8 ms·
Usually when I'm reminded about IME (and whatever the equivalent is in AMD chips), it's in the context of some strong claims about it being "game over" for secu
by warner25 4y ago
Usually when I'm reminded about IME (and whatever the equivalent is in AMD chips), it's in the context of some strong claims about it being "game over" for security and privacy against mass surveillance, engineered / funded by nation-state intelligence agencies, and rendering all other technical efforts moot. They make it sound plausible, and I think "why isn't this talked about or investigated more?" The section of the Wikipedia page that discusses the "backdoor" claim is frustratingly thin. I just don't know what to make of it. Hyperbole about a crappy thing, like the bloatware pre-installed on most new laptops and phones by the vendor? An open secret, with discussion about it suppressed?
- pkulak 4y agoIt's just too old for people to be outraged about still.
- anonym29 4y agoBy this logic, should we not be outraged by 19th and 20th century genocide?
- pkulak 4y agoI'm not telling you what emotions to have, just observing the world around me.
- Alupis 4y ago> By this logic, should we not be outraged by 19th and 20th century genocide? Well, no. I don't think you will actually find a real person living today that matches a real definition of "outrage" for genocides in the 19th and 20th centuries. Discarding performative theatrics, you will find people who all agree it was bad... but they won't be literally outraged. The passing of time, and generations, has that affect.
- kragen 4y agoPretty sure Holocaust survivors and their immediate families, not to mention the scarcer immediate family members of Holocaust non-survivors, are still outraged about the Holocaust. I don't think that's performative theatrics.
- Spooky23 4y agoPerformative theatrics is attempting in any way to contrast Intel vPro with the Holocaust.
- kragen 4y agoIntel vPro and similar systems centralize power over communication and record-keeping in a way that has historically been both necessary and sufficient to cause atrocities like the Holocaust, the Great Leap Forward, GULAG, and so on. But, because of newly pervasive computer mediation of day-to-day interactions, these spyware systems potentially provide a degree of centralized social control that Stalin or Mao could never have dreamed of. Recent infringements on human rights in XUAR provide a preview of the resulting future. Essentialist explanations that attribute them to some unique depravity of the Chinese race are utterly implausible; they are due to the lack of effective checks and balances on state power. Consequently we can expect the atrocities resulting from systems like vPro to be far worse than the Holocaust or any other historical events.
- Alupis 4y agoI cannot tell if you are arguing in good faith or if this is some very clever wit. Comparing vPro to Stalin, Mao, the Holocaust and more is really not serving to forward your argument... particularly while you have an iPhone or Android device in your pocket, watch curated TV content on your Smart TV, and drive your modern car into the office where you use your Windows or OSX computer and ISP provided DNS. This would definitely count in the "performative theatrics" category of any normal book. Why is this age so sensationalized? Words are becoming meaningless due to overuse, abuse and re-definition to fit convenient arguments...
- charcircuit 4y agoYes, as someone born in the 21st century all of that is just stuff in some history book that I was forced to learn to pass some test.
- hsbauauvhabzb 4y agoThose two things have disproportionate direct impact and can’t really be compared on the same level. But apples for apples, school educates students about genocide and not about the privacy considerations of backdoor chips.
- anonym29 4y agoI'm in no way conflating the impact of the two, I'm pointing out that the implication of the original comment "It's just too old for people to be outraged about still", is that people shouldn't be outraged at evil things solely because those evil things happened a long time ago. The implication itself is ridiculous. Time does not make evil things less evil. To suggest that I'm contrasting the impact of ME (not the same as vPro) with the holocaust is either blatantly missing my point (that the implication of the original comment is obviously completely false) or a deliberate, bad faith strawman.
- gjsman-1000 4y agoIt doesn't necessarily need to be a backdoor. Look up Remote Attestation, which is getting easier every year. With that, you can run whatever software you want on your device - but other servers do not need to talk to your device if they detect that you are. It's coming up in Android more with SafetyNet. If your device is rooted, you fail SafetyNet. If you fail SafetyNet, almost all banking app servers will refuse to talk to you, rendering their apps useless. SafetyNet could be spoofed historically, but SafetyNet is moving into hardware instead of software since ~2020, so the spoofing has gotten way, way harder and may cross into downright impossible. It's also coming to Windows with the Windows 11 TPM 2.0 requirement. See the video game Valorant, for example. If you are on Windows 11, it will mandate that you have a TPM 2.0 enabled and Secure Boot enabled. It has exceptions for VMs and Windows 10 and earlier right now - but they can literally close that door, at any time, and immediately remotely lock all machines to that requirement. No amount of game patching will bypass it - the multiplayer servers won't talk to you unless your hardware cryptographically reports that you've passed Secure Boot checks.
- denton-scratch 4y ago> It's also coming to Windows with the Windows 11 TPM 2.0 requirement. My Lenovo L430 is apparently incapable of running Win11 for that reason. Win10 will soon be out of support, so I'm preparing to blow away my last-ever Windows system, and become all-Linux. I'm looking forward to it.
