This is quite possibly the worst and most widespread computing vulnerability that has ever existed, and it's likely that Intel will just maintain the status quo until there's some sort of black swan event.
"Worst" implies harm, not just potential. It doesn't get to be The Worst until something happens, no matter how much it offends your personal design sensibilities or confirms your conspiracy priors.
If you are saying that when assessing the vulnerabilities, potential harm is not important, only actual is, would you feel that putting remotely activated bombs on all planes is not a major vulnerability as long as no one has a password?
What does that mean practically? What you said applies to every networked device and tech. All routers, all computers, all OSs, all voip phones, etc, etc are 'one vulnerability away'. from total compromise.
It's very hard to avoid running ME even if you believe it's actively harmful.
The only viable solution I see is open hardware.
It's not remotely The Worst Vulnerability Ever and any attempt to hyperbolize in that direction is hurting the efforts of the people actually trying to protect you.
I usually like to include a metaphor to explain the equivalence as I see it, but I'm struggling to come up with any other thing where we've built in a problem like this that's waiting for a single event that could effect nearly everyone. The closest I can come up with is Snow Crash, and having to reach that far into science fiction leads me to think we likely have a poor grasp on how to assess this risk (since we as a species are fairly bad at assessing and mitigating risk for events we haven't encountered before). Hopefully it's just an extreme failure of imagination on my part.
Thus advocacy, including overstating its impact, is likely the only option for those who want it changed.
> any attempt to hyperbolize in that direction is hurting the efforts of the people actually trying to protect you
Can you clarify this -- who are those trying to protect us and why do they want this mis-feature to stay? Are you talking about spooks who use this as a backdoor in their own cyber attacks? If so, this IMO only adds urgency to the need to close this backdoor -- such tools often leak and backfire.
2. It doesn't have to be "vulnerable" to be used in an attack; it's essentially designed to be an attack. So any government agency or leaked Intel info may be sufficient to abuse.
3. You can't reliably check/audit if it is being exploited or not since it runs at a higher privilege than any diagnostics you might try to run on your own computer.
Disclaimer: I am not an expert in computer security.
The problem is to make that true, you have to carefully phrase the situation as "this has the potential to give rise to the worst, bad .... etc".
And that's the thing. Ignoring this ranks along attitudes like "that cement pool of mining tails right above town is quite sturdy", "we just need a little time to reduce our carbon emissions..." and "we shouldn't kill the IoT with too much regulation..." etc
If X isn't a problem right now!, then it seems like X is going to get about zero attention from a world swimming in things that are a problem right now.
And that too is going to give rise to further problems down the road, to say the least.
I absolutely hate Intel and AMD for sabotaging their customers like that. Please people, get to that black swan event ASAP.
Even if everyone has backups of everything, offline, it'll be years before all the destroyed computers can actually be replaced. This isn't a scenario I want to happen for real.
What I think needs to happen is for other countries to realize this issue is a matter of national security, and to fund development of alternatives.
No official statement yet, but some info can be had here: https://www.phoronix.com/scan.php?page=news_item&px=AMD-PSP-...
That sounds like the equivalent of "HECI Disabled" for Intel BIOSes, which has been around for years.
It doesn't do anything to shut down the hidden CPU (PSP). It just sends a command to disable the bridge over to the main CPU. All the other ways of talking to the PSP remain open.
That's what they want: a backdoor advertised as a feature.
Is it in the interest of this entity to restrict the publication of Intel ME vulnerabilities to the general public?
How does the general public obtain information on a day to day basis?
Who runs the mass media?
Is the mass media affected by this entity?
Is the mass media narrative influenced by this particular entity?