Re:NSA Said to Have Used Heartbleed Bug for at Least Two Yea...
by Sephr on Friday September 20, 2019 @06:51PM
(#21032107)
ME has a debug mode that might be possible to enable with a signal sent through the 3.5mm jack on some laptops[1]. I'd be pretty concerned about ME bugs and backdoors disguised as ME bugs.
Re:NSA Said to Have Used Heartbleed Bug for at Least Two Yea...
by segfaultbuserr on Friday September 20, 2019 @06:59PM
(#21032157)
I meant, finding a backdoor in its full form on the main system would be a much more significant find, and its impact and newsworthiness is greater than any hypothetical or baseless speculations, such as Bloomberg's BMC affair.
The impact of the BMC affair, if true, is showing real evidence and real demonstration that such an attack has happened, has been used in the wild, rather than showing that the attack is possible (we all know). Unfortunately, bad journalism at work.
P.S: I'm not saying that the ME subsystem, or buggy speculation (pun not intended) isn't a threat, just to make a point.
> I'd be pretty concerned about ME bugs and backdoors disguised as ME bugs.
Same consequences. I'd say they're effectively the same thing.
Re:NSA Said to Have Used Heartbleed Bug for at Least Two Yea...
by ryacko on Saturday September 21, 2019 @02:27AM
(#21033841)
Zuckerberg’s famous MacBook with tape over web cam and microphone jack has a lot more context now.
I guess this says everything about corporations caring about security.
Re:NSA Said to Have Used Heartbleed Bug for at Least Two Yea...
by monocasa on Friday September 20, 2019 @06:54PM
(#21032125)
There's a difference between one guy chasing ghosts, and several sources anonymously saying "we found this and had to mitigate it".
Re:NSA Said to Have Used Heartbleed Bug for at Least Two Yea...
by segfaultbuserr on Friday September 20, 2019 @07:06PM
(#21032193)
Well, a year later, we still haven't seen the backdoor chip in question being taken to a lab or DEFCON yet... Even the photograph was fake, just a stock photo...
I was excited to read the news story, and it was a huge disappointment.
Re:NSA Said to Have Used Heartbleed Bug for at Least Two Yea...
by monocasa on Friday September 20, 2019 @07:32PM
(#21032362)
We also haven't seen the devices in the NSA's TAO catalog taken to a lab or showing up at DEFCON. That's half the point of targeted hardware attacks.
And yeah, it was a graphic that wasn't entirely accurate; welcome to print journalism.
Remember BadBIOS?
* https://en.wikipedia.org/wiki/BadBIOS
Same problem. EVERYTHING that Dragos Ruiu claimed is plausible, and it could be a great cyberpunk plot written by Neal Stephenson. But there is ZERO evidence that the malware actually exists.
And finding an actual incident in real life is much more important than theoretical possibilities. For example, almost everyone knows that it's very possible for semiconductor vendors to include a silicon-level backdoor since the 1980s, but finding an actual Intel/AMD chip with such backdoor (not ME, something like a secret instructions) is another matter.