“We have obtained fully functional JTAG for Intel CSME via USB DCI”

I think it's even more sinister: I would argue that a higher percentage of users on HN might be sworn to secrecy about any knowledge they might have anyway.

So you end up with very smart people who're either sworn to secrecy or who aren't; those who aren't are asking questions (and very few have answers, and those answers are partial or incorrect). Those who are can't answer them honestly or fully.

I know we're used to "Internet speed" and the tweet happened an entire 24 hours ago, but give it a bit of time before declaring it dead. Wired and Vice need a second to write it up, and see if it hits the mainstream before declaring the issue ignored.

Not saying it will get picked up, though I sure hope it does, but as you point out, it's a bit obscure and takes some explaining.

Still, there are numerous reports that the Facebook app on your phone listens to every word you say to show you ads for things you were talking aboutm but on HN and other web forums, there are always an element of disbelief. We may believe that it must be something else - correlation to web searches from the same IP, but there's never been proof one way or the other. (A Facebook exec's claim doesn't count as proof.)

So there's a section of people that believe they already have high resolution recording devices that we take into to bed. What's one more?

(Typing this, very gratefully, from an ARM Chromebook.)

Imagine, Intel were a Russian company. Tomorrow, there would be a simple and clear [screaming] headline similar to "Russians hacked the election" (general public doesn't need to know or understand how the network, computers or elections actually work). The day after tomorrow it would be illegal to buy anything Intel.

The way I see it is Intel ME is a processor-level application that has full control of all computer activity and cannot be blocked or disabled and can be accessed and controlled remotely.

Would like to hear other people's opinions of what it is.

https://www.digitaltrends.com/computing/intel-kaby-lake-skyl...

"As shown in the presentation by security researchers Maxim Goryachy and Mark Ermolov, one way of accessing the JTAG debugging interface" "is to use a" "hardware implant" "running Godsurge" "which can exploit the JTAG debugging interface. Originally used by the National Security Agency -- and exposed by Edward Snowden -- Godsurge is malware engineered to hook into a PC’s boot loader to monitor activity. It was originally meant to live on the motherboard and remain completely undetectable outside a forensic investigation."

Emphasis mine.

But this all was in January:

"The claim was made during a presentation" "which showed how hackers could use a cheap device to gain access to a debugging interface embedded in hardware."

What's the news now compared to then?

EG tool: https://github.com/corna/me_cleaner

List? https://github.com/ransom1538/intel_me_cleaners/

It's that even those of us that care vehemently, have no recourse. It is impossible to fight a secret police state.

Sure, if by one day you mean - for the past 10 years? And if by spy cams you mean - A product with official documentation from the vendor, and similar to other products from other vendors. And these products can be purchased by anyone.

You have some valid points, but they are clouded by your sweeping generalizations and needlessly polarizing language.

I do care, a lot. I have decided to avoid Intel (and AMD) hardware like the pest. I will not buy any Core iSpyOnYou or AMD equivalent anymore. I'm an advocate of economic and judicial sanctions from the political level against Intel (and AMD). I tell people around me about the problems and explain how it is an issue of privacy, security, national sovereignty, and market power abuse.

I'm looking for a desktop computer for my day to day use that comes without compromised hardware. The Raspberry Pi 3 works quite well, but doesnt work without non-free software. I successfully installed Debian onto my A20-OLinuXino-MICRO, but the GUI doesn't start. I'm looking for Hardware without Intel Hardware, without non-free software, mainline Linux support and preferable Debian compatible. The OpenPower system by raptor engineering is simply too expensive. I cannot afford it. Any ideas?

Most people do not have any concrete notion about what management engines are. People weren't that skeeved out by Alexa, and that was a pretty easy-to-understand system. There's no way that people will have any kind of personal connection to something that they barely are aware of and don't understand.

Not really how I think of it. Seems more similar to waking up one day and realizing Tesla controls your Tesla car remotely. Or Microsoft can push bad updates Windows. Or Google can push bad updates to Chrome.

> And yet we really don’t seem to care much. Lesser issues generate national outrage and high volumes of press coverage. Why?

