Intel: We've Found Severe Bugs in Secretive Management Engine, Affecting Millions (zdnet.com)

Wow by Anonymous Coward · 2017-11-21 03:27 · Score: 0

Ain't that about a bitch? No big shock here

Re: Wow by Anonymous Coward · 2017-11-21 03:57 · Score: 1

Yeah... they didn't learn from Microsoft's experience and had to put ME in their chips.
I hope they don't fix it by upgrading to Vista

Further proof by WoodstockJeff · 2017-11-21 03:28 · Score: 5, Insightful

of how well "security by obscurity" works.

Re:Further proof by Anonymous Coward · 2017-11-21 03:39 · Score: 0

Further proof of how well "security by obscurity" works.
Indeed, it's all working fantastically. So many years of good proper easy spying...
As always, they'll fix backdoors once publicly known, while introducing new ones, elsewhere if needed...
Change won't come magically one day.
Re:Further proof by zifn4b · 2017-11-21 03:43 · Score: 5, Insightful

It works just fine until some fucking idiot blabs
It's your thinking that is "fucking idiocy". It doesn't require someone to "blab", it requires a savvy hacker to discover it and that's precisely why you shouldn't do it because it's not good security practice.

--
We'll make great pets
Re:Further proof by DontBeAMoran · 2017-11-21 03:45 · Score: 4, Funny

My house lacking a fucking door worked fine until some jackass thief noticed the lack of door.

--
#DeleteFacebook
Re: Further proof by Anonymous Coward · 2017-11-21 03:46 · Score: 0

Exactly what form of security isn't "security by obscurity"?
There are very few counter examplr forms of security I can think of and when it comes to useful computing, there's almost no forms. This word choice for this convenational wisdom that gets rote learned and repeated is quite bad.
Re:Further proof by Anonymous Coward · 2017-11-21 03:48 · Score: 1

Apparently it works pretty well. Intel ME has been out for how many years now, and this is just coming to light now. So...sounds like they got away with it for quite a while.
Re:Further proof by Archangel+Michael · 2017-11-21 03:56 · Score: 1

Two people can keep a secret, if one of them is dead. Other than that it takes "trust" and that isn't security at all.

--
Agent K: A *person* is smart. People are dumb, stupid, panicky animals, and you know it.
Re: Further proof by DontBeAMoran · 2017-11-21 04:01 · Score: 4, Insightful

When most people say "Security by obscurity" they mean "there's no door in the fucking doorway", not "there's a lock that can be picked on the door in the fucking doorway".

--
#DeleteFacebook
Re:Further proof by Anonymous Coward · 2017-11-21 04:10 · Score: 0

of how well "security by obscurity" works.
Wonderful that you can regurgitate useless pablum like that. Even worse are the ones who will mod up up for such shallow posts.
Why don't you share your online banking passwords or your private SSL keys if there's no security in obscurity?
Re:Further proof by Anonymous Coward · 2017-11-21 04:10 · Score: 0

Since we know that blabbing is a thing that idiots do, it sounds like you're saying it's virtually guaranteed to never work, so anyone who suggests doing it must be an idiot, and .. OMG, they're going to blab!!
Re: Further proof by Anonymous Coward · 2017-11-21 04:11 · Score: 0

Your analogy is a very poor one. There's absolutely no obscurity even being attempted in your first shitty description. What you described there is a total absence of security, which is not security by obscurity. Try again.
Re:Further proof by Aaden42 · 2017-11-21 04:13 · Score: 4, Insightful

The only people who think they're idiots for blabbing are the hackers and governments (what's the difference again? I keep forgetting.) who have been exploiting these bugs/back doors to their own gain. Just because you're just hearing about the bugs doesn't mean they haven't been known and used by others for years.
Re: Further proof by Anonymous Coward · 2017-11-21 04:14 · Score: 0

So does the door make the other side of the doorway more secure or not knowing there's a doorway with no door to begin with?
When it comes to people and security, obscurity of information is the most important form of security. All other forms of physical security can be broken much easier by throwing money at them.
Re:Further proof by thegarbz · 2017-11-21 04:20 · Score: 1

of how well "security by obscurity" works.
Given the length of time it has been in place combined with the complete lack of any open exploits until very recently I'd say so far the answer to that question is "incredibly well" clearly out performing most other forms of security.
Re: Further proof by Anonymous Coward · 2017-11-21 04:25 · Score: 0

When most people say "Security by obscurity" they mean "there's no door in the fucking doorway"
I would alter that by adding that there is a privacy fence (aka, the "obscurity") in front of the doorway, but anyone who peaks around the corner of the fence can see the total lack of door and just walk right in.
Re:Further proof by Anonymous Coward · 2017-11-21 04:33 · Score: 0

Or some angry non-idiot blabs.
Or some criminal finds it while probing for vulnerabilities.
Or some criminal finds the specs for it when hacking the manufacturer.
Re: Further proof by DontBeAMoran · 2017-11-21 04:33 · Score: 1

The door is in the back of the house, you can't know there's no door unless you enter the property.

--
#DeleteFacebook
Re: Further proof by Anonymous Coward · 2017-11-21 04:35 · Score: 0

Now let's put a door there but it's unlocked, you lowered the probability someone will get in but it's still just obscuring what's behind the door.
Now let's add a 1 digit combination lock on the door, well maybe they see the lock from a distance and don't realize it's 1 digit and never try.
Now let's make it a 50 digit combination lock but you have the combination written on laminated paper on the rock right beside the door.
Now let's make the door require a one time pad but the thief happens to be your friend who knows that you keep the one time pad under your matters and grabs it.
At each level, all you're really doing is securing what's behind the door by obscuring information needed to get in.
Re:Further proof by gweihir · 2017-11-21 04:46 · Score: 1

There was no one that did "blab" here. Instead the "fucking idiots" are all with Intel and likely the NSA.

--
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
Re: Further proof by Anonymous Coward · 2017-11-21 04:50 · Score: 0

Also note that only the government has any authority to shut this off. That should tell you who designed this misfeature.
Re: Further proof by Anonymous Coward · 2017-11-21 04:50 · Score: 0

You are trolling, but if anyone is confused:
"Security by obscurity" is any method where you don't disclose the METHOD you used to secure things, often because the act of KNOWING that method lets you in.
Passwords are not: everyone knows that you need a password to log in. What they don't know is what the password is.
MFA tokens are not: everyone can understand the math used behind the scenes to make the numbers, but they lack access to the key used to generate the numbers.
SSH and SSL likewise ultimately rely on one or more private keys, but their implementations and algorithms are well understood.
If you write code and try to hide the code, you usually have security by obscurity- like in this case. Simply knowing what code is running exposes the vulnerabilities.
Re: Further proof by Anonymous Coward · 2017-11-21 04:52 · Score: 0

Security through obscurity: The lock is painted on the door. Thereâ(TM)s no actual lock.
Re:Further proof by Anonymous Coward · 2017-11-21 04:52 · Score: 0

Almost all security involves obscurity. I'd go so far to say that, aside from physical barriers (walls, guards, etc), all security is based on obscurity.
* Private encryption keys become less secure when they're no longer obscure
* Bugs can't be exploited while they're obscure (undetected) (*)
* Face-recognition algorithms are secure only while they're obscure
* Even RNGs have contributed to vulnerability when their results can be somewhat predicted (i.e. result is not obscure)
* Legendary hidden treasures (if they exist) have been perfectly secure for how many centuries?
Some un-thoughtful person will now chime in that good encryption algorithms can be public and still be secure. To this I'll say that a good encryption algorithm is just the means to increase the obscurity of keys; e.g. a bad (weak) algorithm makes it easier to find a key that will work in the absence of the chosen key (remember rainbow tables?); i.e., a weak algorithm reduces obscurity of its keys.
The trick is that there's no way to know for sure that someone out there has de-obscured your security.
(*) side-note: the point of OSS for security is that bugs are de-obscured during dev, or early in life, rather than after the code is considered stable.
Captcha: unproven
Re:Further proof by Anonymous Coward · 2017-11-21 04:54 · Score: 0

> Apparently it works pretty well. Intel ME has been out for how many years now, and this is just coming to light now. So...sounds like they got away with it for quite a while.
Not at all. Privacy folks were infuriated immediately, and everyone "knew" there were huge security holes- they just didn't know exactly WHERE they were. Additionally, while this stuff is just now coming to light, there's no reason not to assume that state actors with motivation and resources couldn't have found these things much faster. You may or may not believe that Intel was in cahoots with one or more state actors, but it's impossible to believe they would be in cahoots with ALL of them, given their conflicting goals: therefore they probably didn't get away with anything.
Re: Further proof by gweihir · 2017-11-21 04:54 · Score: 3, Insightful

Credentials, crypto-keys, etc. are explicitly _not_ "security by obscurity". You just demonstrated extreme incompetence.
Look up "Kerckhoffs's principle" some time to at least get a minimal clue.

--
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
Re:Further proof by gweihir · 2017-11-21 04:57 · Score: 2

And now it demonstrated how it works in the face of a competent attacker: Full, catastrophic, immediate failure. It outperforms any other security in this regard as well, only that it does worse than any other for of security.

