After CIA leak, Intel Security releases detection tool for EFI rootkits

Re:After CIA leak, Intel Security releases detection tool fo... by trendia on Friday March 10, 2017 @01:26PM (#13840791)

No amount of EFI rootkit detection will ever remove the possibility that malicious code is running inside the Intel Management Engine (ME), because code inside the ME would run side-by-side with the bootloader and with unlimited permissions.

Unless Intel provides source code for the ME, it is impossible to 100% know whether unauthorized code is running.

[ Parent | on HN ]

Re:After CIA leak, Intel Security releases detection tool fo... by Kwastie on Friday March 10, 2017 @01:43PM (#13840912)

Someone at https://puri.sm almost completely removed the ME. https://puri.sm/posts/neutralizing-intel-management-engine-o...

[ Parent | on HN ]

Re:After CIA leak, Intel Security releases detection tool fo... by bobcallme on Friday March 10, 2017 @02:31PM (#13841331)

What's with the free advertising? They were not the ones to do the original work with coreboot or removing the non important parts of the ME. If anything, Purism has lied, taken credit for other peoples work and given people a false sense of "privacy" and "security". "Almost completely removed the ME" is not good enough and there is way too much room to do malicious things.

[ Parent | on HN ]

Re:After CIA leak, Intel Security releases detection tool fo... by Relys on Friday March 10, 2017 @02:31PM (#13841335)

[ Parent | on HN ]

Re:After CIA leak, Intel Security releases detection tool fo... by jjawssd on Friday March 10, 2017 @02:34PM (#13841365)

What's your point? Is it that exploit developers are not compensated financially for their work? Exploit developers should find a better business model than their current one. This guy was able to take freely available exploit knowledge and monetize it. If the parties responsible for creating the exploit feel they have some sort of IP claim against them, they should sue. If exploit developers wish to release exploit details for free then the best they can wish for is charity.

[ Parent | on HN ]

Re:After CIA leak, Intel Security releases detection tool fo... by bobcallme on Friday March 10, 2017 @02:56PM (#13841551)

You missed the point. It is all about giving credit to those who do the work and make discoveries. It is in poor taste to exploit people in the case of taking their work and not giving any credit to those that made their business model possible.

[ Parent | on HN ]

Re:After CIA leak, Intel Security releases detection tool fo... by mike-cardwell on Friday March 10, 2017 @01:46PM (#13840939)

Even if Intel gave you the source code, you still wouldn't know if there was any unauthorised code running.

[ Parent | on HN ]

Re:After CIA leak, Intel Security releases detection tool fo... by Taek on Friday March 10, 2017 @01:53PM (#13840992)

Reproducible builds is a very important part of knowing you are secure, and in the absence of that at least being able to flash on your own compilation.

[ Parent | on HN ]

Re:After CIA leak, Intel Security releases detection tool fo... by hdhzy on Friday March 10, 2017 @02:31PM (#13841336)

Well even with reproducible builds how do you check what actually is running there? That'd be the ME reporting "I'm running version X" without a way to really verify it. Also if you flashed it you cannot be 100% sure there is no other component that is still running a rootkit.

[ Parent | on HN ]

Re:After CIA leak, Intel Security releases detection tool fo... by schoen on Friday March 10, 2017 @04:31PM (#13842302)

Good analysis of this issue in Halvar Flake's https://www.slideshare.net/hashdays/why-johnny-cant-tell-if-... ("Why Johnny can't tell if he is compromised").

[ Parent | on HN ]

Re:After CIA leak, Intel Security releases detection tool fo... by ams6110 on Friday March 10, 2017 @06:55PM (#13843184)

Or Ken Thompsons's Reflections on Trusting Trust.

[ Parent | on HN ]

Re:After CIA leak, Intel Security releases detection tool fo... by sschueller on Saturday March 11, 2017 @09:16AM (#13845456)

Is there any reason Intel would not open source that code? It not like it will run on other hardware?

[ Parent | on HN ]