7 ms·

Intel leak: 20GB of source code, chipset design and Intel Management Engine (ME)

78 points by nuker 6y ago

judge2020 6y ago
(August 6, 2020) At the time: https://news.ycombinator.com/item?id=24074588 https://news.ycombinator.com/item?id=24074588
- nxc18 6y ago
  The linked thread discussing weak passwords is particularly delightful in the context of solarwinds123
- nuker 6y ago
  This links to full article though, not just a tweet. Now its killed as dupe...
  - judge2020 6y ago
    Not sure why it was marked as a dupe, but IMO the poster should have included (2020) in the title to make it clear that this isn't breaking news from today. This article does provide value in explaining what's in the dump (plus the old tweet is no longer available) so maybe @dang will re-up[0] it later on. 0: https://github.com/minimaxir/hacker-news-undocumented#second-chance-pool https://github.com/minimaxir/hacker-news-undocumented#second...
runlevel1 6y ago
For those wondering: This is the leak from last August, not a new one.
- piracy1 6y ago
  So that leads me to wonder, were the Intel ME conspiracy govware theories true?
- SulfurHexaFluri 6y ago
  Did anyone find anything interesting in it?
anonymousiam 6y ago
Maybe now we can have an audit of the ME code to see if any 0-day back doors still exist.
- r00fus 6y ago
  Considering ME firmware isn’t generally patched - wouldn’t that be the most lucrative exploit possible?
  - burnte 6y ago
    It actually does get patched through firmware updates.
    - gruez 6y ago
      Does your aunt know how to apply bios updates? And that's assuming such updates are available at all. I searched up various Z170 (released mid 2015) chipset motherboards, and the bios updates seem to end around early-mid 2018. That works out to around 3 years of patches. It's therefore reasonable to assume that if any exploit was discovered today, any systems 3+ year old are sitting ducks.
      - ziml77 6y ago
        She doesn't need to know. They'll come through Windows update and automatically be applied.
        SulfurHexaFluri 6y ago
        Even on linux its trivial. Just pressing update in the gnome software program will update the firmware.
        gruez 6y ago
        Are we talking about the same thing here? Microcode updates might be delivered through windows update but is ME updates delivered through that? Or is it through bios updates?
lovecg 6y ago
I’m curious about the legal state of any academic research that would be done on top of these leaks. If I recall correctly some of the details of the exact workings of atomic instructions and cache coherence protocol are not publicly documented and had to be discovered empirically. Would be fun to confirm some of these findings and settle some old arguments through direct inspection of the design.
deleted 6y ago
[deleted]

78 points by nuker 6y ago

judge2020 6y ago

(August 6, 2020) At the time: https://news.ycombinator.com/item?id=24074588 https://news.ycombinator.com/item?id=24074588

nxc18 6y ago
The linked thread discussing weak passwords is particularly delightful in the context of solarwinds123
nuker 6y ago
This links to full article though, not just a tweet. Now its killed as dupe...
- judge2020 6y ago
  Not sure why it was marked as a dupe, but IMO the poster should have included (2020) in the title to make it clear that this isn't breaking news from today. This article does provide value in explaining what's in the dump (plus the old tweet is no longer available) so maybe @dang will re-up[0] it later on. 0: https://github.com/minimaxir/hacker-news-undocumented#second-chance-pool https://github.com/minimaxir/hacker-news-undocumented#second...

runlevel1 6y ago

For those wondering: This is the leak from last August, not a new one.

piracy1 6y ago
So that leads me to wonder, were the Intel ME conspiracy govware theories true?
SulfurHexaFluri 6y ago
Did anyone find anything interesting in it?

anonymousiam 6y ago

Maybe now we can have an audit of the ME code to see if any 0-day back doors still exist.

r00fus 6y ago
Considering ME firmware isn’t generally patched - wouldn’t that be the most lucrative exploit possible?
- burnte 6y ago
  It actually does get patched through firmware updates.
  - gruez 6y ago
    Does your aunt know how to apply bios updates? And that's assuming such updates are available at all. I searched up various Z170 (released mid 2015) chipset motherboards, and the bios updates seem to end around early-mid 2018. That works out to around 3 years of patches. It's therefore reasonable to assume that if any exploit was discovered today, any systems 3+ year old are sitting ducks.
    - ziml77 6y ago
      She doesn't need to know. They'll come through Windows update and automatically be applied.
      - SulfurHexaFluri 6y ago
        Even on linux its trivial. Just pressing update in the gnome software program will update the firmware.
      - gruez 6y ago
        Are we talking about the same thing here? Microcode updates might be delivered through windows update but is ME updates delivered through that? Or is it through bios updates?

lovecg 6y ago

I’m curious about the legal state of any academic research that would be done on top of these leaks. If I recall correctly some of the details of the exact workings of atomic instructions and cache coherence protocol are not publicly documented and had to be discovered empirically. Would be fun to confirm some of these findings and settle some old arguments through direct inspection of the design.

deleted 6y ago

[deleted]