It looks like you're using an Ad Blocker.
Please white-list or disable AboveTopSecret.com in your ad-blocking tool.
Thank you.
Some features of ATS will be disabled while you continue to use an ad-blocker.
Recent reports that these exploits are caused by a “bug” or a “flaw” and are unique to Intel products are incorrect. Based on the analysis to date, many types of computing devices — with many different vendors’ processors and operating systems — are susceptible to these exploits.
Intel is committed to product and customer security and is working closely with many other technology companies, including AMD, ARM Holdings and several operating system vendors, to develop an industry-wide approach to resolve this issue promptly and constructively. Intel has begun providing software and firmware updates to mitigate these exploits. Contrary to some reports, any performance impacts are workload-dependent, and, for the average computer user, should not be significant and will be mitigated over time.
originally posted by: MindBodySpiritComplex
originally posted by: schuyler
Realistically, how many people have EVER been affected by this? And how many will be? "Horriffic"? Really?
Affected by the flaw? A minority. Affected by the patch? Pretty much everyone via OS update!
Intel’s Management Engine is only a small part of a collection of tools, hardware, and software hidden deep inside some the latest Intel CPUs. These chips and software first appeared in the early 2000s as Trusted Platform Modules. These small crypto chips formed the root of ‘trust’ on a computer. If the TPM could be trusted, the entire computer could be trusted. Then came Active Management Technology, a set of embedded processors for Ethernet controllers.
The idea behind this system was to allow for provisioning of laptops in corporate environments. Over the years, a few more bits of hardware were added to CPUs. This was the Intel Management Engine, a small system that was connected to every peripheral in a computer. The Intel ME is connected to the network interface, and it’s connected to storage. The Intel ME is still on, even when your computer is off. Theoretically, if you type on a keyboard connected to a powered-down computer, the Intel ME can send those keypresses off to servers unknown.
originally posted by: TEOTWAWKIAIFF
Recent reports that these exploits are caused by a “bug” or a “flaw” and are unique to Intel products are incorrect. Based on the analysis to date, many types of computing devices — with many different vendors’ processors and operating systems — are susceptible to these exploits.
Intel is committed to product and customer security and is working closely with many other technology companies, including AMD, ARM Holdings and several operating system vendors, to develop an industry-wide approach to resolve this issue promptly and constructively. Intel has begun providing software and firmware updates to mitigate these exploits. Contrary to some reports, any performance impacts are workload-dependent, and, for the average computer user, should not be significant and will be mitigated over time.
newsroom.intel.com - Intel Responds to Security Research Findings.
I was wondering what this does to all the virtualization that has happened in data centers over the years. And the cloud...
With a Core i7 there are 731,000,000 transistors. Linux kernel has 15 million lines of code. There are bound to be issues that people thought would never be seen or exploitable. With an emphasis on conserving space and speeding up data transmission across a CPU, there are bound to be "short cuts" taken. It also sounds like this is a kernel level exploit that gains access to chip level data transmissions and brings them to user space. Which is why I was wondering about virtualization in the first place.
What a nightmare! This is a real "Y2K" issue! Using AMD does not mean you're safe!
originally posted by: AMPTAH
What if they just found out that it was the Russians who recently discovered the bug, and used it to hack the DNC and RNC, and so now they have to admit there's a bug, and patch the thing before the Russians get more intel this way?
originally posted by: andy06shake
a reply to: MindBodySpiritComplex
I use a Ryzen 1600X for my main rig these days so i guess I'm ok.
But my second PC has an Intel i5 2500K, bloody well love that CPU(4.8Ghz OC on air!). And the weans still use it for gaming so i really hope some form of microcode update can be created to address the issue rather than an OS update that will essentially gimp the things processing ability by 30%. Not looking good in the microcode update dept all the same.
from the Op article.
No researchers have yet come forward with an example program that exploits this flaw, but that's hardly proof that hackers, or the NSA, didn't figure out how to make use of this exploit years ago.
originally posted by: eisegesis
Research: Intel Management Engine
hackaday.com...
Parts of this spy chip were included in the silicon at the behest of the NSA. In short, if you were designing a piece of hardware to spy on everyone using an Intel-branded computer, you would come up with something like the Intel Managment Engine.
The ME is actually running Minix
Well since the ME is running Minix and a web server you have absolutely no control over, it seems that anybody who can figure out how to access that hidden web server owns your PC and there's nothing you can do about it, except switch to another processor that doesn't have this Intel Management engine with the secret hidden web server.
The Intel ME is a tiny, obscure piece of hardware locked away in nearly every modern Intel CPU. It’s connected to your storage and your network interface. If someone can access the ME, they own your computer.