- fencepost 4y agoIsn't 'soon' 3 years from now? And it'll definitely impact PCs more than 7-10 years old at that point, but that's kind of a hard number to get worked up about. If it's that big a deal, when the deadline gets closer buy a new-to-you 7 year old machine for a couple hundred dollars.
- denton-scratch 4y agoYou're right; I thought it was coming up in November. I wonder why I thought that? It might be a message that Microsoft presented to me after the forced update I received yesterday morning, while I was trying to use the damned machine.
- NoImmatureAdHom 4y agoThe existence of the High Assurance Platform (HAP) bit makes it pretty clear that 1) three-letter agencies don't trust the IME, and strongly implies that 2) they asked for it to be there in the first place. "High Assurance Platform" https://trademarks.corporationwiki.com/marks/high-assurance-platform/77432827/ https://trademarks.corporationwiki.com/marks/high-assurance-...
- warner25 4y agoYeah, that's the kind of thing I've seen before, lots of circumstantial evidence that makes the claims sound plausible, but then the trail just seems to stop cold.
- NoImmatureAdHom 4y agoI mean, it is the NSA. They're probably pretty good at what they do. I should hope so, tax dollars pay for it.
- boppo1 4y ago>trail just seems to stop cold. There's your evidence.
- djbusby 4y agoNo, that's the absence of evidence.
- NoImmatureAdHom 4y agoOnly when your priors are that absence of evidence (in the sense of the trail going cold) is normal. Your parent comment's point is that this is a conspicuous absence of evidence.
- salawat 4y agoAbscence of evidence isn't evidence of the abscence thereof. That it runs cold lodges it firmly in the "we are pointedly not going to talk about it" space, which for me is where the worry even starts. If my little gray hat wearing mind can come up with plausible ways to exploit something like that... A) I am not that smart And B) Someone in a position to pull something like that off has probably already implemented it.
- TheNewsIsHere 4y agoThis is offered very much in a “take it for what you will but for obvious reasons I am not going to give many more details” spirit. I worked for a major player in cybersecurity back when they were really trying to get everyone onboard with SGX. Our CISO was a technical guy, and worked closely with a peer who had a hybrid academic and professional background in cryptography. They both had strong credentials in mathematics and one was a practicing mathematician at one point. After a thorough review, all of the stakeholders who reviewed it told the executive leadership not to touch it because their opinion was that it couldn’t offer anything meaningful beyond what we already had in place using the Windows API and it’s interface with the TPM, and they had concerns about what they felt were insufficiencies in the SGX design. That experience was a bit more in-depth than I’ve detailed here, but the takeaway for me was that Blue was desperately trying to justify a technology that wasn’t what it was hyped up to be. I’ve often thought IME is the same thing, “different day”. Edit: typo
- arprocter 4y agoThe AMD version is https://en.wikipedia.org/wiki/AMD_Platform_Security_Processor https://en.wikipedia.org/wiki/AMD_Platform_Security_Processo... They seem to update it a lot less frequently than Intel
- npteljes 4y agoI think we frankly don't know how much of a problem it is, yet. Since there's no widely applicable remote exploit for it, as far as the mainstream is concerned, all we're left to do is speculate on the risk. If someone operates a server, it's best practice not to have any extra services running on top of what's needed to run the original service. This is because every extra open port, software or complexity increases the attack surface. Same with Intel ME, people don't understand why it needs to be there, if nobody seems to even use it. Preinstalls are not hyperbole though, there were some nasty stuff over the years. Lenovo, for one, bundled Superfish, which man-in-the-middled all HTTPS browser communication[0]. Similar effort from Dell[1]. I think ME's situation is similar to Stallman's attitude toward proprietary software. Proprietary is not evil by itself, but it's very easy to corrupt it to be so, and then the end user is powerless. And because the end user can't decide when this change happens, they are powerless to begin with. Therefore the thing shouldn't exist in the first place. [0] https://en.wikipedia.org/wiki/Superfish#Lenovo_security_incident https://en.wikipedia.org/wiki/Superfish#Lenovo_security_inci... [1] https://en.wikipedia.org/wiki/Dell#Self-signed_root_certificate https://en.wikipedia.org/wiki/Dell#Self-signed_root_certific...
- VictorPath 4y agoBefore looking at IME, let's review other topics. Printer machine identification codes were secretly inserted into printers some time between the 1980s and 2004. Our communications are being monitored in a host of ways. One last refuge was our CPU, but now that is under foreign control as well. Then there's older US government operations like Minaret, Shamrock, Cointelpro etc. to surveil US domestic political activities, from black civil rights, to Vietnam doves, to a very extensive surveillance of feminist groups. Cointelpro also involved US intelligence disrupting political movements, writing poison pen letters (a database admin and 60s peacenik I knew had one sent to his boss, a lawsuit later revealed the FBI sent it). Nowadays this is PRISM, Xkeyscore etc. interacting with the telco monopolies and FAANG, to spy on Angela Merkel's phone calls (along with BND turned by the CIA), disrupt Airbus contracts in favor of US aerospace etc.
