4 ms·

I am late to this game so I assume everyone else’s brain was melted by this in 2017: Every Intel CPU since 2008 includes an autonomous computer called the Inte

by nequo 4y ago

I am late to this game so I assume everyone else’s brain was melted by this in 2017: Every Intel CPU since 2008 includes an autonomous computer called the Intel Management Engine that runs Minix, completely circumvents your own OS, has full access to memory, has network access, and cannot be turned off by the owner of the hardware (you). We also don’t know what it does because it’s extremely difficult to reverse engineer due to obfuscation and because Minix 3 is published under a BSD license so Intel is not obligated to publish the source code.

iroddis 4y ago
Not just Intel. AMD had the Platform Security Processor (PSP) that serves as similar role.
floxy 4y ago
Wow. https://itigic.com/minix-the-hidden-operating-system-in-intel-hardware/ https://itigic.com/minix-the-hidden-operating-system-in-inte...
tengwar2 4y ago
Yes and no. It could potentially use the network. To do so, it would have to acquire an IP address, which in the case of IPv4 would show as ARP messages. More significantly, any attempt to call out could be detected at the router (IPv4 or IPv6). Now I know that most people don't look through firewall logs looking for comms from unexpected internal addresses - but some people do. And since this has been around since 2008 with no reports of such comms that I have been able to find, we can be pretty confident that it is not happening. So why would they network-enable it? I would suggest that this is for the declared purpose - if you need to upgrade the microcode, the normal OS (Windows etc.) has to communicate with the IME, and IP is a good way to do that.
- wcarss 4y ago
  > we can be pretty confident that it is not happening. We don't _really_ know this. It could of course wait for a signal (say, in a certain memory region, depending on the host OS) and be activated only by remote control in collaboration with other vectors, for special use against, say, heads of state, or the rare meaningful dissidents against whoever it is who has access.
  - tengwar2 4y ago
    But the only way that signal would get to it would be with the connivance of a user level application or the normal OS. At that point you have spyware with extra steps - and it's easier to detect because of the unexpected IP address.

by nequo 4y ago

iroddis 4y ago

Not just Intel. AMD had the Platform Security Processor (PSP) that serves as similar role.

floxy 4y ago

Wow. https://itigic.com/minix-the-hidden-operating-system-in-intel-hardware/ https://itigic.com/minix-the-hidden-operating-system-in-inte...

tengwar2 4y ago

Yes and no. It could potentially use the network. To do so, it would have to acquire an IP address, which in the case of IPv4 would show as ARP messages. More significantly, any attempt to call out could be detected at the router (IPv4 or IPv6). Now I know that most people don't look through firewall logs looking for comms from unexpected internal addresses - but some people do. And since this has been around since 2008 with no reports of such comms that I have been able to find, we can be pretty confident that it is not happening. So why would they network-enable it? I would suggest that this is for the declared purpose - if you need to upgrade the microcode, the normal OS (Windows etc.) has to communicate with the IME, and IP is a good way to do that.

wcarss 4y ago
> we can be pretty confident that it is not happening. We don't _really_ know this. It could of course wait for a signal (say, in a certain memory region, depending on the host OS) and be activated only by remote control in collaboration with other vectors, for special use against, say, heads of state, or the rare meaningful dissidents against whoever it is who has access.
- tengwar2 4y ago
  But the only way that signal would get to it would be with the connivance of a user level application or the normal OS. At that point you have spyware with extra steps - and it's easier to detect because of the unexpected IP address.