Hardware backdoors, a practical fear?

What are the practical implications of the Intel ME? If it really is a universal backdoor how come we don't see it used so often, and if it used, on who? Theoretically it could be used to record encryption keys, but encrypted devices still seem to cause lot's of trouble for feds. I'm trying to create a security/privacy ranking system for computers but I'm having trouble figuring out how much of a threat the Intel ME really presents. Theoretically any piece of proprietary code running on a computer could contain a backdoor but realistically how many do? Here is my current model: >Compromised: (running a proprietary operating system) >Somewhat trustworthy: (Free Software OS, but with proprietary software and firmware) >Mostly trustworthy: (Free Software OS with only proprietary firmware blobs and ME) >Full trust: (Free Software OS with no proprietary components and running Libreboot) This seems logical to me, but I'm wondering how much one really has to worry about the ME when using full disk encryption and good security practices. I have a similar question regarding proprietary firmware, should I not trust a computer if it's running something like iwlwifi or linux-firmware? Should I trust the computer I'm typing this on, with an Intel ME or is it already compromised?

https://www.csoonline.com/article/3220476/researchers-say-now-you-too-can-disable-intel-me-backdoor-thanks-to-the-nsa.html >The researchers discovered an undocumented field called “reserve-hap” and that HAP could be set to “1” for true. Apparently, the NSA wanted to ensure the agency could close off any possible security risk by disabling Intel ME. I don't know if it still works most people have never been able to actually disable it, despite close attempts there are a few papers on trying included in the article.

>>18656 You can (mostly, read the docs) disable it on many systems using the python script me_cleaner. I have done it successfully on a Skylake system. Seems the script isn't being updated though so your mileage may vary for intel's latest and greatest.

They're waiting to use it in a war or domestic insurgency situation. It's basically an ace-in-the-hole given the amount of things that China could brick.

What is the practical difference between a hardware vulnerability and a hardware backdoor (intentional vuln), when the only adversaries that could insert widespread backdoors also can and do hire hundreds of people in various science/tech departments who are capable of finding hardware vulnerabilities anyway? There is no difference. Only non-attribution will save you from a targeted attack.

https://www.hyperbola.info/ No proprietary software.

Only the manufacturers of the hardware can use the hardware's backdoor. If you're in such a situation that your phone is being taken to the OEM to eg bypass the hardware-based encryption or permatrack I/O and location even when it's off then you should already have destroyed said phone along with other traces of your identity. If hardware backdoors are used on you, it's 99% glowniggers. In which case, run to the hills because you are actually doomed. You can either become a hobohacker or go to prison. The other chance is that you're actually being attacked by someone who's really good. Same thing then, you're kind of fuarrrked anyway at that point.

>>18658 What are the risks of if it doesn't work on my board? Any way to dry run it to see if it would work? I have a few servers in production I'd like to ME Clean, but don't want to brick them. Motherboard: X9DRi-LN4F+ CPU: 2x Intel Xeon E5-2630 V2 Hex (6) Core 2.6GHz

>18714 >Only the manufacturers of the hardware can use the hardware's backdoor not true, IME is ring -3, has access to the entire system and the network (which run at ring 0), is critical in the boot process (IME will forcibly shut down the system in 30 minutes after boot if it detects its been tampered with), and does not shut down even if the system is off (unless you can pull out the battery or the plug, IME remains on). with this level of privileges, an attacker could detect when you are creating an encrypted file or partition and could steal any file you attempt to encrypt before its encrypted. problem with IME is that it has too much privilege, any hacker that can take advantage of it has permanent control of the system even with wiping the OS, even if you tried to patch the IME firmware it could just block the patch

This might be of interest. https://www.win-raid.com/t2540f39-ME-cleaner.html

>>18711 Your OS won't protect you from HW backdoors. What about the CIAware running in practically all x86/x86_64 CPUs?

>>18656 I disabled Intel ME on my laptop using a CH341 and me_cleaner Now it boots a little bit faster because Intel ME is not initialized in start

>>18786 Nothing, if something fails, re-flash the original BIOS and try again I have flashed mine about 20 times and when something fails, I just write the original BIOS file Make sure you never lose the original BIOS file, it is very rare that you will be able to find it on the internet

>>18799 It's so powerful that supposedly you could use it to patch it's own backdoor and mess up with NSA's plan. Some post from an Intel engineer (that obviously doesn't want to be named) said that at least one independent self-replicant version exists in the wild. They had a full team investigating this resilient malware (or is it a goodware?) that was wiping out ME and skillfully bypassing it's self validating protocols. Further investigation led to some unused portion of the blob had been replaced by an ASCII string, that reads "Repent from your sins. T. D., 2021." They still had no clue who this T. D. was.

>>18918 It was Terry's parting gift.

>>18918 [citation needed]

>>18920 >[citation needed] it's a joke

There's another spectrev2 vulnerability and more mitigation required. Is spectre a likely threat to a non-targeted individual with a modern sandboxed browser and who doesn't run random executables?

>>18927 no, its not likely. it of course, depends what you are doing, but if you are not dumb, it probably will never be an issue. I believe alderlake are the main targets and AMD claims they are not affected. there has been rumors that isn't true, but I haven't seen any information that is the case (yet)

>>18655 >Full trust: (Free Software OS with no proprietary components and running Libreboot) As long as it's connected to the internet you should not trust it "fully". Also make sure it's FDE, with the luks header on separate hardware. I remember a lainon in another thread mentioning that if you change your luks passphrase that forensics could still recover your old key? Elaboration on this, I can't find the thread anymore.

>>18917 jmp >>19000 >>18918 unfathomably glorious

>>18655 Just get a via cpu or some obscurity ware. model is pretty spot on but you could add >Somewhat trustworthy: (Proprietary Software OS with severely outdated or obscure hardware components) >Mostly trustworthier: (Free Software OS, but with obscure hardware components) Unironically if you're all about "backdoors" you should understand why even radios are backdoor. Any form of input, a SD card, NFC, a USB port, can become backdoor. It's safe to say that if you had a proprietary phone/tablet with android, assuming you removed the 3+ microphones, the AUX and camera, all wireless incl. the baseband, and removing the data ports of the micro USB/C (leaving only charging voltage pins) then you should be fine too. Sometimes even a fully FOSS+Libre device can even get pwned by a vulnerable BCM43xx running free drivers (worst part is there's already plenty of variants which target ralink mediatek and other manufacturers straight to the core, kinda like firmware input attacks)

>>19187 >Any form of input, a SD card, NFC, a USB port, can become backdoor. What is a "backdoor" here? How does something "become a backdoor"? Those components all communicate to the CPU through standardized means and they are beholden to the MMU. Unless you mean there could be an intentional flaw in a CPU that means anyone who plugs in a certain USB stick gets unrestricted hardware or memory access, those backdoors are gonna be in software , not hardware. >Sometimes even a fully FOSS+Libre device can even get pwned by a vulnerable BCM43xx running free drivers https://www.cvedetails.com/vulnerability-list/vendor_id-5420/product_id-38223/Broadcom-Bcm43xx-Wi-fi-Chipset-Firmware.html ? The only hardware vulns I can find for any broadcom products are speculative execution attacks that would not be very useful in practice, or DOS attacks. Unless you mean some sekrit haxxor lore I don't know about.