- midislack 4y agoIt’s a backdoor for sure. I think the extensive online campaign which desperately tries to prove its not, proves it is. Who can afford to police EVERY forum, social media platform, and web site only to call people mentally ill for suspecting it is? It’s a pattern which only fits certain players.
- CyberDildonics 4y ago> the extensive online campaign which desperately tries to prove its not, proves it is That's like saying the extensive campaign to prove the earth is a sphere proves it's flat. That isn't how logic works.
- Spooky23 4y agoThat’s what they want you to think. First they make you drink fluoridated dihydrogen monoxide, then when you get a job in enterprise IT, the extra ions in your teeth make you pay extra for vPro.
- anonym29 4y agoNobody has any real material gain from tricking people into believing the earth is a sphere. Conversely, if ME/PSP actually is a hardware backdoor: 1. The proprietor of the backdoor would've expended considerable resources designing, implementing, testing, and distributing it, and thus would have an economic incentive not to see it exposed and discarded so as not to incur development expenses on a successor. 2. The proprietor of the backdoor would have an operational incentive to not have collection disrupted by the backdoor being detected, exposed, and discarded. Your comparison of what looks like a real conspiracy to a known character-assasination conspiracy (flat earth) is consistent with COINTELPRO techniques. I'm not accusing you of being a bad-faith actor, but you're arguing against someone who is opposed to an alleged US intelligence agency backdoor, using rhetoric consistent with known techniques used by US intelligence agencies to disrupt conversations (and discredit participants) who are exposing US secrets.
- CyberDildonics 4y ago
- charcircuit 4y agoIt's not talked about more because it's a crazy conspiracy theory that has no merit. After all these years of scrutiny the worst vulnerability required physical access and disassembly in order to preform a hardware attack. The people who believe this conspiracy theory, like many others, peddle misinformation to prove their point. No matter how much you try and debunk it you can't change their mind.
- pencilguin 4y ago
- warner25 4y agoYeah, see that's the other side of the story that doesn't seem to be told much either, and I'm interested in that too. It does seem like some researcher or journalist should have blown the case open by now if this thing were systematically providing telemetry from everyone's "powered off" (but still plugged in) machines to an intelligence agency. Can you point to an article or paper that thoroughly debunks the claims as crazy conspiracy theories?
- wmf 4y agoThe claims shift around so that they're nondisprovable. Someone could say that ME is a backdoor that has never been activated and will be undetectable until some future day when it is activated.
- michaelt 4y ago> Hyperbole about a crappy thing, like the bloatware pre-installed on most new laptops and phones by the vendor? An open secret, with discussion about it suppressed? Personally, I worry about things like IME based on an entirely hypothetical theory: I think many of the big tech companies are riddled with spies from a variety of nations. My rationale for this is simply that if I was in charge of a spy agency's offensive cybersecurity group, my top priority would be placing agents in Microsoft, Apple, Google, Cloudflare, Juniper, Cisco and so on. They'd have orders be careless in undetectably subtle ways - nobody's imprisoning a guy just because he added log4j to the codebase in 2010. To me this seems well within the capabilities of a spy agency with a multi-billion-dollar budget and tens of thousands of employees. Even with code reviews, I doubt anyone could deliver a project like IME with no security bugs, if five of their peers were compromised by different nations' spy agencies. If you think that's completely believable and what else would spy agencies be doing in the modern age, you'd be very suspicious of IME. But if you think that's an undisprovable conspiracy theory with no solid evidence whatsoever, you might think IME sounds just fine.
- warner25 4y ago> my top priority would be placing agents in Microsoft, Apple, Google, Cloudflare, Juniper, Cisco Interesting thought. Or more likely, I'd guess, spy agencies might recruit existing Big Tech company employees who have access to sensitive and desirable things. That's usually how it happens, reportedly, when American security clearance holders get caught doing bad things: they aren't deep cover agents who spent years working their way into position, they approached or got approached by foreign agents because of their position.
- thakoppno 4y agoI absolutely agree with your view. Maybe people forgot about this incident which happened post-Snowden. https://www.theregister.com/AMP/2016/10/14/congress_yahoo_mail_snooping/ https://www.theregister.com/AMP/2016/10/14/congress_yahoo_ma...
- chasil 4y agoVery much so. They found all of this long ago, and it is inconceivable that they did not use it. Solarwinds is a prime example, but people get careless. What we have seen is the smallest fraction of what is, I think.
- myself248 4y agoBefore Snowden, I think absence of evidence could often be construed as evidence of absence. But I think that ship has well and truly sailed. We now know that, behind closed doors in classified places, every bad thing we imagined might be happening, _was_ happening, and then some, beyond the scale of the wildest imaginations of the most paranoid activists. And then some, and then some. The fact that we don't have proof of _this_ particular bad thing, which is entirely possible and downright trivial and could actually be the entire purpose for which the functionality was designed, should in no way suggest that the capability isn't being used. Ten years ago, I could see that being a reasonable argument. Now it just rings as blindingly naive.