6 ms·
> on the good side of things, getting an Intel CPU to enter the red state is not easy to accomplish. In fact, it should never happen unless there are vulnerabil
by TacticalCoder 5y ago
> on the good side of things, getting an Intel CPU to enter the red state is not easy to accomplish. In fact, it should never happen unless there are vulnerabilities in the Intel Management Engine (ME), an almost undocumented subsystem present in all Intel CPUs since 2008 that Intel says is required to provide full performance.
"unless there are vulnerabilities or backdoors in the Intel Management Engine (ME)".
There, fixed it for you.
- unnouinceput 5y agoThe IME itself is a backdoor in the first place. I remember a story a few years past when a full line of CPU's went out with IME having no password set at all, allowing a field day for hackers even when your computer was shut down but still receiving power on standby. Intel had to recall all of them but only after the news blew in media in the first place. Otherwise I'd suspect Intel would've just let it stay, cause money talks.
- google234123 5y agoLink?
- passivate 5y agoI'm in the minority, but I think IME is a great feature to have from a business/IT perspective. As a business, you own the computer, not the the user. And IME lets you provision/control it in at a lower level that most tools won't.
- opan 5y agoThe proprietary nature is the issue. IBM Power 9 stuff has something similar, but much less shady.
- kaba0 5y agoHow is the rest of the CPU not proprietary?
- sudosysgen 5y agoWhy not then let the purchasing user disable the IME, wether its an average person or a business?
- passivate 5y agoI don't know how its implemented, but I'm assume they don't want the user defeating the feature if they're not the owner. The only choice seems to be to use AMD, which probably works quite well given the smackdown that AMD is putting down in recent times..
- jhoechtl 5y agoDARAP, CIA, FBI, NSA -- they are all against that. A computer is a to dangerous tool to leave it to the public without state control.
- girvo 5y agoWhich is fine, except I'm not a business and I _do_ own my computer, but I can't avoid IME.
- derefr 5y ago> allowing a field day for hackers even when your computer was shut down but still receiving power on standby. AFAIK vPro doesn't let anything talk to its management interface over the network until you actually do the local setup. I found this out to my irritation, when I once acquired a used workstation with vPro, freshly wiped, and — thinking I could just set it up by plugging its management-network NIC into my switch and talking to it over the LAN — I found out to my dismay that it wouldn't even bother to acquire an IP address for the management interface until I enabled vPro in the BIOS and then told it to use DHCP. (Am I wrong about this? Perhaps, do OEMs ship batches of machines with vPro pre-configured in certain ways, for clients that explicitly specify that they're going to use vPro for remote provisioning? Or does every workstation order have an implicit "unload from the pallet, plug into a KVM, enable vPro, then install at location" step?)
- gerdesj 5y agoYour parent gave an anecdote: "I remember a story a few years past when a full line of CPU's went out with IME having no password set at all" They describe a pretty serious snag. My experience of iDRAC/iLO/vPRO etc etc etc is that they have all had some pretty major problems. Keep your monitoring/management interfaces on their own network/VLAN is my advice. While you are at it, get the logging and firewall rules sorted.
- Zancarius 5y agoI think the parent you're referring to was echoing a story that popped up as something of a conspiracy on the vestiges of the Internet, hinted at by the claim that the machines could be accessed when powered off. I don't think that's true, and you'd have to have access to the network they're connected to. Though, I suppose you could power such systems up (maybe?) and then gain access to them if you did have access via, say, a corporate network. The closest analog to the claims that I could find in short order did mention a known AMT exploit[1] in 2017. [1] https://www.theregister.com/2017/05/05/intel_amt_remote_exploit https://www.theregister.com/2017/05/05/intel_amt_remote_expl...
- 5y ago
- GuB-42 5y agoI regularly hear story about IME that all seem disproportionate. From what I've seen, AMD has an equivalent, and mobile SoC are worse. Also, it looks like you really have to go out of your way to enable IME remote control, which makes sense because it is a premium feature aimed at professionals. And even if you actually have a backdoor on your PC, for hackers to exploit it, they somehow need to get to your local network first, which is not that easy on a home network unless your computer is the one to initiate the connection. I also probably won't work on anything but the built-in Ethernet port. I don't know what "field day" hackers had, but I suspect it only helped them compromise corporate networks they could access where IME remote control (vPro?) was actively used. It is indeed a serious concern and warrants a recall, but I've yet to see how it can be a concern to most individuals, at least compared to OS-level attacks. And if it is, firewalls, including the simple ones in home routers should be effective.
- aritmo 5y agoThe 3-letter agencies have probably playing with this for a long time.
- junon 5y agoThis is speculation, and doesn't add anything to the conversation. Is there a precedent that TLA's conspire with CPU manufacturers to create backdoors like this? Or are you just a conspiracy theorist?
- fsflover 5y agoAfter the Snowden revelations, those agencies have no benefit of the doubt anymore.
- junon 5y agoYou're moving the goalposts, and is thus still speculation.
- rasz 5y agoChris Domas works at Battelle Memorial Institute. Battelle is a "non profit R&D house" that just so happens to hire "retiring" CIA operatives, and work on tons of CIA/NSA contracts. Completely coincidentally Chris Domas managed to discover the only Intel CPU backdoor ever discovered and publicized the very same year Intel already patched it https://www.youtube.com/watch?v=lR0nh-TdpVg https://www.youtube.com/watch?v=lR0nh-TdpVg
- C19is20 5y agoLet the guy speculate? There diversity of opinions is why I enjoy hn. I would argue that your comment added even less (subtracted from), much as mine has now.
- OldGoodNewBad 5y agoWhen you get mystery people screeching at you for speculating, you’re getting a confirmation that there’s something to speculate about. The US government has 60,000 full time shills telling you to take your meds and stop speculating. And studies have shown that they target their chidings.
- naikrovek 5y agoa backdoor is a vulnerability. no need to call it out separately, I don't think. I don't shop for groceries and canned corn, I shop for groceries. I don't listen to music and <insert artist>, I listen to music. in fact, the way you separate them seems to indicate that you believe that backdoors are not vulnerabilities, and they absolutely are vulnerabilities. vulnerabilities are things that make you vulnerable. undocumented backdoors definitely make you vulnerable.
- tinus_hn 5y agoIs that supposed to be a serious limitation?