Hacker News Reader

Comment by winter_blue | Hacker News Reader

Woah, I didn't know this existed! This is really serious. Why aren't people talking more about this?

There was a CCC talk about it recently https://media.ccc.de/v/32c3-7352-towards_reasonably_trustwor... and there is a good write up about it on Libreboot site https://libreboot.org/faq/#intelme.

With regards to why people aren't talking more about this, maybe fatalism is involved as it seems there is a certain inevitability that whoever controls the silicon also controls to some extent computers. There have been some interesting developments in people trying to create open hardware like lowRISC http://www.lowrisc.org/ and also using ARM so there is some hope in this area.

Intel ME has very useful legitimate purposes for existing. It's a very powerful tool for some people, and most people would call you a conspiracy theorist for suggesting that Intel, or someone who manages to get security creds from Intel, would misuse them break into your computer. I have also had allegedly advanced system engineers tell me that there is really no risk for an outside party being able to compromise your system with this technology, but I remain pretty skeptical of that claim.

In short, the overlap between people who know about it and are also security conscious is pretty small. There's also dozens of other things people should be more concerned about in terms of a corporate or state actor gaining unauthorized access to your computer.

I am much more afraid of non-state actors that would get access to back doors than state actors. The people at the NSA might not be angels but they have some sense of ethics and some controls, other people out there don't. What if someone like Snowden or the Walker brothers get access to it and make it open source or sell it to ISIS?

Discussions about it do exist. I first read about the dangers of it via the Libreboot website. As for why it hasn't had mainstream coverage, your guess is as good as mine.

In case anyone wants a CPU + FPGA combination without this type of security risk, check out Zynq.

I'm not convinced Zynq is much better. They just move the MElike functions on-die and call it TrustZone.

TrustZone is not equivalent to Intel ME. Software must be designed to work with TrustZone extensions, and that software is under the control of the user (as long as you run open-source operating systems). If the software you're running doesn't use any TrustZone extensions, then the TrustZone hardware will not be used.

Intel ME on the other hand is baked into the hardware, and AFAIK can't be properly switched off, it appears the best you can do is set up a fake Intel MPS Server to point it to:

https://software.intel.com/en-us/forums/intel-business-clien...

Well, AMT has been around since about 2005, and vPro since 2007. It's a favorite topic for some people on Slashdot to bring up. There's a hackaday article from about 2 months ago [1]. My theory is that it's a combination of factors.

- Introduced a long time ago; it's old news.

- It is talked about, but only in certain circles

- Confusion over the relationship between vPro, IME, and AMT, or at least unfamiliarity with those terms making articles/discussions related to them less likely to pop out as interesting topics.

- Some of the people who know about it consider it the normal, boring, status quo, and they react to anyone shocked by it as an alarmist.

[1]: http://hackaday.com/2016/01/22/the-trouble-with-intels-manag...

Reply on news.ycombinator.com