moppl

7 ms·

1.
by moppl 9y ago
There exists an alternative to antibiotics since it's very beginnings. It is the bacteriophages therapy: https://en.wikipedia.org/wiki/Phage_therapy It is practiced since the 20ies in Tiblisi Georgia. TED talk ab
2.
by moppl 9y ago
Well, it might also allow for the ultimate rootkit hack of x86 platforms...
3.
by moppl 9y ago
This post seems outdated considering these more recent HN posts: Disabling Intel ME 11 via undocumented mode (ptsecurity.com) https://news.ycombinator.com/item?id=15116719 How to hack a turned-off computer, or running unsig
4.
by moppl 10y ago
Releasing the PSP source code would AFAIK not change a thing. While it might be an interesting read, the PSP (i.e. AMD) would still remain in control of the platform. The PSP does NOT rely on code obfuscation. It is a much deeper architectu
5.
by moppl 10y ago
Did you really "neutralize" the IME? I guess you refer to a procedure as described in https://hardenedlinux.github.io/firmware/2016/11/17/neutrali... I would say what you did is to "neutra
6.
by moppl 10y ago
Yes right, we were. But we were able to install our own firmware before there was the IME. And it has also changed in the sense that the IME is a full fledged autonomous universal computer which has it's own RAM, ROM, clock etc. It is
7.
by moppl 10y ago
You are right, also before IME/PSP we trusted the manufacturer to some extent. But the IME/PSP is intentionally and officially implementing an architecture which ensures that the manufacturer has ultimate control on the platform,
8.
by moppl 10y ago
Yes, AMD was asked if they would release the PSP source code. But IMHO that doesn't change anything as discussed here: https://news.ycombinator.com/item?id=13781408
9.
by moppl 10y ago
Yes right, but the gm45 chipset is a core2Duo chipset. And the X220 features Sandy Bridge (2011). While it is possible to mess around with older implementations of the IME it is pretty much impossible with recent versions. It sits now on th
10.
by moppl 10y ago
Well, you are right that it is slightly heavy handed. I also thought that a lot of the higher level stuff in it might still be valid. But at the fundamental level the battle is lost, you will never own your (x86 based) PC as long as there i
11.
by moppl 10y ago
The article is dated. The game changed fundamentally with the introduction of the Intel Management Engine (or the AMD Platform Security Processor) on the x86 platform. The system is now "deep pwned" as described in point 3.1.1 of
12.
by moppl 10y ago
Ruan writes in his book in chapter 4 "The Engine: Safeguarding Itself before Safeguarding Others": "In addition, there is a basic guideline for realizing security: Never rely on security through obscurity. When designing secu
13.
by moppl 10y ago
That reddit post was mine. I just created a new account there, but somehow my comment doesn't show up, no idea why. But fortunately there is HN :) I would not call it an enterprise security solution. It is also very much aimed at the o
14.
by moppl 10y ago
Oh, sorry for the dead link. So I repost it here: "Hello!? Releasing the source code would NOT change the fundamental problem with the PSP! It will still remain a black box under the control of the manufacturer! The problem is not the
15.
by moppl 10y ago
This is a futile discussion. It would not make any difference if AMD released the PSP source code. The problem with the PSP is not it's firmware, it is a much deeper fundamental architectural problem as outlined in (unfortunately dead
16.
by moppl 10y ago
The ME is basically an independent universal computer in its own right, it comes with its own clock, RAM, CPU etc... It is like a Matryoshka doll sitting inside the Intel CPU of your computer. Therefore, yes, it can contain all of that. For
17.
by moppl 10y ago
Just to give an idea of how bad the stuff is with the IME, I recommend reading up Chapter 4 here: Intel x86 considered harmful by Joanna Rutkowska https://blog.invisiblethings.org/papers/2015/x86_harmful.pdf The I
18.
by moppl 10y ago
True Key makes use of the Intel Management Engine (IME). It gives a hint at what Intel is up to with the IME. One of the intended uses is "identity protection", storing secrets like e.g. biometric data in the realm of the IME, and
19.
by moppl 10y ago
And by the way, he also suggests in his blog post that Ghostery and Adblock Plus might as well sell browser histories as WOT does. There might be even more.
20.
by moppl 10y ago
Here is the blog entry of the Journalist Mike Kuketz, explaining in detail how he uncovered the fraud, unfortunately only in German. This includes samples of the questionable GET and POST Requests, as well as a link to a commit to the WOT s