--
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
Re: Further proof by Ashtead · 2017-11-21 05:09 · Score: 3, Insightful

This ME thing is like a door on the back of the house. It is painted so as to not be easy to tell apart from the wall, but it is not impossible to discover. And it even has a lock, with a key that has a funny and strange shape.
And this backdoor is present on every house on the street. And although the key is of an obscure and not readily available design, it is the same one for all these houses. So once you find out how to open up one of these doors, opening any of the others on all the neighbors' houses from the same manufacturer iis easy, with the knowledge of the design of this key.
Some other houses may have been made by a different manufacturer. Some of these have similar doors with a different key that works on all of them, in much the same way. Then there are still a number of houses that are either too old, or made by a manufacturer that doesn't include this back door.
Point is, once the presence and nature of the back-door and its lock are known, the house is wide open, and security by obscurity has failed.

--
SIGBUS @ NO-07.308
Re:Further proof by Groo+Wanderer · 2017-11-21 06:08 · Score: 5, Informative

As the one who outed the 10+ year AMT bug a few months ago, Intel's ''security' policy is a joke. No it is worse than that, it is willfully malign. They know how to do the right thing but they refuse to do so for whatever reason. I have been begging them for quite literally years not to be abjectly stupid on TXT and ME security issues but they just get worse. You are seeing the tip of the iceberg, wait for the hardware issues you can't patch to be found....
-Charlie
Re: Further proof by hey! · 2017-11-21 06:55 · Score: 1

Not really. Accessing your secured assets always requires some secret, possibly encoded in hardware (something you have). But robust security reduces the secrets you depend on to a single easy to protect secret, like a private key.
Security by obscurity refers to trying to using weak methods and hoping nobody notices.
It's important to understand this, because you're making it sound like a well choosen high entropy password is no better than rot13. In fact passwords can still work pretty well, if you can force an attacker to search a large key space by brute force.

--
Post may contain irony: discontinue use if experiencing mood swings, nausea or elevated blood pressure.
Re:Further proof by zifn4b · 2017-11-21 07:35 · Score: 1

Almost all security involves obscurity. I'd go so far to say that, aside from physical barriers (walls, guards, etc), all security is based on obscurity.
I'm not sure why I feel compelled to respond to yet another AC on this topic, especially one that made a reference Legendary Hidden Treasures (El Dorado, the City of Atlantis) as though that were actually relevant to the topic, but have you heard of something called a Cryptographic Hash Function by chance?

--
We'll make great pets
Re:Further proof by Anonymous Coward · 2017-11-21 07:53 · Score: 0

Except the 11 bugs weren’t publicly-known. Why would they volunteer them up if they were unknown and intentional backdoors?
Re: Further proof by Anonymous Coward · 2017-11-21 08:13 · Score: 0

They weren't known by the public. If they were known by anyone other than the NSA (like Russia, for example), then the intelligence community already (smartly) considered them now irrelevant and unusable.
Re:Further proof by DarkOx · 2017-11-21 08:41 · Score: 1

combined with the complete lack of any published open exploits
There fixed that for you.
We have no idea if the 3 letters American or otherwise have known about or have been abusing this for years! Nor do we know if organized crime groups might have been using it.

--
Repeal the 17th Amendment TODAY! Also Please Read http://www.gnu.org/philosophy/right-to-read.html
Re: Further proof by Anonymous Coward · 2017-11-21 09:08 · Score: 0

That is not what "obscurity" means in this context.
I suspect this AC has just posted 3-4 similar posts throughout this thread, and in every one has misused "obscurity".
Not sure if it's a troll or not...
Re:Further proof by Anonymous Coward · 2017-11-21 09:32 · Score: 0

Another idiot who's trying to twist the definition of what's meant by security through obscurity I see.
Re:Further proof by thegarbz · 2017-11-21 09:57 · Score: 1

Exploits don't need to be published to be in the wild, actually the vast majority of exploits aren't.
Re:Further proof by thegarbz · 2017-11-21 10:02 · Score: 1

it requires a savvy hacker to discover it and that's precisely why you shouldn't do it

If that is your defence you've just described every exploit ever regardless of whether it was through security through malice or through sheer incompetence, and to be honest I'm not sure which of the three is the worst.
Re:Further proof by MangoCats · 2017-11-21 11:24 · Score: 1

My house with glass windows is perfectly secure, until somebody picks up a rock from the flowerbed.
My uncle's solid wood front door was perfectly secure until some jerk with a sledgehammer smashed it open.
Sometimes the key under the mat just doesn't matter, other times the thief will notice it and you're done.
Re:Further proof by MangoCats · 2017-11-21 11:26 · Score: 3, Insightful

But, are you privy to the government deals which have been brokered to leave these flaws in the mass market chips?
Oftentimes, willfully malign is a signpost for covertly compensated.
Re:Further proof by Anonymous Coward · 2017-11-21 12:43 · Score: 0

If I found a remotely exploitable problem in an open source thing no one uses, say for example, Minix, and then I used that thing with confidence that no one else had figured out the exploit, I would definitely have a lot of things in my favor. If no one finds the exploit, I have it and no one else. If someone does find the error, well, I didn't put it there- it was just some preexisting issue with an open source product. There's no "lose" case for me, just "win/draw".
Meanwhile, if I coded my own solution and put in a backdoor, I'd potentially be liable.
Just some thoughts.
Re:Further proof by Anonymous Coward · 2017-11-21 14:02 · Score: 0

The Intel ME broohaha is a lot of whine about nothing though.
If you don't turn it on, then you can't have anything happen with it.
That said, this mostly affects enterprise equipment which the ME is intended to be used on, and IT staff will absolutely fight you tooth and nail if you try to turn it off because it prevents people from stealing or selling work equipment when they've been fired.
Re:Further proof by Anonymous Coward · 2017-11-21 14:07 · Score: 0

But it's mostly useless complaining in the end. If it was easy to remove, then people would steal enterprise equipment, flash the bios, and sell it on eBay.
It's a catch-22 problem. If it were easy to remove from the south bridge, then, someone would have put out a motherboard already with a non-intel southbridge chip, the problem is that each chipset Intel releases is married to just one or two CPU classes, so it's not in any third parties interest to make a south bridge for Intel ever again.
https://www.intel.com/content/www/us/en/support/articles/000025619/software.html
Systems using Intel ME Firmware versions 11.0.0 through 11.7.0, SPS Firmware version 4.0, and TXE version 3.0 are impacted. You may find these firmware versions on certain processors from the:
6th, 7th, and 8th generation Intel® Core Processor Family:
Intel® Xeon® Processor E3-1200 v5 and v6 Product Family
Intel® Xeon® Processor Scalable Family
Intel® Xeon® Processor W Family
Intel Atom® C3000 Processor Family
Apollo Lake Intel Atom® Processor E3900 series
Apollo Lake Intel® Pentium® Processors
Intel® Celeron® N and J series Processors
Anyhow, Intel can clearly fix it.
Re:Further proof by Groo+Wanderer · 2017-11-21 14:33 · Score: 2

Some, enough to keep me from sleeping some nights, and more than enough to keep me from having any respect for the people ostensibly working in our best interest who simply don't get the implications what they are doing.
Re:Further proof by Anonymous Coward · 2017-11-21 19:33 · Score: 0

If you mean the public relations, sure.
But you are kidding yourself that these flaws haven't been exploited yet. The dark hats have used them for years. Admins noticed their servers doing strange things for years now.
But now it's PUBLIC, yes.
Re:Further proof by Anonymous Coward · 2017-11-22 04:59 · Score: 0

>Hidden Treasures
I made no reference to any specific one. In addition to the clearly mythical tales of treasure that you mention, there are well-documented shipwrecks that were known to have been carrying large amounts of gold. Smaller ones are occasionally found. "Found" is the key here: they are hidden (i.e. obscure) for centuries, though no special technology is required to find them -- just dumb luck.
>Cryptographic Hash Function
I'm no crypto expert, but I assume you mean as used as a signing algorithm in a digital signature. If so, you missed my point (or maybe I didn't say it clearly enough). The security of a signing function is 100% dependent on the obscurity of the private key. If I get it from you somehow (steal, coercion, quantum computer, etc) your signature instantly loses 100% of its security value. Alternately, if I can find a collision in your algorithm I can spoof your signature. The measure of the security value of a signing algorithm is, I believe, its resistance to collision. Think about it for a moment:all that means is that a strong signing algorithm does a good job of keeping your signing key (or the hash-collision equivalent) obscure.
To summarize: "secret" === "obscure." One more thought experiment for you, imagine this: if I take a page of text and encrypt it with the best commonly-used encryption (n-times the age of the universe) and post it for you to download and crack. I also print the same message on durable media and hide it somewhere on planet Earth. Which do you believe you're more likely to find eventually? Yep, in 10,20,50 years (if we're still around), today's encryption will be broken...and you'll have no clue where that damned printed page is hidden.
Re: Further proof by Anonymous Coward · 2017-11-22 07:25 · Score: 1

Security by obscurity has nothing to do with hiding your private key.
It references the fact that you have a poor design but hope that no one looks there.
E.g. build a massive safe, with a fancy complicated unpickable lock, but painting the safe hinges the same color as the wall, hoping that no one looks at the hinges, because anyone with half a brain can just take the hinges off.
The 'private key' (combination) is still secret, but the security is not there (only in appearance...big safe door).
Re: Further proof by Anonymous Coward · 2017-11-22 07:28 · Score: 0

