After CIA leak, Intel Security releases detection tool for EFI rootkits

Re:After CIA leak, Intel Security releases detection tool fo... by mike-cardwell on Friday March 10, 2017 @01:46PM (#13840939)

Even if Intel gave you the source code, you still wouldn't know if there was any unauthorised code running.

[ Parent | on HN ]

Re:After CIA leak, Intel Security releases detection tool fo... by Taek on Friday March 10, 2017 @01:53PM (#13840992)

Reproducible builds is a very important part of knowing you are secure, and in the absence of that at least being able to flash on your own compilation.

[ Parent | on HN ]

Re:After CIA leak, Intel Security releases detection tool fo... by hdhzy on Friday March 10, 2017 @02:31PM (#13841336)

Well even with reproducible builds how do you check what actually is running there? That'd be the ME reporting "I'm running version X" without a way to really verify it. Also if you flashed it you cannot be 100% sure there is no other component that is still running a rootkit.

[ Parent | on HN ]

Re:After CIA leak, Intel Security releases detection tool fo... by schoen on Friday March 10, 2017 @04:31PM (#13842302)

Good analysis of this issue in Halvar Flake's https://www.slideshare.net/hashdays/why-johnny-cant-tell-if-... ("Why Johnny can't tell if he is compromised").

[ Parent | on HN ]

Re:After CIA leak, Intel Security releases detection tool fo... by ams6110 on Friday March 10, 2017 @06:55PM (#13843184)

Or Ken Thompsons's Reflections on Trusting Trust.

[ Parent | on HN ]