On my end it's because I have not seen a single shred of evidence that it has been used for spying, and because I figure the moment anyone becomes aware of that happening, people would probably find a way to block the network traffic at the router or somewhere else.

It is not just a matter of apathy. They get violently ill at being told to think about protecting themselves. If you tell them not to put their debit card into an ATM without giving the card reader a tug to see if its real first for example, they'll do it wrong anyway just to spite you. It isn't that giving the tug is hard or that it isn't wise, but they simply do not want you to be right or have to think about it.

Admitting that you are right about that one little thing means they have to deal with all the other issues that you brought up as well. There is probably an interesting field of psychology to be researched with just that phenomena alone. I don't think this is just the people I know personally because I've encountered a lot the public who has this mindset as well. It is how we got ourselves into these problems in the first place with no recourse.

I stopped sending the emails about a year ago because they asked me to. The reason stated is that no one cares about security and a number of them had already auto-forwarded me to the junk folder. Or, told me they saw my name and would skip my emails and not open them. I don't even feel like bringing it up again now that it is a going concern. They will continue to not care.

I find it frustrating.

EDIT: I've disabled Intel ME on my machines. I would offer to do it for others but they'd have to acknowledge it's something that concerns them to want that help, and they won't.

I think I am a bit out of the current state of events. Is ME short for management engine? If that is the case, what is the problem with it?

I can't help but to think of all those exploits that target anti-virus software.

The concern with the Intel ME is that it has a native network adapter. You can bet efforts are currently underway to discover how to exploit the ME remotely. THAT'S when things get scary.

Your paranoia is not unjustified. Personally, I am nervous that some of my systems have the ME. When attention turned to it about a year ago, i knew it would only be a matter of time before someone broke into it.

In white hats we trust :)

At least now that everyone can see the problem people can make informed decisions.

I thought this behavior disappeared ~10 years ago.

At the same time as "buy American"? You're aware that any American chipmaker will be gag-ordered to help the CIA?

- The masses actually care

- There is an alternative

Neither is the case here. Most people couldn't care less about things like ME and AMD and Intel are a oligopoly. If you want a modern x86-64 CPU you only have those two choices and both do this. That is the problem here, not fiat currency.

While the ME is worrying for many reasons, there's absolutely zero evidence that the Intel ME contains a backdoor.

Backdoors don't stay hidden forever.

I worked at Intel on ME and the things that came before it until around 2013. I can tell you two things --

1. No, Intel ME wasn't born out of a desire to spy on people nor was it -- to the best of my knowledge but I honestly believe I would know -- created at the request of the US government (or others). It was an honest attempt at providing a functionality that we believed was useful for sysadmins. If it was something done for the CIA, I believe it would probably have been kept secret instead of marketed.

2. It was initially going to be much "worse". Early pilots with actual customers -- such as a large british bank -- were going to run a lot more stuff -- think a full JVM -- and have a lot more direct access to the user land.) Security concerns scrapped those ideas pretty early on though.

In retrospect, I personally believe the whole thing was a bad idea and everybody is free to crap on Intel for it. But the thing was never intended as a backdoor or anything like that.

So they can mess with ME (dump its code, analyze it, observe how it runs, modify it live) as they see fit.

AMD have something similar so no help there.

A JTAG is a standard minimal serial port used for debugging purposes. You'll find them on nearly all embedded devices - routers, phones, TVs, refrigerator controllers... usually appearing as a set of two or three contact points. Sometimes they connect directly to a debugger.

In this case, it appears that at least some Intel CPUs have a JTAG on the ME that can be routed through the on-CPU USB handler, and thus physical access to the right USB ports can be used to access the ME.

Imagine that you have your high level program. When you execute it, it goes through a just-in-time compilation (whether that's script parsing or bytecode conversion, or actual compilation, or whatever) before reaching the CPU which actually executes your code. Now imagine that your interpreter has the capability of reading and monitoring everything you do.

Nothing wrong with that, it's supposed to do that, it's how it works. But imagine if it had an exposed, unlogged, unmonitored, API which allowed a third party to be able to interact with whatever you do. Say that it's there "for debugging purposes".