Well those aren't quite the right analogies. Using a rock/sledgehammer is brute forcing (trying every combination) to get into a door. Security by obscurity says...this door only opens outwards, but we put a sign to say "push". Hopefully no bad guy realizes it's impossible to break the door by pushing, but if he only pulled the door...
Re: Further proof by Anonymous Coward · 2017-11-22 11:20 · Score: 0

Look up the "no true Scotsman" and "straw man" fallacies.
The problem with "security through obscurity" is that it's hard to do a good job of obscuring. A thing is secure so long as it is well-obscured. You can't just wave your hands and say that keeping a key safe is not obscurity, of course it is! It's a very good method of obscurity, but it's still obscurity.
Re: Further proof by toddestan · 2017-11-23 18:57 · Score: 1

Security by obscurity would be more like there's no obvious door into the house. There's a lever obscured by the downspout that when pulled opens a secret door so you can get inside. Anyone determined to get into your house will figure out how to get in, especially since there's no actual lock on the lever. But the thieves who want to bust in, grab something quick, and be out within a minute aren't going to spend more than a few seconds trying to get in and thus may give up and move on.
Re:Further proof by misnohmer · 2017-12-02 02:28 · Score: 1

How is this different from full transparency? Are you somehow under the impression there are no security vulnerabilities in open source software, which is completely open to anyone for inspection?

ugh... by Anonymous Coward · 2017-11-21 03:32 · Score: 4, Funny

I want my C64 back. I want hardware I can understand and software I can control. Fuck this modern bloated 4 gigabyte web browser tab horseshit with thousands of people mashing their keyboards randomly and millions more observing my private data.

Re:ugh... by Narcocide · 2017-11-21 03:35 · Score: 1

Seconded.
Re:ugh... by Anonymous Coward · 2017-11-21 03:40 · Score: 0

SYS 49152
Re:ugh... by zifn4b · 2017-11-21 03:44 · Score: 1

I want my C64 back. I want hardware I can understand and software I can control. Fuck this modern bloated 4 gigabyte web browser tab horseshit with thousands of people mashing their keyboards randomly and millions more observing my private data.
So you prefer ASCII porn then?

--
We'll make great pets
Re:ugh... by DontBeAMoran · 2017-11-21 03:47 · Score: 2

Fuck your lame C64. I want my 512 KiB CoCo3 back, with OS/9.
Jokes aside, what's the lowest we can go without all the spying bullshit? Is the Motorola 68060 safe?

--
#DeleteFacebook
Re:ugh... by Anonymous Coward · 2017-11-21 04:05 · Score: 0

Even early day computers leaked data through radio emissions. It used to be possible to see what was on a CRT monitor in this way:
https://en.wikipedia.org/wiki/Tempest_%28codename%29
Re:ugh... by pscottdv · 2017-11-21 04:10 · Score: 1

Arduino?

--
this signature has been removed due to a DMCA takedown notice
Re:ugh... by Anonymous Coward · 2017-11-21 04:35 · Score: 0

I'll put my expanded 576 KiB 64 with GEOS and a 1581, 1351 and 1541-II against your CoCo3 anytime!
https://en.wikipedia.org/wiki/...
But yeah, I'll grant you that the 6809 is a better 8 bit CPU and that OS/9 is pretty cool.
But I adore my 64!!
Re:ugh... by Anonymous Coward · 2017-11-21 04:43 · Score: 0

Used to be, that's cute.
Re:ugh... by DontBeAMoran · 2017-11-21 04:54 · Score: 1

And I'll grant you that the C64 had a much better sound chip, the 6581 is one of the most legendary sound chip ever made.

--
#DeleteFacebook
Re: ugh... by Anonymous Coward · 2017-11-21 04:55 · Score: 0

Thatâ(TM)ll crash unless you have a cart ROM mapped there.
No no...
SYS 64738
Re:ugh... by MrDoh! · 2017-11-21 05:06 · Score: 2

There's other types now?

--
Waiting for an amusing sig.
Re:ugh... by Neo-Rio-101 · 2017-11-21 10:13 · Score: 1

May I present to you: http://mega65.org/

--
READY.
PRINT ""+-0
Re:ugh... by complete+loony · 2017-11-21 12:41 · Score: 1

There's a hobby-ish project attempting to recreate one; Mega 65

--
09F91102 no, 455FE104 nope, F190A1E8 uh-uh, 7A5F8A09 that's not it, C87294CE no. Ah! 452F6E403CDF10714E41DFAA257D313F.
Re:ugh... by Anonymous Coward · 2017-11-21 14:38 · Score: 0

I want my C64 back. I want hardware I can understand and software I can control. Fuck this modern bloated 4 gigabyte web browser tab horseshit with thousands of people mashing their keyboards randomly and millions more observing my private data.
My still-fully-functional Commodore VIC-20 rocks my world.
Re:ugh... by Anonymous Coward · 2017-11-21 19:37 · Score: 0

https://www.sifive.com/
Re:ugh... by Anonymous Coward · 2017-11-22 01:20 · Score: 0

EBCDIC porn is a rare fetish these days
Re:ugh... by Anonymous Coward · 2017-11-22 05:34 · Score: 0

I want my C64 back. I want hardware I can understand and software I can control. Fuck this modern bloated 4 gigabyte web browser tab horseshit with thousands of people mashing their keyboards randomly and millions more observing my private data.
So you prefer ASCII porn then?
Not ASCII, it's PETSCII porn on a C64.
Way better definition with all the graphic chars, dirty ASCII peasant.

What about older CPUs? by Neuroelectronic · 2017-11-21 03:32 · Score: 1

Are we just to assume that they're effectively obsolete and have to purchase new "patchable ME" CPUs that are probably just putting a newer, more secure back door in?

Re:What about older CPUs? by Anonymous Coward · 2017-11-21 03:46 · Score: 0

Intel ME is in the chipset. It is a completely independent CPU (in case of Skylake and newer a 3-core x86 Pentium-class) with RAM, ROM and independent access to the network hardware (if it's a special Intel model and built-in on the motherboard). It can listen on a TCP port that's invisible to the host OS.
Re:What about older CPUs? by networkBoy · 2017-11-21 04:30 · Score: 5, Interesting

Actually on ME9 Intel changed the kernel. In ME6 they changed the platform layout.
* ME < 6: GMCH northbridge and southbridge. ME lived in the GMCH and had full access to RAM even in S5 (off) system state. Kernel is based on ThreadX. CPU is ARM core.
* ME 6-8, same kernel, but moved to PCH (formerly southbridge) and the CPU gined the GM part of GMCH. Northbridge removed from platforms. ME loses access to RAM in all states besides S0 (on) and has to make do with PRAM on PCH.
* ME9+: ME now runs on Minix and Quark CPU. Vulnerabilities become an issue.
* ME10: internal struggle for dominance between kernel and AMT teams (based in US and Israel respectively) leads to departures. (including mine)
* ME11 (12?): US team is disbanded.

--
whois gawk date unzip strip find touch finger mount join nice man top fsck grep eject more yes exit umount sleep dump
Re:What about older CPUs? by Groo+Wanderer · 2017-11-21 06:12 · Score: 1

Like many others trying to do the right thing on Intel security, I am sorry you left. I know several others starting with the pre-AMT vPro reveal team members who got sick of beating their heads against the wall and quit in frustration. The idiots stay. This is not good for humanity.
Re:What about older CPUs? by sexconker · 2017-11-21 06:38 · Score: 1

I predict that as Intel gradually loses its grip on the desktop and server markets, Israel will gradually lose its grip on US policy, with some lag time.
Re:What about older CPUs? by Anonymous Coward · 2017-11-21 08:17 · Score: 0

It can listen on a TCP port that's invisible to the host OS.
Do you have more details on this?
I have one particular PC wired to my router that always appears in the router's interface as being connected twice. Once with its legitimate, statically assigned IP and the MAC I can verify from Windows. The second connection is DHCP with the name "*" and a MAC address that begins with 48:00:33 (Technicolor, could be anything). This machine only has one NIC, no wireless card, and only one adapter/interface listed in ipconfig. Being unable to identify what the DHCP connection is or where that MAC is coming from, I've blocked that MAC from all network access in the router, but I've always been suspicious about what it is. The machine is running an Intel P6200.
Re:What about older CPUs? by rahvin112 · 2017-11-21 08:55 · Score: 1

Eh, when the inevitable hacking starts and then the lawsuits start Intel as a company may cease to exist in it's current form.
Re:What about older CPUs? by Groo+Wanderer · 2017-11-21 14:34 · Score: 1

The hacking is already done and it is more than documented. I have been warning Intel directly about the financial implications for literally years. They denied it was a problem. Now it is too late.
Re:What about older CPUs? by Anonymous Coward · 2017-11-22 02:22 · Score: 0

The Ark confirms that your processor does not have vPro support. However, that does not necessarily mean that the Intel ME is completely inert (for example, on my laptop, I cannot get to the configuration menu of the ME, but I can still flash it with the ME firmware, and the vulnerability checker tool detects it). Based on what I have observed on all the computers at work that support ME, they reuse the MAC address of the network interface. All it does is redirect certain ports to ME when accessed from the network (on configured systems).
Technicolor sounds like a modem company. Perhaps your router is throwing that into the ARP table.
Re:What about older CPUs? by Anonymous Coward · 2017-11-24 12:45 · Score: 0

Thanks for the follow-up. The unusual DHCP entry only appears when this PC is powered on, and disappears when it's powered off. So it's something to do with that machine but I can't track it down. Since the MAC differs from the legitimate one, perhaps I can rule out ME.
Re:What about older CPUs? by networkBoy · 2017-11-27 04:56 · Score: 1

Yeah, I started in the 3.1 days, so AMT was already there.
I still maintain that the ME kernel (prior to the push to get on to tiny IA and Minix) was pretty damn secure.
I also maintain that a sub processor with a kernel based os running apps for system bringup is a good idea. It allows not having to build dedicated hardware for all the separate functions on a motherboard (power management, USB init, SATA init, etc.) the issue is making this kernel have *any* outside world connection other than an output only health monitor BAR or similar.

