Quoting: TurkeysteaksGenuinely asking here, what is the path forwards for this situation? I do not see how it can be solved. I love linux and the fact it is completely open, but that of course means it's also undoubtedly going to be easier to be malicious in. I will never switch to windows as I haven't for the few decades I've been alive (and we never had many of these games working on linux without a headache back then, aside from ID software <3). I am wondering however if my playable library is going to keep dwindling when it comes to multiplayer games. I love PVP shooters; I have many hours in Titanfall 2, COD WWII, Urban Terror & Wolfenstein, Q3A, even a chunk in Apex and Battlefield 4/V/1 which of course is no longer possible to play.

Unless something like PlaysafeID actually takes off - and let's be real, how many of us really want to submit our ID to play games? I don't see the pathway to take. Server side anticheat is unfortunately a dream (Poor Counter Strike), and cheats only keep getting more sophisticated. Is this problem solvable?

I have several conflicting answers.

Theoretical and practical.

Theoretical:
In theory kernel side checking doesn't actually add much.
It can always be edited out in the binary and mathematically users with physical access have root.
In that sense Linux openness doesn't do much damage.

Techinical:
If you ask the anti-cheat makers like easy anti-cheat and battle eye. They will tell you. "No problem."

This hides a lot of complexity here's a small slice of the technical state of the matter:

There're ways to do anti-cheat in a system you don't have superior control over, but each of these ways work on Windows too.
Server side code.
Obfuscation.
Captcha's.
sgx
etc.
Some of these ways are currently in use and others aren't.

Yet Windows has a significant amount of cheaters, so apparently it doesn't work.
I currently suspect only one way of doing this that might be Linux specific and nobody has tried it yet in that sense.
Ring 0- resource hogging(My hypothesis is that you might be able to hash check entire resource states in ways that would if subverted on the same system result in detectable longer load times. You're allowed to ask further I'm pretty proud of the trick.).

On Windows you can't do much you can't do on Linux as an anti-cheat writer, but you can feel safe knowing that you're one of the few with access to the kernel, while in Linux that number is potentially infinite.

By the way:
Kernel checks still work on Linux they're just slightly less effective.

Market-political:
Personally I suspect this is currently what we're encountering.
There're several players in the industry to which Linux gaming is not a profitable business anyway(not enough market share), but an interesting chess piece you can freely move.
EA has chosen to move against Valve who has incorporated the piece in their strategy, so breaking Linux is a good business move.

A comparable much bigger problem in this case is hardware attestation Android keyboxes:
Basically all android phones have hardware backed keys deep in the firmware(TEE).
These keys are the root of trust used for drm, custom Rom blocking, anti-cheat etc..
Each android phone Vendor has their own keys.
In the past Google(Seller of Pixel and Winedivine drm) has revoked several vendor keys(keyboxes), because the devices proved vulnerable to attack and the keys could be extracted out of the device, breaking all the functions reliant on these keys.
Not long ago someone pulled this on the beta version of the Pixel phone. At first Google revoked these key too, but that significantly angered their customers who want to be able to use a phone as such they reinstated the key and now there is a consistent crack for all these functions I mentioned before.
The same has happened before with all Qualcomm devices until 2013.
Google could revoke all these keys, but they would do too much collateral damage and as such they accept the damage.

For this problem I see two fixes(I'm a programmer not a marketer)
Positive reinforcement: grow the Linux userbase and general Linux gaming profit margin.
Negative reinforcement: Launch a fork of Proton/wine that specifically fixes detection attempts in blocked games.

My conclusion: the current primary obstacle for anti-cheat on Linux is market-political and the currently employed method against it is growing the Linux gamer userbase.

Edit:
Also a true and tested way nobody uses to do anti-cheat would be to utilize ASLR(Address space layout randomization).
This works on both Linux and Windows, but with the right features enabled in the kernel Linux does it much better.
It's easy to test for.
This is also something a motivated programmer/Valve could do to make Linux stronger in general and more attractive to anti-cheat.
Implement distribution time ASLR in to their choice a game engine or the Linux kernel.
Currently ASLR is implemented at boot or compile time.
Neither case would be enough for anti-cheat.
Compile time makes people capable of cracking it for entire distros and a bootkit could crack boot ASLR.
What you would need is a distribution script that implements a new seed every download and if you implement it for the kernel also a way to check that we're dealing with a kernel with the feature enabled.
The best way I can think off is a distro signed cryptographic secure hash of the seed used.

Implementing it in the kernel has as "benefit" that it doesn't benefit Windows.
Implementing it in a game engine is more freedom preserving(you can make code modifications of specifically the game hard instead of the entire kernel)

Boot ASLR can be kind of for checked for by checking the bootloader.
The real problem is detecting compile time seed generation and seeds that are distributed with the kernel.
Compile time seed generation can be pretty well detected with a blacklist(the only issue was that it could be too predictable), Seeds distributed with the kernel can be pretty well detected with signing an arbitrary part of the ASLR'ed kernel.

A way this could be improved would be to create assymetric ASLR, so not only verified distros can launch anti-cheat compatible kernels, but that is a dream. I'm not yet convinced that's even possible.

ASLR was designed against return-to-libc attacks. I don't actually think this is the best way(I would advise for VAC(voluntary access control) if programs themselves clearly state what they don't need they can prevent themselves from being exploited with tricks they don't use themselves.

View this comment - View article - View full comments

Quoting: tuubi

Quoting: LoudTechieStability is something sysadmins salivate over, but there are lots of other parties like Gamers and developers that don't care about stability and want the newest of the newest tools.

That's such an absurd thing to say. I wouldn't want to work with a developer who doesn't care about stability. Nor would I want to be their customer.

And as a gamer, I don't see why I'd want anything but a stable and predictable platfrom to enjoy my games on. That's actually one of the reasons I run Linux.

