And to think that posting about Intel ME on HN only a couple years ago would have commenters swarm you with accusations of being a deluded conspiracy theorist. Neat. It's good that people are finally becoming aware of the problems that it poses.
William Binney said the companies are paid money for providing data and access. How is that not subsidizing that industry? Financial helps are a first-class reason for other governments to impose duties, restrict international trade and subsidize local competitors. Yet, there is no reaction in Europe. Microsoft can freely sell their OS and Intel is free to have their monopoly, and uses that to backdoor everybody.
It is creepy that european countries don't take action.
LiMux was a good example of moving in the right direction. Recently it was abandoned. I didn't see big unseen powers at play there, just the harsh reality that most people don't understand computers and don't care.
And... this is where the deluded conspiracy theorist accusations the upthread poster was complaining about come from.
There's no evidence for any of that[1]. The ME's capabilities (low level system controller with access to all memory and hardware, with special access to network hardware that can operate cleanly along with a running OS) have been known and even advertised by Intel for years. The news of the moment is that it's subject to a few rather embarrassing exploits.
But that's rather better explained by incompetance instead of evil. Yet everyone jumps to "back door" because that sounds more fun I guess. (In fact, to the extent there is evidence of government involvement here, it's in the opposite direction: the NSA appears to have demanded an "off switch" for the ME).
[1] Edit to clarify: I'm talking about the ME folks. Yes, the government does bad things. The EC flaws under discussion in this subthread are not among them, so citing them as evidence paints you as a conspiracy nut and not someone serious about security.
IME is (by construction) a backdoor. It's primary purpose is as a management tool, but all management tools are by necessity backdoors. The only distinction between the two is whether the person using the backdoor has ownership over the machine.
> In fact, to the extent there is evidence of government involvement here, it's in the opposite direction: the NSA appears to have demanded an "off switch" for the ME.
It also shows that the NSA is in communication with Intel and is capable of getting them to implement something that large corporations like Google were unable to convince them to do. Which should be concerning, because it makes you wonder what else the NSA might've asked as well.
Also these really aren't conspiracy theories anymore. We know that the NSA and CIA do these sorts of things thanks to the information we learned from Snowden and other whistleblowers.
Historically, Australia has heavily interfered in PNG affairs. Should you be accused of espionage or subversion if you decide to hike a portion of the Kokoda Trail?
Would it be appropriate for Indigenous People to accuse you of attempting to steal their children, a practice that occurred until the 1970s?
It shows they'll do anything within their power, legal or illegal, in order to get at more people's data. Of course they have involvement with this, why wouldn't they?
> Historically, Australia has heavily interfered in PNG affairs. Should you be accused of espionage or subversion if you decide to hike a portion of the Kokoda Trail?
> Would it be appropriate for Indigenous People to accuse you of attempting to steal their children, a practice that occurred until the 1970s?
Bizarre points in support of your initial comment I think.
You're right that anyone else should be mystified.
I think you give them too much credit and unnecessarily slander Intel, which has little reason to go along with NSA (no large DoD contracts, almost all consumer and B2B market).
Also, you overestimate the amount of resources NSA has. If they have enough money to overcome Intel's appetite for risk, then why doesn't the NSA just run every single internet and hardware service out there? Your threat model needs to have bounds. It's worthless if you expect the adversary to have unlimited resources.
> In 2012, the NSA said more than 30,000 employees worked at Fort Meade and other facilities.[2] In 2012, John C. Inglis, the deputy director, said that the total number of NSA employees is "somewhere between 37,000 and one billion" as a joke,[4] and stated that the agency is "probably the biggest employer of introverts."[4] In 2013 Der Spiegel stated that the NSA had 40,000 employees.[5] More widely, it has been described as the world's largest single employer of mathematicians.
Let's assume they have 30 000 employees and the large majority of them are highly educated, that would make it into one of the largest organization on Earth in terms of intellect capital.
In terms of actual budget it's obviously classified but estimations are probably around 10 billions USD per year.
https://www.globalsecurity.org/intell/library/budget/index.h...