--
whois gawk date unzip strip find touch finger mount join nice man top fsck grep eject more yes exit umount sleep dump

And the bug was... by Anonymous Coward · 2017-11-21 03:33 · Score: 0

That Intel allowed remote access on cheaper motherboards where the customer did not pay for the feature.

Going out on a limb here.... by Luthair · 2017-11-21 03:33 · Score: 3, Insightful

Going out on a limb here.... while Intel claims the problems affect the 6th, 7th, and 8th gen processors, I bet they probably didn't bother testing or auditing earlier systems. Hasn't ME been around much longer than that?

Really, this ought to be factory disabled by OEMs and only shipped enabled to large corporate customers.

Re:Going out on a limb here.... by DontBeAMoran · 2017-11-21 03:48 · Score: 1

Does the Core 2 Duo series have any of this bullshit?

--
#DeleteFacebook
Re:Going out on a limb here.... by paulej72 · 2017-11-21 03:51 · Score: 1

Going out on a limb here.... while Intel claims the problems affect the 6th, 7th, and 8th gen processors, I bet they probably didn't bother testing or auditing earlier systems. Hasn't ME been around much longer than that?
Really, this ought to be factory disabled by OEMs and only shipped enabled to large corporate customers.
Yes ME has been around for 10 years or more. I would not be surprised that the older ones have the same issues or very similar ones. Unfortunately I work for a large university that purchased all of our systems with vPro enabled so no help here.
Re:Going out on a limb here.... by AmiMoJo · 2017-11-21 03:52 · Score: 5, Interesting

Unfortunately you can't disable the ME. It's needed for the CPU to start up from cold. It manages the cold boot process. The best you can do is disable it after the initial boot up, but you have to trust that setting the disable flag really did what it claims to.
You can also erase all the firmware modules not related to the early boot process, but again you have to trust that the ME is lying when it says they are gone.

--
const int one = 65536; (Silvermoon, Texture.cs)
SJW, n: "Someone I don't like, and by the way I'm a fuckwit" - AC
Re:Going out on a limb here.... by thegarbz · 2017-11-21 04:26 · Score: 3, Informative

Yes. Everything after about 2006 does to varying extent.
Re:Going out on a limb here.... by networkBoy · 2017-11-21 04:32 · Score: 1

ME Ver 9 saw an architecture change (new kernel, new CPU core). Not actually sure what "generation" that maps to, as MEINFOVer is not the same as CPU gen ID

--
whois gawk date unzip strip find touch finger mount join nice man top fsck grep eject more yes exit umount sleep dump
Re:Going out on a limb here.... by thegarbz · 2017-11-21 04:33 · Score: 1

Going out on a limb here.... while Intel claims the problems affect the 6th, 7th, and 8th gen processors, I bet they probably didn't bother testing or auditing earlier systems. Hasn't ME been around much longer than that?
ME in some form or another has been around since 2006. However it has gone through many changes over the years with 11 major versions each introducing additional features. It stands to reason that bugs may be introduced in certain versions. e.g. Despite how long it's been around the majority of it's more advanced remote control features weren't introduced until AMT 7.0 which provided remote provisioning and KVM functionality. That didn't even come out until ... 2013 ... I think.
Re:Going out on a limb here.... by Anonymous Coward · 2017-11-21 04:36 · Score: 0

I called Intel about a month ago and they told me my particular chip doesn't have IME at all.
Re:Going out on a limb here.... by Anonymous Coward · 2017-11-21 05:06 · Score: 0

Skylake is 6th, which isn't all that old- I very much doubt that they wouldn't think to test Broadwell and most especially they would check Haswell, which has huge server room numbers.
This is probably related to some "feature" added around then.
If you have the option not to trust the earlier implementations, I'd recommend not trusting them either. Or the later ones: just because this bug was located doesn't mean there aren't a great many more.
Re:Going out on a limb here.... by Anonymous Coward · 2017-11-21 05:21 · Score: 0

I called Intel about a month ago and they told me my particular chip doesn't have IME at all.
Because it's in the chipset ;)
Re:Going out on a limb here.... by infolation · 2017-11-21 06:00 · Score: 1

The Core 2 Duo series are the last design that can have the ME entirely removed (see Libreboot project).
Re:Going out on a limb here.... by sexconker · 2017-11-21 06:42 · Score: 1

Or they lied. Intel loves to dodge the question, too. They'll tell you your CPU doesn't have it even though it's physically present and is just disabled (trust us) via firmware. Or they'll tell you your system isn't vulnerable even though your BIOS shows the vulnerable ME firmware version string because your SKU doesn't have those features enabled.
It's all still physically present. The hardware is there in the CPU (or chipset on older platforms), waiting to fuck you, and you have to trust the firmware and hardware to be truthful. You have to go over a decade back to be safe from this shit.
Re:Going out on a limb here.... by Anonymous Coward · 2017-11-21 08:42 · Score: 0

You can also erase all the firmware modules not related to the early boot process, but again you have to trust that the ME is lying when it says they are gone.
I have complete trust that the ME is lying when it says they are gone.
Re:Going out on a limb here.... by Anonymous Coward · 2017-11-21 09:12 · Score: 0

Ah, thegarbz, welcome to the discussion. I recall replying to you a week ago when you were carrying on about how ME bugs were a storm in a teacup...I replied "fuck you" back then, and I'll say "fuck you" again now. How's that humble pie tasting?

Give me the list of impacted hardware by Anonymous Coward · 2017-11-21 03:33 · Score: 0

FFS give me a list of impacted hardware. Or is it EVERYTHING? Should I just be using a RaspPi until this mess is sorted out? Oh wait I have to run a tool. Why should I trust Intel code on my system again? Here's a better way to secure a system: Don't have code run below the OS, CPU, and Memory!

Re:Give me the list of impacted hardware by Narcocide · 2017-11-21 03:37 · Score: 2

I wouldn't bet on the Pi being backdoor-free, either.
Re:Give me the list of impacted hardware by Anonymous Coward · 2017-11-21 03:48 · Score: 1

RPi is actually a fascinating device. The ARM CPU is not really the main one. On boot the GPU is the one that's running a proprietary firmware and is starting the "main" ARM CPU later on. There are no public sources or tools to build software for that GPU.
Re:Give me the list of impacted hardware by EndlessNameless · 2017-11-21 03:50 · Score: 2

Intel AMT (which runs on the ME) predates multicore CPUs, and AMT has supported an IP stack since its original release.
Only offbrand and extremely obsolete hardware lacks this feature. AMD has a different but similar feature---Secure Processor, based on ARM TrustZone.
As suggested by AMD's implementation, ARM has the same capability, although it is up to the SoC designer to decide whether or not it's implemented. I will assume that Qualcom, Samsung, and Broadcom all use the feature until I hear otherwise.

--

---
According to the latest ruleset, this post should be modded as Vorpal Flamebait +5.
Re:Give me the list of impacted hardware by Anonymous Coward · 2017-11-21 03:51 · Score: 0

Everything after Core 2 Duo is running Intel Management Engine and cannot function without it. Even the NSA is only able to disable it after it's finished with the computer boot sequence. For us, mortals, trying to disable ME completely will make the computer reboot after 30 minutes. There are efforts to disable parts of it (me_cleaner tool), but still it's not completely avoidable and requires reflashing of the motherboard (using a RPi for example).
Re:Give me the list of impacted hardware by Anonymous Coward · 2017-11-21 04:02 · Score: 0

At least on the Pi it's you who's providing the closed blobs to boot on your SD card.
Re:Give me the list of impacted hardware by gweihir · 2017-11-21 05:00 · Score: 1

Form most practical purposes "EVERYTHING" with an Intel CPU is a good approximation. AMD and alternate CPU architectures are not yet affected, may take a few years until the same attack is performed there and published.

--
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
Re:Give me the list of impacted hardware by infolation · 2017-11-21 06:06 · Score: 1

The Beaglebone Black would be a better platform than the Pi. A Beaglebone can be booted using open-source Secure Boot, as discussed in this thread.
Re:Give me the list of impacted hardware by infolation · 2017-11-21 06:11 · Score: 1

AMD has shared the same vulnerabilities as Intel since 2013 due to the AMD Platform Security Processor.

The libreboot project recommends avoiding all modern AMD hardware. If you have an AMD based system affected by the problems described below, then you should get rid of it as soon as possible.

The PSP is an ARM core with TrustZone technology, built onto the main CPU die. As such, it has the ability to hide its own program code, scratch RAM, and any data it may have taken and stored from the lesser-privileged x86 system RAM (kernel encryption keys, login data, browsing history, keystrokes, who knows!). To make matters worse, the PSP theoretically has access to the entire system memory space (AMD either will not or cannot deny this, and it would seem to be required to allow the DRM "features" to work as intended), which means that it has at minimum MMIO-based access to the network controllers and any other PCI/PCIe peripherals installed on the system.