First:
You're right to be upset I phrased this really poorly, sorry for that.

Second:
For the developers.
I meant for their own system.
Producing stable software is an admirable goal a lot developers have, but especially for those an unstable distro is a good system to develop on.
The best way to produce a stable outcome is to develop it in an unstable environment until it stays stable even in such harsh conditions(ever changing dynamic libraries, buggy drivers, etc).

For the gamers:
Here I was even worse(, to in the level this is in retrospect actually irrelevant for the point I was trying to make).
I didn't define the level of stability.
You want your system to never crash, lag or experience trouble, while in use.
There a lot of situations when your system isn't in use and you've no issue with it crashing, updating and generally figuring stuff out.
The kind of stability I was referring is the kind NASA or a big cloud provider needs: fire and forget.
There's not a situation the system isn't in use and as such we can't have reboots for updates, we can't have any data corruption ever, etc.

Also for both I threw them in big boxes that don't correspond to everybody in that group.

The point I was trying to make is that stability is just a single feature and one that thanks to the different requirements of different people isn't always the one with the most priority especially when it costs functionality and this isn't bad, but good because we've devised ways to make them benefit from each other.
I failed at that, but now you can at least see a second attempt.

View this comment - View article - View full comments

Quoting: Eike

Quoting: Stella

Quoting: Mountain Man

Quoting: AsciiWolfNice, but I wonder why they didn't go with Mesa 24.2. Mesa 24.1 is already quite old at this point.

As a Linux user, you should know that "old" means "thoroughly tested and stable".

Yup, I'd rather have older stuff that works properly than bleeding edge with tons of bugs

That's the opposite of what people guessed why Valve's using Arch now, though.

I don't know what "people guessed".
I do know what I guessed:
Valve is/was trying pull a bunch of sprints to compete with Microsoft, Nintendo, Asus and Sony and as such needed to do a lot of innovation.
Why is this easier: faster release cycle and access to the latest and greatest software ready to break on a first moments notice.
I think you're right though in your statement that this could indicate a change in policy.
Maybe they think they've catched up with the competition and are trying to slow down to a stable walk.

We've seen more tactical changes of Valve in the recent past.
Developing features for SteamOS on other devices than the SteamDeck.
ARM investments.
VR tests.

I suspect they plan to release a non-steamdeck vr device running ARCH/GNU/LINUX/Aarch64 and don't want to invest too heavily on SteamDeck maintenance in the future.

Also I severely disagree with @Stella.
Stability is something sysadmins salivate over, but there are lots of other parties like Gamers and developers that don't care about stability and want the newest of the newest tools.
These people are Linux users too and actually pretty useful for these same sysadmins(from the perspective of a sysadmin these people are testers), but they don't know and don't care that it means "well tested".
This is why we have beta releases in the first place.
Once the code passes its development(alpha) tests we throw it to a group of people who don't care about occasional breakage as long it works most of the time and get their crash rapports and patch them.
This is how the xz-backdoor was found and this is why most "beginner friendly" distros are rolling release(they need all kind of cutting edge stuff to look like windows/mac and they were apparently willing to risk losing their data and bricking their computer).
It's also one of the many ways we make certain the "tide lifts all boats".
The people who need software stability get cheap testing and the people who need cutting edge tools get enterprise grade software for cheap(so those enterprises don't have to deal with the bugs).

View this comment - View article - View full comments

Quoting: F.Ultra

Quoting: LoudTechieYou demand nanometer precision, you get nanometer precision.(I still argue that a full microcontroller without shared cache, which is what ME would need to be to be hidden from software analysis requires a lot more than a single transistor, but maybe intel can do it. [External Link]

Still I don't think you have thought this through fully. Your claim was that every single University out there could reverse engineer a modern Intel CPU with ease and now you bring out a paper from this year talking about "a world record" where they have achieved 4nm, the needed resolution to even begin to look at how a modern CPU is constructed.

So a world record in 2024 would have made every one be able to see hidden logic back in 2011? But it doesn't end there, looking at 4nm is one thing, being able to fully re engineer a chip of 20Bn transistors and probably 100-200 times that in interconnects and then on top of that being able to fully determine the use of each and every transistor and interconnect...

Don't you see the problems here? It's your bias to make this out to be a large conspiracy that makes you ignore all of this.

I did not claim every university could reverse engineer it with ease, I claimed that some universities could detect its presence even if intel tried to hide it and that if they did they would publish about it. If they could all easily reverse engineer the whole thing we wouldn't be having this conversation. We would be flashing our own versions.

Quoting: LoudTechieYou demand evidence that intel ME was put there as part of a mass surveilance conspiracy.
I provided means(FISA)
I provided opportunity(meeting between officials with connection PRISM and Intel)
I provided capability(AMT keys can be used like this, due to the lack of user config needed to activate it)
I provided precedent(PRISM)
I thought the motive was obvious(fighting enemies of the USA)
I provided a semi-weak casus(bootguard, drm and secure boot all keep you from running self-checked code and the default is of a company that is in the PRISM program according to the Snowden leaks)

And none of these are evidence that Intel ME is a mass surveillance conspiracy. This is not how evidence works. What you have presented are the kind of things that conspiracy theorists always use since they have no real evidence. It's all conjecture and guilt by association.

Evidence here would be actual evidence that Intel ME was designed for and used for surveillance. If it now is so easy to reverse engineer cpus as you believe, why have no one come forward with actual evidence of this yet when the Intel ME circuits are that much easier to decode than the rest of the CPU?

