4 ms·
Agree. Remember BadBIOS? * https://en.wikipedia.org/wiki/BadBIOS https://en.wikipedia.org/wiki/BadBIOS Same problem. EVERYTHING that Dragos Ruiu claimed is p
by segfaultbuserr 7y ago
Agree.
Remember BadBIOS?
* https://en.wikipedia.org/wiki/BadBIOS https://en.wikipedia.org/wiki/BadBIOS
Same problem. EVERYTHING that Dragos Ruiu claimed is plausible, and it could be a great cyberpunk plot written by Neal Stephenson. But there is ZERO evidence that the malware actually exists.
And finding an actual incident in real life is much more important than theoretical possibilities. For example, almost everyone knows that it's very possible for semiconductor vendors to include a silicon-level backdoor since the 1980s, but finding an actual Intel/AMD chip with such backdoor (not ME, something like a secret instructions) is another matter.
- deleted 7y ago[deleted]
- Sephr 7y agoME has a debug mode that might be possible to enable with a signal sent through the 3.5mm jack on some laptops[1]. I'd be pretty concerned about ME bugs and backdoors disguised as ME bugs. 1. https://youtu.be/xUJQps2-VWk?t=301 https://youtu.be/xUJQps2-VWk?t=301
- segfaultbuserr 7y agoI meant, finding a backdoor in its full form on the main system would be a much more significant find, and its impact and newsworthiness is greater than any hypothetical or baseless speculations, such as Bloomberg's BMC affair. The impact of the BMC affair, if true, is showing real evidence and real demonstration that such an attack has happened, has been used in the wild, rather than showing that the attack is possible (we all know). Unfortunately, bad journalism at work. P.S: I'm not saying that the ME subsystem, or buggy speculation (pun not intended) isn't a threat, just to make a point. > I'd be pretty concerned about ME bugs and backdoors disguised as ME bugs. Same consequences. I'd say they're effectively the same thing.
- ryacko 7y agoZuckerberg’s famous MacBook with tape over web cam and microphone jack has a lot more context now. I guess this says everything about corporations caring about security.
- monocasa 7y agoThere's a difference between one guy chasing ghosts, and several sources anonymously saying "we found this and had to mitigate it".
- segfaultbuserr 7y agoWell, a year later, we still haven't seen the backdoor chip in question being taken to a lab or DEFCON yet... Even the photograph was fake, just a stock photo... I was excited to read the news story, and it was a huge disappointment.
- monocasa 7y agoWe also haven't seen the devices in the NSA's TAO catalog taken to a lab or showing up at DEFCON. That's half the point of targeted hardware attacks. And yeah, it was a graphic that wasn't entirely accurate; welcome to print journalism.