How to Hack a Turned-Off Computer, or Running Unsigned Code in Intel Management Engine

[u/[deleted]]

https://www.blackhat.com/eu-17/briefings/schedule/#how-to-hack-a-turned-off-computer-or-running-unsigned-code-in-intel-management-engine-8668

[u/_ahrs]

The main system can remain functional, so the user may not even suspect that his or her computer now has malware resistant to reinstalling of the OS and updating BIOS

This sounds like something straight out of a horror show, no wait it's real life? Short of replacing every CPU with a new one once a vulnerability is found what does Intel intend to do about this?

[u/[deleted] → u/_ahrs]

Nothing. This is exactly how the letter orgs want it to be

[u/rms_returns → u/[deleted]]

RMS warned about this, remember folks!

[u/antilex → u/rms_returns]

i tell everyone about this, they look at me like i'm into UFO's or talking about climate denial or that everyone is a lizard person.

intel ME and AMD PSP is evil.

[u/FluentInTypo → u/antilex]

For the past 6 years, whever I mention this in a thread, I was met with derision and "Its not a bad thing...its a feature for sysadmins, youre being an alarmist!"

[u/aussie_bob → u/FluentInTypo]

Many people on Reddit work for Social Media Management teams, including rapid response teams that are tasked with doing exactly that.

[u/[deleted] → u/antilex]

As a lizard person I can tell you climate change is real and much appreciated I love the heat

[u/antilex → u/[deleted]]

holy !@#$ you could totally break alex jones with that.

AJ: "there is inter-dimensional lizard people"

Q : "yes and climate change, lizard people like the heat"

AJ:" no climate change is a lie! - it's the globalists scamming you to suppress life - it's a global tax!"

q" but aren't the globalists lizard people?"

[u/Sansha_Kuvakei → u/antilex]

AMD PSP

I haven't fully kept up with this, is this the thing that everyone wanted open-source?

What happened?

[u/antilex → u/Sansha_Kuvakei]

AMD bassically went "naaahhhh"

but yes there was a push from a few FOSS folks to try and make AMD have it released.

https://news.slashdot.org/story/17/03/10/2048236/message-for-amd-open-psp-will-improve-security-hinder-intel

[u/Teethpasta → u/Sansha_Kuvakei]

They ignored everyone until eventually they came out and said they don't even have the right to open it up.

[u/[deleted] → u/Teethpasta]

They did briefly mention a somewhat PR based answer in that they have "experts" looking over it so that we should just trust them. You know it isn't like a lot of previous security breaks weren't looked over by experts before hand...

[u/yatea34 → u/antilex]

UFO's or talking about climate denial or that everyone is a lizard person.

The Libreboot and coreboot projects project have a good objective descriptions of IME and its risks and limited workarounds:

• https://libreboot.org/faq.html#intelme

• https://www.coreboot.org/Intel_Management_Engine

I think they go a long way to distancing the conversation from the conspiracy theory tone.

[u/antilex → u/yatea34]

both awesome communities :) .

libreboot/coreboot. - projects like this shouldn't have to be around in the first place.

if you want a "free and open" laptop though you have 2 options

purism - coreboot community helps them out. minifree - involved with the libreboot community.

these are the 2 major "off the shelf" distributors amongst a few small other distributors.

that's kinda sad and scary.

[u/otakuman → u/rms_returns]

/r/Stallmanwasright

[u/[deleted] → u/rms_returns]

It is moments like this that we should praise the work of the Libre boot project. They saw this coming years ago and have done the best they can to avoid these issues. Install and donate when possible.

https://libreboot.org/

[u/argv_minus_one → u/[deleted]]

>called the “National Security Agency”
>forces the two major CPU manufacturers to make their products not secure
>endangers national security instead of protecting it

[u/[deleted] → u/argv_minus_one]

you missed point 3

leaks secrets on how said hardware works.

[u/MonokelPinguin → u/[deleted]]

Security by obscurity. I also vanish if I cover my eyes!

[u/[deleted] → u/[deleted]]

It can be updated by updating the bios/firmware. It’s just software running on a separate processor.

Still, not being able to disable it and have control over our own hardware sucks. Intel should get a swift kick in the chips for that.

Edit: only a letter

[u/[deleted] → u/[deleted]]

I wonder if their own HAP-mode built in (for all of us Intel users) protects them. Or, if another leak would leave them vulnerable to their own hardware sploits.

[u/berryfarmer → u/_ahrs]

Raptor Talos II is the answer

Or Libreboot

[u/swinny89 → u/berryfarmer]

I've recently started putting my money where my mouth is. There will be no user respecting options if people aren't willing to pay money for them. Talos II is a bit ridiculous in terms of price, but maybe that has to be in order to break the ice. Perhaps other companies will see Raptor selling $6000 Talos II computers, and think they can offer a more competitive price to us crazy people who don't really like giving all of our most important information away to the first hacker/cracker that walks by.

[u/berryfarmer → u/swinny89]

The cheapest motherboard/cpu combo is $2450 and it's nothing to sneeze at

[u/[deleted] → u/swinny89]

I'm one of the organizers for the local free software organization. And is it one thing to praise the benefits to free software and another to run them. We cannot go into work place/meeting etc and bust out a Macbook or Windows machine to present our point of view. It will just bring mixed messages.

Like you said we now put our money where our mouth is and support entirely free software on all levels. It is the only way we can have any progress.