It's designed to undetectable take over computers from a distance and monitor every aspect of them(AMT). I can't proof it has actually been used for this by Intel without permission from the owner(yes other parties, but that could've been hackers), because that would be the "Intel spies" part of "Intel spies for a government"
I've given you more proof for "Intel ME is a surveillance" tool than the American government has given anybody which isn't a government official for "Kaspersky is a surveilance tool" and "TikTok is a foreign conspiracy". For the USA this was enough to ban them.
This includes the promise for Classified proof(China and the USA turn off button).
''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''
Edit:
about TikTok we got the most proof:
We know it sells AI to the Chinese military, just like Intel [External Link], Google [External Link] and Microsoft do to the American government [External Link].
We know it spies on its users just like its direct competitors youtube and twitch and ofcourse Intel [External Link](they didn't use ME for this, so it doesn't count as ME proof).
We know it has a board member appointed by the CCP. Of Intel we only have meetings between board members and military officials and a debt of at least 11 billion dollars and subsidy [External Link], which is arounda tenth of Intel's market capitalisation. [External Link], but the same can be said for Microsoft [External Link] of which we already know that it spies for the USA(PRISM) and Google(although their company was founded [External Link] on a SIGINT research program. [External Link].
''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''

Quoting: LoudTechieI don't understand how the economy of scale works, because I think that inserting a device in billions of chips you actively lock out of using it for a few thousand/hundred customers for who you already have several separate product lines (XEON and vpro), a separate purchase process and who you will be requiring to register anyway. Apparently.

Yes that very sums it up. Intel ME is integrated into the CPU core, the fabs that makes those cores cost around $10Bn to create, that is why the same core is used for the consumer cpu and for the Xeon line (the differences between the two lies outside the core). The silicon making up the Intel ME parts costs nothing, having unique fabs for non Intel ME and Intel ME cores however is extremely costly. Why would they spend 2x$10Bn when they can get away with $10Bn?

This is the exact same reason why you on the Phenom II and Athlon II could activate more cores by modifying the bios since AMD only made quad core variants but sold some of them as 2 or 3 core cpu:s with the 2-1 cores disabled by software. It was much cheaper for them to do it that way than to create fabs for a 2 and a 3 core cpu.

I don't need them to remove the silicon itself. If they allow me to flash my own software on the still existing intel ME on the non-professional lines I will be more than happy.
'''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''
Edit:
Demanding that I can use my own tools for their marketed purpose is kind of too much.

I would already be happy if they delegated the hw intialisation steps it does back to the bios, so I can remove the firmware without bricking my device.

I would be happy if they allowed me to change the key with which they do the signature check to keep me from replacing.

I would be somewhat happy if they brought it up to ring 0, -1 or -2, so coreboot could at least monitor what it is doing.
I would be somewhat happy if they allowed the OS to send a signal to turn it off.
'''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''

Quoting: LoudTechieI'm not above conspiracy theories. I claim that Microsoft, Dropbox and the NSA all collected data about my behavior online in the hope to find whether or not I had the necessity to keep things from them, to when if they did dispose of me. I even claim they called it PRISM and did it to all my friends and family(I'm not an USA citizen, so FISA always meant they could look at my data)

Ofc they do, that is not the question though. We know that the NSA have these programs, but that is not the same thing that they managed to get some secret backdoor into every single CPU out there with the help of Intel. Also why would they even bother with PRISM if they already could have done it much more sneaker with Intel ME?

Not every cpu. Just x86 cpus. On the question why bother with PRISM. "It's not the same thing." In one case they managed to get some kind of secret backdoor in every major cloud provider in the other case they managed to get a secret backdoor in one major cpu architecture(not even the biggest qua market share).
On why bother with PRISM:
Easy as you already stated monitoring activity with intel ME is visible on firewall logs. The rest of PRISM was mostly cloud providers. In the cloud nobody can see you spy, which means ME's a valuable targeted tool, but not a valuable mass surveilance tool.

It would also put in question why the NSA are hoarding zero days if they have access to Intel ME.

Because somebody could be using a non-x86 cpu, could be monitoring their traffic, could have used ME cleaner or another trick to disable it that actually worked, etc.
Intel ME isn't the ultimate monitoring tool.
It's just pretty good.

View this comment - View article - View full comments

Quoting: F.Ultra

Quoting: LoudTechie

Quoting: F.Ultra

Quoting: LoudTechie

Quoting: BlackBloodRum

Quoting: F.Ultra

Quoting: LoudTechie

Quoting: F.Ultra

Quoting: LoudTechie

Quoting: F.Ultra

Quoting: LoudTechie

Quoting: F.Ultra

Quoting: LoudTechie

Quoting: F.Ultra

Quoting: LoudTechie

Quoting: F.Ultra

Quoting: PublicNuisanceSo the companies that screw me over with Intel ME and AMD PSP are joining forces ? Consider me wanting to get off X86 to RiscV or Power9 even more than before.

yes it is popular to scare people that have no clue on how things work that these are somehow secret spy things when they in reality are nothing but managing devices for enterprise IT departments (just like how we in the server space have full on BMC cards instead).

ME is also what powers fTPM, bios signing and PlayReady drm.
These are all used to restrict your freedom to use your device how you like right now.
ME has been used by Israelian hackers to hack devices.
The procedure for using it requires you to receive an identification key from Intel based on information Intel generated, there is no indication that you can lock Intel out.
Maybe the American government isn't using it as a back door right here, right now, but the only reason we have to believe that is Intels' word.
ME is the reason modern devices can't install coreboot.

Also if it was just for remote management they would've put not such ridiculous amount of effort to counter all the efforts that have been done to remove it, because this is how it went: first you could simply remove the hardware, than they patched that and you could only remove the software, than they patched that and you couldn't, but someone found the secret government switch to turn it off and than they patched that and now the we have clean room reverse engineer it to turn it off without bricking our devices.

Also I'm not an It department and Intel knows that, because they sell a different bussiness and consumer line.
This is a feature they know I will never need, but they added it anyway.