In theory any malicious entity with access to the AMD signing key would be able to install persistent malware that could not be eradicated without an external flasher and a known good PSP image. Furthermore, multiple security vulnerabilities have been demonstrated in AMD firmware in the past, and there is every reason to assume one or more zero day vulnerabilities are lurking in the PSP firmware. Given the extreme privilege level (ring -2 or ring -3) of the PSP, said vulnerabilities would have the ability to remotely monitor and control any PSP enabled machine completely outside of the user's knowledge.
Re:Give me the list of impacted hardware by gweihir · 2017-11-21 11:17 · Score: 1

It is not "the same" vulnerabilities. It is "similar" ones. Nobody yet has found a way to dump the AMD PSP code. Also, AMD made at least sure that code has to be signed to get in there.
Wile that is still not a good situation, it is a bit different from the "full compromise" Intel currently has.

--
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
Re:Give me the list of impacted hardware by Anonymous Coward · 2017-11-21 12:10 · Score: 0

Exactly right, and it takes up less of the die. There is no known separate Eth0 stack or redundant RAM access. These MAY exist but unlike intel they aren't being exploited right the fuck now, publicly.
Re:Give me the list of impacted hardware by Anonymous Coward · 2017-11-21 14:25 · Score: 0

Easier to give you a list of hardware that is not affected. A good place to start is the FSF's Respects Your Freedom list.
You'll notice that this list doesn't contain anything with an Intel processor manufactured after around (I think) 2008.
Although there have been efforts to "disable" the ME in newer systems, by removing most of its firmware, I'd still be hesitant to trust any of them unless and until the complete source code for the remaining firmware is released (or reverse-engineered.)

And that is why back-doors are a very bad idea by gweihir · 2017-11-21 03:34 · Score: 1

As can be nicely seen, not only do back-doors allow people in that you do not really want to let in (Intel, the NSA), they often have serious flaws that let everybody else into your machines as well. The only sane and secure design is not to have any back-doors in the first place.

Since Intel now has a ton of egg on their faces after their announcement, I expect we have a really, really serious problem now as long as the ME stays active in any significant number of computers. Otherwise they would just have tried to sweep this under the rug, but it seems to be that the insecurity of the ME is far, far too bad for that.

--
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.

Re: And that is why back-doors are a very bad idea by Anonymous Coward · 2017-11-21 03:44 · Score: 0

Iâ(TM)ve been leery about backdoors ever since that documentary âoeWar Gamesâ.
Re: And that is why back-doors are a very bad idea by Anonymous Coward · 2017-11-21 04:04 · Score: 0

Egg on their face? Do you think the general consumer cares about any of this? Maybe they should but they don't. I suppose the market for average consumers has been squeezed by ARM and mobile devices but none-the-less, this is what you have. For the people who do care Intel is closely approaching monopolization which is the point a company can stop caring about anything.
Re: And that is why back-doors are a very bad idea by gweihir · 2017-11-21 04:44 · Score: 1

You seem to forget that this potentially compromises a massive amount of enterprise computing.

--
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.

Glad I have older hardware by Anonymous Coward · 2017-11-21 03:34 · Score: 0

Seriously glad I have older Intel CPU's that are not affected. The only one is my Skylake laptop but given this is a hardware attack not OS attack this is pretty serious because you can be running Windows or Linux and be affected.

Let me guess... by jonr · 2017-11-21 03:37 · Score: 3, Insightful

...and very difficult to patch?

Re:Let me guess... by Anonymous Coward · 2017-11-21 04:34 · Score: 0

Everyone will have to buy new hardware to get the fix.
That is why this is coming out now...PC sales are down and need a boost.
Re:Let me guess... by thegarbz · 2017-11-21 10:05 · Score: 1

Why would it be? Surely since it's backdoored Intel can just push out a global update to everyone on the internet.

local only though... by Anonymous Coward · 2017-11-21 03:39 · Score: 2, Interesting

I do not like the ME, but at least this is local acess exploit only:

would allow an attacker with local access to execute arbitrary code.

To be fair, a local attacker can pretty much always gain access to your system, ME or no ME. A simple HW keylogger is ample and most people would never notice.

So you HAVE to keep your hardware secure if you want the data ot be secure. That is still true with the ME. I will be much more worried if there is a remote exploit.

Re:local only though... by networkBoy · 2017-11-21 04:34 · Score: 1

There is a remote exploit in AMT (one of the apps for ME). So if you have AMT you're remotely exploitable if it's not disabled in ME.

--
whois gawk date unzip strip find touch finger mount join nice man top fsck grep eject more yes exit umount sleep dump
Re:local only though... by gweihir · 2017-11-21 04:51 · Score: 2

You are mistaken. This is an attacker that can locally execute code. It is not one with physical access. And a local code execution can sometimes be upgraded to a fully remote code execution, especially as the ME can snoop at least on chipset-integrated network cards.
In addition, AV cannot detect an infection...

--
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
Re:local only though... by ctilsie242 · 2017-11-21 04:53 · Score: 1

Local access can mean a heap of trouble as well. Especially on the CPU level where a VM may run untrusted code, and the code is able to use the ME to escalate privs.
Re:local only though... by Anonymous Coward · 2017-11-21 04:58 · Score: 2, Interesting

If you have a server running public services. Web server, mail server, FTP server, etc. then everyone on the public Internet has some level of "local" access. That's just the way it works. Think about it.
Re:local only though... by cfalcon · 2017-11-21 05:10 · Score: 3, Interesting

> I do not like the ME, but at least this is local acess exploit only
It's still fucked up.
The previous ME flaw involved gaining remote access illegitimately. This one involves being able to inject stuff into the super ultra privileged secret area that operating systems can't see or guard against once you have that access. And there's NO REASON to believe that this is the final bug that exists. So far it looks like chained vulns from internet down to a run level that the chip prevents the kernel from seeing.
Re:local only though... by Groo+Wanderer · 2017-11-21 06:16 · Score: 1

I take issue with the term 'a'. :)
Re:local only though... by Groo+Wanderer · 2017-11-21 06:18 · Score: 3, Informative

There have been remote attacks capable of provisioning AMT in the wild. Intel conveniently does not acknowledged them in their NDA documents about security for some reason, can calls users with AMT turned off 'safe'. Take from that what you will about their priorities when it comes to customer's security.
Re:local only though... by Anonymous Coward · 2017-11-21 12:16 · Score: 0

from internet down to a run level that the chip prevents the kernel from seeing.
I exactly noticed this when I tried to run a popular Linux distro. I tried the $netstat command and the connections are clear according to Linux, nothing is happening. While at the same time doing also a netstat inside my router thru ssh, lo and behold!!! According to my router the said Linux machine was connected to 16992 to an AWS server located near my neihboring country. Now it is clear to me, this IME is doing scary things behind my back without the knowledge of Linux (Debian based distro).
Re:local only though... by Anonymous Coward · 2017-11-22 18:22 · Score: 0

You are mistaken. This is an attacker that can locally execute code. It is not one with physical access. And a local code execution can sometimes be upgraded to a fully remote code execution, especially as the ME can snoop at least on chipset-integrated network cards.
In addition, AV cannot detect an infection...
But what I would like to know is what level of privilege this requires. Does it require ring 0 access, e.g. to provide the ability to communicate with the ME via HECI, or can it be exploited in userspace with no privileges, using entirely unprivileged instructions?
Re:local only though... by Anonymous Coward · 2017-11-22 18:41 · Score: 0

Local access can mean a heap of trouble as well. Especially on the CPU level where a VM may run untrusted code, and the code is able to use the ME to escalate privs.
A VM does not provide access to privileged instructions, as those are trapped and result in a vmexit, so unless the vulnerabilities can be exploited using entirely unprivileged instructions, then VMs are safe.

This is the problem by Anonymous Coward · 2017-11-21 03:42 · Score: 0

This is exactly why these features should be extensively documented and people should be able to run their own dam code on them.
That way it can be disabled and it isn't some great surprise when you get hacked because intel thought it was a good idea to host a facebook page from a secret processor in your machine.

Is Intel the only one with such a thing? by 140Mandak262Jamuna · 2017-11-21 03:43 · Score: 2

Have other chipmakers clearly and unambiguously said their chips do not have a back door mechanism?

More importantly has there been any independent verification of chips from others? Intel has been doing it for years. Employees, senior developers and managers routinely leave one chip company and join other chip companies. This idea must have metastasized by now and the dispersed cells must have established new locations to grow.

Are you really going to trust any statement from the management of Samsung, of all companies? Heck, I can't even trust German companies after Volkswagen.

--
sed -e 's/Chuck Norris/Rajnikant/g' joke > fact

Re:Is Intel the only one with such a thing? by iCEBaLM · 2017-11-21 03:59 · Score: 1

AMD has started adding what they call the PSP to their zen core chips. It's apparently an ARM trustzone system. Lots of AMD customers have been asking AMD for a way to disable it since Ryzen launched.
Re: Is Intel the only one with such a thing? by Anonymous Coward · 2017-11-21 04:04 · Score: 0

Why trust German companies? They gave us world wars I and II. We ought to have burned it flat to the bare earth and been done with it! We should've killed all dem Nazis!
Or, in a less jingoistic fashion, perhaps large governmental or authoritarian institutions are inherently impossible to trust over the long run.
Re:Is Intel the only one with such a thing? by erapert · 2017-11-21 04:24 · Score: 1

They ALL have back doors similar to Intel's, though they're called other names.

