News for hackers. Stuff that matters.
Re:Intel patches new ME vulnerabilities by blitmap on Sunday July 22, 2018 @03:06PM (#17588272)
As I understand it, ME is used to remotely control the processor like in a datacenter. If a datacenter is buying hundreds of thousands of these it makes sense to have it on by default so their people don't have to go in and turn anything on. As much as I recognize it as a vulnerability (to the extreme), it doesn't make sense to have it off by default. They should certainly support a way to _permanently_ disable it. I wish there were easy tools to verify ME is "not accessible" since I don't work in a datacenter and I wouldn't know how to test that it's off.

Things that come with great benefit to risk for abuse:

- Intel ME

- Computrace

- Device Guard

Re:Intel patches new ME vulnerabilities by forapurpose on Sunday July 22, 2018 @04:50PM (#17588851)
> ME is used to remotely control the processor like in a datacenter

It's used to remotely manage almost all aspects of the computer; it's a parallel, out-of-band subsystem, complete with its own processor, memory and OS.

It's very useful for managing computers at scale and at physical distances. Imagine making changes to thousands of computers; manual, one-at-a-time, hands-on solutions are very inefficient and error-prone. Imagine a campus or office building where the average distance from the IT support office to the computer is 20 minutes. Staff can spend most of their time in transit: 20 minutes there, 10 minute fix, 20 minutes back. 80% of the IT labor budget is paying people to walk.

But I agree; there's no reason the computer's owners shouldn't have the power to disable it if they choose.

Re:Intel patches new ME vulnerabilities by emsy on Sunday July 22, 2018 @03:29PM (#17588418)
Their motivations are irrelevant. Consumers aren't datacenters.
Re:Intel patches new ME vulnerabilities by TomMarius on Sunday July 22, 2018 @06:28PM (#17589244)
You know that companies deploy these processors as well, right? I just finished a deployment of 10k Intel i5 machines.
Re:Intel patches new ME vulnerabilities by emsy on Monday July 23, 2018 @06:45AM (#17591801)
And yet, customers still aren't datacenters, but still they carry the risks.
Re:Intel patches new ME vulnerabilities by TomMarius on Monday July 23, 2018 @09:07AM (#17592444)
I'm not talking about datacenters, I'm talking about workstations.
Re:Intel patches new ME vulnerabilities by emsy on Monday July 23, 2018 @12:08PM (#17593671)
In my reply, I used datacenters as a term to describe mass deployed computers (for which a ME actually makes sense). I’m sorry, I should’ve clarified.
Re:Intel patches new ME vulnerabilities by JumpCrisscross on Sunday July 22, 2018 @10:42PM (#17590217)
> Consumers aren't datacenters

Consumers have also shown zero intention of paying more for secure devices. Until we have a public ME hack with real consequences, I do not expect that to change.

Re:Intel patches new ME vulnerabilities by emsy on Monday July 23, 2018 @06:41AM (#17591793)
The funny thing is that making the processor more secure would require less work by not implementing a ME.
Re:Intel patches new ME vulnerabilities by daxorid on Monday July 23, 2018 @11:58AM (#17593611)
Demonstrably untrue. Consumers pay a premium for access to the Apple SEP and App Store review/analysis process (Jekyll and XCodeGhost notwithstanding, it's been a major security success)
Re:Intel patches new ME vulnerabilities by acct1771 on Sunday July 22, 2018 @09:56PM (#17590008)
Backdoors that can be turned off are backdoors that can be turned on.

Unless you have a fuse to be pulled, or blown.

Re:Intel patches new ME vulnerabilities by philjohn on Sunday July 22, 2018 @03:27PM (#17588404)
IIRC AMD allows their PSP to be disabled via the BIOS.
Re:Intel patches new ME vulnerabilities by IntelMiner on Monday July 23, 2018 @12:12AM (#17590530)
Some do. Though it's unclear what that does yet
Re:Intel patches new ME vulnerabilities by floatboth on Monday July 23, 2018 @01:47PM (#17594387)
It definitely prevents the OS from accessing it over PCI, but whether it prevents the PSP from accessing the OS is indeed unclear.
Re:Intel patches new ME vulnerabilities by 76 on Monday July 23, 2018 @03:18AM (#17591055)
It might make sense only on Xeon CPUs, but consumer models like i7 are not meant for data centers.
Re:Intel patches new ME vulnerabilities by blitmap on Monday July 23, 2018 @02:15PM (#17594609)
This is something obvious I had not considered. Good point!