> And yet we really don’t seem to care much.

I know we're used to "Internet speed" and the tweet happened an entire 24 hours ago, but give it a bit of time before declaring it dead. Wired and Vice need a second to write it up, and see if it hits the mainstream before declaring the issue ignored.

Not saying it will get picked up, though I sure hope it does, but as you point out, it's a bit obscure and takes some explaining.

Still, there are numerous reports that the Facebook app on your phone listens to every word you say to show you ads for things you were talking aboutm but on HN and other web forums, there are always an element of disbelief. We may believe that it must be something else - correlation to web searches from the same IP, but there's never been proof one way or the other. (A Facebook exec's claim doesn't count as proof.)

So there's a section of people that believe they already have high resolution recording devices that we take into to bed. What's one more?

(Typing this, very gratefully, from an ARM Chromebook.)

Plenty of people were still saying the Snowden revelations were old hat when they came out, we all knew it was happening just didn't have proof, etc. The novelty and seriousness tends to be out-of-whack with the amount of news coverage. It's a poor way to measure the importance of existing news coverage or lack of it for that reason. What matters is that it gets out and incentivizes developers, manufacturers, company policies, and behavioural change.

There are plenty of hot news scare pieces after boring security leaks all the time bringing awareness to issues that technical people have known well. For ex, I'm hearing about friends older parents putting tape over their laptop cameras.

We love to trash bugs that having marketing brands but these exploits, and more importantly obvious attack surfaces like ME or cellphone modems, often just need the right amount of human-interest story, practical real-life example, and wrapped in good news friendly explanation for regular people to care.

It tends to happen a lot more randomly and without a rational order of priority, but it's still happening more and more often. At the end of the day it's always going to come down to the time and effort of a security researcher caring and the tech community putting the effort in to make the journalists care.

Prior to the NSA contractor Edward Snowden's revelations in 2013, Room-641A had already been exposed by an AT&T employee-turned-whistleblower Mark Klein. The EFF sued the government in 2006 over it.

Tape over laptop cameras isn't just a "parents-of-friends" thing, it's a good idea. Buy a set of stickers and support the EFF: https://supporters.eff.org/shop/laptop-camera-cover-set

Anyone know somebody at Wired?

> Tape over laptop cameras isn't just a "parents-of-friends" thing, it's a good idea. Buy a set of stickers and support the EFF: https://supporters.eff.org/shop/laptop-camera-cover-set

Support the EFF! But I hate the stickers.

Everyone puts a sticker on their webcam and completely ignores the hot mic. But you get that false sense of security…

I unplugged the microphone on my daughter's iMac years ago. She did not use it, and was ok with that.

I did not break her phone in that way. Her phone is more dangerous.

> I unplugged the microphone on my daughter's iMac years ago.

Please note that a speaker may also act as a microphone if configured so (at software level). This is especially true for speakers/headphones connected via the jack.

It's likely an internal microphone and speaker; the sound card may not support input through that interface. What you're saying can be true for many other modern computers, though.

There was an article (a while ago) showing that at least one major brand of onboard sound cards has undocumented features to switch the audio-out jack port to input. Cheap headphone/earbuds function as a microphone too, so that's a thing. Only if you leave the earbuds plugged in, of course. It can't listen from an empty jack port.

I (personally) think that intelligence/privacy-wise the mic on many devices is a lot more troubling than a camera. Camera is very directional and (again, personally for me) would at most result in embarrassment? While a microphone can record all conversations in a room/appartment, transmit everything with fairly negligible bandwidth, and taping over it won't do much good. You actually need to open the device and disconnect/cut a wire.

OT: @lightedman you're dead. Apparently due to some heated discussion on the term regression. But from a glance I couldn't find anything that stood out enough to warrant a ban. Might want to send an email and have your account unbanned.

Exactly. I've given up on tape on camera. Frankly my mug just isn't that important compared to the key strokes I make.

audio only nudies are usually slightly less exciting.

Most people’s hacked nudes will come from pictures they take themselves, not webcam snaps.

We should start demanding physical shutters for laptop webcams. Does anyone make those yet?

Even better is a hardware kill switch, especially for the mic.

Librem Purism labtop has hadware kill switches.

I managed to unplug the mic in my Thinkpad and my Dell XPS laptop with about 5min of work for each. It's still possible to do at the moment if you don't mind relying on plugging in headphones w/ a mic to use one.

