6 ms·
Isn't it good? Does leaked key mean that now owners of hardware will be able to read and modify the firmware, including IME, and check it for backdoors? Such k
by codedokode 3y ago
Isn't it good? Does leaked key mean that now owners of hardware will be able to read and modify the firmware, including IME, and check it for backdoors?
Such keys should be in the hands of users, not Intel.
- hilbert42 3y agoAbsolutely. My first thought was 'ah now I can modify my BIOS the way I want it'.
- QuiDortDine 3y agoIf there was something to leak, it was always going to. Just a matter of when. Pretending otherwise is just security theater.
- guerrilla 3y agoYeah, don't depend on a permanent global conspiracy for your security. Someone always defects and accidents often happen long before that.
- henriquez 3y agoIt is not a conspiracy. Just like the iOS App Store it is for your own protection. There is no legitimate reason to run your own software on general purpose computing hardware.
- ChrisClark 3y ago/s I hope. ;)
- brookst 3y agoDoesn't really matter /a or not, it's a ridiculously reductive and extremist position either way. Security is about tradeoffs, most notably security vs convenience, but also many others. Anyone who suggests that their personal preferences in tradeoffs are not just universally correct but also the only reasonable position to hold is just silly.
- userbinator 3y agoIt's extremist but unfortunately also an opinion that seems to be nonsarcastically becoming more popular.
- chaxor 3y agoI love this comment, thank for such a good laugh. I really hope no one would ever think this non sarcastically.
- vivegi 3y agoYeah, right. Wait until the day when iOS App Store infra keys leak. Oh no! That will never happen. Because it runs on Apple M1 kryptonite chip that even Superman can't touch. /s
- Dalewyn 3y agoThis rings more true than many would want to accept: Most people view and use computers as household appliances; they just use whatever is installed on it and if it breaks they go out and buy a new one. For most people there are, in fact, no legitimate reasons to run "their own" software on "general purpose" (read: household appliance) computing hardware. Almost nobody runs custom software on their washing machine or toaster.
- deleted 3y ago[deleted]
- hammock 3y agoThat’s the same argument that people use to support the second amendment (the people’s right to bear arms)
- sobkas 3y ago> Yeah, don't depend on a permanent global conspiracy for your security. Someone always defects and accidents often happen long before that. But then we still also have things like Crypto AG.
- 19h 3y agoPfft, keys, schmeys. Real security is built on handshakes and backroom deals, not strong encryption.
- brookst 3y agoIs everything that is gong to fail eventually just useless theater? Like new cars Re just transport theater because they will have to be junked eventually? I agree that master private keys are bad security design, and we can and should do better. I'm just not willing to say that all past security value is retroactively nullified. That feels polemic more than realistic.
- htag 3y agoThere's a difference between temporary security and security theater. Real but temporary security -> This 2048 bit key you generated will be commercial grade protection until at least 2030. Sometime after that computers will be strong enough to brute force it. Do not store anything with this key that will still be highly sensitive in 7 years. It's possible the underlying algorithm is cracked, or a leap in quantum computers happen that will make the key obsolete sooner. Security theater -> All software running on this chip must be signed with our master key. Please trust all software we sign with this key, and no malicious party will have access to it. You are not allowed to run arbitrary software on your hardware because it is not signed with our key. In the first case, the security is real. You own the lock, you own the key, and you control the entire security process. In the second case, you neither own the lock, the key, and basically have limited access to your own hardware.
- brookst 3y agoThe trick is seeing different personas rather than just "you". IT admins are thrilled to have limited access to their own hardware, as long as adversaries do too. In corporate IT, the greatest fear is insider attacks, either knowing or because statistically some users will inevitably make mistakes. Secure boot is fantastic in this context, even if it feels like an unreasonably impingement to gamers / tech enthusiasts.
- conradev 3y agoYeah, it is puzzling that the key was able to be leaked in the first place. The key should have been in an HSM.
- er4hn 3y agoSame thing with Samsung and their key leak. Part of the blame, imo, lies with how clunky tools are at the lower levels. I've seen plenty of hardware based signing protocols that don't allow for key hierarchies. Higher level tools push this along as well. Hashicorp Vault also, last I checked, doesn't allow for being a front end to an HSM. You can store the master unlock key for a Vault in an HSM, but all of the keys Vault works with will still be in Vault, in memory.
- foobiekr 3y agoHSMs are not secure to sustained competent hardware attacks. This should have been on an HSM in multiple secure a signing service facilities with authenticated access and never handed to an OEM of any kind in any form.
- tapoxi 3y agoRealistically it means a lot more people are going to cheat in Valorant.
- biosboiii 3y agoI've read a lot of anti cheat RE in the past, seems like the cheater/modder people have found their way to the infosec community, can you elaborate on how this would accelerate Valorant cheating. Is their watchguard thing using some Intel feature?
- r1ch 3y agoTheir anti cheat is a kernel level driver and requires secure boot to make sure it loads before anything could potentially tamper with the system.
- jsheard 3y agoDoesn't it only require secure boot on Windows 11? For now you can get around that requirement by simply staying on Windows 10, until they retire support for that.
- r1ch 3y agoYes, the mandatory TPM and secure boot only applies to Windows 11. I'm sure they're eager to drop Windows 10 support as soon as they're able to.
- CircleSpokes 3y agoYou are correct. Secure boot is not required to play valorant on windows 10.
- shrimp_emoji 3y agoOh no! Here, please, backdoor my OS with a kernel anticheat -- anything that saves me from cheaters in the current bideo game of the month! D:
- hnthrowaway0315 3y agoIs there any tutorial that I can learn to do it? Should I Google "dump Intel firmware" or some other more specific ones? I'm going to do some research after going through my training this afternoon.
- mjg59 3y agoNothing's prevented you from reading the firmware - this is a signing key, not an encryption key. Multiple people have spent time reverse engineering the ME firmware, people have found bugs but no evidence of a backdoor.