5 ms·
So you mean, if I am a state actor able to kidnap the child of an Intel high level employee... say I m Joe Biden, I can ask Intel to... remote unlock my CPU and
by xwolfi 6y ago
So you mean, if I am a state actor able to kidnap the child of an Intel high level employee... say I m Joe Biden, I can ask Intel to... remote unlock my CPU and read arbitrary memory block ?
Or you mean Intel had to physically handle your CPU with a debug cable or whatever ?
Cause I really dont feel it s okay that the only safety we have from a newly discovered exploit is that there needs to be another newly discovered exploit :D
- tedunangst 6y agoDon't use CPUs from companies that have employees that can be kidnapped.
- thayne 6y agoDon't use CPUs from companies that have employees.
- fctorial 6y agoDon't use CPUs from companies.
- sodality2 6y agoDon't use anything
- mightyoj 6y agoDon’t
- sgtnoodle 6y agoDon't be so paranoid. Just build your own CPU from discrete NAND gates like everyone else.
- tartoran 6y agoA pen and paper is everything you need.
- colejohnson66 6y agoBut what if it’s some of that fancy paper or a pen that records everything you write! Might need to manufacture your own pen and paper now...
- smlss_sftwr 6y agoHold up there you don't know if someone's been tampering with the trees, you'll have to grow your own forest first
- justinclift 6y agoDoesn't seem like that would leave many possibilities... ;)
- fulafel 6y agoI guess out of business CPU companies are one easily accessible category.
- justinclift 6y agoWhile true, it's pretty likely their IP was sold to still-in-business companies. ;)
- mjg59 6y agoRemotely? I think Intel would need to produce a backdoored ME firmware, get the system vendor to incorporate that into a system update and then convince the target to flash that. In that sense I don't know that they'd technically need physical access, but it doesn't really meet most people's description of a remote attack.
- scaramanga 6y agoIt is public knowledge that US intelligence agencies actually just hijack computers and equipment on their way to the customer and install hardware backdoors there (Snowden et al., 2014). It is also known that they have had backdoors in commercial systems as they came off the shelf, but I think usually those were CIA owned and controlled companies like the crypto AG phones. What is unknown (pure speculation) is whether, for example, Intel CPUs come backdoored straight from the factory floor? On the one hand, that would be a powerful capability to have, but on the other hand, the risk of exposure and subsequent damage to the US economy, prestige, etc. would be non-zero. So it's hard (for a plebian like me, anyway) to estimate how those costs/benefits might be weighed up by the US government.
- boomboomsubban 6y ago>What is unknown (pure speculation) is whether, for example, Intel CPUs come backdoored straight from the factory floor? There is also a third possibility, that some intelligence agency invested a ton of cash into finding abusable exploits in these systems giving them the same access a backdoor would provide. Also from the Snowden leaks, we know that they have programs with budgets in the millions into finding similar exploits and that there were similar programs outside Snowden's clearance. And though a bug may cause the same damage to the economy, it wouldn't hurt US prestige in the same way.
- jeffbee 6y agoBudgets in the millions, eh? So two full-time engineers?
- boomboomsubban 6y agoSorry, I misremembered the details. Around $400 million a year for the one program we have details on.
- rblatz 6y agoIf I'm the CIA I have dozens of highly placed agents or at least informants at Intel. Not necessarily placing backdoors, but finding and not fixing exploits and sending them back to the CIA for later use. It would be extremely cheap, hell if I'm China, Russia, the UK, or Israel I'm doing the same thing.