Of course a switch would be nice, similar to the older Thinkpads which had a hardware switch for the network devices on the front, originally for use on airplanes.

> I managed to unplug the mic in my Thinkpad

Any chance you documented the procedure or have links to relevant documentation?

For Thinkpads the documentation you're looking for is the "Hardware Maintenance Manual" (HMM). E.g. here is one for the X260, it clearly describes where the camera/microphone assembly is, how to get to it and where its wire connections go: https://ok2.de/ThinkPad/HMM/x260_hmm_en_sp40j72016.pdf I haven't taken apart one of the more Ultrabook-style ones, so not sure how accessible those are, but the traditional ones are very serviceable.

I wouldn't be surprised if the better Dell models have similar documentation available.

This is easy in almost all laptops: the microphone is attached to the mobo via a 2-wire tiny plug. Disassemble your laptop, look at the other side of the keyboard pane, a bit away from the speakers. Some laptops might also carry mikes in the screen bezel or multiple mikes, so check all cables that go away from the mobo.

But now you have to trust the switch to really deactivate the mic. I'm a recursive paranoiac !

The usual* way to handle this is to have a small LED next to the mic/camera that shows when it's on -- and have it wired up to the device in series, such that it's software-impossible for the device to be powered without the light being on.

*: it's what we did on the One Laptop Per Child laptop, and I'm sure others have too.

Thank you for inventing the netbook and showing the ODMs how to make low cost PC notebooks.

Any idea where to get a CLI-from-boot notebook for teaching kids programming and encouraging a hacker ethic?

Thanks for the kind words! I haven't used it personally, but a programmer in my Twitter feed recommended this one that they've been using with their kids recently. (I don't think there's a heavy emphasis on CLI.)

https://tksstgiftguide.tumblr.com/post/167274832422/our-kids...

At least you only need to verify a switch once, it won't be compromised by software changes.

Assuming the switch does really cut the mic signal and doesn't instead act on a i/o pin which calls a function to disable the mic input. The second solution would be hackable.

That's a very good point. We have it for wifi already, so...

I 3d-printed a crude shutter and super-glued it to the bezel: https://youtube.com/watch?v=oOkPP_5bjhs

I think it would be about as easy to make a cardboard one.

Indeed they do. The security team at my work ordered hundreds of them and hand them out to anyone that asks. They even have the company logo on them.

There's been a Kickstarter called Nope for cams for a few years now, they exceeded funding by a large multiple each time. I got the second version a year ago, they are now on version 3 and added a headphone jack blocker.

https://www.kickstarter.com/projects/bungajungle/nope-sound-...

Not really sure about the headphone jack blocker; I'm not aware of an OS where the sound source can't be trivially switched in software, even when headphones are plugged in.

The likelihood is that if an attacker has the ability to record audio, they also have the ability to bypass this device.

My Asus EEEPC has one.

C-slide dot com, the iPad one (round with a pivot) is my favourite

Indeed, bags of lens stick on lens covers (that allow you to open when you need the camera) is a product idea I thought of ages ago, but too lazy to actually do.

it exists already, got one as swag at a conference from Nvidia (???). strange gift, I like the sentiment though.

Yes, got mine as a swag too (not Nvidia), works perfectly. Can be found by looking for "webcam cover slider" on Amazon or I assume any web store that deals with such things.

> Tape over laptop cameras isn't just a "parents-of-friends" thing

Not sure why you took that statement as deriding the practice because some older people are doing it? I noted it merely as an indication of how far the behavioural change has spread as a result of news stories... Of course it's good security hygiene. Not an ideal solution though, as others have already mentioned, compared to a hardware switch or built-in cover.

Ah, apologies; The way I read it was that your friends don't but their parents do.

That's funny, because I noticed something during a recent ~10k device audit.

Across the mobile IT we manage, the groups who covered or unplugged their webcams, internal or external, most consistently were middle to older age women, with the least common as women in their 30s or younger. Men covered randomly across all ages, but still less than women. And while they'll cover their laptop camera, most who didn't have a folding case did not also cover their tablet or phone cameras.

I don't know if it's comfort or awareness, but the ones who covered acted like it was common sense, and the ones who didn't hadn't considered it or felt like they weren't likely to be a target of interest. A few women said they chose their laptops because of the physical shutter over the camera.

I don't know if trust in electronics is more generational or age related, but it's definitely a gradient.

