MINIX – The most popular OS in the world, thanks to Intel
networkworld.com
networkworld.com
>Google wants to remove MINIX from its internal servers
No, Google wants to remove IME from its internal servers. They don't care that it's MINIX.
>But MINIX has total and complete access to the entirety of your computer. All of it.
You mean IME.
MINIX is really cool operating system, even if it's being used for evil. But other operating systems are used for evil, too. MINIX has nothing to do with the fact that Intel put it on their secondary processors and ran a bunch of nasty services on it.
Or maybe he doesn't care, in which case, he may read : https://en.wikipedia.org/wiki/Nuclear_ethics
It sounds harsh, I know, but in the age of computers, these questions do matter (imho).
I am absolutely certain this comes with backing maybe even pressure from government surveillance bodies. You don't have it - you don't get a contract.
AMD does already follow suit and is not better by any means.
http://www.pvsm.ru/informatsionnaya-bezopasnost/262876
(you can use Google translator from the top of the page, to translate content from Russian to English)
On Monday, Positive Technologies researchers Dmitry Sklyarov, Mark Ermolov, and Maxim Goryachy said they had found a way to turn off the Intel ME by setting the undocumented HAP bit to 1 in a configuration file.
HAP stands for high assurance platform. It's an IT security framework developed by the US National Security Agency, an organization that might want a way to disable a feature on Intel chips that presents a security risk.
The Register asked Intel about this and received the same emailed statement that was provided to Positive Technologies.
"In response to requests from customers with specialized requirements we sometimes explore the modification or disabling of certain features," Intel's spokesperson said. "In this case, the modifications were made at the request of equipment manufacturers in support of their customer's evaluation of the US government's 'High Assurance Platform' program. These modifications underwent a limited validation cycle and are not an officially supported configuration."
We can all rest easy now that Intel has come out and public said this, right?
And this has already been added to me_cleaner [2] as --soft-disable option 2 months ago.
[1] http://blog.ptsecurity.com/2017/08/disabling-intel-me.html
[2] https://github.com/corna/me_cleaner/commit/ced3b46ba2ccd7460...
The promise of dollars makes men do odd things.
So at least Android still ships in more devices.
If we're all MINIX users, then Linux is a major player in the smartphone market and BSD is crushing the laptop market.
Intel would have picked it for it's high reliability (e.g it can survive critical driver bugs without rebooting).
The official application of ME is, well, about managing the hardware. This means it has to work with lots of different components, including coordination of the resources available. When you think of it, that's pretty much the definition of an OS. Instead of writing their own one, they decided to use one of the ones already available.
- Can not see what that operating system is doing
- Can not read the source code for that operating system
- Can not stop or manage that operating system
- Can not upload/change/edit anything to do with that operating system
Rather, these are symptoms of specific implementations.
[0] http://spritesmods.com/?art=hddhack&page=3 [1] http://appleinsider.com/articles/13/03/01/apples-lightning-d...
However with ME and PSP they have complete access to everything you do on your computer. It can record your screen, monitor your traffic, connect to the internet, etc
It's a very useful feature for large enterprises, and pretty much only for them. The interesting question is why doesn't Intel charge "enterprise pricing" for the feature, just like they do for stuff like ECC?
IPMI is not integrated into the main CPU, so you don't have direct ability to control the state of the main CPU, but (depending on implementation) you'll be able to access sensor data, operate on the sensor data logs, get a console etc.
With a properly set up system it means you have a standard way to attach, request a reboot and and interact with the system remotely.
Also, related: http://spritesmods.com/?art=hddhack&page=1
How could Intel/AMD reasonably communicate this to customers and have it taken at face value?
"Here's a flag to disable this black box we ship in every CPU. The product design and source code are proprietary, so please take our word for it that this flag disables everything."
There was a blackhat talk on embedding malware in SMM and triggering it with a magic number written to a register to escalate the process privileges. [0] So there will always be suspicion of special triggers to re-enable the black box that you turned "off"
I think there is a very slim chance that Intel and AMD can regain credibility when it concerns the IME/PSP.
Especially after it emerged Intel created a special ME disabled mode intended for US agency customers. [1]
[0] https://youtu.be/lR0nh-TdpVg
[1] https://m.hardocp.com/news/2017/08/30/how_to_disable_intel_m...
You're referring to something deeply embedded in silicon and firmware. This isn't a separate device you can easily depower through a jumper.
What about a laptop or tablet where there is no user accessible jumper?
A jumper on a laptop is not impossible. But to be honest, I haven't seen one in my Thinkpads.
Just turning it off is hardly a guarantee that it'll stay off forever. Remove the entire component physically and I'll know it'll never be running in the background.
Interesting Atom boards mentioned in the talk: https://minnowboard.org/
P.S.: I haven't observed the prompt "Press <CTRL-P> to enterIntel®MESetup" during boot.
Besides not being able to turn it of, it actually seems like a nice enough offer, I just never heard of anyone using it.
Is there a demo of the ME somewhere?
Pretty great talk from 32C3 about Intel ME https://media.ccc.de/v/32c3-7352-towards_reasonably_trustwor...
If you ignore all that, then Intel ME actually seems rather useful, for a subset of users, specifically organisations with large numbers of machines deployed. Still I'm not sure that even the target audience of ME is actually using it, so it seems like a huge waste of time and money from Intel perspective.
It's probably cheaper for Intel to ship the same ME on every motherboard than to customize it endlessly.
Likewise, I have had him email me to tell me that a hard drive in one of the hardware RAID arrays had failed. No main OS involvement.
There is a use-case for this stuff. What is evil is how it is switched on all the time on everything when that is unnecessary.
But seriously, the Tannenbaum stuff (book, code) was really impressive, if painful to do on 3.5" floppies.
I'm just assuming that by now, we'd have something better for embedded OSes in one of the most central computing approaches used in the world.
This article seems to be trying to fluff up ME by defending MINIX (is it MINX3? that's cool, but still doesn't make ME sit right).
A bridge isn't considered safe until it collapses, it is considered unsafe until it has been shown that according to our current understanding of physics and material properties, it can be expected to hold up.
The same should obviously apply to software and computing hardware.
FUD is when you deliberately avoid getting an accurate picture of the uncertainty/danger so as to paint as bleak a picture as possible and thus induce gratuitous fear.