Slashdot Mirror
Intel: We've Found Severe Bugs in Secretive Management Engine, Affecting Millions (zdnet.com)
Liam Tung, writing for ZDNet: Thanks to an investigation by third-party researchers into Intel's hidden firmware in certain chips, Intel decided to audit its firmware and on Monday confirmed it had found 11 severe bugs that affect millions of computers and servers. The flaws affect Management Engine (ME), Trusted Execution Engine (TXE), and Server Platform Services (SPS). Intel discovered the bugs after Maxim Goryachy and Mark Ermolov from security firm Positive Technologies found a critical vulnerability in the ME firmware that Intel now says would allow an attacker with local access to execute arbitrary code. The researchers in August published details about a secret avenue that the US government can use to disable ME, which is not available to the public. Intel ME has been a source of concern for security-minded users, in part because only Intel can inspect the firmware, yet many researchers suspected the powerful subsystem had bugs that were ripe for abuse by attackers.
of how well "security by obscurity" works.
I want my C64 back. I want hardware I can understand and software I can control. Fuck this modern bloated 4 gigabyte web browser tab horseshit with thousands of people mashing their keyboards randomly and millions more observing my private data.
Are we just to assume that they're effectively obsolete and have to purchase new "patchable ME" CPUs that are probably just putting a newer, more secure back door in?
Going out on a limb here.... while Intel claims the problems affect the 6th, 7th, and 8th gen processors, I bet they probably didn't bother testing or auditing earlier systems. Hasn't ME been around much longer than that?
Really, this ought to be factory disabled by OEMs and only shipped enabled to large corporate customers.
As can be nicely seen, not only do back-doors allow people in that you do not really want to let in (Intel, the NSA), they often have serious flaws that let everybody else into your machines as well. The only sane and secure design is not to have any back-doors in the first place.
Since Intel now has a ton of egg on their faces after their announcement, I expect we have a really, really serious problem now as long as the ME stays active in any significant number of computers. Otherwise they would just have tried to sweep this under the rug, but it seems to be that the insecurity of the ME is far, far too bad for that.
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
...and very difficult to patch?
I wouldn't bet on the Pi being backdoor-free, either.
I do not like the ME, but at least this is local acess exploit only:
would allow an attacker with local access to execute arbitrary code.
To be fair, a local attacker can pretty much always gain access to your system, ME or no ME. A simple HW keylogger is ample and most people would never notice.
So you HAVE to keep your hardware secure if you want the data ot be secure. That is still true with the ME. I will be much more worried if there is a remote exploit.
More importantly has there been any independent verification of chips from others? Intel has been doing it for years. Employees, senior developers and managers routinely leave one chip company and join other chip companies. This idea must have metastasized by now and the dispersed cells must have established new locations to grow.
Are you really going to trust any statement from the management of Samsung, of all companies? Heck, I can't even trust German companies after Volkswagen.
sed -e 's/Chuck Norris/Rajnikant/g' joke > fact
RPi is actually a fascinating device. The ARM CPU is not really the main one. On boot the GPU is the one that's running a proprietary firmware and is starting the "main" ARM CPU later on. There are no public sources or tools to build software for that GPU.
Intel AMT (which runs on the ME) predates multicore CPUs, and AMT has supported an IP stack since its original release.
Only offbrand and extremely obsolete hardware lacks this feature. AMD has a different but similar feature---Secure Processor, based on ARM TrustZone.
As suggested by AMD's implementation, ARM has the same capability, although it is up to the SoC designer to decide whether or not it's implemented. I will assume that Qualcom, Samsung, and Broadcom all use the feature until I hear otherwise.
---
According to the latest ruleset, this post should be modded as Vorpal Flamebait +5.
Are you shilling for Broadcom here? What makes you think their black box is any more secure?
Forget Intel chips, use AMD
The USA has NEVER been a Democracy, never. Thats just a fact, its a republic, theres a difference.
Yeah... they didn't learn from Microsoft's experience and had to put ME in their chips.
I hope they don't fix it by upgrading to Vista
Somebody bring me my fainting couch. Security through obscurity never works.
The US is a corporate kleptocracy similar to Fascism but with less government control.
I don't read your sig. Why are you reading mine?
The US is republic. We have always pseudo democratic processes to choose our leaders.
OK. It's there and it's not going to just disappear, sooooo, is there any way to root it and use it ourselves? Who wouldn't want to turn a dual-core into a tri-core (or even just a dual and 1/2 core)?
STFU or we'll plant CP on your devices because we can and have you SWATed and sent to prison using parallel construction like we have done to countless innocent people before you.
--US TLAs
The kind where the user can take control of his machine against the wishes of its maker? Yeah, that's a nasty one, fix that immediately!
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
> Intel [...] is on a path to bankruptcy.
lol. because they enable government agencies to spy on us? have you been paying any attention to who has all the money?
- For the complete works of Shakespeare: cat
Form most practical purposes "EVERYTHING" with an Intel CPU is a good approximation. AMD and alternate CPU architectures are not yet affected, may take a few years until the same attack is performed there and published.