That's not a small budget by any feat, and we know they operate huge data centers for surveillance, so they are certainly not a "passive" intelligence agency.
Throwing up a big number is dazzling, but when you look at what the NSA does with that $10B, there is a limit. For example, the supposed 40k employees already eat up $3.2B, assuming an extremely charitable average fully-loaded cost of $80k per employee.
Including facilities and supercomputer costs, this rapidly dwindles.
That leaves maybe $5B for bribes, according to your accounting. Is that enough to subvert everybody?
> they are certainly not a "passive" intelligence agency
What is this addressing? Are you attempting to change the goal posts? The topic is ostensible unlimited NSA resources to corrupt every proprietary technology.
I doubt wal-mart has as many highly educated employees as the NSA. Numbers don't mean anything by themselves, but if you hire thousands of mathematicians they are bound to deliver more than Wal-Mart in the datascience and cryptography department.
> Including facilities and supercomputer costs, this rapidly dwindles.
Well, considering the overall surveillance budget of all secret agencies constantly increases, it does not seem that they will ever lack funding.
> That leaves maybe $5B for bribes, according to your accounting. Is that enough to subvert everybody?
Why would you need bribes when you have the Law and the full might of government power behind you? If you can convict of high treason anybody who speaks publicly about what the NSA does, why would anyone at Google, Microsoft or other companies working with the NSA have any incentive to say anything?
> The topic is ostensible unlimited NSA resources to corrupt every proprietary technology.
Resources is not only money. When you work for the government (and furthermore of the military establishment), as I said earlier, you can bring down a whole new level of pressure that money itself cannot buy. If that were not the case, then a bunch of secrets (take for example everything related to nuclear testing in the US) that were only revealed way, way after the facts, would have emerged much earlier in all likelihood.
This is where your rhetoric is getting ahead of the facts. The Snowden leaks were published in American newspapers. Company officers from each of those businesses publicly berated the NSA. FBI national security letters did force companies to disclose information about foreign intelligence targets, but this is not because of secret NSA powers, it's from a law passed by Congress.
> When you work for the government (and furthermore of the military establishment), as I said earlier, you can bring down a whole new level of pressure that money itself cannot buy.
What does the military have to do with Software-as-a-Service providers? Can you name an instance when the modern military provided a chilling effect or seriously impacted these services?
Snowden is being prosecuted under the Espionage Act, the reporters were threatened repeatedly by the authorities, The Guardian was forced to destroy their copies of the Snowden Archives, etc etc.
Also, just because the "secret NSA power" of National Security Letters are a tool made legal by Congress doesn't change the ethics concerns relating to their use.
Assuming a supposedly* adversarial agency has unlimited resources and ability will only cause you to focus on that threat instead of more immediate ones. Or worse, make you needlessly complacent when there is so much that can be done to harden against APTs and other, more immediate threats.
* supposedly because if you're a U.S. citizen, the government works for you. If you're outside of FVEY (AU,CA,UK,US,NZ) and are a government official, military member, have interesting technical infrastructure, or operate an interesting company, then yes you should include NSA in your threat model.
You can only conservatively assume the worst since they operate in complete secrecy with pretty much a blank check from the Federal Government, and prevent anyone from disclosing what they actually do. And take in account that even the Snowden revelations were not the full picture, there are documents that were still not released from what he passed on to journalists.
And it's in their agency's interest to go above and beyond what the Law, and to lie about it like they did before the Congress hearing. They will do every malicious thing given the opportunity because that's their core mission. Unless you assume they are grossly incompetent at it.
Have you heard about PRISM? Have you heard about Lavabit? Have you heard about the FISA court and its practice?
> But that's rather better explained by incompetance instead of evil.
Have the ME in all products, not deactivatable, and not replaceable is not a trivial thing to do, so it surely isn't incompetence. What is it then?
Because they don't want people bricking their computers.
