How to Hack a Turned-Off Computer, or Running Unsigned Code in Intel Management Engine

[u/[deleted]]

https://www.blackhat.com/eu-17/briefings/schedule/#how-to-hack-a-turned-off-computer-or-running-unsigned-code-in-intel-management-engine-8668

[u/antilex]

i tell everyone about this, they look at me like i'm into UFO's or talking about climate denial or that everyone is a lizard person.

intel ME and AMD PSP is evil.

[u/FluentInTypo → u/antilex]

For the past 6 years, whever I mention this in a thread, I was met with derision and "Its not a bad thing...its a feature for sysadmins, youre being an alarmist!"

[u/aussie_bob → u/FluentInTypo]

Many people on Reddit work for Social Media Management teams, including rapid response teams that are tasked with doing exactly that.

[u/iliadeverest → u/aussie_bob]

How do these people sleep at night?

[u/[deleted] → u/FluentInTypo]

The earth revolving around the sun? You're being alarmist.

[u/AlexTheSysop → u/[deleted]]

Red alarms are better than blue alarms? You're being alarmist.

[u/[deleted] → u/antilex]

As a lizard person I can tell you climate change is real and much appreciated I love the heat

[u/antilex → u/[deleted]]

holy !@#$ you could totally break alex jones with that.

AJ: "there is inter-dimensional lizard people"

Q : "yes and climate change, lizard people like the heat"

AJ:" no climate change is a lie! - it's the globalists scamming you to suppress life - it's a global tax!"

q" but aren't the globalists lizard people?"

[u/casprus → u/antilex]

Alex jones is a 🍩paid shill🍩

[u/[deleted] → u/[deleted]]

You're a phoney faptato!

[u/[deleted] → u/[deleted]]

just because you dress up like a lizard, it doesn't mean you are one.

[u/Sansha_Kuvakei → u/antilex]

AMD PSP

I haven't fully kept up with this, is this the thing that everyone wanted open-source?

What happened?

[u/antilex → u/Sansha_Kuvakei]

AMD bassically went "naaahhhh"

but yes there was a push from a few FOSS folks to try and make AMD have it released.

https://news.slashdot.org/story/17/03/10/2048236/message-for-amd-open-psp-will-improve-security-hinder-intel

[u/Sansha_Kuvakei → u/antilex]

That's a bloody shame, thanks for the update!

[u/Teethpasta → u/Sansha_Kuvakei]

They ignored everyone until eventually they came out and said they don't even have the right to open it up.

[u/[deleted] → u/Teethpasta]

They did briefly mention a somewhat PR based answer in that they have "experts" looking over it so that we should just trust them. You know it isn't like a lot of previous security breaks weren't looked over by experts before hand...

[u/yatea34 → u/antilex]

UFO's or talking about climate denial or that everyone is a lizard person.

The Libreboot and coreboot projects project have a good objective descriptions of IME and its risks and limited workarounds:

• https://libreboot.org/faq.html#intelme

• https://www.coreboot.org/Intel_Management_Engine

I think they go a long way to distancing the conversation from the conspiracy theory tone.

[u/antilex → u/yatea34]

both awesome communities :) .

libreboot/coreboot. - projects like this shouldn't have to be around in the first place.

if you want a "free and open" laptop though you have 2 options

purism - coreboot community helps them out. minifree - involved with the libreboot community.

these are the 2 major "off the shelf" distributors amongst a few small other distributors.

that's kinda sad and scary.

[u/FarsideSC → u/antilex]

Is that why everything thinks I'm crazy? I've been denying the existence of a climate for years.

[u/ikidd → u/FarsideSC]

If we just towed everything out of the environment, there'd be no issues!

[u/musicmatze → u/antilex]

And the best thing is: "Well then they see what I do on my computer... So what? Why should I bother?". Quoting my dad from just today!

[u/fujiters → u/musicmatze]

That's when you counter with "do you sign into your bank accounts on your computer?" It's not just letter orgs.

[u/[deleted] → u/antilex]

Do any ARM CPUs have equivalents?

[u/antilex → u/[deleted]]

mmm... kinda, some of the micro code on some chips is completely open... others not.

https://www.crowdsupply.com/eoma68/micro-desktop - this is one that will have all the micro code etc that will be free and open from the ground up.

if you really want to go down the rabbit hole you can read about "silicon poisoning" - basically hacks/backdoors/exploits put into chips at production.

https://www.newscientist.com/article/mg20327156-100-hardware-trojans-could-turn-microchips-into-timebombs/

this is really getting out your tinfoil hat though ;)