But this doesn't mean there's no way to punish Intel. Here are some options:

1. Send them some nasty letters and emails. Even better: be polite but detailed and specific in explaining exactly how they went wrong and why you will no longer buy from them nor allow your company to buy from them.

2. Buy AMD chips instead. Yes, of course, AMD chips have the same thing in them-- but that is still money that Intel won't get from you and you'd be fostering competition which is a good way to motivate AMD or Intel to remedy this stuff.

3. Send a letter to your congresscritter and demand they apply the force of the federal government to safeguard the privacy and security of the citizens. Fat chance of this, by the way, because who do you think wanted Intel to build in these back doors in the first place?

4. Contribute to OpenRISC and/or RISC-V with the goal being to produce a truly open source chip for actual, useful, computing on the desktop.

5. Contribute to various projects to help hack the ME stuff out and disable it.

6. Write a seriously nasty virus that goes out and infects all Intel chips that have this thing in them. It would wake up the whole world and light a fire under Intel's ass. If you do it right you might even embarrass the government and shame them into getting the NSA to back off... unlikely, but we can dream can't we?
Re:Is Intel the only one with such a thing? by infolation · 2017-11-21 06:20 · Score: 4, Interesting

Have other chipmakers clearly and unambiguously said their chips do not have a back door mechanism?
Yes, IBM's Power series of CPUs are fully open without any equivalent of the Management Engine.
Re:Is Intel the only one with such a thing? by Groo+Wanderer · 2017-11-21 06:23 · Score: 5, Informative

Intel can't say their chips don't have a back door. They also haven't said their chips don't have a back door so at least they are honest.
AMD is working on greater disclosure and I am prodding them as hard as I can. Internally they seem to be doing the right things, or at least trying to.
ARM has their full code base published on Github. This doesn't prevent licensees from using something else, adding nefarious things etc, but I can almost guarantee most don't. You can always checksum the code if you want.
As an aside, AMD's PSP is based on ARM's stuff which is completely open source. I am fairly sure that the majority of AMD's code in this area is unchanged from the vanilla ARM version so you could consider AMD's partially open.
-Charlie
Re:Is Intel the only one with such a thing? by markdavis · 2017-11-21 09:54 · Score: 2

>"AMD is working on greater disclosure and I am prodding them as hard as I can. Internally they seem to be doing the right things, or at least trying to."
Unfortunately, there is only one real acceptable solution to many of us, and that is the owner of the computer needs to have the ability to turn it all OFF. Anything short of that is really an automatic "fail." If they are worried about how THAT might be accessed, then make it a jumper or physical switch on the motherboard. Done.
Re:Is Intel the only one with such a thing? by Baron_Yam · 2017-11-21 12:04 · Score: 1

Allow me to suggest a modification to your plans...
1. Send them some nasty letters and emails. Even better: be polite but detailed and specific in explaining exactly how they went wrong and why you will no longer buy from them nor allow your company to buy from them UNTIL THEY CHANGE THEIR WAYS.
2. Buy AMD chips instead. Yes, of course, AMD chips have the same thing in them-- but that is still money that Intel won't get from you and you'd be fostering competition which is a good way to motivate AMD or Intel to remedy this stuff. CEASE BUYING AMD PREFERENTIALLY IF INTEL CHANGES OR LOSES ENOUGH MARKET SHARE THAT YOU CAN START THREATENING AMD.
Re:Is Intel the only one with such a thing? by Groo+Wanderer · 2017-11-21 14:36 · Score: 1

I agree. Inte; has that feature but they deny it and hide it from users, even users who they know are being exploited. I am pissed.

INTEL INSIDE, INSIDE, INSIDE by Anonymous Coward · 2017-11-21 03:46 · Score: 0

Intel has severely compromised their future.
How could anyone dig their way out of this mess?
( Glad I dumped my stock! )

Re:Is the U.S. government no longer a democracy? by Anonymous Coward · 2017-11-21 03:48 · Score: 0

Raspberry Pi has firmware running in it that you don't have access to either. I say this not to escuse Intel but to point out that Raspberry PIs are not necessarily safer.

I hate the CIA by WCMI92 · 2017-11-21 03:48 · Score: 0

The CIA thinks it gets to have it's hands into everyone's computer.

They don't.

--
Corporatism != Free Market

Re:I hate the CIA by Anonymous Coward · 2017-11-21 04:14 · Score: 1

STFU or we'll plant CP on your devices because we can and have you SWATed and sent to prison using parallel construction like we have done to countless innocent people before you.
--US TLAs
Re:I hate the CIA by Anonymous Coward · 2017-11-21 05:52 · Score: 0

The TLAs are like the Harvey Weinstein (or Roy Moore, or, well the list is becoming endless) of the spying world. Handsy and uninvited.
Re:I hate the CIA by Anonymous Coward · 2017-11-21 12:04 · Score: 0

New slogan of Intel:
Central Intel Agency Inside
captcha: obvious

Re:Is the U.S. government no longer a democracy? by Narcocide · 2017-11-21 03:51 · Score: 1

Are you shilling for Broadcom here? What makes you think their black box is any more secure?

Good reason to buy AMD by ealbers · 2017-11-21 03:53 · Score: 1

Forget Intel chips, use AMD

Re:Good reason to buy AMD by Anonymous Coward · 2017-11-21 04:14 · Score: 0

Forget Intel chips, use AMD
because it's better to be clueless and pretend that AMD doesn't do the exact same thing
Re:Good reason to buy AMD by Anonymous Coward · 2017-11-21 04:20 · Score: 0

Forget Intel chips, use AMD
Yeah, about that...
Re:Good reason to buy AMD by Kokuyo · 2017-11-21 04:27 · Score: 2

I've got bad news for ya, matey...
Re:Good reason to buy AMD by Barefoot+Monkey · 2017-11-21 05:33 · Score: 1

Same problem, different name. AMD now uses what they call PSP, which is essentially their own version of IME.
As much as I'd like to support AMD adoption, they're unlikely to back off on PSP if everyone who dislikes IME switches to AMD without holding them to the same standard. If you want to see a change it might be better to loudly complain about IME while commenting that you would switch to AMD if only they didn't have the same problem. Maybe then AMD would eventually notice that they're missing out on a lot of potential customers. Maybe.
If AMD at least provided a mechanism for the actual owners to control the key used for TrustZone (along with maybe the source to a barebones firmware with all the trade secret magic stubbed out) then that would probably be enough.

Re:Is the U.S. government no longer a democracy? by ealbers · 2017-11-21 03:54 · Score: 1

The USA has NEVER been a Democracy, never. Thats just a fact, its a republic, theres a difference.

Enabled on Macs? by Anonymous Coward · 2017-11-21 03:59 · Score: 0

Haven't seen this mentioned anywhere, but I assume this "feature" is also enabled on Intel-based Mac computers?

Re:Enabled on Macs? by gweihir · 2017-11-21 05:05 · Score: 1

Of course. Why would it not be? Unless people that do this kind of crap are locked away for life when discovered, this is not going to stop. There are far too many authoritarian assholes in governments around the world that do not feel comfortable until they can spy on everybody.

--
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
Re:Enabled on Macs? by rogoshen1 · 2017-11-21 06:22 · Score: 1

And there are even more soccer-mom types who don't feel comfortable unless everyone is surveilled, because if you don't have anything to hide, why worry, right?
the problem here is you'd need a huge grassroots-type movement to get AMD or Intel to back-down on this. But sadly the truth is that the vast absolute majority of people:
Do not care
Don't understand enough about the hardware to have a valid opinion
OR worst of all actively support this kind of capability to you know; keep their kids safe from terrorists and/or the child-predators that some app has clearly shown to be infesting their neighborhood.
We live in a society that has completely run out of real threats, and so we've started to hyperfocus on statistically anomalies (partially thanks to a sensationalist media and 24 hour news cycle) to invent new ones.
Call it the Nancy Grace syndrome.
Re:Enabled on Macs? by Anonymous Coward · 2017-11-21 09:18 · Score: 0

"Haven't seen this mentioned anywhere, but I assume this "feature" is also enabled on Intel-based Mac computers?"
A good question; I'm afraid I don't have a good answer. The obfuscation is strong here:
*No. Apple does not use this Intel Silicon.
*No. Silicon is present, but not hardware enabled.
*No. Silicon is present, hardware enabled, not firmware enabled.
*Partially. Some low level functions, such as related to Macbook Charging or NTP enabled.
*Partially. Some high level functions, such as related to Network Monitoring enabled.
*Hell yes. But nobody has ever seen any related Code or Tools.
*Hell yes. Now I have to kill you.
Short of pulling the related Chips, grinding off the covers, and snooping with an Electron Microscope, presence of the Silicon may be impossible to tell, and even so, what would one look for? (And yes, we routinely did this, for SEU Research.)
Also, debugging by using Packet Sniffers and poking around may not reveal anything. Just how trustworthy are commercial Packet Sniffers? These are the sorts of gadgets that TLAs have historically been interested in.
Possibly the best reason not to go all Tinfoil Beanie over this is that the Intel ME was ostensibly created for IT Management; to make their lives easier and their work more secure. The Tools created for this purpose don't appear to exist for OSX. This is of course a recurrent complaint among IT Lardasses; they can't easily control Macs like they control PCs.
At work, a few years back, IT decided that they would no longer support UNIX, Linux, or Apple. We were on our own. They were swamped with Windows nastiness anyway, and we weren't worth the trouble. We still had to pitch in for some IT Overhead.
Anyway, online searches for:
apple intel ME "management engine"
and related terms just yields confusion, paranoia, and some genuine wishful thinking.
Myself, I'm not the least bit worried.
Re:Enabled on Macs? by gweihir · 2017-11-21 11:24 · Score: 2