The PlayReady drm does not use Intel ME, it uses SGX which is a completely different thing. fTPM exists only on AMD so again not Intel ME. Nor does it do bios signing.

Various hackers around the world have used every single piece of hw and sw to hack devices so not sure why Intel ME should be singled out for that reason. And for that matter I cannot find any information at all about anyone having hacked Intel ME, Israeli or otherwise, is this you confusing this with something else again or do you have any links?

You also seem a bit confused about coreboot, there are no Intel ME mechanism to prevent the installation of coreboot. The only connection between Intel ME and coreboot is that since Intel ME have it's firmware stored in the BIOS, Intel ME is disabled by coreboot since coreboot does not contain the necessary firmware.

Intel ME have never been a separate piece of hw, it have always been builtin to the cpu and it really have to be in order for it to function the way it's supposed to work.

I think that you are confusing Intel ME with TPM here since TPM started out as a separate chip and was then moved into the CPU after it was discovered that the connection between the TPM and the CPU could be eavesdropped and manipulated in a way that rendered TPM useless.

Intel ME is builtin to every single cpu since #1 Intel does not know which specific cpu a business tends to purchase for their office machines that their IT department wants to perform remote administration on and #2 it would be extremely expensive to have two separate chip fabs for non-ME and have-ME line of CPU:s of the same core design.

I would hope that people would understand that IF intel decided to put some hidden backdoor into their processors that they would have done that _hidden_ and not in a piece of hw that they openly advertise (and with complete guides on how to use like this one: Getting Started with Intel® Active Management Technology [External Link]. Also to date not a single person have been able to see any Intel ME trying to communicate with the outside world (aka phone home), had this ever occurred you would not have missed it since it would have been screamed from rooftops.

In the modules section of the wikipedia BootGuard(bios signing), Protected Audio Video Path, frimware TPM(fTPM) and Secureboot(os signing) are explicitly mentioned as ME modules together with AMT(remote management feature). [External Link]
You seem to be right about your playready thing though.

I'm not confusing ME with the TPM. That's why I specified it served fTPM(the f stands for firmware).
I was though conflating Coreboot with Libreboot. Libreboot/Canoeboot can't run on modern devices, because it doesn't include the properietary ME code.

The problem with the hacking, is that I can flash a new os when my os is hacked, but not a new ME.

wikipedia explanation of how Intel bootguard prevents coreboot. [External Link]

Intel sells the Xeon line for enterprise applications and the I line for consumer applications they can simply only include it in Xeon processors.

The lack of phoning home is indeed the best proof we have about it not being a backdoor, which to me proofs mostly that they're not listening in on the devices of the kind of people who monitor and publish their web traffic.
Intel publishing it isn't that surprising.
Several researchers pull processors apart for new undocumented features finding something new without an explanation is really suspicious, while "we're trying to compete with openssh" is a lot less suspicious.

ok, had somehow missed that boot guard was part of ME, thanks for pointing that out. Yes XEONS are for server and workstation use but 99% of office machines are not Xeons and remote management is something that large companies use to manage their large fleet of office machines. Myself I only use the server side version (so a full BMC on Xeons and Epycs) since where I work we let every one manage their own pc as they see fit, but the servers we have in a remote location and ssh is not fun when the machine is stuck in bios, powered off or kernel hang.

99% of office machines are not Xeons

: extra reason for Intel not to include enterprise specific features in them. A Xeon is an upsell(more expensive), you want those precious enterprise features, pay for them.
On the SSH point:
A. SSH is only not fun in those situations when it's not on a separate already booted controller(just like intel AMT), but that is actually quite easy to build.
Most server racks already have separate controllers.
B. Well, yes that's why they can argue it to be an attempt at competing with SSH. SSH might be free as in freedom and free beer and have more features, but it requires to set up your own separate microcontroller to manage ring 0 crashes.

Also a more generic reason I have against, "but it's for enterprise IT".
In enterprise IT the users don't own their time and/or devices any limitation of software freedoms makes sense in such a situation, because it would directly cost the one who does own these things the software freedom they get from owning these assets.
As a private buyer I do own my time/devices as such I want to control them.

Office desktops outsells consumer desktops by orders of magnitude and is where the money is for companies like Intel. Them removing ME from their consumer grade CPU:s and trying to get companies to upgrade to Xeons would only lead to one outcome: every single company would switch to AMD.

A. For at least a decennium AMD didn't have their own ME/AMT alternative(yes, it does now, but that is much later), so there would still be little reason and on the workstation devices AMD was never a real alternative anyway(, because no seller of prebuild workstation devices includes them, allegedly because intel pays them to).
B. Also Office desktops don't need the, "but I can edit the bios" feature, since there will always be someone who can follow simple instructions behind it and the os can flash the bios if you want to run an update.
For servers it's needed, because you might need to flash a new custom and unsigned bios, but for workstations you don't need that.

Edit: They included the option to turn it off for the American army, they could have simply left the option when it was discovered and used.
It required a special motherboard, so enterprise workstation devices could have avoided it easily by simply not blowing that fuse.
Residential consumers aren't an as profitable market as big enterprise contract, but they're the size of American Army contracts.

Intel added ME in 2008 and AMD added PSP in 2013 so both have had this for 11 years now, and those 5 years in between was Intel taking 100% of the company sales due to AMD not being viable here, Intel breaking that advantage by moving it to Xeons only would be an insanely stupid move.

Also this "they could not have hidden it" is kinda moot, the number of people that can scan down to nanometres AND also make some sense out of interconnections among 4.2bn transistors are easily counted and those same people would be far more capable of finding any nefarious design in the small area of the ME thanks to Intel showing exactly where on the chip it is. This whole fear mongering that it was put there due to demand from NSA was shutdown when we got the Snowden files since there isn't a trace of this there plus that it also showed that this is not how they operate, they instead perform targeted attacks where they capture hardware in transit and modify it before it reaches the customer (which is much more logical since it reduces the number of possible whistleblowers).

