Securing intel devices

http://blog.ptsecurity.com/2017/08/disabling-intel-me.html can someone help me understand this article? it sounds like a method to bypass some special intel brand chip that allows intel to read computer data, I figured someone here could understand and provide an explanation of what it means

Google is your friend Lain. https://en.wikipedia.org/wiki/Intel_Active_Management_Technology From the second paragraph: >AMT is designed into a secondary (service) processor located on the motherboard, and uses TLS-secured communication and strong encryption to provide additional security. AMT is part of the Intel Management Engine, which is built into PCs with Intel vPro technology. tldr: it is a chip Intel puts in all their CPUs to make security and management easier but the source code isn't available to the public so we cannot audit if it is actually secure or just leaks our data to the NSA. The article you posted is about trying to disable it.

>>2051 Other Lain here, just for technical clarification - ME chip doesn't reside in main CPU physically, it's in PCH (Platform Controller Hub), mainbaoard's chipset that superseded old northbridge and southbridge model on Intel-based systems

>>2050 The ME chip runs code before the main CPU and has full access to hardware, including network cards. In otherwords it is a hardware backdoor included in all modern Intel processors and there is nothing you can do to mitigate it from the main CPU. Intel ME is necessary to boot the machine so it can never be disabled entirely but there is a project to disable as much of it as possible called me_cleaner. https://github.com/corna/me_cleaner/wiki/How-does-it-work%3F The article you linked is a new piece of research that found an official (but secret) switch Intel has added to disable ME after it does the required hardware initialization. The interesting part is that Intel confirmed this switch was added by request from an influential customer (possibly government or a contractor) specifically for security reasons. There were other interesting things discovered as well like how the Intel ME firmware is based on Minix but that's not related to /sec/.

>Guys, how does an ICE inside of an automobile works? >Google is your friend, here is an article: https://en.wikipedia.org/wiki/Wheel >Other Lain here, Just for technical clarification a Transmission does not reside in main Engine physically, it's in Drivetrain, car's part superseded old Clutch and Steering Wheel on Ford-based cars >The Engine runs inside car and has full access to hardware, including exhaust. In otherwords it is a hardware backdoor included in all modern cars and there is nothing you can do to mitigate it from the car.

>>2069 It's funny because it's entirely divorced from reality. ME is a real thing that has been exploited in the past, and ME is in fact what >>2052 and >>2060 were talking about. There are several talks about it available online. https://www.youtube.com/watch?v=QDSlWa9xQuA is a good place to start. I'd recommend having some real knowledge before you get snarky.

>>2070 Don't feed the troll.

>>2050 TL;DR The " High Assurance Platform" is a function for the NSA. More parts of the ME can be removed thanks to this discovery. The removed part makes the ME go into "TemporaryDisable mode" a undocumented function. Which allows the CPU to initialize without the ME activated. This hack doesn't work on Apollo Lake platforms. Imo since we can't directly audit that soykaf there's probably a lot more undocumented functions. https://github.com/xoreaxeaxeax/sandsifter/raw/master/references/domas_breaking_the_x86_isa_wp.pdf Use POWER9 https://www.raptorcs.com/TALOSII/

>>2075 It just neutralize the ME it doesn't remove it like libreboot would do.

>>2075 >Use POWER9 PowerPC truly is the best platform.

>>2075 >The " High Assurance Platform" is a function for the NSA. There is no indication that this has anything to do with the NSA. >More parts of the ME can be removed thanks to this discovery. Nothing is being removed. It is a software flag which disables ME after initialization. Read better next time.

>>2075 Ignoring the possible FUD above. The cost for POWER processors is outrageous, I hoped that the OpenPOWER initiative would lower the cost, but it seems like it has not. Anyone able to give me tips on how to acquire more architecture that uses RISC? (Non-ARM).

>>2079 You might be interested in RISC-V. There is no such thing as an Intel replacement for general desktop computing though. All open source processors are either very slow or very expensive. >Ignoring the possible FUD above. It looks like >>2069 and >>2075 are the same person. I'm guessing that's why people are ripping >>2075 apart.

>POWER larpers >RISC V larpers you don't even know what you are talking about, lains POWER9 is for database servers and proprietary IBM systems, soykaf performance for your average looniks desktop for triple the price of top Intel platform RISC V/HiFive is in state of arduino-compatible microcontroller at best, plus cück license, so don't expect much >2078 >There is no indication that this has anything to do with the NSA. >reading comprehension >One of the fields, called "reserve_hap", drew our attention because there was a comment next to it: "High Assurance Platform (HAP) enable". >Googling did not take long. The second search result said that the name belongs to a trusted platform program linked to the U.S. National Security Agency (NSA) >A graphics-rich presentation describing the program can be found here http://fm.csl.sri.com/LAW/2009/dobry-law09-HAP-Challenges.pdf(Always argue in good faith and avoid personal attacks.)

>>2086 >There is no indication that this has anything to do with the NSA. What I meant was there is no indication that it was the NSA who asked Intel for this off-switch. I now realize that's not what you said. Actually what you said >The " High Assurance Platform" is a function for the NSA. doesn't mean anything as an English language sentence. I guess I gave you too much credit to start with.

Welcome to Intel Management Engine Such a nice surprise, (such a nice surprise) Plenty of code in Intel Management Engine Any type of exploits, (any type of exploits) You can find it here~~~~ DMA access to host RAM, connected to NIC, And rms said "We are all just prisoners here, of our own device." Last thing I remember, I was Flashing for firmware I had to get my Ring 0 back To the state the PC was before "Relax, " said Intel, "We are programmed to shutdown (after 30 minutes), You can "me_clean" it any time you like, But you can neeeeeever switch oooofffffff!!

>>2079 From what I've seen the pricing seems to be comparable to similar Intel parts. There just aren't any "consumer" grade CPUs or motherboards, only high end server hardware.

>>2087 > >The " High Assurance Platform" is a function for the NSA. >doesn't mean anything as an English language sentence. >I guess I gave you too much credit to start with. Not that lainon but while the syntax is a bit awkward, it still has all the necessary elements and ordering. It has a fairly clear meaning.

Is there a posibility of create some policies rules in a firewall to dinamically block packets to Intel?

>>3237 It runs its own network stack However theoretically if your firewall were an external, trusted device then ya