Hacker News Reader

Comment by openasocket | Hacker News Reader

That's a blatant misinterpretation of that article. Here's the main quote:

"According to a highly technical blog post, Positive Technologies experts revealed they discovered a hidden bit inside the firmware code, which when flipped (set to "1") it will disable ME after ME has done its job and booted up the main processor.

The bit is labelled "reserve_hap" and a nearby comment describes it as "High Assurance Platform (HAP) enable."

High Assurance Platform (HAP) is an NSA program that describes a series of rules for running secure computing platforms.

Researchers believe Intel has added the ME disabling bit at the behest of the NSA, who needed a method of disabling ME as a security measure for computers running in highly sensitive environments."

TL;DR the evidence is that the NSA made Intel give them a way to DISABLE the management engine on their machines, not a backdoor.

View on HN

I interpret that to mean that the NSA said "Add this and give only us a way to turn it off"

So, your comment is as good a place as any to put this. There's a ton of allegations about ME being a backdoor for the NSA or some other government entity, but very little in the way of good evidence, at least that I've seen. Many proponents seem to provide circumstantial evidence or simple accusations as opposed to what I would consider substantial evidence.

Here's some examples of solid evidence

- Leaked documents either from Intel or the NSA documenting the NSA pressing Intel to provide backdoors, and Intel accepting

- One of the APT groups believed to be associated with the US government is found using an ME vulnerability in the wild, before the vulnerability became publicly known

- Refusal or extreme reluctance on the part of Intel to fix a discovered vulnerability

- A vulnerability which is clearly intentional, like having ME automatically execute any shell script sent over the network signed with a particular certificate or something.

Examples of circumstantial, but still quite compelling evidence:

- A vulnerability which appears intentional, as in it doesn't require any buffer overflow or shell code injection or abuse of certain registers, but rather seems to be a part of normal operations.

- Intel pushes a change to fix an ME vulnerability, but that change simultaneously introduces another vulnerability.

- Evidence that Intel, while giving the US government the ability to disable ME, refuses to give such an ability to other large customers (Google, Amazon, other governments, etc.), for any amount of money.

Seriously, if someone comes forward with evidence like the above, I'm completely open to accepting the possibility Intel ME is an active backdoor for the US government.

Re: Evidence that Intel, while giving the US government the ability to disable ME, refuses to give such an ability to other large customers (Google, Amazon, other governments, etc.), for any amount of money.

I'm not intimately familiar with the situation but I heard some chatter a few years ago about Google (which likes to use Coreboot on its Chromebooks) asking Intel for documentation and source code for various firmware components including the IME and being turned down.

Researchers recently found an undocumented bit can be set in recent IME versions with a name ("High Assurance Program (HAP)") said to be associated with the US government which disables most functions of the IME.[1]

[1] http://blog.ptsecurity.com/2017/08/disabling-intel-me.html

I'm completely aware of the hap bit, I explicitly linked it in the GP, and so did the OP.

If you have a source to back up the claim that Google offered money for access/documentation for disabling ME and were rejected, that's something, though.

Ah, I was reading quickly and didn't realize that "while giving the US government the ability to disable ME" was a given, not one of the things that had to be shown.

I did some quick searching (I mostly skipped the coreboot mailing list which is probably the most interesting place to look but I didn't want to spend too much time) and every reference I've found alludes to someone from Google or Coreboot _asking_ for Intel's assistance in the form of documentation or source code, which Intel has plenty of non-NSA-related reasons to refuse to provide for free (licensed code, preserving competitive advantage, DRM shit, etc.). I couldn't find any references to anyone offering to _pay_ Intel for ME firmware source code or similar but then again such an offer would hardly be public. So this is weak circumstantial evidence at best.

I find AMD's refusal to cooperate with the FOSS community on the matter of its management coprocessor to be slightly suspicious as well as it's an area where it could possibly gain a significant competitive advantage vs Intel but a lot of Intel's reasons for keeping the IME locked down apply to AMD's insistence on black boxing its PSP as well.

I know, I didn't say that they found an NSA backdoor smoking gun, but it still seems suspicious to me that the NSA got to dictate anything about what should happen in ME. I remain a conspiracy theorist. I really don't see a market demand for all hardware since 2007 to have this built-in by both duopolists.

So the fact that the NSA doesn't like ME on their machines either is evidence that they put ME on the machines in the first place? Those two things are unrelated at best.

The NSA gets to dictate to Intel what it wants in the chips because the US government is an absolutely huge customer. Hell, Intel has an entire subsidiary devoted to selling chips to the federal government (https://washingtontechnology.com/articles/2011/08/30/intel-f...). And if the NSA says computers must meet these standards to be able to interact with classified data, well then Intel better make it possible for their chips to meet those standards or they stand to lose a lot of money. That's why they get a special kill switch for ME.

Which isn't to say that the NSA could use that influence to inject a backdoor. They can't refuse to certify a computer for handling classified information because the manufacturer didn't do something to their other computers.

If its good enough for the NSA its good enough for me. I want control over that bit, on my hardware. Why should I not have that? So far, I'm not hearing any good reasons.

First off, I completely agree. This really should be something you can disable, because often times it isn't used and it increases attack surface.

You can control that bit, as shown here: http://blog.ptsecurity.com/2017/08/disabling-intel-me.html . Of course, that method isn't documented or officially supported by Intel, and you could brick your machine if you mess up, so that's not exactly what you meant. I think Intel definitely should document it and provide official support. As to why they don't currently, I have some guesses. The first is general lack of interest: it costs money for them to support this new feature for everyone and make sure it plays nicely with everyone's setup, and maybe there isn't enough customer demand for the feature. The second is money: I wouldn't be surprised if they sell their chips to the government with the bit already set in firmware at a markup. Making that easily available to everyone means less money.

Reply on news.ycombinator.com