Comment by bri3d | Hacker News Reader

Comment by bri3d | Hacker News Reader

Parent Full thread

Yes. There are several ways, depending heavily on the version, and ranging from most trustworthy to least trustworthy:

* By patching the ME firmware itself - see the me_cleaner project, and methods documented here: https://puri.sm/posts/deep-dive-into-intel-me-disablement/ . This is Pretty Reliable; the runtime code has been deleted from flash.

* By setting a bit in the flash configuration, assumed to be added for the US High Assurance program: https://github.com/corna/me_cleaner/wiki/HAP-AltMeDisable-bi... , https://www.ptsecurity.com/ww-en/analytics/disabling-intel-m... . This is Mostly Reliable; the mechanism has been fairly aggressively reverse engineered and was added for a program with strict requirements.

* By sending an HECI command that says "hey ME, turn off your runtime" https://review.coreboot.org/c/coreboot/+/52800 . This is Somewhat Reliable; the method is well understood and seems to work but I'm not sure someone has done a deep dive audit into whether it could be re-enabled somehow.

Do we have anything equivalent for AMD’s PSP?

The equivalent of Option 3, send a supported command that tells the runtime capabilities to shut down, has been provided as a user-selectable option by AMD in AGESA (the unified AMD BIOS/EFI package) for several years now.

I haven't found anyone who has actually reversed the functionality to audit what it's doing, though.

In a way this is all insane: we are spending a fortune on security globally but at the same time manufacturers get to insert massive backdoors into the hardware and hardly anybody bats an eye.

What if... ME/PSP are actually very low security risk relative to everything else in the system.

It's troubling to have even a potentially very low security risk in hardware I paid for being beyond my reach to resolve.

>manufacturers get to insert massive backdoors into the hardware

There is no proof that they are

>hardly anybody bats an eye.

Because only a certain niche of paranoid people are willing to believe that companies are trying to make their systems intentionally insecure so that you can be personally hacked.

It's a fact that NSA solicits companies to add security weaknesses to their products. They'll "make an offer you can't refuse" by offering cash (in the form of a contract), and they'll use their influence with other "contractors" and government agencies to punish companies that don't participate.

This is not unique to NSA. Security agencies within other governments play the same games with supply chains.

Intel making their products insecure is bad for their brand and bad for world wide computer security. Massive amounts of damage could happen by abusing such a backdoor. There is plenty of evidence of Intel claiming that there are no backdoors in their products, but there isn't for some NSA deal for adding a backdoor.

Pardon? Snowden showed huge amounts of NSA backdoors. It’s probably worth limiting the conversation to what they don’t have access to rather than trying to enumerate what they do have access to.

It most certainly doesn't have to be intentionally insecure but it almost definitely is accidentally so. There should be no OS nor network stack running in the firmware, period.

User-respecting OS running in the firmware can be really useful. It must be FLOSS though. Example: https://puri.sm/posts/pureboots-powerful-recovery-console/.

You must have slept through Snowden.

That is not an argument. You can't justify that everything is secretly backdoored because of some old leak.

The safe assumption is that if there is a computer sitting on your LAN that you don't have access to that has access to your stuff that you have a massive security issue in waiting. That it hasn't materialized yet doesn't mean a thing and there are plenty of documented security holes associated with the ME, and likely many more that you simply will never know about. This stuff has been chewed to bits on HN and elsewhere.

If you feel different that's fine but with security the old adage 'better safe than sorry' applies very much and given the data collected so far the evidence of 'some old leak' times n is rather more solid than your belief in the opposite. FWIW Intels claims that they would not cooperate with the NSA are worth absolutely nothing because the USG has the power to tell Intel to stay quiet about such a deal.

If CISCO could be influenced by the NSA then so can Intel, either through supply chain interdiction or through more direct means. But to categorically claim that this is an impossibility is nonsense, the relevant questions are (1) has it been done? and (2) how would we ever find out given the locked up status of the ME? and (3) who past Snowden would be brave enough to leak the evidence if it exists?

This is probably going to change when AMD switches from AGESA openSIL, fully open firmware.

Reply on news.ycombinator.com