Posts by whitepines

Intel's super-secret Management Engine firmware now glimpsed, fingered via USB

Neutering the ME won't stop this exploit!

Time to buy ARM or OpenPOWER, just watch out for the ARM vendors that implement their own version of the ME/PSP....

Nope. It's in every single chip and increasingly vital to the boot process (well, technically, even now *no* AMD chips will boot without it, it's just that now DRAM setup and other functions are also being moved into the PSP. Can you say "exploits everywhere"?)

Microsoft, Intel cook kit to secure firmware in servers and beyond

This looks like a direct copy of Raptor Engineering's FlexVer technology that was originally going to be part of the Talos systems: https://www.raptorengineering.com/TALOS/documentation/flexver_intro.pdf

Will be interesting to see how this plays out!

Do fear the Reaper: Huge army of webcams, routers raised from 'one million' hacked orgs

You wouldn't let your pet do this...

Perhaps it's time to start fining IoT owners if they let their oh so cute little IoT device poop all over DDoS the Internet? Same way we regulate dog / cat owners to make sure that they can enjoy their pet without forcing everyone else to clean up after it?

Wanna exorcise Intel's secretive hidden CPU from your hardware? Meet Purism's laptops

Re: Disabled? Yeah, right...

Yes, it's called the Platform Security Processor (PSP for short). Given AMD's track record of (not) keeping key material secret I'd expect it to be hacked at some point, and not in a good way....

Disabled? Yeah, right...

What everyone seems to be overlooking here is that "disabled" is not really "disabled". The ME is integral to the x86 boot process and always, always runs.

What Purism is using here is the kill switch for the second level of ME services, akin to userspace on a normal Linux computer. The ME kernel still runs and is still required for bootup, even if it goes offline afterward. This means the machine is still just as vulnerable to preinstalled / evil maid type malware targeting the ME as it ever was.

Purism really needs to be more clear on just what they are doing. They keep making grandiose claims that are not 100% true and compromising everyone's security as a result.

In current affairs news: Teen boffin with lots of potential crafts electric honeycombs out of oil

That one already has a solid explanation as a hexagonal resonance due to the difference in cloud speeds at differing latitudes. Apparently Saturn's atmosphere has just the right viscosity (or lack thereof) to allow it to happen.

There's a physics demo floating around also showing the resonance using a spinning bucket and some water. No electric fields needed to explain that one!

Open your doors to white hats before black hats blow them off, US deputy AG urges big biz

"Balance between privacy and [national] security"

Yeah, right. The balance tipped away from privacy to "national security" (tracking, thoughtcrime, harassing polical opponents, etc.) at the advent of the information age. Before that, criminals put data beyond the reach of law enforcement all the time -- pretty sure fire, for instance, isn't all that new of an invention and that it works really well against incriminating papers. It's just that in the old days you actually had to bother tracking someone with real police work instead of just waiting to sift through mountains of data and cherry pick the crimes you wanted to prosecute without actually doing any work beforehand.

Nothing like making average law-abiding citizen's lives a bit more "exciting" (fending off identity thieves, having to prove innocence for crimes not committed, watching what you say and think in private), and also suppressing "unwanted public discussion", all for the sake of convenience when someone commits a crime, eh?

Patch alert! Easy-to-exploit flaw in Linux kernel rated 'high risk'

Apparently there is a workaround for high uptime systems:

sysctl -w vm.legacy_va_layout=1

No need for emergency patch / reboot; this stops the attack cold until you can reboot in a more scheduled manner.

From https://access.redhat.com/security/cve/cve-2017-1000253

Signal taps up Intel's SGX to (hopefully) stop contacts falling into hackers, cops' hands

Yeah, but you only need to spend that couple million once as a state actor, and then you get access to pretty much all Intel SGX "protected" data, right?

And that's even assuming SGX doesn't have bugs like the ME, or that the ME isn't able to subvert SGX with the entry point being via one of the already public ME exploits...

Overall, I give Signal points for trying, but I'm not really sure this feature does what it says on the tin. Smells more like marketing and wishful thinking than a hardened solution.

Researchers promise demo of 'God-mode' pwnage of Intel mobos

Re: Actually, it is standing on a turtle

Yeah, I was being pedantic on purpose. Agree pretty much 100% with the rest of this. Intel and AMD will never allow it though since by the design of their systems allowing this level of control would make their DRM basically ineffective.

I assume you've seen Talos II? That machine does all of this but it's not x86...

Good to know. The X-Gene was recommended by a colleague but I've never actually tested one. The Qoriq I can vouch for though; built the firmware for it from source (i.e. with the proprietary network controller disabled).

Re: Actually, it is standing on a turtle

Well, technically it is on a replaceable Flash device, the problem is that the CPU / PCH requires the firmware stored on that Flash device to carry a valid Intel cryptographic signature. Furthermore, you can't just delete the firmware since it's integral to system boot (the x86 CPU literally won't come out of reset without it).

If you want this level of control, the new POWER9 systems that are being released this year use essentially the proposed scheme. There might be a couple of ARM systems too, not sure. If you need x86 though, you're kind of stuck just living with the security problems -- rumor has it that even Google couldn't get Intel to provide chips without mandatory signed ME firmware....

