3 ms·
Depends on your level of paranoia and the age of the CPU. The ME has had many security vulnerabilities and probably more to come. For an appliance some old CPU
by usr1106 5y ago
Depends on your level of paranoia and the age of the CPU.
The ME has had many security vulnerabilities and probably more to come. For an appliance some old CPU might be good enough, but it does not get security updates. Some claim the ME might contain a NSA backdoor. That the ME can do networking certainly doesn't give confidence. The US government can order CPUs without ME, but nobody else can. Does not raise confidence either.
- eru 5y agoWhat's ME? The article doesn't seem to mention this.
- adrianN 5y agohttps://en.wikipedia.org/wiki/Intel_Management_Engine https://en.wikipedia.org/wiki/Intel_Management_Engine, AMD has something similar.
- SilverRed 5y agoEvery intel cpu past 2008 contains a coprocessor which runs at a higher permissions level than the normal CPU and therefor the OS. Its primary function is DRM for video and theorized backdoor access for governments.
- Google234 5y agoIt should be noted that AMD has an equivalent management engineZ
- usr1106 5y agoBut ARM hasn't. Or have they added something to their server range of designs?
- mjg59 5y agoThe short version is "It's complicated". Most ARM cores have a feature called TrustZone. Effectively, there's a set of system resources that are allocated to TrustZone and not accessible from the normal world. Various events can trigger the CPU to transition into executing code in this "Secure world", at which point the core stops running stuff from the normal world and instead starts running an entirely separate set of things. This can be used to do things like "hardware" key generation, DRM management, device state attestation and so on. Whether a specific platform makes use of TrustZone is largely up to the platform designers, but there's plenty of room to hide backdoors there if you were so inclined.
- usr1106 5y agoHmm, I have never seen Trustzone as comparable to ME. Trustzone is a secure execution environment, mostly isolated from normal CPU operation. Wasn't it so that it cannot even access main memory??? ME is really more privileged than the CPU? I have not heard about Trustzone doing networking. But ME can supposedly do even WLAN while the CPU is not running. Disclaimer: I am not a hands-on expert at that level, more like an armchair pilot...
- als0 5y agoTrustZone is a CPU mode, hence it is not fully isolated from normal CPU operation. The CPU chooses to enter it and the current CPU state gets saved/restored. It contains the highest exception level, so it is able to access all memory. It does not usually have networking because that would invite complexity, but there is nothing to stop a vendor from putting a full network stack in there and assigning a network peripheral. Typically, it would rely on the main OS to send and receive packets.
- ex_amazon_sde 5y agoPlease don't call it "paranoia": a whole lot of vulnerabilities have been found in CPUs together with plenty of undocumented functions that look just like backdoors. On top of that, it is well known that governments research or buy 0-day hardware and software vulnerabilities and keep them secret to be used as weapons. ME is just a fraction of the attack surface. When I read the title of the article I thought "trustworthy" was about mitigating hardware vulnerabilities. At this stage it's practically impossible. :(