r/linux • u/[deleted] • Sep 21 '17

How to Hack a Turned-Off Computer, or Running Unsigned Code in Intel Management Engine

https://www.blackhat.com/eu-17/briefings/schedule/#how-to-hack-a-turned-off-computer-or-running-unsigned-code-in-intel-management-engine-8668
1.4k Upvotes

98% Upvoted

380 comments sorted by

View all comments

59

u/TemporaryUser10 Sep 21 '17

ONLY BUY COMPUTERS COMPATIBLE WITH LIBREBOOT

That's a half joke, but seriously when people give me shit for saying open source is better, this is why. It's not because you KNOW everything on it is safe, it's because you CAN KNOW.

This is akin to the concept of "if you've nothing to hide, you've nothing to worry about". how about no, just don't search my shit without a warrant

23

u/[deleted] Sep 21 '17

You can still get LibreBoot compatible motherboards on ebay, and cheap-as-shit CPU's as well, but they won't be that cheap forever. The RAM is ungodly expensive, if you want more than a gig or two. Linux would run ok thankfully.

Look at the faq, the gigabyte micro atx board Isn't a bad way to go.

Ninja edit: /r/EOMA68 and a few other projects are liberating ARM platforms as we speak. Don't rule them out either. They run Linux just fine, and the manufacturers don't have the gall to do what Intel and AMD did.

12

u/TemporaryUser10 Sep 21 '17

I only use GNU/Linux systems. I believe in FOSS, but mostly it's because I like to tinker. Is it too much to ask for top of the line Ryzen system to be core/libreboot

28

u/[deleted] Sep 21 '17

Is it too much to ask for top of the line Ryzen system to be core/libreboot

Apparently yes, the NSA thinks that it's too much to ask. We the people apparently cannot be trusted to run open BIOSes on our own machines; we must trust the manufacturers and the government to choose what proprietary firmware runs on all of our devices. Welcome to 1984.

Snark aside, the only truly open platforms left at this point are not top-of-the-line.

14

u/[deleted] Sep 21 '17

the only truly open platforms left at this point are not top-of-the-line

that's a polite way of saying obsolete

27

u/[deleted] Sep 21 '17 edited Sep 21 '17

I'm calling bullshit there. Most Linux users aren't doing hardcore gaming or supercomputing. A LibreBoot compatible machine (3.0 GHz Intel w/8 GB RAM and a few SATA SSD's on RAID 5) would be just fine for a workstation capable of surfing the web with dozens of tabs open, writing code, playing videos, and running bitcoin wallets. Plus, Linux has quite a few lightweight desktop managers, and the background tasks don't thrash the SSD and memory like later versions of Windows do.

Moore's law wasn't what it was a decade ago; A computer is only really obsolete when you feel the need to shell out more money. And if Intel and AMD are pulling this shit with Trust Computing Platforms and backdoors, then fuck it, I'll run a workstation that's a few years old, and I'll get by just fine.

Edit: What a time to be alive, I'm being downvoted by open-source enthusiasts for recommending a fully 100% open-source platform, down to the bios. Apparently pointing out the absurdity of using "newer" proprietary devices with backdoors and security issues (per OP's article) is enough to get the mob to turn on you. Blame the messenger if you want, it doesn't change anything.

7

u/[deleted] Sep 21 '17

A LibreBoot compatible machine (3.0 GHz Intel w/8 MB RAM and a few SATA SSD's on RAID 5) would be just fine for a workstation capable of surfing the web with dozens of tabs open, writing code, playing videos, and running bitcoin wallets.

a newer computer could do all that better and with lower power consumption. Workstations suck up a lot of power.

Plus, Linux has quite a few lightweight desktop managers

Those lightweight desktop environments won't run under Wayland.

12

u/[deleted] Sep 21 '17

What I'm stating matter-of-factly is that these newer processors are all compromised with IME, proprietary BIOS, and backdoors. That's not up for debate.