And there are even more soccer-mom types who don't feel comfortable unless everyone is surveilled, because if you don't have anything to hide, why worry, right?
Well, ask them to put cameras and microphones into their bathrooms and bedrooms and at least some seem to wise up.

the problem here is you'd need a huge grassroots-type movement to get AMD or Intel to back-down on this. But sadly the truth is that the vast absolute majority of people:
Do not care
Don't understand enough about the hardware to have a valid opinion
OR worst of all actively support this kind of capability to you know; keep their kids safe from terrorists and/or the child-predators that some app has clearly shown to be infesting their neighborhood.
We live in a society that has completely run out of real threats, and so we've started to hyperfocus on statistically anomalies (partially thanks to a sensationalist media and 24 hour news cycle) to invent new ones.
Call it the Nancy Grace syndrome.
We will see. There is a real possibility using these CPUs may become illegal in some sectors of finance and medicine in the EU. Also, think about how much critical infrastructure is possibly affected. That would create a bit of pressure, I Imagine.
While I agree on the hyperfocus on statistical anomalies, I do really not think this is one. I agree that "ordinary citizens" are clueless as always. Just look like about every fascist and totalitarian government was cheered in by these "ordinary people". I do expect this will have a lot of people very, very concerned for years to come in a professional capacity, and some of those people will be the ones that decide about really large hardware purchases.

--
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.

I'm shocked by Revek · 2017-11-21 04:05 · Score: 1

Somebody bring me my fainting couch. Security through obscurity never works.

Re: Is the U.S. government no longer a democracy? by mspohr · 2017-11-21 04:05 · Score: 2

The US is a corporate kleptocracy similar to Fascism but with less government control.

--
I don't read your sig. Why are you reading mine?

Re:Is the U.S. government no longer a democracy? by Revek · 2017-11-21 04:07 · Score: 1

The US is republic. We have always pseudo democratic processes to choose our leaders.

It was just a joke by Anonymous Coward · 2017-11-21 04:08 · Score: 0

Lighten up. It was just a joke.

https://unix.stackexchange.com/questions/405783/why-does-man-print-gimme-gimme-gimme-at-0030

The other side of the chip... by CyberRacer · 2017-11-21 04:12 · Score: 2

OK. It's there and it's not going to just disappear, sooooo, is there any way to root it and use it ourselves? Who wouldn't want to turn a dual-core into a tri-core (or even just a dual and 1/2 core)?

Re:The other side of the chip... by Opportunist · 2017-11-21 04:25 · Score: 1

is there any way to root it and use it ourselves?
Yes.
Why do you think a patch is necessary?

--
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
Re:The other side of the chip... by networkBoy · 2017-11-21 04:35 · Score: 1

it'd be a dual and a couple cents.
there is not much memory available to it, and it's a pretty limited Quark core (or ARM if older than ME9).

--
whois gawk date unzip strip find touch finger mount join nice man top fsck grep eject more yes exit umount sleep dump

Re:Is the U.S. government no longer a democracy? by Anonymous Coward · 2017-11-21 04:13 · Score: 0

Yeah, let's allow some shitbox knockoff CPU manufacturer in China to backdoor our chips instead of Intel.

You're one stupid piece of shit, you know that? Is the POTUS on Slashdot now?

Of what nature are those "bugs"? by Opportunist · 2017-11-21 04:24 · Score: 1

The kind where the user can take control of his machine against the wishes of its maker? Yeah, that's a nasty one, fix that immediately!

--
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.

Re:Of what nature are those "bugs"? by Anonymous Coward · 2017-11-21 04:42 · Score: 0

The kind where the user can take control of his machine against the wishes of its maker? Yeah, that's a nasty one, fix that immediately!
by "user" you are talking about the person who has taken over your computer
and by "maker" you mean yourself who drops turds instead of talking

Let me guess by Anonymous Coward · 2017-11-21 04:29 · Score: 0

Intel has a way to update the management engine firmware for your security, but it just also happens that the update makes it impossible to disable via methods some have recently discovered.

Re:Is the U.S. government no longer a democracy? by Anonymous Coward · 2017-11-21 04:33 · Score: 0

So, it is entirely okay with Intel that we are being dominated by hidden government?

Why do you care what they think? We The People have known that we can't audit this stuff for years and we didn't care, so it's kind of weird to expect Intel to be mad about it or something.

Democracy is the best form of government.

Voters disagree. I'm not saying you're wrong, just that most people disagree with you, so your views are incompatible with democracy. You might want to ease down on this anti-democracy talk and maybe consider a position that voters in a democracy would support. We The People think you democracy-promoting people are very undemocratic and we are all constantly working to drop a nice, warm, new pile of shit on you every two years.

Re:INTEL INSIDE, INSIDE, INSIDE by Anonymous Coward · 2017-11-21 04:38 · Score: 0

Intel Backdoor Inside (TM)

Re: Is the U.S. government no longer a democracy? by Anonymous Coward · 2017-11-21 04:48 · Score: 0

The US is actually both. We get to vote on our government which meets the minimum criteria for a democracy. Just because we have representatives who run the government doesnâ(TM)t make us not a democracy.

Re:Is the U.S. government no longer a democracy? by hoggoth · 2017-11-21 04:49 · Score: 1

> Intel [...] is on a path to bankruptcy.

lol. because they enable government agencies to spy on us? have you been paying any attention to who has all the money?

--
- For the complete works of Shakespeare: cat /dev/random (may take some time)

hey, d1psh1t by Anonymous Coward · 2017-11-21 04:49 · Score: 0

>"Sorry buy Fascism is a socialist ideology"

the definition of fascism is "rule by corporations"

trying to conflate socialism with marxism just makes you an a55licker to power. suck that a55, fvcking shill

Agreed by Anonymous Coward · 2017-11-21 05:06 · Score: 0

The USA has NEVER been a Democracy, never. Thats just a fact, its a republic, theres a difference.

Agreed. One results in continuous expansion of government power, while the other results in continuous expansion of government power.

Just more reason to stop AMT/ME thus EASILY by Anonymous Coward · 2017-11-21 05:06 · Score: 0

Stop Intel AMT/ME easily... apk

See subject: Stop it's ability to send info. outward via router port filtering ala ports 16992-16995 + 623-625 that Intel AMT/ME uses so filter those ports in a modem/router external to OS/PC. Intel ME/AMT operates from your mobo but has NO CONTROL OF YOUR MODEM/ROUTER!

(This stops it cold talking in/out permanently OR being able to remotely 'patch' it to use other ports by Intel OR malicious actors/malware makers etc.!)

Additionally, once you disable the AMT engine's software interface (ez via software these articles note)? A malware to 'repatch' this = impossible (bios updaters require it in usermode ware, e.g. ASUS).

(I only allow 80, 8080 & 443 in/out here on a SINGLE stand-alone system (no home LAN but TCP/IP connected online in BOTH my modem or router port filters or software firewalls))

HOWEVER - Be CERTAIN your modem/router's internal ware is "solid" as well (turn off things like UPnP etc. & CHECK router/modem HAS NO KNOWN BACKDOOR EXPLOITS (tons do unfortunately)) - get it patched ASAP if it's KNOWN exploited & TONS of routers, ARE https://it.slashdot.org/comments.pl?sid=9995967&cid=53488785/

* GOOD ROUTERS/MODEMS HAVE PORT FILTERING OPTIONS (crappy ones do not)!

APK

P.S.=> Good luck - it's the BEST EASIEST & CHEAPEST DEFENSE using what you already have (hopefully, again as not ALL modems have port filtering but most do & certainly GOOD ONES DO) vs. this threat by stopping it being able to communicate in/out period, from OUTSIDE of the INTEL chipset external to it via a router/firewall hardware... apk

Re: Just more reason to stop AMT/ME thus EASILY by Anonymous Coward · 2017-11-21 07:37 · Score: 0

> Stop it's ability to send info. outward via router port filtering ala ports 16992-16995 + 623-625 that Intel AMT/ME uses
Excellent! Thanks very much.

Re:Is the U.S. government no longer a democracy? by Anonymous Coward · 2017-11-21 05:13 · Score: 0

It's well-known that the USA is a republic, but why do you say that it is not a democracy? The concepts are definitely not mutually-exclusive, you know. In fact, one of the most iconic forms of republic is the "representative democracy", which also happens to be a democracy. Guess which type of republic the USA is.

Great by Anonymous Coward · 2017-11-21 05:16 · Score: 0

Great, now there will be no chance of disabling this bullshit. Once Intel patches up all these bugs there will be slim chance of using any of the exploits to find a way in to and disable the IME.

Sure the older platforms may still have a chance, until BIOS updates, or driver updates go out to update the IME. Hopefully the IME doesn't phone home to pull updates. But you know the new platforms that come out will have all these exploits sealed up.