I definitely agree about tapeing the camera. Zuckerberg does it too

https://www.theverge.com/2016/6/21/11995032/mark-zuckerberg-...

While I don't care one way or another what people choose to do to their own devices and am happy to accept that it's probably a good practice, it does always cause me to chuckle when the "Zuckerburg does it" argument is thrown out.

I think the threat profile faced by "the rest of us" is probably just a little less intense than someone as well known, wealthy, famous and influential as the CEO of Facebook, but perhaps that's just me.

The money for that tape came from selling our privacy.

> Wired and Vice need a second to write it up, and see if it hits the mainstream before declaring the issue ignored.

You're right about this new development of the functional JTAG being very recent and needing time to get around. However, security folks and others have been decrying the potential of the IME backdoor for years.

That they've been largely ignored for years lends some credibility to the thought that "we don't seem to care much." It's hard for most laypeople to understand, and it's difficult to get people excited about something they don't understand (unless they are convinced that they do understand, of course).

> A Facebook exec's claim doesn't count as proof.

How about an official statement from Facebook itself over a year ago[1]? If it was true, people could find out by decompiling the app and make Facebook look absolutely horrible.

[1] https://newsroom.fb.com/news/h/facebook-does-not-use-your-ph...

> How about an official statement from Facebook itself over a year ago

That also doesn't count as proof; it carries barely more weight than the Facebook exec's statement.

However, you're quite right about the decompiling argument. And chances are that security researchers have done just that.

It's one thing to lie, it's another thing to lie about something that could easily be found out and possibly get them sued. The risk/reward ratio seems way too high for Facebook to lie (unless they were forced to.) That's obviously not proof, but it seems like pretty strong evidence.

Can you use an ARM Chromebook without it constantly leaking data to Google? I tried to use the C201 without Chrome OS, but with libreboot, and Debian with mainline Linux. I didn't succeed.

A little late to the party, but I also have a libreboot C201, and have successfully installed mainline Debian on a USB drive connected to it. I'm going to put up a comprehensive guide + shell scripts in December when I'm on break from school, but until then, check out these links:

https://github.com/atopuzov/c201/blob/master/debian-install....

https://archlinuxarm.org/platforms/armv7/rockchip/asus-chrom...

The main thing I haven't gotten working yet is the touchpad. For wifi, I'm using an atheros dongle with open firmware.

The gallium os guys have everything working perfectly on my asus chromebook.

Yes, but gallium doesn't support arm [1]

[1] https://wiki.galliumos.org/Support/ARM

See https://johnlewis.ie/custom-chromebook-firmware/rom-download...

Doesn't work for every Chromebook, but it does for many. Working fine on my Chrome Box.

I already had flashed libreboot onto the device. That wasn't hard. The problem was and is mainline Linux support.

Ahh. Maybe this? https://github.com/altreact/archbk

Thanks for the link. The C201 is listed as work-in-progress.

> "Still, there are numerous reports that the Facebook app on your phone listens to every word you say".

> "(Typing this, very gratefully, from an ARM Chromebook.)"

Have you installed a non-stock OS on that Chromebook? Google aren't exactly known for being strong advocates of user privacy.

The most basic analysis will show that Facebook isn't listening to everything you say, even just at the level of realising that either doing speech recognition of everything you say or uploading an audio stream would be both impractical and easily detected by anyone with the inclination.

"opaque, obtuse, and obscure" is a red herring.

Imagine, Intel were a Russian company. Tomorrow, there would be a simple and clear [screaming] headline similar to "Russians hacked the election" (general public doesn't need to know or understand how the network, computers or elections actually work). The day after tomorrow it would be illegal to buy anything Intel.

Elections have almost certainly been hacked - the security on electronic voting machines is abysmal - and no one seems to care, so I think your 'Russians hacked the elections' example doesn't say what you meant.

A successful SQL injection probe that does not intentionally or otherwise result in data modification would be unusual, beyond the simple 1 == 1 methods.

The DREs don't seem to have been a target, though the physical and OPSEC vectors are quite well known at this point.

I'm not commenting on the information operations or the loose and ambiguous langauge that has been used to describe these events.

There are economic sanctions against Russia. There are no sanctions against Intel. I meant what I said.

