5 ms·

They also bundle a separate CPU inside the real CPU, and gave it full access over the system. https://en.wikipedia.org/wiki/Intel_Management_Engine https://en.

They also bundle a separate CPU inside the real CPU, and gave it full access over the system. https://en.wikipedia.org/wiki/Intel_Management_Engine https://en.wikipedia.org/wiki/Intel_Management_Engine https://en.wikipedia.org/wiki/AMD_Platform_Security_Processor https://en.wikipedia.org/wiki/AMD_Platform_Security_Processo...

metadat 4y ago
Do ARM processors have a similar mechanism? Edit: Yes, it's called TrustZone. https://en.wikipedia.org/wiki/ARM_architecture_family#Security_extensions https://en.wikipedia.org/wiki/ARM_architecture_family#Securi...
- dmitrygr 4y ago
  not the same at all. Trustzone is a special mode of the very same main CPU (more like intel's SMM), whereas PSP and ME are a separate core
  - elromulous 4y ago
    More specifically, trustzone is the arm equivalent of Intel's (mostly deprecated) sgx. https://en.m.wikipedia.org/wiki/Software_Guard_Extensions https://en.m.wikipedia.org/wiki/Software_Guard_Extensions
- qbasic_forever 4y ago
  ARM doesn't have a concept of anything like the management engine, but remember it's just an ISA and actual SoC implementations like from Qualcomm, Samsung, Apple, Amazon, etc. are free to add their own logic and side controllers.
  - ace2358 4y ago
    Which I feel like Apple does do? When I turn my iPhone off, it says it’ll still be able to be found using find my phone…
    - concinds 4y ago
      That's different. It's a feature where Apple deliberately keeps some components running after shutdown, in a very low-power way, and provides an option to turn that off. Those components (the Bluetooth chip, for example) are all strictly separated from each other by IOMMUs. Intel Management Engine is very different. It's basically another CPU within your real CPU, running its own software with no visibility to the main OS, and it has (AFAIK) full access to other components. If it's compromised, or has a factory backdoor, you're 0wned. The closest thing to Intel IME that the iPhone has, is the baseband, which can run its own code. But if I'm reading marcan correctly (https://news.ycombinator.com/item?id=30393283 https://news.ycombinator.com/item?id=30393283), modern iPhones/Android phones all use IOMMUs to isolate that (with the exception of a few so-called "free/libre" phones). The IOMMUs can be easily inspected from the OS to make sure they're correct, so it's just not a concern, unlike IME.
      - ace2358 4y ago
        Thank you for this break down. I appreciate the distinction.
      - fmajid 4y ago
        The baseband doesn't have control over the application (main) processor the way IME does, however, and Apple is rightfully distrustful of Qualcomm's security and the two are fairly stringently separated. What a baseband (or WiFi controller) rootkit can do, however, is intercept all your network traffic, and inject exploits for software bugs in the main OS.
- concinds 4y ago
  Note that Apple M-chips don't have TrustZone or anything equivalent.
  - squarefoot 4y ago
    Are those CPUs documented enough so that we can be 100% sure of that?
  - amelius 4y ago
    How do we know that the foundry didn't insert anything Apple doesn't know about?
    - tempay 4y ago
      I would expect apples quality control processes to pick this up. They’re so closely involved in the chip design process that it’s hard to imagine Apple’s engineers are debugging wouldn’t notice something was amass. Not to mention the technical challenge of quickly understanding and editing Apple’s designs from the limited information that is shared with the foundry.
      - amelius 4y ago
        The device could be dormant until it gets a signal, meaning Apple won't find it unless they cut up the die. And they could attach it to anything that looks like a bus, then figure out how to exploit it later.
naikrovek 4y ago
I love how people forget what this is for. that's "love" in sarcasm quotes, if it isn't clear. this is for me when I want to enable virtualization on a user's laptop remotely, without sending a human to their desk or to their house to enter the bios password and to enable virtualization or do whatever else I need done in there. this is how I ship a laptop from the manufacturer directly to an end user, at their home, and they unbox it, turn it on, log in, and the computer becomes a corporate-managed device. I don't have to fly someone out so they can set up the computer, or ship the computer to the office for configuration before it gets shipped again to the end user. this is not a nefarious thing, nor is it a target for hackers, because there are far easier ways to trick someone into doing something which lets the hacker onto their system.
- nequo 4y ago
  Why is there no easy way to disable it if I don’t need someone to tweak my non-corporate-managed laptop remotely?
- speed_spread 4y ago
  > nor is it a target for hackers I think hackers will decide on this, not you. And at least acknowledge that IME/PSP seriously expands the attack surface of the hardware at a very low level, enabling new classes of exploits against which the OS has no defense.
- LukeShu 4y ago
  Neat, I'm glad you have the option of purchasing hardware with this feature. But please let me buy hardware without it.
  - naikrovek 4y ago
    well if you aren't in an enterprise it is unused and inactive if you don't want to spend $0.10 on the feature in the chip, spend 100 billion times more than that to start a CPU fabrication company and license x86_64 so you can make your own CPU. we can't have everything a la carte. it doesn't make sense.
matheusmoreira 4y ago
This is just the tip of the iceberg. Turns out our operating systems are actually just sandboxed applications in the hardware manufacturer's proprietary hellscape. Not only are they not real operating systems anymore, they are no longer even in real control of pretty much anything. https://youtu.be/36myc8wQhLo https://youtu.be/36myc8wQhLo

metadat 4y ago

Do ARM processors have a similar mechanism? Edit: Yes, it's called TrustZone. https://en.wikipedia.org/wiki/ARM_architecture_family#Security_extensions https://en.wikipedia.org/wiki/ARM_architecture_family#Securi...

