5 ms·
Yes. There are several ways, depending heavily on the version, and ranging from most trustworthy to least trustworthy: * By patching the ME firmware itself - s
by bri3d 3y ago
Yes. There are several ways, depending heavily on the version, and ranging from most trustworthy to least trustworthy:
* By patching the ME firmware itself - see the me_cleaner project, and methods documented here: https://puri.sm/posts/deep-dive-into-intel-me-disablement/ https://puri.sm/posts/deep-dive-into-intel-me-disablement/ . This is Pretty Reliable; the runtime code has been deleted from flash.
* By setting a bit in the flash configuration, assumed to be added for the US High Assurance program: https://github.com/corna/me_cleaner/wiki/HAP-AltMeDisable-bit https://github.com/corna/me_cleaner/wiki/HAP-AltMeDisable-bi... , https://www.ptsecurity.com/ww-en/analytics/disabling-intel-me-11-via-undocumented-mode/ https://www.ptsecurity.com/ww-en/analytics/disabling-intel-m... . This is Mostly Reliable; the mechanism has been fairly aggressively reverse engineered and was added for a program with strict requirements.
* By sending an HECI command that says "hey ME, turn off your runtime" https://review.coreboot.org/c/coreboot/+/52800 https://review.coreboot.org/c/coreboot/+/52800 . This is Somewhat Reliable; the method is well understood and seems to work but I'm not sure someone has done a deep dive audit into whether it could be re-enabled somehow.
- jimbob45 3y agoDo we have anything equivalent for AMD’s PSP?
- bri3d 3y agoThe equivalent of Option 3, send a supported command that tells the runtime capabilities to shut down, has been provided as a user-selectable option by AMD in AGESA (the unified AMD BIOS/EFI package) for several years now. I haven't found anyone who has actually reversed the functionality to audit what it's doing, though.
- jacquesm 3y agoIn a way this is all insane: we are spending a fortune on security globally but at the same time manufacturers get to insert massive backdoors into the hardware and hardly anybody bats an eye.
- wmf 3y agoWhat if... ME/PSP are actually very low security risk relative to everything else in the system.
- dboat 3y agoIt's troubling to have even a potentially very low security risk in hardware I paid for being beyond my reach to resolve.
- charcircuit 3y ago>manufacturers get to insert massive backdoors into the hardware There is no proof that they are >hardly anybody bats an eye. Because only a certain niche of paranoid people are willing to believe that companies are trying to make their systems intentionally insecure so that you can be personally hacked.
- feanaro 3y agoIt most certainly doesn't have to be intentionally insecure but it almost definitely is accidentally so. There should be no OS nor network stack running in the firmware, period.
- fsflover 3y agoUser-respecting OS running in the firmware can be really useful. It must be FLOSS though. Example: https://puri.sm/posts/pureboots-powerful-recovery-console/ https://puri.sm/posts/pureboots-powerful-recovery-console/.
- anonymousiam 3y agoIt's a fact that NSA solicits companies to add security weaknesses to their products. They'll "make an offer you can't refuse" by offering cash (in the form of a contract), and they'll use their influence with other "contractors" and government agencies to punish companies that don't participate. This is not unique to NSA. Security agencies within other governments play the same games with supply chains.
- jacooper 3y agoThis is probably going to change when AMD switches from AGESA openSIL, fully open firmware.