The Russian trade sanctions are about their activities in Ukraine, not about the last US presidential elections. Besides, there's plenty of evidence of domestic tampering with US election results and comparatively little done as a result. If election fraud was a big enough issue to effectively stop Moore's Law dead in its tracks then you'd expect much more activity around election fraud without that level of economic impact.

What do you think the headline about Intel be in Russian media?

Intel ME is not new. You don't need to imagine it, you could google it.

Most likely they will be quiet because Russia is 100% dependent on foreign technology.

Not the military.

They must be decades behind, then. I don't think in-house Russian engineering capabilities have been competitive let alone ahead of the consumer electronics curve going back at least a decade in the of fabrication. Maybe when it was 1997 and everything was DIP.

I'll negate this by taking the opposite position, and similarly having no facts or references.

MCST make stuff used by russian military. see e.g. Elbrus chips https://en.wikipedia.org/wiki/Elbrus-2S%2B

The idea I commented on was to ban Intel chips. Russia cannot do that, military or not. The military accounts for a fraction of a fraction of tech that Russia depends on.

And the military are also dependent on foreign technology. If not for CPUs inside tanks and planes, then for CPUs inside command center computers. (and not just CPUs)

> And yet we really don’t seem to care much.

I do care, a lot. I have decided to avoid Intel (and AMD) hardware like the pest. I will not buy any Core iSpyOnYou or AMD equivalent anymore. I'm an advocate of economic and judicial sanctions from the political level against Intel (and AMD). I tell people around me about the problems and explain how it is an issue of privacy, security, national sovereignty, and market power abuse.

I'm looking for a desktop computer for my day to day use that comes without compromised hardware. The Raspberry Pi 3 works quite well, but doesnt work without non-free software. I successfully installed Debian onto my A20-OLinuXino-MICRO, but the GUI doesn't start. I'm looking for Hardware without Intel Hardware, without non-free software, mainline Linux support and preferable Debian compatible. The OpenPower system by raptor engineering is simply too expensive. I cannot afford it. Any ideas?

Librem laptop is reasonable powerful, and they have effectively neutered the ME.

Libreboot replaces firmware for some decade-old server machines lacking a ME (although noisy, they work quite well as a desktop).

The Librem laptop are not an option because they use Intel chips. Buying Intel products supports and finances their current way. They did not even address the grave accusations. There is no way I can give them money.

When Librem was first announced, I had grave concerns too, and I stuck with my Libreboot computers. However, it was just this past month when they showed proof of concept for their Purism phone running KDE plasma on an ARM board without any firmware/driver blob concerns and also showed how they isolated and disabled the Intel ME that I took them seriously, at which point I ordered a labtop and have been very happy.

The amount of money that Intel gets off these chips can't be significant because they are currently over two years old anyways (Q3'15).

I don't get how their work on the Purism phone makes their laptop any better. Care to explain the relation?

That one can maybe fix a hardware backdoor in Intel chips does not make buying them any better. Intel does not get my money but should instead get clear-worded, sanctioned letter from the authorities. I think they should be banned from trading and selling their backdoored stuff. I will not buy even old products of them. They messed up big time and don't even explain themselves.

"how their work on the Purism phone makes their laptop any better"

So you are obviously right that proof of concept of fully FLOSS ARM phone doesn't directly translate to x86.

But it does show that they know how and want to build fully FLOSS systems. Whether they don't quite succeed 100% with the x86 system (as the management engine is still in my computer, albeit isolated and disabled), they have been making great strides in getting close to %100 and I am willing to reward them for that.

Regarding the morality of buying Intel chips, I do share the reluctance to support Intel. I hadn't bought a new Intel computer or CPU since 2007 with Core2Duo for that reason. But sometimes morality decision can't be made in a binary all or nothing manner. In this case I am aware of the damage done by purchasing an x86 system, but it makes up for in being able to have a productive labtop which I can more effectively work to make FLOSS applications with.

For more details on this, see https://puri.sm/posts/purism-librem-laptops-completely-disab...

Your best bet will be with NXP then. They still haven't released the i.MX8 cpus, but i.MX7 boards are available (up to dual core 1.2GHz), and, as far as I know, they are the only (decent, omap3 & 4 don't have enough power these days) with full opensource support for the entire SoC, even the GPU

Thank you for pointing these out. The i.MX7 and i.MX8 SoCs seem very interesting, but I have a hard time finding information about available SBCs, mainline Linux and official Debian support. The only SBC I found is the Nitrogen7[0] and it doesn't seem to geared towards desktop use as there is no DP nor HDMI nor VGA, though the PCIe expansions is gold. I wonder why other SBC don't offer PCIe. They might not have the highest performance, but I don't need that.