There are not "it can edit the bios" feature, not more than what you can do from userspace.

I can find no information on that the US army required Intel ME to be disabled. What I do know happened however is that the NSA requires that it is disabled to meet their "High Assurance Platform Mode" standard but that is not strange, that is simply them requiring all venues where code can be injected and run that is not neccessary for their operation to be disabled, in a HAP the very term remote administration is a big nono to begin with.

To date no one have found a shred of evidence that Intel ME or AMD PSP is used as a backdoor for anyone despite having existed for 16 years and it's not that people haven't tried to find any.

during that period [External Link]they grew 6 percent [External Link]and made faster chips [External Link], while when they still had market dominance, but slower chips and their competition had AMT too it cost them 10% market share. [External Link].
I internally explained that with people buying faster cpus, but maybe you're right and the only feature the profitable customers care about is AMT or AMT is needed feature for faster chips.
If any of those is the case I would be quite sad, but maybe you're right.

I don't need to scan down to the silicon level to activate an option in the bios. This is a feature they disabled later when users like myself started using it. [External Link]
On the ease of hiding
A. Universities have access to such ability and they publish most to all things they find.
B. Also you don't need to scan up to silicon space to find software(and you need software to keep it updateable, which they need and did for something with full control of the entire device).
C. Also it's always active, so it could've been easily detected by power draw.
Generic storage chips take quite a lot more space than a few hard wired instructions and storing it on existing chips means someone only has to scan that chip

I've personally used the permanently disable feature on my older computer where this was still an option. [External Link]

There are not "it can edit the bios" feature, not more than what you can do from userspace.

Than it has no advantage to openssh in workspace machines and as such they should make it Xeon specific.

On the backdoor question:
A. Bootguard, secureboot and drm are backdoory enough for me personally(they took control of my bios/computer).
B. Distinquishing an actively exploited vulnerability from a backdoor is really hard especially when the attacker has resources on par with intel. It has at least been actively exploited by the PLATINUM group.
C. Often western government attacks are aimed at specific targets(often called "spear fishing"), so just because the kind of people who actively publish their internet traffic aren't currently under attack doesn't mean nobody is and all the other signs are there.
All you need for AMT access is a code provided by intel(I read in on the public procedure).
They put real effort in sabotaging all removing efforts.
We didn't get access to the source code(not even source available).
It has access to the entire device.
The thing was introduced 3 years in the PRISM program(changing the fabs for new chip features costs 2 years).
(Also if you want to get truly paranoid:
For as long they only had it they made the fastest chips in the world and once that stopped they didn't, it doesn't sound like a very speed inducing feature, so maybe they got heavy R&D funding or access to classified technology from the government for introducing it.
I don't think it's the case, but it's an argument someone might use.)

The thing you have missed with PRISM is that it was leaked (on several occasions), now show me the Intel ME / AMD PSP leaks. And please show me a single university with this capability.

Holy quote tree! :woot:

Yeah It's my shame.
I can't resist it.
What I should have done was let them have the last word, but I didn't, because I can't resist flexing my web search skills and am quite addicted to the smug feeling I get from being convinced that I'm right.
Also they're the first actual AMT user I've encountered in my life, so their perspective is actually quite refreshing.

Edit:
I retract all my shame look what I found. It seems to be a description about how to get full read/write access to most of intel ME and at least the advanced method works for us too. The official Intel method(pinmod) works too. [External Link]

I am not an Intel AMT user, not even sure where you got that from. And these new links doesn't prove your case either.

I wasn't trying to proof my case to him and yes this proofs zilch.
On where I got it from

Myself I only use the server side version

Edit:
also the only Intel Me functionality you named was remote control, which is named AMT by Intel.
I would not describe myself as an ME user, much like the average Windows user isn't a Microsoft Telemetry user until they start reading or writing crash rapports.

And with server side version I obviously meant a BMC/ipmi card. I wasn't talking about the server version of Intel ME but about the server side of this kind of service.

Ah, sorry.
I hadn't made that up out of your post.
I was thinking versions of Intel ME.

You inspired me to look it up and AMT hasn't managed to completely conquered this market yet.
That actually surprises me. You don't have to buy any new hardware or trust a new party if you go for the Intel option.

View this comment - View article - View full comments

Quoting: F.Ultra

Quoting: LoudTechieharvard can do it, without destroying the chip. [External Link]

No they can't, look at the paper you linked, they talk about reverse engineering simple single layer chips at the micrometer scale while we are talking about multilayered chips at the nanoscale.

Quoting: LoudTechieThis is a paper by an academic who introduces extra methods to reverse engineer chips(which is what this is. [External Link]

No this is not at all what this paper describes, this paper describes a case where a chip foundry can inject malicious code into an existing design by using the design schematics (aka netlists) given to them by the customer, aka say Apple outsourcing the foundry to China and China using this to inject malware into Apple chips.

Quoting: LoudTechieThese academics innovated in the space [External Link]

This is a variant of the previous attack vector, aka injecting malware at the foundry using customers schematics.

Quoting: LoudTechieThese guys innovated a way without fancy equipment for always on hardware trojans(the only possible difference between IntelME and a hardware Trojan anybody has been able to present to me is intent, which isn't a property this method exploits, so it could also be used to detect IntelME) [External Link]

This paper is about how to detect if a malicious foundry have injected malware into your design by using timers to detect if the chip have been altered to contain extra data paths (since that would insert latency). So this is about detection and detection for something that again is not the context of what we are discussing. Seriously at this time I'm getting anxious if you are even understanding what we are talking about or if you are trying to troll me with links.

