6 ms·

I'm wondering how someone like the USA government manages this? They have massive deployments of Intel x86 like at the Utah Data Center [1]. [1] https://en.wi

I'm wondering how someone like the USA government manages this? They have massive deployments of Intel x86 like at the Utah Data Center [1]. [1] https://en.wikipedia.org/wiki/Utah_Data_Center https://en.wikipedia.org/wiki/Utah_Data_Center

deelowe 3y ago
They partner with Intel to get what they need taken care of. Not something the average person can do.
mhitza 3y ago
They might just ask Intel to put a special flag in, like the one discovered back in 2017. > One of the fields, called "reserve_hap", drew our attention because there was a comment next to it: "High Assurance Platform (HAP) enable". > Googling did not take long. The second search result said that the name belongs to a trusted platform program linked to the U.S. National Security Agency (NSA) https://web.archive.org/web/20170829010653/https://blog.ptsecurity.com/2017/08/disabling-intel-me.html https://web.archive.org/web/20170829010653/https://blog.ptse...
charcircuit 3y ago
They don't need to disable ME, no more than they need to disable some microprocessor in a network card. The government doesn't have to believe baseless conspiracy theories when they design datacenters.
- DaSHacka 3y ago
  Yes, that's clearly why they order computers from manufacturers with ME disabled, because it's not a backdoor...
  - flangola7 3y ago
    What evidence is there of it being a backdoor? Who was ultimately harmed/arrested as a result of it? I've never seen a link to a single case demonstrating that.
    - Krutonium 3y ago
      Personally, I don't care for the ME one way or the other, but I also don't think it's strictly spyware. That being said, Parallel construction is a thing and could be used in every case where the initially got their information from the backdoor in the ME, if such a thing exists.
      - strbean 3y ago
        The Silk Road bust comes to mind - https://www.schneier.com/blog/archives/2014/10/how_did_the_fed.html https://www.schneier.com/blog/archives/2014/10/how_did_the_f...
  - charcircuit 3y ago
    >because it's not a backdoor It lowers the attack surface by running less code. Most government computers don't even have the HAP bit set.
caeril 3y ago
"I'm wondering how the people who ordered Intel to integrate spyware into their processors manages this? Answer: order them to tape out N units without the spyware for only you. A new photomask isn't all that expensive.
elif 3y ago
There was a dell link floating around for a while to an internal store listing for laptops with IME-free CPU's. It was then taken down with the (implied? Explicit? I don't recall) explanation that it was meant for government employees only.
- mjg59 3y ago
  The ME isn't in the CPU, it's in the PCH. I'd be astonished if Intel made special parts that didn't use the ME at all, it's much more likely that they just have the HAP bit set in the FIT and the ME largely shuts down part-way through boot (you still need ME firmware to be present, so the ME clearly still runs some amount of code before disabling itself)

deelowe 3y ago

They partner with Intel to get what they need taken care of. Not something the average person can do.

mhitza 3y ago

They might just ask Intel to put a special flag in, like the one discovered back in 2017. > One of the fields, called "reserve_hap", drew our attention because there was a comment next to it: "High Assurance Platform (HAP) enable". > Googling did not take long. The second search result said that the name belongs to a trusted platform program linked to the U.S. National Security Agency (NSA) https://web.archive.org/web/20170829010653/https://blog.ptsecurity.com/2017/08/disabling-intel-me.html https://web.archive.org/web/20170829010653/https://blog.ptse...

charcircuit 3y ago

They don't need to disable ME, no more than they need to disable some microprocessor in a network card. The government doesn't have to believe baseless conspiracy theories when they design datacenters.

DaSHacka 3y ago
Yes, that's clearly why they order computers from manufacturers with ME disabled, because it's not a backdoor...
- flangola7 3y ago
  What evidence is there of it being a backdoor? Who was ultimately harmed/arrested as a result of it? I've never seen a link to a single case demonstrating that.
  - Krutonium 3y ago
    Personally, I don't care for the ME one way or the other, but I also don't think it's strictly spyware. That being said, Parallel construction is a thing and could be used in every case where the initially got their information from the backdoor in the ME, if such a thing exists.
    - strbean 3y ago
      The Silk Road bust comes to mind - https://www.schneier.com/blog/archives/2014/10/how_did_the_fed.html https://www.schneier.com/blog/archives/2014/10/how_did_the_f...
- charcircuit 3y ago
  >because it's not a backdoor It lowers the attack surface by running less code. Most government computers don't even have the HAP bit set.

caeril 3y ago

"I'm wondering how the people who ordered Intel to integrate spyware into their processors manages this? Answer: order them to tape out N units without the spyware for only you. A new photomask isn't all that expensive.

elif 3y ago

There was a dell link floating around for a while to an internal store listing for laptops with IME-free CPU's. It was then taken down with the (implied? Explicit? I don't recall) explanation that it was meant for government employees only.

mjg59 3y ago
The ME isn't in the CPU, it's in the PCH. I'd be astonished if Intel made special parts that didn't use the ME at all, it's much more likely that they just have the HAP bit set in the FIT and the ME largely shuts down part-way through boot (you still need ME firmware to be present, so the ME clearly still runs some amount of code before disabling itself)