Glad I bought AMD and not the vaunted i7 by Anonymous Coward · 2017-11-21 05:17 · Score: 0

Hahaha

"Local access" by Anonymous Coward · 2017-11-21 05:23 · Score: 0

Or someone installs a separate malware with virtual USB device to take advantage of said ME flaw.
Firmware cleaning won't work because the malware can simply lie about a successful installation.
Boom, enjoy your worthless motherboard.

Thank heavens I have an old Athlon... by emil · 2017-11-21 05:31 · Score: 1

...where I run CentOS and Firefox. I'm not trusting any sensitive personal data to Intel until I get easy tools to remove the ME.

I wish Oracle would put out a "Raspberry-Pi" class of the SPARC T2. The design is open and can be trusted.

Re:Thank heavens I have an old Athlon... by Anonymous Coward · 2017-11-21 06:04 · Score: 0

Is AMD affected by this vulnerability?
Re:Thank heavens I have an old Athlon... by sexconker · 2017-11-21 06:31 · Score: 1

...where I run CentOS and Firefox. I'm not trusting any sensitive personal data to Intel until I get easy tools to remove the ME.
I wish Oracle would put out a "Raspberry-Pi" class of the SPARC T2. The design is open and can be trusted.
Nothing from Oracle can be trusted. Being open doesn't mean something is trustworthy. It means you're able to build your own and audit it. You can't trust something unless you actually do that.
Re: Thank heavens I have an old Athlon... by Anonymous Coward · 2017-11-21 09:51 · Score: 0

No, AMD is immune to this Intel specific weakness. AMD has its own version which runs 90% as fast per core for half the wattage and price though.

obscurity by Anonymous Coward · 2017-11-21 05:32 · Score: 0

Security by obscurity is crypto with closed source (obscure) code. No way to audit or check.

More transparent security is with open source crypto algorithms.

The algorithm is known to every one...but the key that runs through the algorithm with your message is secret.

Re:Is the U.S. government no longer a democracy? by Anonymous Coward · 2017-11-21 05:36 · Score: 0

Big difference Ubetcha. Yep ... a Demos lets Bantus parasite bling ... lets savages vote ... trashes whitemans paradise for mudville guilt. Shitsville. OTOH a just republic having first blundered into slavery repents ... pays restitution vis Bibical rules ... then steamships them back to jujuland. Lives happy ever-after. Big difference eh pad'res ?

It's a feature, not a bug by Anonymous Coward · 2017-11-21 05:48 · Score: 0

brought to you by your local 3 letter agency. this is just limited hangout after they get outed

An engineering problem by Anonymous Coward · 2017-11-21 05:49 · Score: 0

Maybe so, but the isolation options are not very well-engineered yet. You have to be an IT guru to even have a shot at getting Qubes to work properly, and Purism has their head so far in the clouds it is not known if they can deliver a workable, long-term support plan for their products. What we need are engineers to take conpartmentalization and make it easy and default in mainstream builds.

At Least They're Admitting It by TheFakeTimCook · 2017-11-21 05:54 · Score: 1

Two thumbs WAY down for Intel pulling this shit in the first place.

One thumb sorta up for them admitting they have bugs in said shit.

Russian and Chinese chips by Anonymous Coward · 2017-11-21 06:03 · Score: 1

This is why I only buy my chips from the Russians and Chinese.

So no need to Worry by oldgraybeard · 2017-11-21 06:13 · Score: 1

The govcode/malware is installed directly by the manufacturer.

One wonders how fast computers would be if they were not running other priority tasks at all times.

Re:So no need to Worry by Anonymous Coward · 2017-11-21 06:59 · Score: 0

Oddly, enough, the precursor to this (System Management Mode) actually causes severe issues for people doing hard-real-time work.
I wonder how much battery life is eaten up in this nonsense as well.

Dear Intel by Anonymous Coward · 2017-11-21 06:25 · Score: 0

Give everyone tools to shut this crap down or we will never buy shit from you again.

Signed,
Everyone

Re:Dear Intel by Anonymous Coward · 2017-11-21 11:38 · Score: 0

Yeah sure, you talk like you have other alternative CPU suppliers. I heard China already designed a chip and trying to release them to the public soon. But would you trust their chip?

Re:Is the U.S. government no longer a democracy? by Thanatiel · 2017-11-21 07:17 · Score: 1

"choose" ... with a convoluted process where one's vote does not carry the same weight as someone else's.
"choose" ... going around a few obstacles making it very difficult for many people to vote

"choose" ?

Who do you think has the power in the end ?
_ The people ?
_ Whoever corrupts ... sorry, I meant lobbies the politicians ?

--
Irrelevant news and morons using moderation to mod down what they disagree on. 2018 resolution: so long.

Re: Is the U.S. government no longer a democracy? by Anonymous Coward · 2017-11-21 07:22 · Score: 0

US should be a republic, which means the rule by constitution. In fact US is more or less democracy, which means rule by zeitgeist. Fascism btw is a form of socialism, where individual property rights are non-existent, and production is delegated to government selected corporations with no competition or freedom of entry to the markets.

And these clowns want to take our "legacy" BIOS by ponraul · 2017-11-21 07:33 · Score: 1

http://www.templeos.org/ToPuni...

Heed Terry the Terrible's Edict!!!

Brian Richardson directly challenged authority of King 11/18/17. Gets a beating for stupidity. 11/18/17 NIST at 17:20 hours

You're welcome & another great tool... apk by Anonymous Coward · 2017-11-21 09:13 · Score: 0

APK Hosts File Engine 9.0++ SR-7 32/64-bit https://www.google.com/search?hl=en&source=hp&biw=&bih=&q=%22APK+Hosts+File+Engine%22+and+%22start64%22&btnG=Google+Search&gbv=1/

Ads/script/malware rob speed/security/privacy/bandwidth.

Hosts add speed (via hardcodes/adblocks), security (vs. bad sites/malware/poisoned dns), reliability (vs. dns down), & anonymity (vs. dns requestlogs/trackers).

Less power/cpu/ram + IO use vs. DNS/routers/addons/antivirus + less security bugs/complexity & faster vs. addons/routers/remote dns!

Avoids DNSChangers in routers/IP settings & dns redirect (99++% of ISP DNS != patched vs. it) + DNS tracking & lighten DNS load & resolve faster from local RAM!

* Via what u NATIVELY have in a FASTER kernelmode IP stack (does more w/ less).

APK

P.S. - Safe https://www.virustotal.com/en/file/e01211ca36aa02e923f20adee0a3c4f5d5187dc65bdf1c997b3da3c2b0745425/analysis/1433430542/ (self checking vs. infection of it built-in)

BTW... by Anonymous Coward · 2017-11-21 09:52 · Score: 0

> The researchers in August published details about a secret avenue that the US government can use to disable ME, which is not available to the public.

Besides that obscure processor RMS talks about (Longsoon, after a quick search), what options are left if someone is mandated to have secrecy (e.g., people on other countries' IRSes) or just want to avoid having his/her equipment taken hostage?

Intel is out, AMD is out, what choices are considered reasonably safe? I remember hearing about smart phones having similar surveillance, but was it at the CPU level?

11 bugs? by Anonymous Coward · 2017-11-22 05:35 · Score: 0

It was 11 *categories* of bugs, most of them with multiple occurrences.

Not actually true anymore. by Anonymous Coward · 2017-11-22 12:13 · Score: 0

And hasn't been for about 2 years now.

There is a mostly open source firmware built on top of the VC4 core that can initialize everything except for the GPU display hardware and some other things. It DOES initialize serial, and the ARM cores however, and I believe had USB working last time I looked. Since it is running on the VC4 you could run custom GPU code on it, but it unfortunately lacks the display output initialization needed for non-console/network display. On the OTHER hand, if you wrote suitably secure code (since the VC4 does NOT have an MMU, and has full hardware level access to all RAM in the system.) you could use it as an encryption acceleration processor to free up the main ARM cores for general purpose processing loads, and even run OpenCL threads on it with some compiler/library support.

It is too bad they don't have a high speed bus interface, or they would actually make an excellent low end open source GPU replacement for PCI/PCIe systems now that both Nvidia and AMD GPU hardware is locked up as tight as Intel and AMD's (Mis-)Trusted Execution Cores..

Is ring 0 required to exploit this? by Anonymous Coward · 2017-11-22 19:09 · Score: 0

So most of these bugs rely on local access. This seems to mean executing code locally, rather than physical access. But what kind of privilege is required to exploit the vulnerabilities? Can only privileged, ring 0 instructions do this, e.g. by writing to the ME over HECI, or can any old unprivileged instruction run by any old process do this? "Unspecified vector" isn't gonna cut it, but I don't know enough of the internals of the IBM PC architecture, much less modern Intel architectures, to know if there are even any *possible* ways to interact with the ME short of using privileged I/O.

This is the difference between this being an irritating show of Intel's security, and an extreme, unmitigated disaster a la rowhammer.

Re:Is the U.S. government no longer a democracy? by Anonymous Coward · 2017-11-26 23:56 · Score: 0

No there isn't ya dumb shit. A republic is a representative democracy by definition. Check a dictionary before you haul out that silly talking point again.

Slashdot Mirror

Intel: We've Found Severe Bugs in Secretive Management Engine, Affecting Millions (zdnet.com)

207 comments