Applied Micro X-Gene, NXP QoriQ, Raspberry Pi 3, etc. Not everything is a phone...

The difference is that, unlike x86, you can choose to purchase hardware where you are actually in control. It's not a magic guarantee that all ARM hardware puts you in control, just that options exist.

Re: Asus?

Intel AMT is an optional module that runs on the ME. You still have the ME, but dodged a bullet with your current hardware because it's an older ME version that doesn't (yet) have a public "God-mode" exploit.

Does your firewall have known backdoors (cisco, et al)? Does it, perchance, use an x86 processor with a vulnerable ME (i.e. more firewalls than you might think)? Do you use Windows (especially W10)?

If you can answer no to all of those questions, you might have a chance so long as no other box on the internal network is ever hacked. In all honesty though, if this is as big as it could be, it's time to get new hardware. Think long and hard as to whether you need x86 (or modern x86) when replacing it...

Re: trusted computing platform

Exactly! What really surprises me though is people that should know better that just keep on going for the most convenient thing, even though it means loss of privacy and more expense later on to buy new "fixed" hardware that'll even then only be reasonably secure for another year or two.

Then again, the number of people that apparently don't care about W10's maximum telemetry setting enough to actually change it is quite unsettling....

Why all the downvotes? Lots of Intel employees / shareholders on this forum? :-S

Before downvoting, why don't you take a deeper look into the ME and the PSP. You might not like what you see (even the "disable switch" linked earlier doesn't prevent this new attack, BTW)...

It becomes an x86 problem because the two x86 vendors:

* Made its use mandatory (i.e. it can't be completely turned off or even have its firmware replaced outside of an official update from Intel/AMD).

* Gave it the highest possible privilege level in the system.

Furthermore, in a more general sense, both of these vendors misled consumers about "Disable" (hint: it's integral to both the platform and various DRM schemes). "Disabled" in the EFI interface just means "running in the background without advertising itself to the OS". There is no way to disable it on x86 platforms, whereas e.g. ARM allows an individual with proper access to disable / replace the TrustZone firmware and platforms like OpenPOWER keep the BMC as a separate, open-source compatible component without an elevated system privilege level.

Like it or not, this is an x86 specific problem, and it all comes down to both sides of the duopoly deciding that DRM was more important than your security. This probably won't even make a dent in their consumer sales, so from a business POV it's a smart move.

Keep hearing more and more of this. AMD likely has similar issues waiting in the wings once the PSP (AMD's ME analogue) comes under scrutiny.

Wonder what it'll take before people not stuck using Windows finally switch to something other than the x86 duopoly?

DRM now a formal Web recommendation after protest vote fails

Re: Oh really?

Is that copy DRM-free such that it can be freely and legally copied when the copyright expires? If so, that's great news (aside from creating a second Library of Alexandria), but if not, it doesn't help much.

Re: Oh really?

Thanks for the detailed explanation. I'm still somewhat new here so wanted to make sure I wasn't overlooking something.

While I also sit on both sides of the fence, so to speak, I'm not sure that dystopian future is really avoidable. The biggest problem is that circumventing the DRM is a felony, so by the time the perpetual copyright (120+ years over here) expires there is likely no chance the media will be available outside of illegal actions. I think in general content providers are smart enough to know not to compete with themselves (see, for instance, the Disney Vault), and it may be financially "smarter" to simply destroy the content versus allowing it to fall officially into the public domain.

Honestly, what I'd like to see is a linking of DRM with loss of copyright privileges -- if you choose to only distribute content with DRM attached then you don't have a copyright when the DRM is finally broken or the protection of things like the DMCA, while if you rely on copyright you have to sell at least one high quality version of the content to the public via non-DRMed media but you get full copyright privileges / DMCA protection. This would seem to balance both sides' needs far better than what we currently have, but alas these kinds of reforms are not possible due to the Berne convention (treaties are all but impossible to change). :-/

Linux, 'cause if you can't access common cultural content using a libre system something's amiss!

Re: Oh really?

Why the downvotes? What's wrong with my post?

Oh really?

How can it be cracked when the CPU controlling your CPU stops the information / program you are using to try to attack the DRM module? Remember, you can't trust your system either since it answers to the vendor and their partners, not you...

There will come a time and place where there is no way to access the cultural history of the West outside of an active rental agreement. We're real close now, but no one really cares and certainly no one is willing to actually a.) forgo content or b.) spend money to make DRM-free content.

Oh well.

Microsoft pitches encrypted Azure to keep cloud data secret

Suuuurrrrreeee......

....if you trust the great Data Slurp that is Microsoft not to have access via another method. Their over-reliance on Intel's black box, ME-controlled isolation technology is another major fail IMHO.

This changes nothing in terms of trustworthiness of cloud services! If you don't own the box and it's not under your exclusive physical control you really have no security to speak of with current technology.

Intel ME controller chip has secret kill switch

Re: I guess I know what architectures to avoid...

ARM and OpenPOWER systems both come in versions that can be trusted, at least far more than x86 can. POWER9 is due out shortly and should give x86 a run for its money hardware-wise; it remains to be seen software-wise what the uptake will be.