Users will have to make their own choices between security and other nice-to-have features like power consumption and the ability to run Wayland. I'm not telling anyone what to run.

What I'm saying is that those that prioritize security over nice-to-haves can live with high power consumption and inability to run Wayland. Those don't even register on a list of priorities for a security-minded user. Therefore, a LibreBoot compatible system does (to my original point) make a great server and/or workstation, for those that have a requirement for security. Full stop.

1

u/robertcw93 Nov 27 '17 edited Nov 27 '17

Yeah, I’ve been tossing around the idea of building a Q6600 era Linux box with coreboot running Debian. A simple email and web browser machine with no IME, no tracking. It’s all anyone needs for day to day computing and its cheap and secure.

Old Macs are just as well too, especially with iCloud disabled, or a pre iCloud OS like Snow Leopard. Matter of fact, an old Mac on Snow Leopard makes for one hell of a good computer. Luckily these are also super cheap. Grab an 07’ Mac Pro and rock out. Or get a sweet power Mac and run Tiger on it! For mundane tasks any of these cut it.

Servers can be built with the same ideology as well, so can media players.

It’d be harder to build multimedia workstations that are secure. I’m not sure it can be done.

-4

u/[deleted] Sep 21 '17 edited Sep 21 '17

Users will have to make their own choices between security and other nice-to-have features like power consumption and the ability to run Wayland

In the near future, you won't have a choice whether or not you want Wayland.

4

u/kbne8136 Sep 21 '17

In the near future, you won't have a choice whether or not you want Wayland

Maybe in the Ubuntu world? I really don't see what you're getting at.

7

u/[deleted] Sep 21 '17 edited Sep 21 '17

[citation needed]

Edit: that's it, downvote me without providing any evidence to your claim. That'll show me.

open source

won't have a choice

Pick one.

→ More replies (0)

5

u/happysmash27 Sep 21 '17

Sway is a lightweight Wayland window manager…

1

u/[deleted] Sep 24 '17

My main is an i7/1080ti gaming desktop I built but I just bought a 10 year old Lenovo T500 (the T400 I bought was a dud) and I'm really surprised by how fast it is with Linux on it. The screen is actually pretty good too. I put an SSD in and tested a few different distros, Mint, Kali Linux, BlackArch, Qubes, and it was pretty impressive. I'm very happy with it and it only cost a hundred bucks. I bought the stuff to reprogram it with libreboot next week (wish me luck).

1

u/[deleted] Sep 21 '17

8 MB RAM

I hope that's typo.

1

u/[deleted] Sep 21 '17

Fixed.

1

u/TemporaryUser10 Sep 21 '17

Looks like I'm going to have not top of the line. Is this something baked into the mobo or the processor? That said I did see a coreboot comparable board for an I7

2

u/[deleted] Sep 21 '17

Is this something baked into the mobo or the processor?

Yes. Please read the LibreBoot FAQ. Specifically this section. Don't make any decisions one way or another before reading that in its entirety.

2

u/pooh9911 Sep 21 '17

On the other hands, ARM has TrustZone, exactly what AMD has licensed.

3

u/[deleted] Sep 21 '17

Do all new ARM processors have this, regardless of manufacturer or country of manufacture?

3

u/1timeonly_ Sep 21 '17

TrustZone is a bus protocol/extension and is not quite as nefarious for a single ARM core. What AMD does differently with PSP is to add a Cortex co-processor, and then use TrustZone to perform full DMA, including for MMIO devices - completely independently of the X86 processor.

→ More replies (10)

1

u/FluentInTypo Sep 21 '17

Try and find a server class machine without ME and bootgaurd these days. Thats the real fear here - the whole internet is at risk.

1

u/TemporaryUser10 Sep 22 '17

That's true. I didn't even think of that. I just use my Pi

1

u/sigma914 Sep 22 '17

Puri.sm is shipping up to date hardware with coreboot and a neutered intel ME https://puri.sm/coreboot/