[0] https://boundarydevices.com/product/nitrogen7/

Could you not just buy a Macintosh? Macs lack the AMT chip so the ME in the CPU can't do anything.

It's still Intel hardware. But besides that, does the Macintosh work without blobs and mainline Linux? Can I install Debian on it and have stuff working? I'm just tired of uncooperative manufactures.

> Can I install Debian on it and have stuff working?

Depends on the kind of Mac you buy. I can only comment on their mobile offerings:

- Best supported are the current MacBook Airs. Everything except the Webcam should work out-of-the-box. The webcam needs the out-of-tree bcwc_pcie driver (https://github.com/patjak/bcwc_pcie)).

- The Retina MacBooks need some manual work before being usable (e.g. need to compile out-of-tree keyboard & touchpad driver (https://github.com/cb22/macbook12-spi-driver)), but should work fine as well.

- The MacBook Pros before October 2016 are also quite good supported, the support for newer ones is still quite incomplete (check out https://github.com/Dunedan/mbp-2016-linux for details), although it's possible to use them as daily driver if you're aware of the limitations.

I've never tried but Debian has a lengthy (if out of date?) wiki page about running it on Macbooks:

https://wiki.debian.org/MacBook

https://wiki.debian.org/MacBookPro

The latest macbook pros essentially don't work well with linux. I think wifi isn't a solved issue still, for example.

None of them work well with Linux, despite the Linux folks sometimes bending over backwards to make it work. https://lwn.net/Articles/707616/

All of the Macs I have require binary firmware blobs for WiFi, for the open source driver to work. And even in that case none of them can do even 802.11n. I have to use the proprietary WiFi driver to get 802.11n or 802.11ac. And yes each model varies in this regard, which makes it something of a Choose Your Own Adventure book.

Depends on the model. On the non-TouchBar models WiFi works fine, on the TouchBar models it doesn't. For more details check: https://github.com/Dunedan/mbp-2016-linux

What’s AMT? Is ME on Macs innocuous?

Active Management Technology is the backdoor that's sold as a feature.

> https://en.wikipedia.org/wiki/Intel_Active_Management_Techno...

Not innocuous, but probably less dangerous.

I heard https://beagleboard.org/black can boot and run Linux w/o any blobs either in bootloader or kernel (provided you're OK with a sub-par screen resolution and not using the onboard GPU)

https://news.ycombinator.com/item?id=12584880 and others might have details on WiFi and such

The BeagleBoard X15 seems very interesting. The onboard GPU is definitely a problem though. Why didn't they go for a useable GPU? And no, if it does not have open Mesa drivers, it is not usable.

I really wonder why the GPU situation is such a huge mess. Very few are supported by free drivers and the closed drivers are, besides being closed, often of very low quality. Is patent law holding this situation stable? Isn't patent law there to promote advance? I feel it isn't working.

Your best bet is probably a tablet or smartphone with a fast ARM processor. Those don't have the management engine and can run surprisingly fast.

While it's true that they don't have MEs, the basebands in smartphones almost always have direct memory access, and their own proprietary firmware, so the same problems apply :-(

As a desktop computer for day to day use? Can I run it without non-free software? Can I natively install Debian with mainline Linux to actually get work done? Can I connect a monitor and other accessory?

Should not trust a phone or tablet. Are the radios off? Are you sure?

> I think HN is uniquely positioned to show us the answer. Take a community of people with generally above average interest and/or knowledge in this stuff, and the comments are filled with

I think it's even more sinister: I would argue that a higher percentage of users on HN might be sworn to secrecy about any knowledge they might have anyway.

So you end up with very smart people who're either sworn to secrecy or who aren't; those who aren't are asking questions (and very few have answers, and those answers are partial or incorrect). Those who are can't answer them honestly or fully.

In the past discussions of the ME here and elsewhere, there have always been people making self-assured poo-pooing noises about what a trivial nonissue it is, make deceptive claims about exposure, and then dumb claims about how you can't trust any hardware. They never reply to particular questions that might point out how deceptive the arguments are.

