's business.) Anyway, I think a whole processing subsystem would be too big and obvious to hide. Hiding functionality within it? Quite plausible. And we have precedents, in this regard. (Fiber trunk and other splitting/tapping, e.g. the "ATT room"; the Clipper Chip agenda; weakening of NIST encryption standards; the scope of "inadvertant" domestic data collection;...)