Hacker News Reader

Comment by Chaebixi | Hacker News Reader

> I bet you that the next generation of Intel processors will have patched this workaround from working, and maybe go as far removing the ability to kill IME unless you use some kind of rotating encryption dongle. Unfortunately for consumers, there's no way to escape this as even AMD has their own IME.

What would be the justification for Intel going through all that trouble to do that (besides a conspiratorial "the NSA needs it to spy on everyone")?

The impression I've gotten, to this point, is that Intel just doesn't care enough about people in the general public who are bothered by the IME to publicly support ways to disable it. Governments had enough buying-power to get Intel to implement an unsupported workaround, but I'm not convinced Intel has a motivation to make accessing that workaround hard.

View on HN

> besides a conspiratorial "the NSA needs it to spy on everyone"

Besides the real reason? I dunno.

Do you have any specific evidence that the NSA is directly involved in pushing implementation of IME for the purposes of espionage? That's an extraordinary claim; the mere existence of the NSA isn't sufficient evidence that it's true.

Yes, the NSA exists. Yes, it's their job to spy on people. And yes, it's perfectly valid to include mass surveillance in your threat model. But these constant, uncorroborated claims that the NSA boogeyman is hiding behind every rock and tree are starting to become quite tiresome.

> the NSA boogeyman is hiding behind every rock and tree are starting to become quite tiresome.

Yeah indeed, they have backdoor-ed every ISP, nation, router, HDD, what-have-you in existence and these people keep telling boogeyman tales.

Tsk tsk tsk. How tiresome.

> they have backdoor-ed every ISP, nation, router, HDD, what-have-you in existence

This is exactly the kind of hyperbolic nonsense I'm talking about. You can't claim that every HDD in existence has an NSA-installed backdoor installed in it without providing any evidence.

If the NSA's capabilities were nearly as extensive as you're claiming, the US wouldn't need to bother maintaining a military. They could just remotely command all of North Korea's computers to shut themselves off, then sit back and wait around for their surrender.

I'm not saying mass surveillance isn't a problem, or even that the NSA doesn't have a backdoor installed in IME (I certainly don't have evidence to the contrary); just that people need to stop exaggerating the threat, or making claims about the NSA having compromised any specific system without providing any evidence to back those claims up.

https://www.theregister.co.uk/2015/02/17/kaspersky_labs_equa...

There is an equivalent article from Ars technica, if "theregister" isn't to your liking.

As for the evidence on routers and Internet infrastructure, you should pay more attention to leaks of state-sponsored tools, like the equation group leaks and the CIA one.

"possibly tens of thousands of Windows computers" is not anywhere near the same thing as "every HDD in existence".

Remember when the NSA crippled a standardized CSPRNG ? http://www.reuters.com/article/us-usa-security-nsa-rsa/exclu...

Remember when the US shut down NK's internet ? https://gizmodo.com/so-who-shut-down-north-koreas-internet-1...

Remember when the NSA was revealed to have a malware that could infect hard drives, being potentially undetectable ? https://motherboard.vice.com/en_us/article/ypwkwk/the-nsas-u...

Remember PRISM ? How about stuxnet, and the other couple of viruses that are almost surely the NSA's.

Sure, those are not backdoors installed by the OEM, rather they are malware that the NSA can use to infect (lots of) systems. But let's not kid ourselves, the NSA does have a ridiculous amount of power, and we have lots of evidence of it.

At this point I'd be rather surprised if the NSA haven't hacked my fridge yet somehow.

And I agree, those are some pretty impressive feats. Whenever your threat model includes state actors, it's probably not a bad idea to be paranoid. Let's not carry that paranoia to ridiculous extremes though.

_Could_ the NSA have the ability to utilize IME somehow as a means to infect computers? Certainly. Do they _actually_ have that capability? We have no idea. Same goes for your motherboard's firmware, your hard drive's hardware, and any number of other possible vectors. They _could_ be compromised somehow, yes, but let's not claim that any specific motherboard firmware, HDD model, or CPU processor brand definitely _is_ compromised without evidence.

That is a very naive view.

The Intel IME is far different than 'rock and tree' to an organization of 40k employees and $10B budget tasked with bypassing stuff like the IME.

You know whats tiresome? Fighting for control over your own hardware.

Do you want to live in a free society or not? Because this is not acceptable to a free society.

I don't see how that's related to my comment. I'm not discussing whether IME is a good idea or not, I'm just objecting to the unsubstantiated claim that the NSA is involved in pushing it.

Actually: It is quite well substantiated that the NSA has a mandate to usurp, and has factually usurped all technology in its purview, for its purposes - i.e. American information technology corporations, manufacturers, and so on, are bent to its will - it is treasonous for Intel to allow IME to be completely disabled, cf., the Yahoo case against NSA, etc.

The fact of secrecy around this issue is the only thing to be doubted. Its no secret to non-Americans/concerned citizens; if you choose to continue to be ignorant, I choose to set you the challenge: go and find out for yourself just how bad it really is with the NSA. (It is atrocious.)

Yeah, most likely, IME was developed for a completely legitimate purpose of administering PCs without special software.

The idea of the NSA working with a major components supplier isn't an extraordinary claim. Intel will have a major presence in all sorts data centers of interest to the NSA.

If I were an American and believed in what the NSA was doing, I'd want to know what they were doing with their budget if they didn't at least try to get a hardware back door into Intel CPUs. Why waste budget on finding exploits in patchable software when they can go straight to the silicon?

It's absurd to suggest that the NSA is the guiding hand behind the IME. For one thing, the enterprise use cases for the thing are quite obvious, so it's not like the NSA would have had to compel Intel to design and implement it in the first place. And if there weren't a demand for it, there's no way the US government could COMPEL them to make the business decision to undertake a massive change to their core product. Nor could they realistically bribe them to do it, not because the government lacks access to funds to make a sufficient large hypothetical bribe, but because Intel is a huge publicly traded multinational. How many employees do you think worked on the IME? How much money do you think it cost? Maybe the NSA has access to some unaccountable billions to throw; would Intel be able to explain that windfall in its books? Perhaps. But how many people would have to keep quiet in perpetuity about all of this? It just keeps stretching believability the more you think about it, like all conspiracy theories that involve more than a handful of actors.

Some people seem to be in denial about NSA. The body of evidence about the ties to private industry via programs like Prism and others is overwhelming for anyone with the barest curiosity.

Why would Intel go through all the trouble of creating ME or the broke AMD PSP at around the same time? This is hardwired in silicon, is not cheap to do and definitely needs huge business justification to initiate, implement and maintain. What's the business case?

Are they charging a premium for these features and disabling it for everyone else as they would if it was actually a 'premium' feature? Are they giving an option to those who don't want it to disable it without ado?

No, they are pushing it on everyone. That itself compromises ME. How do we know there is no NSL in effect forcing both Intel and AMD to implement this. Nobody does. But it is an intrusive piece of tech that has complete authority over your PC.

> What would be the justification for Intel going through all that trouble to do that (besides a conspiratorial "the NSA needs it to spy on everyone")?

Well, some companies and users use the IME to enable theft-prevention technology. If you can circumvent the IME, you can easily steal a laptop and disable this theft-prevention technology.

If that’s worth building an ever more closed walled garden is another question.

> besides a conspiratorial "the NSA needs it to spy on everyone"

Isn't the ability to spy on everyone the official mandate of the NSA?

Pretty much. That's the NSA's mandate though, not Intel's.

They don't have a need to spy on everyone, just a compulsion to.

The HAP bit will probably at the least remain since it's part of the NIST assured computer program.

Reply on news.ycombinator.com