I'm one of the people that claims you can't trust hardware. Care to elaborate why that's not the case. How does one trust a chip with 14nm transistors? Are you claiming that one can 'simply' decap the chip and examine it with a microscope on a Saturday night? How do I then trust that the chip I have in hand is of the same architecture as the one you decapped and examined?

You are of course correct that in the general case for threat models above a risk threshold, one cannot trust hardware. But that is not the argument under discussion. The argument being made is that it doesn't matter if the ME is a big fat target, because (f'instance) your NIC could also be a big fat target we just don't know about.

That is the argument I am asserting is dumb. And it is obviously dumb; in adversarial contests, you don't leave weaknesses exposed just because you might have other weaknesses[1]. It also ignores the presence of differential threats; I may not care about hypothetical compromised NICs because my use case my not require a network, but need anti-evil-maid defenses.

Bottom line: in the context of discussing whether or not the ME is dangerous in the general case, other potential hardware threats are irrelevant, and I believe the argument is one used to intentionally muddy the waters.

[1] Putting aside deeper strategies; I'm not going to argue about game theory here.

This is how I feel -> I've treated every device I've had for the last decade as if it were compromised, because who can prove to me otherwise? I certainly don't have the expertise to verify for myself.

You're only responding to the part after "dumb claims," right?

And your (valid) refutation of that part in no way implies spending less time reverse engineering and disabling ME, nor being less excited about this tweet. Correct?

Call them out on it.

This is what I think, too. My professional knowledge doesn't encompass anything like ME, but occasionally areas I am expert in do come up. Unfortunately I can't honestly do much more than just watch -- I'm afraid that I might give away things I shouldn't without realizing it.

I'm sure that I'm far from the only one.

If you are in this position, you may be able to take secretly actions:

- create tools to help fight what you deem contrary to things that are important to you

- dispatch leaks in subtitle ways so that humanity is not left in the dark

- lead anonymous and discrete community of people sharing your believes, your skills and passion to improve things

Be careful. And best of luck.

Late to the party here and I doubt you'll ever see this.

But I haven't seen anything that worried me. Besides those NDAs are legally binding promises, I take those seriously.

Previously, explaining what the author of the tweet did months ago:

https://www.digitaltrends.com/computing/intel-kaby-lake-skyl...

"As shown in the presentation by security researchers Maxim Goryachy and Mark Ermolov, one way of accessing the JTAG debugging interface" "is to use a" "hardware implant" "running Godsurge" "which can exploit the JTAG debugging interface. Originally used by the National Security Agency -- and exposed by Edward Snowden -- Godsurge is malware engineered to hook into a PC’s boot loader to monitor activity. It was originally meant to live on the motherboard and remain completely undetectable outside a forensic investigation."

Emphasis mine.

But this all was in January:

"The claim was made during a presentation" "which showed how hackers could use a cheap device to gain access to a debugging interface embedded in hardware."

What's the news now compared to then?

That we have one more person capable of exploiting this in the wild.

Who?

The guy who made the tweet...

No, he's the same guy who made the news in January, Maxim Goryachy.

I've been warning friends and family about it for years back before it was well known, my first email about it was 2015. Their reaction has been one of three things; you're too paranoid, who cares so what, and stop talking to me. I've always made a variety of suggestions and updates on general security issues, even beyond the Intel ME problem, to friends/family via email.

It is not just a matter of apathy. They get violently ill at being told to think about protecting themselves. If you tell them not to put their debit card into an ATM without giving the card reader a tug to see if its real first for example, they'll do it wrong anyway just to spite you. It isn't that giving the tug is hard or that it isn't wise, but they simply do not want you to be right or have to think about it.

Admitting that you are right about that one little thing means they have to deal with all the other issues that you brought up as well. There is probably an interesting field of psychology to be researched with just that phenomena alone. I don't think this is just the people I know personally because I've encountered a lot the public who has this mindset as well. It is how we got ourselves into these problems in the first place with no recourse.

I stopped sending the emails about a year ago because they asked me to. The reason stated is that no one cares about security and a number of them had already auto-forwarded me to the junk folder. Or, told me they saw my name and would skip my emails and not open them. I don't even feel like bringing it up again now that it is a going concern. They will continue to not care.

I find it frustrating.

EDIT: I've disabled Intel ME on my machines. I would offer to do it for others but they'd have to acknowledge it's something that concerns them to want that help, and they won't.