Quoting: LoudTechieThe university of Wyonming can do it at least destructive. [External Link]

By the numbers presented in the page you linked they cannot even see down to the scale of what we are talking about.

Quoting: LoudTechieA moment capture of the state of technology on this question. [External Link]

And now we are back again with papers about malicious foundries injecting malware into customers designs based on the customers schematics.

Quoting: LoudTechieThese academics actually went looking for hardware trojans. [External Link]

This is a paper where they had one team injecting malware into a design and then having another team trying to detect it, again not at all what we are talking about. In fact so far every paper have been not apples to oranges but apple pies to rockets.

Quoting: LoudTechieThis academic published an AI model for it(you know how much data is needed for AI). [External Link]

The same thing again but this time using machine learning to try and detect these injections instead of having to to perform the timing detections manually.

Ok I think I now understand what is going on here. You have read bits and pieces about injected trojans into IC:s (which is what you have linked papers on) and somehow believed that this is equal to if Intel had hidden a backdoor into their CPU:s.

But this is not equal at all, all these malware IC:s are taking real IC:s and then inserting malware into them giving the researches access to both the original and the tampered with version to compare signals, and some of your papers are talking about comparing e.g timing differences in the signals between the two to determine if there have been something injected into the second IC. But this is not how it would be if Intel had implemented a secret backdoor in their CPU:s, for one there would have been no "unmodified" version to compare with and secondly there would be no difference in signal timing. Aka all of these methods are for simple IC:s and for where we have access to the original design.

Also if you think about this for a second you would realize the folly in believing that universities all around the world would be perfectly capable of fully reverse engineering the CPU:s but then be completely stumped by a few MiB of closed firmware. The problem space is quite reversed in that logic, and not by orders of magnitude but by thousands orders of magnitude (and before you complain that the firmware is encrypted contemplate that the encryption algorithm AND key have to be in that design you claim they can so easily reverse engineer).

Quoting: LoudTechieOn the part where you demand proof for the obviously classified information: "does Intel spy for a government?"
The person in charge of PRISM met with the leaked companies and you guessed it Intel. [External Link]
Although this could only have been a government contract negotiation, you've to remember that seem to be the places where the government demands backdoors. [External Link]

On the, "but it would have leaked" part.
So, because Intel and AMD can look after their own intel they're not spies.

Not at all, there are mathematical designs on how long a conspiracy can be maintained based on the number of people involved. When it comes to the NSA itself this doesn't normally apply due to #1 the people working there believe in what they do (aka they are true believes) and #2 they are put under heavy penalties if they ever leak. And still we have leaks from the NSA. So the idea here that Intel and AMD with thousands of people involved should be able to keep every single person from speaking about it is actually a bit naive. The fact is that most that would have to insert such a backdoor would be forced to do it against their own personal belief (since they are not the true believers that the NSA are) which would further increase the risk of leaks.

Quoting: LoudTechiePRISM would've still existed had it not leaked and the only thing that was leaked was a bunch of (quite damning)executive summary slides.
The laws [External Link] needed for it apply to Intel and AMD too(those one sided codes can be demanded under the FISA).
They already introduced a feature to keep us locked to Windows and Microsoft was mentioned in the PRISM leak and windows spies on its users.
Apple, Microsoft and Meta never leaked about their government spying either, the government did, if those companies did it before the government they would be in violation of the FISA.
Microsoft is one of the few to admit sharing data with the government after the leak, dropbox denies it to this day, while they were explicitly mentioned.

PRISM is competely different, for one it was full known at the time the program was created that the NSA and the FBI could request data by handing over a national security letter (this was all public when it was created in the patriot act). What the leak of PRISM showed and that was unknown before was the extent to which the NSA and the FBI used these letters.

Quoting: LoudTechieThe dumb program of the CIA that assumed that LSD was the key to mind control(It's not) was never leaked, just declassified and took a lot more decades than PRISM and it directly endangered interfered with the life of those keeping it a secret contrary to PRISM. [External Link]

MKultra was disclosed by the New York Times having done extensive research after having received leaks from inside the CIA, it was not "just declassified".

Quoting: LoudTechieI do have criticism on the demand for airtight proof for "Intel spies for the government":
Intel and the secret service are very secretive and I've already shown they're contractually(American army turn off switch for Intel ME) close related to Intel ME.

No one is demanding that, the demand is any evidence at all that Intel ME was put into their cpu:s as part of a mass surveillance conspiracy, something that so far no one have ever been able to do. And your point about the US army I already debunked, they never demanded this at all and instead you confused this with the requirements to meet a specific NSA designation that requires all remote access and networking to be disabled (aka Intel ME is not singled out, it is disabled as part of disabling any remote access).

Quoting: LoudTechieAnother way Intel could've easily avoided having to include the ME everywhere:
is one of the ways they limit who can use it right now. If you want to be the one activating an AMT connection you need a vpro device. Intel could have used the same tech to lock the entire feature to the vpro line. [External Link](you've to buy vpro computers anyway if you want to use it, they could even have introduced a premium and non-premium version of vpro through binning.)
[They served it to only servers before with IPMI.](file:///tmp/mozilla_martin0/lacon12_intel_amt.pdf)

That you don't understand how economies of scale works is not the fault of Intel.

Quoting: LoudTechieOther fun timing coincidence I just realised: AMD released psp in the same year as the Snowden Leaks came out 2013.
I don't think this is because of the Snowden leaks(they would've had to have it ready for years if that's how they played it).

Thinking that timing like this is relevant is the basis on many conspiracy theories and I'm glad for you that you did realize that it took AMD more than a few months to develop that technology. For example the recently released Zen5 architecture was something that they started development back in 2019, these things take a very long time from idea to finished product.

