News for hackers. Stuff that matters.

A comment on Who controls your computer? and how to make sure it's you. Parent comment

Re:Who controls your computer? and how to make sure it's you by moppl on Tuesday March 07, 2017 @10:02AM (#13810787)
Yes right, we were. But we were able to install our own firmware before there was the IME.

And it has also changed in the sense that the IME is a full fledged autonomous universal computer which has it's own RAM, ROM, clock etc. It is not just some very specific chip with hard-coded functionality, no, it can e.g. load and run Java applets. So it is a very powerful moving target which can be used for whatever it is programmed to. Rootkit researcher Joanna Rutkowska called it the perfect rootkitting infrastructure.

[ Parent | on HN ]
Re:Who controls your computer? and how to make sure it's you by shostack on Tuesday March 07, 2017 @11:20AM (#13811593)
Are there any documented cases of this vector being used against a user?
[ Parent | on HN ]
Re:Who controls your computer? and how to make sure it's you by AnimalMuppet on Tuesday March 07, 2017 @12:42PM (#13812634)
Not documentation, but... a former co-worker had done some work for intel agencies. He told me about something that was similar to this (though back in the 2008 time frame, so not using IME). If he can be believed (and I can neither confirm nor disprove what he told me, nor can I now prove that he ever said anything), this approach has been used for a long time.
[ Parent | on HN ]