> One way to think of ME is, we all woke up one day and discovered we have had high resolution night vision spy cams installed in our bedrooms.

Not really how I think of it. Seems more similar to waking up one day and realizing Tesla controls your Tesla car remotely. Or Microsoft can push bad updates Windows. Or Google can push bad updates to Chrome.

> And yet we really don’t seem to care much. Lesser issues generate national outrage and high volumes of press coverage. Why?

On my end it's because I have not seen a single shred of evidence that it has been used for spying, and because I figure the moment anyone becomes aware of that happening, people would probably find a way to block the network traffic at the router or somewhere else.

The point of ME is that it's invisible. And until then, few people had access to it.

Now I can't wait for rogue monero miners to use ME to propagate :)

It doesn't matter if it's visible or invisible. The point is, it cannot go undetected while being used:

- If it were to periodically "check in" with an external server to see if it needs to do any kind of spying -- admins would notice the network traffic.

- If it needed to be contacted externally to "initiate" any kind of spying at all, that would mean anyone behind a NAT would be safe, and furthermore, the the moment anybody notices such a thing, it would make the headlines and get blocked on networks, so this capability would need to be kept secret and turned off except for ultra-high-value targets... which most people do not view themselves as.

You are not giving anywhere near enough credit to those who would be your adversary.

The NSA routinely intercepted Google internal traffic. Did Google, who are presumably running the most advanced network on the planet and staffed by people who don't suck, notice the intrusion? They did not; they got informed via PowerPoint.

While the sophistication of the attackers decreases as you move from NSA to random hackers, so does the sophistication of the network as you move from Google to mid-sized businesses.

> The NSA routinely intercepted Google internal traffic

How are these even similar? Did the NSA ever send traffic of their own on the Google network infrastructure? Citation needed if so, because I recall they merely listened in on existing traffic using external network equipment.

You assume it would be used for mass spying.

Not at all.

When you have something that good, you use it for specific targeting. You get a guy with a work laptop at home, you infect him, then you use the machine to get one closer to your objective. Slowly. With time between the events. Without being a beacon in the network.

Or you just use it to spy on a guy you suspect.

Or to get access to secrets of somebody you wanna black mail.

> You assume it would be used for mass spying. Not at all. When you have something that good, you use it for specific targeting.

Did you even read what I wrote? Specifically the last sentence?

Woops

"If it were to periodically "check in" with an external server to see if it needs to do any kind of spying -- admins would notice the network traffic."

Admins would use network dedicated hardware with network chipsets driven by closed source firmware. In a crazy but technically doable scenario, that closed source firmware could contain instructions to "send packets containing magic word X to address a.b.c.d" and not reporting or counting that traffic, even to applications opening the device in promiscuous mode, with all routers in between to obey the same instructions. Not a single byte would be reported, counted or sniffed unless someone sticks a digital analyzer on the network cable.

> Admins would use network dedicated hardware with network chipsets driven by closed source firmware.

No, I fully expect there are enough admins out there running dedicated hardware whose design & source code they have access to. That is sufficient.

Given that the ME has full access to the NIC, outbound traffic could be concealed onboard traffic that is already outbound. If the adversary has also compromised network routers, the traffic could be observed and decoded without explicitly being sent anywhere.

Similarly inbound control signals could be delivered by modifying inbound traffic that the ME observed and decided.

Depending on your throughput needs the signal could be delivered subtly by for example modifying the timing between packets in a way that would be very hard to identify as a signal.

I’m hoping the ME firmware Now gets dumped and studied closely. I’m betting there are some surprises in there

It's still possible to monitor that traffic, especially at the corporate firewall level, or use a Raspberry Pi, or use an old, pre-ME computer.

Until there is evidence, this is technically just a government conspiracy theory.

It isn't a conspiracy when the feared idea has been confirmed. There is a separate os running on the cpu to monitor and control each and every single one of new intel machines.

Right, but there's no confirmation of any remote access or spying going on.

Are you so sure about point 1?

Yes? I'm not claiming every single admin would notice it, I'm just saying some competent admins somewhere would notice it. I hope I'm not proven wrong, but I don't expect to wake up one morning and read "Breaking news: No admin has noticed this strange this IP traffic to Intel/NSA/whatever for the past decade".

I agree. No one has ever observed ME sending unexpected traffic. (Feel free, anyone, to point to a counter example.)

It's never been secret. It's been advertised by Intel as a feature so enterprises can control the computers they own.