Quoting: LoudTechieOther backdoory behavrior I've found:
Personally I've observed from two x86 computers in my room that if I turned the os off and left Ethernet connected around 20seconds later it would start flashing as if was exchanging.
Intel anti-theft allows someone with access to intel data to remotely brick your pc. [External Link]

Disable WakeOnLAN in your BIOS (not all NIC:s allow this to be disable though so beware) to see that card go completely dark when your computer is turned off. And even with that off some NIC:s still flash, what is happening there is that the PSU is still powering the NIC (for the WOL feature) and the flashes are when the router you are connected to sees broadcast data (so it sends it your way) and the led of the NIC is simply hardwared to blink when that happens even if it doesn't process the data that it sees, aka the led is connected to the presence of data in the hw, not to the processing of data in the sw.

Intel Anti-Theft cannot be used to brick your pc unless you have enabled to do so in the first place, it is not running on your system.

also

layered chips can be delayered it's standard reverse engineering practice. [External Link]
This opensource project actually fuzzes all of the intel chip(including higher privileged once like me) and discovers specific instructions only those more privileged layers can call and the implementation faults made in them. [External Link]
You demand nanometer precision, you get nanometer precision.(I still argue that a full microcontroller without shared cache, which is what ME would need to be to be hidden from software analysis requires a lot more than a single transistor, but maybe intel can do it. [External Link]
Every university with a medical wing has at least one electron microscope and the commercial ones can go up to 0.1nm, optical microscopes stop at 20nm [External Link]

You demand evidence that intel ME was put there as part of a mass surveilance conspiracy.
I provided means(FISA)
I provided opportunity(meeting between officials with connection PRISM and Intel)
I provided capability(AMT keys can be used like this, due to the lack of user config needed to activate it)
I provided precedent(PRISM)
I thought the motive was obvious(fighting enemies of the USA)
I provided a semi-weak casus(bootguard, drm and secure boot all keep you from running self-checked code and the default is of a company that is in the PRISM program according to the Snowden leaks)
What I cannot proof(convincingly) is intent, because I don't have access to the kind of data only the top 10 of intel and a few hundred secret agents have access to.
Also I actually admitted it wasn't (yet) mass surveilance. In an earlier post one of the reasons I gave for no obvious detected web traffic was that they employed "spear fishing", which is a tactic that gets specific targets with hacks instead of large groups specifically to avoid discovery and human rights violations.

That's why I claimed what I claimed and said you wanted proof of "Intel spies for a government."
I could easily proof that it could and was in a unique position to be pressured into it and that the government it reports to has the tendency and means to do these thing.
The only thing I provided weak to no evidence that although they were really sensitive to doing such things they might not have actually done it.
In other words I have weak proof for "Intel spies for a government."
The only indication I can give you for that claim are foreign fear mongering [External Link] and conspiracy theorist talk(intel ME came a year after FISA and laws are contrary to leaks by spies quite predictable on Intel's time scale).

Okay that CIA stuff was a leak, but still one that stayed under wraps for half a century compared to that Intel ME is still young.

I don't understand how the economy of scale works, because I think that inserting a device in billions of chips you actively lock out of using it for a few thousand/hundred customers for who you already have several separate product lines (XEON and vpro), a separate purchase process and who you will be requiring to register anyway. Apparently.

I'm not above conspiracy theories. I claim that Microsoft, Dropbox and the NSA all collected data about my behavior online in the hope to find whether or not I had the necessity to keep things from them, to when if they did dispose of me. I even claim they called it PRISM and did it to all my friends and family(I'm not an USA citizen, so FISA always meant they could look at my data)

Disable WakeOnLAN in your BIOS (not all NIC:s allow this to be disable though so beware) to see that card go completely dark when your computer is turned off. And even with that off some NIC:s still flash, what is happening there is that the PSU is still powering the NIC (for the WOL feature) and the flashes are when the router you are connected to sees broadcast data (so it sends it your way) and the led of the NIC is simply hardwared to blink when that happens even if it doesn't process the data that it sees, aka the led is connected to the presence of data in the hw, not to the processing of data in the sw.

THNX(It is clearly the first case not the second one, because my device doesn't attract much traffic as it's a home workstation)

Intel anti-theft is part of a completely dark and undocumented box and runs in Intel ME. I can turn it off in the bios and at most what I achieve is that I have clarified to Intel that I don't want my device bricked, same is the case for I can turn AMT off in the bios, but I don't get to see what if it does what I ask.

View this comment - View article - View full comments

Quoting: F.Ultra

Quoting: LoudTechie

Quoting: BlackBloodRum

Quoting: F.Ultra

Quoting: LoudTechie

Quoting: F.Ultra

Quoting: LoudTechie

Quoting: F.Ultra

Quoting: LoudTechie

Quoting: F.Ultra

Quoting: LoudTechie

Quoting: F.Ultra

Quoting: LoudTechie

Quoting: F.Ultra

Quoting: PublicNuisanceSo the companies that screw me over with Intel ME and AMD PSP are joining forces ? Consider me wanting to get off X86 to RiscV or Power9 even more than before.

yes it is popular to scare people that have no clue on how things work that these are somehow secret spy things when they in reality are nothing but managing devices for enterprise IT departments (just like how we in the server space have full on BMC cards instead).

ME is also what powers fTPM, bios signing and PlayReady drm.
These are all used to restrict your freedom to use your device how you like right now.
ME has been used by Israelian hackers to hack devices.
The procedure for using it requires you to receive an identification key from Intel based on information Intel generated, there is no indication that you can lock Intel out.
Maybe the American government isn't using it as a back door right here, right now, but the only reason we have to believe that is Intels' word.
ME is the reason modern devices can't install coreboot.