You want to encrypt an HTTPS session? This API allows them to grab your key without ever notifying you. Or, even if you use custom encryption, it allows them to grab your specific instructions and the data used in processing to reverse your encryption.

It allows a remote party to inject their own flow of execution into your program. So you're sitting there waiting for the next user event to occur in your event loop while, instead, the interpreter simply handed the whole event loop to a third party. They could inject user events for you to process that the user never actually performed; they could modify data in ways that you can never detect.

Except that it's not the interpreter. It's a side-channel, an additional hidden core on your CPU (it's actually a completely hidden and separate secondary CPU). Your processor still runs and executes your code. But another processor is simultaneously running and executing its own code with its own RAM that you can't access. It has access to your RAM as if it were a file open on your hard disk.

You can't disable it. You can't interact with it. It's even running when your computer is "shut off". If there's power on the motherboard, then this hidden processor is running.

That, in a nutshell, is Intel ME...

... This sounds _really_ paranoid and alarmist. But it's not all bad. Intel has usually done really well with "security through obscurity" in this case and there aren't many known exploits for Intel ME. That said, those that do or could exist, gain all of the capabilities of Intel ME.

Most people consider "game over" for physical access anyway, so I'm not sure that pwning it with physical access is a new problem; instead it's a secret basement in a bank; it's only a problem if someone figures out it's there and starts digging a tunnel to it.

Also, remember that a lot of motherboards these days come with built-in wifi or bluetooth adaptors. Intel ME has access to those too; you can't just rely on an upstream firewall for your physical ethernet. With the right (wrong?) exploit, all it takes is an adversary to be within directional antenna distance (which is actually really far) to be able to pwn your system. The best way to prevent abuse over that channel is to physically break the antenna connection (lol warranty voided because you've damaged your motherboard).

However, one thing that I've always felt conflicted about is why this feature is present in _all_ CPUs. Usually if someone wants to use Intel's AMT then they have a giant support contract with specialty hardware, so it seems odd that the core CPU feature necessary is present on all CPUs despite no user actually using outside of enterprise.

Is it because the bring-up, other low-level stuff, and things like PASP (DRM) were implemented on top of ME, and so it was not considered viable to re-do that on chips that didn't have ME (though I was under the impression that very early ME was not used for anything else)? Or was it just a matter of "it's easier to just use what we have for every chip"?

But given the already well-known threat model at the time this thing was conceived of self-propagating malware, creating a technology that is embedded in every single device with a desktop CPU that can't be turned off, makes the device unusable without it, and has remote compromise bugs that can succeed while the target is "off" was certainly a bad idea.

Seems irrelevant. The internet and smartphones were also not created by the CIA/NSA for mass surveillance, yet the 3 letter guys still uses those technologies for mass surveillance very successfully.

1. Many features have options to be disabled (e.g. bios settings). Why doesn't this, even to this day?

2. You may have been involved in implementation, but do you know why it still exists on every board regardless of backlash?

3. I am a bit ignorant, does the chip fabbing process justify putting this on every board instead of just on enterprise ones (especially since you can consider it a feature worth upcharging for)?

Pardon my skepticism, but its continued use without the ability to disable speaks to ulterior motives regardless of original implementation design.

Probably not a rubber stamp with "CIA" on top of the project documentation, but someone on the team could have been talking to the intelligence community and relaying specs or meeting details.

It's an obvious target just because of Intel's ubiquity and they are based in the US. You're kind of a bad intelligence agency if you don't try for backdoors to this level on processors running millions of devices world-wide. And the intelligence community has actively tried to stop good encryption from spreading while promoting bad encryption/RNG (forgive me for not knowing the details), and so it's pretty clear they are willing to compromise worldwide standards in favor of gaining an edge.

TIL about this detail. Where can I learn more?

EDIT: So this is now at 0 points. Interesting...

Next, download Minix and get a good handle on it. The next step is getting access to the Minix kernel on the ME, and after that, it'll be a case of who has the best apps for the CPU in their CPU.

There was no call nor need for an answer...