“We have obtained fully functional JTAG for Intel CSME via USB DCI”

Re:“We have obtained fully functional JTAG for Intel CSME vi... by matthewaveryusa on Friday November 10, 2017 @10:42AM (#15670553)

I'm one of the people that claims you can't trust hardware. Care to elaborate why that's not the case. How does one trust a chip with 14nm transistors? Are you claiming that one can 'simply' decap the chip and examine it with a microscope on a Saturday night? How do I then trust that the chip I have in hand is of the same architecture as the one you decapped and examined?

[ Parent | on HN ]

Re:“We have obtained fully functional JTAG for Intel CSME vi... by _jal on Friday November 10, 2017 @11:09AM (#15670815)

You are of course correct that in the general case for threat models above a risk threshold, one cannot trust hardware. But that is not the argument under discussion. The argument being made is that it doesn't matter if the ME is a big fat target, because (f'instance) your NIC could also be a big fat target we just don't know about.

That is the argument I am asserting is dumb. And it is obviously dumb; in adversarial contests, you don't leave weaknesses exposed just because you might have other weaknesses[1]. It also ignores the presence of differential threats; I may not care about hypothetical compromised NICs because my use case my not require a network, but need anti-evil-maid defenses.

Bottom line: in the context of discussing whether or not the ME is dangerous in the general case, other potential hardware threats are irrelevant, and I believe the argument is one used to intentionally muddy the waters.

[1] Putting aside deeper strategies; I'm not going to argue about game theory here.

[ Parent | on HN ]

Re:“We have obtained fully functional JTAG for Intel CSME vi... by kfrzcode on Friday November 10, 2017 @10:47AM (#15670595)

This is how I feel -> I've treated every device I've had for the last decade as if it were compromised, because who can prove to me otherwise? I certainly don't have the expertise to verify for myself.

[ Parent | on HN ]

Re:“We have obtained fully functional JTAG for Intel CSME vi... by jancsika on Friday November 10, 2017 @11:25AM (#15670935)

You're only responding to the part after "dumb claims," right?

And your (valid) refutation of that part in no way implies spending less time reverse engineering and disabling ME, nor being less excited about this tweet. Correct?

[ Parent | on HN ]