Hacker News Reader

Comment by sounds | Hacker News Reader

In case you haven't already used the following, please note that the NSA had an undocumented "backdoor" included which "disables" the ME. (Man, oh man, I wish I was making this stuff up.)

http://blog.ptsecurity.com/2017/08/disabling-intel-me.html

I put quotes around "disables" because the ME is not fully disabled. The blog's analysis does show how it is in a "safe" state, i.e. forced to ignore the outside world very early in its code path. Also, not likely to brick your computer, assuming unscrewing your case and using a SPI flash programmer hasn't already bricked your computer.

Edit: "backdoor" in quotes too.

View on HN

You should also put "backdoor" in quotes. It's not a backdoor in any meaningful sense; it's just an undocumented setting that allows them to (mostly) disable the ME on their machines.

It's quite the opposite of a backdoor. It's "locking" their own backdoor that probably stands wide open on everbody elses house.

On the other hand, I like the irony of a backdoor having a backdoor.

It's backdoors all the way down!

"cat flap"

... which itself contains a flap for mice.

How do we hack our computers to be secure?

You can do this fairly easily with me_cleaner[1] which also does a lot of other disarming of ME.

[1]: https://github.com/corna/me_cleaner

I found the relevant flags:

--soft-disable-only

and

--soft-disable

https://github.com/corna/me_cleaner/commit/d5705b62f802fdf1c...

cmon, too much miss-information to ignore you... the ability to remove the firmware partitions is in no way or form a "backdoor", also you don't need an SPI programmer to perform the mod and the number of partitions you can remove depend on the version.

I don't think the High Assurance Platform (HAP) flag removes any firmware partitions; it just doesn't start certain processes.

which allow you to remove the partitions... otherwise you end up with the 30min reboot.

If there is a "safe" state, there's also an "unsafe" state and it was obviously introduced knowing it might be unsafe, otherwise there'd be no "safe" state.

Long story short, it's not a backdoor but a key to a backdoor which implies there is a backdoor.

ME is the backdoor - it's unsafe by default meaning it can be used to inspect/control your machine remotely. That, AFAIK, is it's primary and stated function!

False. ME by itself does not do any remote communication whatsoever. Zero external attack surface. Different story for vPro, but you can disable it.

It's a great place, however, to gain persistence after an initial compromise as the talk shows.

Do you have proof that the ME does not do any remote communication and has zero attack surface? Be sure to include "internal" attack surfaces that may be accessible from malware in ring 0.

I was talking about the external attack surface, and there's absolutely no indication that ME has any such attack surface as far as software vulnerabilities go. They could have built a deliberate backdoor into the network code, but that's highly unlikely.

It obviously has a lot of internal attack surface, which is bad enough.

I also assume it's the backdoor but with this piece of info (there is a "safe" state") the Intel people cannot legally claim they didn't know it was unsafe, so stupidity is ruled out (as in the saying never attribute to malevolence ...)

The last missing piece is now whether ME was actively put there to enable a few agencies to gain unauthorized access.

That's also from Positive Technologies, the people giving the presentation at Black Hat.

This reminds me of how no one cared about 40-bit crypto in the 1990s because only the NSA can break it, to take one example. Even Snowden's NSA leaks are often relatively old. This is part of why I dislike the debt-based economy. The more money the NSA spends, the more government debt is created.

Reply on news.ycombinator.com