I have yet to hear a good reason for the ME that makes it possible to argue that it is not for backdooring of and having power over all x86 machines.
Oh there is: Dual_EC_DRBG, and that took years to get proof. Also, NSA and AT&T room 641A, plus the packet interdiction programs of the NSA - and I mean physical packets containing DC hardware, that then was modified by NSA.
And we don't have any overview what the US government forces companies and people with NSLs to do... only the sliver of info we got with the Lavabit case.
What's the point of asking for more 'evidence'? Do you expect Snowden levels of sacrifice and disclosures every month?
Apologists will continue to do this untill it's too late to do anything about surveillance, at which point they will shrink into the thicket and leave everyone else hanging onto a surveillance state.
Those who care about surveillance, privacy and democracy have every responsibility to be alert and act now.
This is not incompatible with them encouraging or exploiting a back door, and it is strong evidence that ME is a security risk.
William Binney said something. Does it mean that it applies to all companies? Did he mention which companies? Is he a credible source for things that occurred after he left NSA? Is he even a credible source outside his expertise?
Do you think that European countries don't take action? What would you call the anti-trust suit against Google, GDPR, anti-tax haven lawsuit against Apple, and other actions?
Having a narrow set of news sources can lead a reasonable person (you) to your conclusion. I urge you to look at a variety of sources. Some good ones: Der Spiegel, Al Jazeera, NPR, The Economist, The Wall Street Journal, The South China Morning Post.
> Do you think that the U.S. government has enough money to influence Intel and Microsoft?
I think the government uses (legal) force and threats to get what they want. The laws are in place to leave no options for the company. The money is more a compensation than a bribery. It could make the companies comply without needing to go nuclear. Also, it supports local companies.
> It is the other way around: both companies spend tens of millions on lobbyists.
Do these lobbysist have any influence on the FBI, CIA, NSA, etc., either directly or remotely through the government? I don't think so.
> William Binney said something. Does it mean that it applies to all companies? Did he mention which companies? Is he a credible source for things that occurred after he left NSA? Is he even a credible source outside his expertise?
All companies? I don't know, and it doesn't even matter. He talked about his time at the NSA. I consider him a credible source, since I have no reason not to.
> Do you think that European countries don't take action? What would you call the anti-trust suit against Google, GDPR, anti-tax haven lawsuit against Apple, and other actions?
Yes, I think they don't take sufficient and adequate action. The GDPR is a good step, but the race is not won by a step. It reminds me of an anti-corruption office in a one-party communist regime. A good thing, but not enough.
Please don't meddle this with taxes. That is a totally different outrageous clusterfuck.
These agencies have their budgets set by the U.S. Congress. I think you're unfamiliar with the composition of the United States government.
> I consider him a credible source, since I have no reason not to.
What makes him a credible source? His claim to fame is THINTHREAD, not cash deals with companies. Are you saying that if a man says something that aligns with your world view, but is outside of his expertise, you'll still believe the statement? That doesn't sound honest.
> Yes, I think they don't take sufficient and adequate action
Then why claim that the EU won't take any action when you admit they do in the next reply?
This is the problem with discourse on most of the internet. People make extreme claims to make a point. But that's not a reasoned argument. You're venting, not arguing. That belongs on Reddit and 4chan, not here.
Nobody suggested there was a parallel multi-process operating system running, with full bus arbitration, and mmio capability.
Edit. Not sure why I am being downvoted reddit style. Every-time these threads come up - it's necessary to trot out an explanation of the basic differences between ARC core, psp, arm cortex and trustzone etc, and who uses what technology, what is known about the software/OSes that are running - jvm versus minix-os, amt versus ME etc, what is new knowledge, what is official, and what has been uncovered from private research. I base my statements about lack of general awareness on these topics from actually following HN submissions.
Just a few days ago, someone in a thread was speculating on using low-level op-codes in bootstrap code to subvert the BIOS, apparently in complete ignorance of the depth of the embedded stack.
https://www.slideshare.net/codeblue_jp/igor-skochinsky-enpub