Vaughan-Nichols's article is at http://www.zdnet.com/article/minix-intels-hidden-in-chip-operating-system/
----- Forwarded message from Rick Moen <[email protected]> ----- Date: Wed, 8 Nov 2017 17:19:35 -0800 From: Rick Moen <[email protected]> To: [email protected] Subject: Re: [skeptic] MINIX: ?Intel's hidden in-chip operating system Organization: If you lived here, you'd be $HOME already. Quoting Scott Peterson ([email protected]), citing a mostly good Steven J. Vaughan-Nichols's ZDnet article: > Buried deep inside your computer's Intel chip is the MINIX operating > system and a software stack, which includes networking and a web > server. It's slow, hard to get at, and insecure as insecure can be. [...] The referenced Intel Management Engine (ME) firmware (if it is running AMT code - see below) is indeed a big problem. Recently, a firm called Positive Technologies stumbled upon (http://blog.ptsecurity.com/2017/08/disabling-intel-me.html) a way of disabling ME version 11 immediately after boot, by poking it and setting a bit that in the RAM copy of ME called reserve_hap, with the effect of making ME-mediated processes shut down. Intel have confirmed that this truly _does_ disable ME completely during subsequent runtime. Note that totally disabling ME so it never functions at all is not an option, because CPUs that include it rely on ME functionality to initialise power management, the CPU proper, and other hardware. Unlike some paranoics, I believe Intel when they say this (that the Positive Techologies hack fully disables ME firmware code, post-boot.) The story of why ME firmware is present in all new Intel x86_64 CPUs, as is the story of why parallel effort AMD Platform Security Processor (PSP) is present in all that company's new x86_64 CPUs, is credible. They're not out to 'get' anyone. It's a (regrettable) technology intended to facilitate OOB (out of band) system management by firms running large numbers of computers. The rationale makes perfect sense, even if the unintended side-effects are woeful. (Technically, the real issue is a software build called Active Management Technology = that runs atop the ME. Without AMT, the ME firmware code would be doing nothing.) The researchers speculate, by the way, that 'reserve_hap' is a hidden switch included at the behest of equipment manufacturers intending to sell equipment through the US government's NSA-administered High Assurance Platform program, so the manufacturers could answer any objection of 'What if the ME gets compromised or produces a side-channel data leak?' by saying 'Don't worry about that. The ME can be instructed to shut down immediately after boot.' > Why? Let's start with what. Matthew Garrett, the well-known Linux and security > developer who works for Google, explained recently that [...] Garrett's AMT FAQ makes good reading for people wanting to know more. https://mjg59.dreamwidth.org/48429.html?thread=1840429 This includes the fact that by _no_ means do all Intel chipsets possessing ME firmware also have AMT code that runs on it -- and how to query your machine to find out if it does. Most Intel systems don't have AMT. Most Intel systems with AMT don't have it turned on. It also includes the fact that the biggest concern is remote access to the AMT. If that isn't enabled, and there are various ways to ensure that it isn't, that concern (a remote backdoor) goes away. _______________________________________________ skeptic mailing list [email protected] http://linuxmafia.com/mailman/listinfo/skeptic To reach the listadmin, mail [email protected] ----- End forwarded message ----- _______________________________________________ Dng mailing list [email protected] https://mailinglists.dyne.org/cgi-bin/mailman/listinfo/dng
