Ring -3 Untermining your ass

https://www.networkworld.com/article/3236064/servers/minix-the-most-popular-os-in-the-world-thanks-to-intel.html?fbclid=IwAR3AYZ2-GBTUtQVNEXUBGHN9ZJAle0Ow3BdpFHJbKrgA8icFlEsw45UphTc Don't know if this is widely known so posting incase it wasn't only me missing this. tldr: there's a mini os on a lower level with full access you can't access or remove. What you think of as you "bottom" OS is actually just sitting on top and not in full control. Some processors allow partially disabling it but that's it.

IME is pretty well known yeah. It's probably backdoored on some level.

>>6502 IME is old news but i never heard that it hosts a full small OS with complete access before. It's no wonder that exploits continiously creep up. Once you own it the user can't even detect the intrusion since he has no access to it from his level.

Does coreboot help against IME exploits?

>>6504 IME is loaded first. Coreboot sits on top. There's currently afaik no replacement for IME. As for countermeasures that exist https://github.com/corna/me_cleaner

>>6503 if there was going to be any OS running under everything on my computer, I'd want it to be minix or seL4 or something similar. They tend to be much less bug-prone due to their small size and well-researched nature.

This came up on HN a little while ago and may be of further interest to OP: https://www.gwern.net/Turing-complete

>>6501 >tldr: there's a mini os on a lower level with full access you can't access or remove. What you think of as you "bottom" OS is actually just sitting on top and not in full control. It's not that there is something "under" your OS, ME is separate processor acting like a supervisor. Both run side by side not one on top of the other. >>6504 >Does coreboot help against IME exploits? coreboot is code that runs on the main processor just like your OS, so no it's just as helpless against the ME processor.

>>6511 It's inappropriate to call it side by side when one has onesided full control over the other. As for why it's "on top": IME is classified as Ring -3 while your OS lowest option is Ring 0. So it's on top in this schemata and it suits well as this also illustrates the onesided power dynamic.

It's not actually running Minix, this was an incorrect assumption by the researchers. It does use some small pieces of code that are also in Minix, but the overall OS is custom built.

>>6522 minix by itself is very little. The whole point is that it's a microkernel, most functionality happens in user space, which the intel engineers would have written.

So is there any real news here for people who are already familiar with IME? Aside from Intel using some MINIX code?

>>6514 >It's inappropriate to call it side by side when one has onesided full control over the other. It's appropriate to call it side by side when it's physically separate silicon. >IME is classified as Ring -3 while your OS lowest option is Ring 0 What is a type 2 hypervisor? What ring is Linux running in when KVM is enabled? sage because this thread is an embarrassment and the mods are defending it for some reason.

>>6501 > you can't access or remove. I bought an X200 because installing Libreboot (at least in the way my friend did it) purges IME except for some `return 1` function. There isn't really a way for anyone to restore IME without physical access -- if they have that, I've lost already. Besides, it takes more effort to reflash IME on it than to remove the hard disk.

>>6548 >sage because this thread is an embarrassment and the mods are defending it for some reason. You have a point that this thread is unnecessary and whatnot. All that has been written here is enough. This thread is locked.