News for hackers. Stuff that matters.
Re:Disabling the Intel Management Engine by Ajedi32 on Tuesday October 10, 2017 @05:23PM (#15445423)
Do you have any specific evidence that the NSA is directly involved in pushing implementation of IME for the purposes of espionage? That's an extraordinary claim; the mere existence of the NSA isn't sufficient evidence that it's true.

Yes, the NSA exists. Yes, it's their job to spy on people. And yes, it's perfectly valid to include mass surveillance in your threat model. But these constant, uncorroborated claims that the NSA boogeyman is hiding behind every rock and tree are starting to become quite tiresome.

Re:Disabling the Intel Management Engine by rantanplan on Tuesday October 10, 2017 @05:30PM (#15445474)
> the NSA boogeyman is hiding behind every rock and tree are starting to become quite tiresome.

Yeah indeed, they have backdoor-ed every ISP, nation, router, HDD, what-have-you in existence and these people keep telling boogeyman tales.

Tsk tsk tsk. How tiresome.

Re:Disabling the Intel Management Engine by Ajedi32 on Wednesday October 11, 2017 @01:12AM (#15447447)
> they have backdoor-ed every ISP, nation, router, HDD, what-have-you in existence

This is exactly the kind of hyperbolic nonsense I'm talking about. You can't claim that every HDD in existence has an NSA-installed backdoor installed in it without providing any evidence.

If the NSA's capabilities were nearly as extensive as you're claiming, the US wouldn't need to bother maintaining a military. They could just remotely command all of North Korea's computers to shut themselves off, then sit back and wait around for their surrender.

I'm not saying mass surveillance isn't a problem, or even that the NSA doesn't have a backdoor installed in IME (I certainly don't have evidence to the contrary); just that people need to stop exaggerating the threat, or making claims about the NSA having compromised any specific system without providing any evidence to back those claims up.

Re:Disabling the Intel Management Engine by roblabla on Wednesday October 11, 2017 @04:14AM (#15448098)
Remember when the NSA crippled a standardized CSPRNG ? http://www.reuters.com/article/us-usa-security-nsa-rsa/exclu...

Remember when the US shut down NK's internet ? https://gizmodo.com/so-who-shut-down-north-koreas-internet-1...

Remember when the NSA was revealed to have a malware that could infect hard drives, being potentially undetectable ? https://motherboard.vice.com/en_us/article/ypwkwk/the-nsas-u...

Remember PRISM ? How about stuxnet, and the other couple of viruses that are almost surely the NSA's.

Sure, those are not backdoors installed by the OEM, rather they are malware that the NSA can use to infect (lots of) systems. But let's not kid ourselves, the NSA does have a ridiculous amount of power, and we have lots of evidence of it.

At this point I'd be rather surprised if the NSA haven't hacked my fridge yet somehow.

Re:Disabling the Intel Management Engine by Ajedi32 on Wednesday October 11, 2017 @09:34AM (#15449577)
And I agree, those are some pretty impressive feats. Whenever your threat model includes state actors, it's probably not a bad idea to be paranoid. Let's not carry that paranoia to ridiculous extremes though.

_Could_ the NSA have the ability to utilize IME somehow as a means to infect computers? Certainly. Do they _actually_ have that capability? We have no idea. Same goes for your motherboard's firmware, your hard drive's hardware, and any number of other possible vectors. They _could_ be compromised somehow, yes, but let's not claim that any specific motherboard firmware, HDD model, or CPU processor brand definitely _is_ compromised without evidence.

Re:Disabling the Intel Management Engine by rantanplan on Wednesday October 11, 2017 @04:05AM (#15448071)
https://www.theregister.co.uk/2015/02/17/kaspersky_labs_equa...

There is an equivalent article from Ars technica, if "theregister" isn't to your liking.

As for the evidence on routers and Internet infrastructure, you should pay more attention to leaks of state-sponsored tools, like the equation group leaks and the CIA one.

Re:Disabling the Intel Management Engine by Ajedi32 on Wednesday October 11, 2017 @09:39AM (#15449629)
"possibly tens of thousands of Windows computers" is not anywhere near the same thing as "every HDD in existence".
Re:Disabling the Intel Management Engine by mmjaa on Tuesday October 10, 2017 @05:43PM (#15445565)
You know whats tiresome? Fighting for control over your own hardware.

Do you want to live in a free society or not? Because this is not acceptable to a free society.

Re:Disabling the Intel Management Engine by Ajedi32 on Wednesday October 11, 2017 @01:16AM (#15447459)
I don't see how that's related to my comment. I'm not discussing whether IME is a good idea or not, I'm just objecting to the unsubstantiated claim that the NSA is involved in pushing it.
Re:Disabling the Intel Management Engine by mmjaa on Wednesday October 11, 2017 @10:24AM (#15449980)
Actually: It is quite well substantiated that the NSA has a mandate to usurp, and has factually usurped all technology in its purview, for its purposes - i.e. American information technology corporations, manufacturers, and so on, are bent to its will - it is treasonous for Intel to allow IME to be completely disabled, cf., the Yahoo case against NSA, etc.

The fact of secrecy around this issue is the only thing to be doubted. Its no secret to non-Americans/concerned citizens; if you choose to continue to be ignorant, I choose to set you the challenge: go and find out for yourself just how bad it really is with the NSA. (It is atrocious.)

Re:Disabling the Intel Management Engine by roenxi on Tuesday October 10, 2017 @06:22PM (#15445823)
The idea of the NSA working with a major components supplier isn't an extraordinary claim. Intel will have a major presence in all sorts data centers of interest to the NSA.

If I were an American and believed in what the NSA was doing, I'd want to know what they were doing with their budget if they didn't at least try to get a hardware back door into Intel CPUs. Why waste budget on finding exploits in patchable software when they can go straight to the silicon?

Re:Disabling the Intel Management Engine by quickben on Tuesday October 10, 2017 @05:35PM (#15445504)
That is a very naive view.

The Intel IME is far different than 'rock and tree' to an organization of 40k employees and $10B budget tasked with bypassing stuff like the IME.

Re:Disabling the Intel Management Engine by ksk on Tuesday October 10, 2017 @06:13PM (#15445768)
Yeah, most likely, IME was developed for a completely legitimate purpose of administering PCs without special software.