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
Of course. Why would it not be? Unless people that do this kind of crap are locked away for life when discovered, this is not going to stop. There are far too many authoritarian assholes in governments around the world that do not feel comfortable until they can spy on everybody.
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
...where I run CentOS and Firefox. I'm not trusting any sensitive personal data to Intel until I get easy tools to remove the ME.
I wish Oracle would put out a "Raspberry-Pi" class of the SPARC T2. The design is open and can be trusted.
Two thumbs WAY down for Intel pulling this shit in the first place.
One thumb sorta up for them admitting they have bugs in said shit.
This is why I only buy my chips from the Russians and Chinese.
The Beaglebone Black would be a better platform than the Pi. A Beaglebone can be booted using open-source Secure Boot, as discussed in this thread.
The libreboot project recommends avoiding all modern AMD hardware. If you have an AMD based system affected by the problems described below, then you should get rid of it as soon as possible.
The PSP is an ARM core with TrustZone technology, built onto the main CPU die. As such, it has the ability to hide its own program code, scratch RAM, and any data it may have taken and stored from the lesser-privileged x86 system RAM (kernel encryption keys, login data, browsing history, keystrokes, who knows!). To make matters worse, the PSP theoretically has access to the entire system memory space (AMD either will not or cannot deny this, and it would seem to be required to allow the DRM "features" to work as intended), which means that it has at minimum MMIO-based access to the network controllers and any other PCI/PCIe peripherals installed on the system.
In theory any malicious entity with access to the AMD signing key would be able to install persistent malware that could not be eradicated without an external flasher and a known good PSP image. Furthermore, multiple security vulnerabilities have been demonstrated in AMD firmware in the past, and there is every reason to assume one or more zero day vulnerabilities are lurking in the PSP firmware. Given the extreme privilege level (ring -2 or ring -3) of the PSP, said vulnerabilities would have the ability to remotely monitor and control any PSP enabled machine completely outside of the user's knowledge.
The govcode/malware is installed directly by the manufacturer.
One wonders how fast computers would be if they were not running other priority tasks at all times.
And there are even more soccer-mom types who don't feel comfortable unless everyone is surveilled, because if you don't have anything to hide, why worry, right?
the problem here is you'd need a huge grassroots-type movement to get AMD or Intel to back-down on this. But sadly the truth is that the vast absolute majority of people:
Do not care
Don't understand enough about the hardware to have a valid opinion
OR worst of all actively support this kind of capability to you know; keep their kids safe from terrorists and/or the child-predators that some app has clearly shown to be infesting their neighborhood.
We live in a society that has completely run out of real threats, and so we've started to hyperfocus on statistically anomalies (partially thanks to a sensationalist media and 24 hour news cycle) to invent new ones.
Call it the Nancy Grace syndrome.
"choose" ... with a convoluted process where one's vote does not carry the same weight as someone else's. ... going around a few obstacles making it very difficult for many people to vote
"choose"
"choose" ?
Who do you think has the power in the end ? ... sorry, I meant lobbies the politicians ?
_ The people ?
_ Whoever corrupts
Irrelevant news and morons using moderation to mod down what they disagree on. 2018 resolution: so long.
http://www.templeos.org/ToPuni...
Heed Terry the Terrible's Edict!!!
Brian Richardson directly challenged authority of King 11/18/17. Gets a beating for stupidity. 11/18/17 NIST at 17:20 hours
It is not "the same" vulnerabilities. It is "similar" ones. Nobody yet has found a way to dump the AMD PSP code. Also, AMD made at least sure that code has to be signed to get in there.
Wile that is still not a good situation, it is a bit different from the "full compromise" Intel currently has.
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
And there are even more soccer-mom types who don't feel comfortable unless everyone is surveilled, because if you don't have anything to hide, why worry, right?
Well, ask them to put cameras and microphones into their bathrooms and bedrooms and at least some seem to wise up.
the problem here is you'd need a huge grassroots-type movement to get AMD or Intel to back-down on this. But sadly the truth is that the vast absolute majority of people:
Do not care
Don't understand enough about the hardware to have a valid opinion
OR worst of all actively support this kind of capability to you know; keep their kids safe from terrorists and/or the child-predators that some app has clearly shown to be infesting their neighborhood.
We live in a society that has completely run out of real threats, and so we've started to hyperfocus on statistically anomalies (partially thanks to a sensationalist media and 24 hour news cycle) to invent new ones.
Call it the Nancy Grace syndrome.
We will see. There is a real possibility using these CPUs may become illegal in some sectors of finance and medicine in the EU. Also, think about how much critical infrastructure is possibly affected. That would create a bit of pressure, I Imagine.
While I agree on the hyperfocus on statistical anomalies, I do really not think this is one. I agree that "ordinary citizens" are clueless as always. Just look like about every fascist and totalitarian government was cheered in by these "ordinary people". I do expect this will have a lot of people very, very concerned for years to come in a professional capacity, and some of those people will be the ones that decide about really large hardware purchases.
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.