> "To fully compromise EPID, hackers would need to extract the hardware key used to encrypt the Chipset Key, which resides in Secure Key Storage (SKS)," explained Positive's Mark Ermolov.
> "However, this key is not platform-specific. A single key is used for an entire generation of Intel chipsets. And since the ROM vulnerability allows seizing control of code execution before the hardware key generation mechanism in the SKS is locked, and the ROM vulnerability cannot be fixed, we believe that extracting this key is only a matter of time.
> "When this happens, utter chaos will reign. Hardware IDs will be forged, digital content will be extracted, and data from encrypted hard disks will be decrypted."
And this formidable response as usual:
> Intel says folks should install the firmware-level mitigations, "maintain physical possession of their platform," and "adopt best security practices by installing updates as soon as they become available and being continually vigilant to detect and prevent intrusions and exploitations."
When will it stop? How deep run the flaws in Intel's platform? Is AMD equally exposed?
Utter chaos? I don't think so.
> Hardware IDs will be forged
Seems like a victory for privacy. Who wants to be tracked via hardware IDs?
> digital content will be extracted
Any victory over DRM technology is a good thing. The only people shedding any tears will be those in the copyright industry.
> data from encrypted hard disks will be decrypted
People actually rely on proprietary hardware encryption? They should have learned the lesson when built-in SSD encryption turned out to be worthless.
>Seems like a victory for privacy. Who wants to be tracked via hardware IDs?
Those are probably not the hardware ids you're thinking about. They're the hardware ids used in trusted computing (eg. remote attestation, TPM sealing), not the ones used for fingerprinting.
>People actually rely on proprietary hardware encryption? They should have learned the lesson when built-in SSD encryption turned out to be worthless.
This is a very naive take on what's at stake. With disk encryption, there's the risk of an evil maid attack (where the attacker replaces the bootloader with a malicious one and intercepts your key next time it boots). One way of preventing this is by using trusted computing to ensure that the encryption keys are only released when the system is at a known good state (ie. bootloader hasn't been tampered with). This applies to both proprietary solutions (bitlocker) and free ones (tpm-luks).
You are more than welcome to decline to use DRM if you don't like it. Just don't expect people to give you copies of data they don't want shared by you.
That ship has sailed.
Not in the least.
"Cloud" is merely the modern spin on "terminal in the office, mainframe at the HQ". We moved from terminals to local mini/microcomputers back then, and we will move from "cloud" to edge computing again. Notably, serverless and "installable web apps" are already a growing thing.
And no, Sun, the network is the computer will not come to pass during this cycle.
We're seeing the tide turn from x86 to ARM pretty quick in both the datacenter and laptop markets. AMD should come through relatively unscathed as they're pretty diversified, but Intel is fucked. Graviton2 (Amazon's proprietary ARM stack) absolutely crushes x86 from a $/performance perspective, and there are plenty of other companies building 80+ core ARM chips.
Combined with the persistent rumors that Apple is shifting the Mac to ARM along with Microsoft reviving ARM Windows are a pretty strong signal as to where the laptop / desktop market is headed too. x86 (and by extension Intel's platform) is definitely headed towards a more niche role in the computing landscape.
"Internet-of-Things attestation" ?? A poor attempt to stick a refreshing buzzword in front of a fundamentally unwanted user-betraying open-society-undermining technology.
Remote attestation does away with the basic foundation of protocols for mediating between mutually-untrusting parties, making it so users must trust the remote party. Imagine if websites attempting to enforce (browser fingerprinting, no image save, anti-adblock, etc) could successfully implement their hostile restrictions!
This break is great news for everybody that wants their computer to remain under their own control, rather than an increasingly locked down Big Tech WebTV.
> This break is great news for everybody that wants their computer to remain under their own control, rather than an increasingly locked down Big Tech WebTV.
Completely agree. This "security breach" is only bad for corporations who want to track users and implement DRM. It's great for the freedom of the people who are actually using the computers.
While I agree with you at a consumer level, at the industrial level this is a thing. Like, imagine a vertical farm that is controlled by a thousand, networked on-prem robots. An "attestation" mechanism makes setting this up easier and less-error prone.
Remote attestation in general does have positive uses, and would be freedom preserving if the signing keys were controlled by the device's owner. The problem is Intel's design of baking in privileged keys that they themselves control, such that hostile parties can require that you run software that they provably control.
If the attestation key has been created by Intel (or within the secure element and signed by Intel), then the system can verify to arbitrary parties that the owner has not "tampered" with their own system. This creates a security vulnerability, as now overly aggressive (aka hostile) parties can demand that the owner gives up control of their own system as a condition of interacting with them.
Given the extreme power imbalance in B2C relationships, if this vulnerability exists it will eventually be abused in lockstep. Remember the days of dual-booting Windows to run some proprietary crapware? Yeah, that again, but with websites. And you couldn't just run a headless second machine with VNC, or even use too old of a monitor, depending on the business whims of the proprietary OS!
It's actually quite amazing that the 1080p exploit hasn't leaked and been patched yet, considering how widespread it is.
corporate customers often have an elevated relationship that retail consumers dont have. There is a different level of trust. I dont trust Intel. I didnt ask for ME and i treat any hardware with ME as an edge device.
as far as impact is concerned its possible that clone machines could be manufactured with hardware modifications. how possible depends on how much money someone has to throw at the project.
exploit chips could become a common offering all you need is a steady hand and a solder iron, and a blob of epoxy for good measure if you want to hide the job.
if as a highminded attacker you determine the hardware key, as it stands you can then decode a software key and begin manipulating firmware. The concern being that the same hardware key is used accross all ME chipsets.
https://i.blackhat.com/USA-19/Wednesday/us-19-Hasarfaty-Behi...
The ME is not needed for the end user to operate thier machine in a secure manner.
The ME is a trojan that allows intel to manipulate your system and lock you into the whole DRM nonsense. the only reason Intel platforms havent become as bad as mobile platforms is because there isnt enough fear of system compromise from the average user.
Anyone from enterprise knows his much of a timesaver amt is. I make a call andi don't have to wait for the IT dude to appear on my desk- he clicks a few buttons from his desk and my problem is fixed.
> Arbitrary code execution is bad! But exploiting this vulnerability requires local access at a minimum, compounded by the attacker needing to exploit a relevant device to gain a foothold on the system. This list of valid footholds is quite limited. For instance, an attacker would need to perform code execution in the ISH or other Platform Controller Hub (PCH) devices — exploiting PCIe devices (like GPUs or RAID controllers) wouldn’t suffice. Additionally, per the original blog post, other methods of exploitation require physical access. Either way, this is limited to incredibly motivated and well-resourced attackers (like a nation-state with a high-value target identified).
[0] https://capsule8.com/blog/ramming-down-hype-via-intel-csme/
So, every serious company should be concerned that their competition (maybe abroad) will be able to eventually decrypt a lost / stolen laptop with trade secrets. So every corporate laptop needs its full-disk encryption upgraded. It's large.
https://www.biostar.com.tw/app/en/mb/result.php?model[]=973&... should be under 100$
I certainly don't.