dmitrygr 4y ago
not the same at all. Trustzone is a special mode of the very same main CPU (more like intel's SMM), whereas PSP and ME are a separate core
- elromulous 4y ago
  More specifically, trustzone is the arm equivalent of Intel's (mostly deprecated) sgx. https://en.m.wikipedia.org/wiki/Software_Guard_Extensions https://en.m.wikipedia.org/wiki/Software_Guard_Extensions
qbasic_forever 4y ago
ARM doesn't have a concept of anything like the management engine, but remember it's just an ISA and actual SoC implementations like from Qualcomm, Samsung, Apple, Amazon, etc. are free to add their own logic and side controllers.
- ace2358 4y ago
  Which I feel like Apple does do? When I turn my iPhone off, it says it’ll still be able to be found using find my phone…
  - concinds 4y ago
    That's different. It's a feature where Apple deliberately keeps some components running after shutdown, in a very low-power way, and provides an option to turn that off. Those components (the Bluetooth chip, for example) are all strictly separated from each other by IOMMUs. Intel Management Engine is very different. It's basically another CPU within your real CPU, running its own software with no visibility to the main OS, and it has (AFAIK) full access to other components. If it's compromised, or has a factory backdoor, you're 0wned. The closest thing to Intel IME that the iPhone has, is the baseband, which can run its own code. But if I'm reading marcan correctly (https://news.ycombinator.com/item?id=30393283 https://news.ycombinator.com/item?id=30393283), modern iPhones/Android phones all use IOMMUs to isolate that (with the exception of a few so-called "free/libre" phones). The IOMMUs can be easily inspected from the OS to make sure they're correct, so it's just not a concern, unlike IME.
    - ace2358 4y ago
      Thank you for this break down. I appreciate the distinction.
    - fmajid 4y ago
      The baseband doesn't have control over the application (main) processor the way IME does, however, and Apple is rightfully distrustful of Qualcomm's security and the two are fairly stringently separated. What a baseband (or WiFi controller) rootkit can do, however, is intercept all your network traffic, and inject exploits for software bugs in the main OS.
concinds 4y ago
Note that Apple M-chips don't have TrustZone or anything equivalent.
- squarefoot 4y ago
  Are those CPUs documented enough so that we can be 100% sure of that?
- amelius 4y ago
  How do we know that the foundry didn't insert anything Apple doesn't know about?
  - tempay 4y ago
    I would expect apples quality control processes to pick this up. They’re so closely involved in the chip design process that it’s hard to imagine Apple’s engineers are debugging wouldn’t notice something was amass. Not to mention the technical challenge of quickly understanding and editing Apple’s designs from the limited information that is shared with the foundry.
    - amelius 4y ago
      The device could be dormant until it gets a signal, meaning Apple won't find it unless they cut up the die. And they could attach it to anything that looks like a bus, then figure out how to exploit it later.

naikrovek 4y ago

I love how people forget what this is for. that's "love" in sarcasm quotes, if it isn't clear. this is for me when I want to enable virtualization on a user's laptop remotely, without sending a human to their desk or to their house to enter the bios password and to enable virtualization or do whatever else I need done in there. this is how I ship a laptop from the manufacturer directly to an end user, at their home, and they unbox it, turn it on, log in, and the computer becomes a corporate-managed device. I don't have to fly someone out so they can set up the computer, or ship the computer to the office for configuration before it gets shipped again to the end user. this is not a nefarious thing, nor is it a target for hackers, because there are far easier ways to trick someone into doing something which lets the hacker onto their system.

nequo 4y ago
Why is there no easy way to disable it if I don’t need someone to tweak my non-corporate-managed laptop remotely?
speed_spread 4y ago
> nor is it a target for hackers I think hackers will decide on this, not you. And at least acknowledge that IME/PSP seriously expands the attack surface of the hardware at a very low level, enabling new classes of exploits against which the OS has no defense.
LukeShu 4y ago
Neat, I'm glad you have the option of purchasing hardware with this feature. But please let me buy hardware without it.
- naikrovek 4y ago
  well if you aren't in an enterprise it is unused and inactive if you don't want to spend $0.10 on the feature in the chip, spend 100 billion times more than that to start a CPU fabrication company and license x86_64 so you can make your own CPU. we can't have everything a la carte. it doesn't make sense.

matheusmoreira 4y ago

This is just the tip of the iceberg. Turns out our operating systems are actually just sandboxed applications in the hardware manufacturer's proprietary hellscape. Not only are they not real operating systems anymore, they are no longer even in real control of pretty much anything. https://youtu.be/36myc8wQhLo https://youtu.be/36myc8wQhLo