Secret no. But if somebody uses it to own you, you can't see it.

> "Apparently, ME is the perfect combination of opaque, obtuse, and obscure. It’s not rocket science, but complicated enough it’s hard to explain well quickly."

The way I see it is Intel ME is a processor-level application that has full control of all computer activity and cannot be blocked or disabled and can be accessed and controlled remotely.

Would like to hear other people's opinions of what it is.

The mnemonic "opaque, obtuse, and obscure" is a valid denotation of targeted qualities, not unlike the qualities targeted for drone activity are related, with the mnemonic "dull, dirty or dangerous."

So, the three O's is a good conceptual utility, for understanding the combination of traits that can exploit the realities of human psychology, and explain why no one seems to care about how technical paralysis can stifle apparent relevance.

It's not only a means of explaining sneaky cloak and dagger stuff. You could describe lots of niche tech staples with this mnemonic.

When something is difficult to explain, that's often enough to derail any casual conversation with simple mental fatigue.

  Opaque:

Any number of qualities can render subject matter opaque. A poorly indexed, large volume of data is opaque, but a recursive function may also be opaque in it's behaviors.

  Obtuse:

Intel ME's position in the stack is placed at a key choke point, requiring highly abstract approaches to utility. In other words, it is obtuse.

  Obscure:

It's readily available, but sequestered as a feature behind interfaces non-technical users rarely visit, without advertising to promote, train or recommend it's use. Is it supposed to be an easter egg? For who?

It's a pretty big thing and parts are necessary, parts are useful, parts are scary, and too much of it is shrouded in secrecy.

Let's be pragmatic. Does anyone know if ME blockers work? Can you please post one if it does? Can we start a list? Are the destination ips it can be controlled from hard coded, can it be blocked via simple firewall rules?

EG tool: https://github.com/corna/me_cleaner

List? https://github.com/ransom1538/intel_me_cleaners/

You can use me_cleaner, and it's better than nothing, but the ME is still required for booting the motherboard.

It's not that "we really don't seem to care much"

It's that even those of us that care vehemently, have no recourse. It is impossible to fight a secret police state.

Well with that attitude it is...

Part of winning is to even begin to believe you can fight...

There's ongoing work to fight against this, it just takes a very long time because the problem domain is incredibly complex.

RISC-V [0] is an open ISA that looks promising. Unfortunately, the privileged instruction set is still a draft, which is important for getting a full modern OS up and running.

lowRISC [1] is as non-profit open hardware company that has been working on a fully open RISC-V-based SoC that can run Linux. In their about page they claim it'll be ready this year.

There's also the stuff from SiFive. They have an arduino-comparible microcontroller, and have ongoing work for a 64-bit quad-core. I don't think their hardware is open, though.

[0] https://en.wikipedia.org/wiki/RISC-V

[1] http://www.lowrisc.org

To be fair, many of us noticed the giant camera in the corner a long time ago. ME has been a holy grail in the security researcher community for a long time, frequently the subject of presentations at conventions. And we have been pestering Intel about this since its inception. But the fact is that it doesn't matter how much outrage you or I may have. It will take enterprise-level shifts away from Intel products to get them to offer chips without ME.

I would rather hope that it would take a brave judge or the EU to forbid this spy-device.

Commercially there's no alternative. Enterprises even use Microsoft over Linux/BSD. Why would they get rid of Intel? For Anti-US spying a firewall should be enough.

What about AMD? Which chips does the sec-comm recommend for not getting pwnd

AMD and ARM have 'TrustZone', which is not the same, but if you don't trust it maybe you're in trouble.

> One way to think of ME

I think I am a bit out of the current state of events. Is ME short for management engine? If that is the case, what is the problem with it?

> And yet we really don’t seem to care much.

Most people do not have any concrete notion about what management engines are. People weren't that skeeved out by Alexa, and that was a pretty easy-to-understand system. There's no way that people will have any kind of personal connection to something that they barely are aware of and don't understand.

>One way to think of ME is, we all woke up one day and discovered we have had high resolution night vision spy cams installed in our bedrooms.

Sure, if by one day you mean - for the past 10 years? And if by spy cams you mean - A product with official documentation from the vendor, and similar to other products from other vendors. And these products can be purchased by anyone.

You have some valid points, but they are clouded by your sweeping generalizations and needlessly polarizing language.