Also if it was just for remote management they would've put not such ridiculous amount of effort to counter all the efforts that have been done to remove it, because this is how it went: first you could simply remove the hardware, than they patched that and you could only remove the software, than they patched that and you couldn't, but someone found the secret government switch to turn it off and than they patched that and now the we have clean room reverse engineer it to turn it off without bricking our devices.

Also I'm not an It department and Intel knows that, because they sell a different bussiness and consumer line.
This is a feature they know I will never need, but they added it anyway.

The PlayReady drm does not use Intel ME, it uses SGX which is a completely different thing. fTPM exists only on AMD so again not Intel ME. Nor does it do bios signing.

Various hackers around the world have used every single piece of hw and sw to hack devices so not sure why Intel ME should be singled out for that reason. And for that matter I cannot find any information at all about anyone having hacked Intel ME, Israeli or otherwise, is this you confusing this with something else again or do you have any links?

You also seem a bit confused about coreboot, there are no Intel ME mechanism to prevent the installation of coreboot. The only connection between Intel ME and coreboot is that since Intel ME have it's firmware stored in the BIOS, Intel ME is disabled by coreboot since coreboot does not contain the necessary firmware.

Intel ME have never been a separate piece of hw, it have always been builtin to the cpu and it really have to be in order for it to function the way it's supposed to work.

I think that you are confusing Intel ME with TPM here since TPM started out as a separate chip and was then moved into the CPU after it was discovered that the connection between the TPM and the CPU could be eavesdropped and manipulated in a way that rendered TPM useless.

Intel ME is builtin to every single cpu since #1 Intel does not know which specific cpu a business tends to purchase for their office machines that their IT department wants to perform remote administration on and #2 it would be extremely expensive to have two separate chip fabs for non-ME and have-ME line of CPU:s of the same core design.

I would hope that people would understand that IF intel decided to put some hidden backdoor into their processors that they would have done that _hidden_ and not in a piece of hw that they openly advertise (and with complete guides on how to use like this one: Getting Started with Intel® Active Management Technology [External Link]. Also to date not a single person have been able to see any Intel ME trying to communicate with the outside world (aka phone home), had this ever occurred you would not have missed it since it would have been screamed from rooftops.

In the modules section of the wikipedia BootGuard(bios signing), Protected Audio Video Path, frimware TPM(fTPM) and Secureboot(os signing) are explicitly mentioned as ME modules together with AMT(remote management feature). [External Link]
You seem to be right about your playready thing though.

I'm not confusing ME with the TPM. That's why I specified it served fTPM(the f stands for firmware).
I was though conflating Coreboot with Libreboot. Libreboot/Canoeboot can't run on modern devices, because it doesn't include the properietary ME code.

The problem with the hacking, is that I can flash a new os when my os is hacked, but not a new ME.

wikipedia explanation of how Intel bootguard prevents coreboot. [External Link]

Intel sells the Xeon line for enterprise applications and the I line for consumer applications they can simply only include it in Xeon processors.

The lack of phoning home is indeed the best proof we have about it not being a backdoor, which to me proofs mostly that they're not listening in on the devices of the kind of people who monitor and publish their web traffic.
Intel publishing it isn't that surprising.
Several researchers pull processors apart for new undocumented features finding something new without an explanation is really suspicious, while "we're trying to compete with openssh" is a lot less suspicious.

ok, had somehow missed that boot guard was part of ME, thanks for pointing that out. Yes XEONS are for server and workstation use but 99% of office machines are not Xeons and remote management is something that large companies use to manage their large fleet of office machines. Myself I only use the server side version (so a full BMC on Xeons and Epycs) since where I work we let every one manage their own pc as they see fit, but the servers we have in a remote location and ssh is not fun when the machine is stuck in bios, powered off or kernel hang.

99% of office machines are not Xeons

: extra reason for Intel not to include enterprise specific features in them. A Xeon is an upsell(more expensive), you want those precious enterprise features, pay for them.
On the SSH point:
A. SSH is only not fun in those situations when it's not on a separate already booted controller(just like intel AMT), but that is actually quite easy to build.
Most server racks already have separate controllers.
B. Well, yes that's why they can argue it to be an attempt at competing with SSH. SSH might be free as in freedom and free beer and have more features, but it requires to set up your own separate microcontroller to manage ring 0 crashes.

Also a more generic reason I have against, "but it's for enterprise IT".
In enterprise IT the users don't own their time and/or devices any limitation of software freedoms makes sense in such a situation, because it would directly cost the one who does own these things the software freedom they get from owning these assets.
As a private buyer I do own my time/devices as such I want to control them.

Office desktops outsells consumer desktops by orders of magnitude and is where the money is for companies like Intel. Them removing ME from their consumer grade CPU:s and trying to get companies to upgrade to Xeons would only lead to one outcome: every single company would switch to AMD.

A. For at least a decennium AMD didn't have their own ME/AMT alternative(yes, it does now, but that is much later), so there would still be little reason and on the workstation devices AMD was never a real alternative anyway(, because no seller of prebuild workstation devices includes them, allegedly because intel pays them to).
B. Also Office desktops don't need the, "but I can edit the bios" feature, since there will always be someone who can follow simple instructions behind it and the os can flash the bios if you want to run an update.
For servers it's needed, because you might need to flash a new custom and unsigned bios, but for workstations you don't need that.

Edit: They included the option to turn it off for the American army, they could have simply left the option when it was discovered and used.
It required a special motherboard, so enterprise workstation devices could have avoided it easily by simply not blowing that fuse.
Residential consumers aren't an as profitable market as big enterprise contract, but they're the size of American Army contracts.

Intel added ME in 2008 and AMD added PSP in 2013 so both have had this for 11 years now, and those 5 years in between was Intel taking 100% of the company sales due to AMD not being viable here, Intel breaking that advantage by moving it to Xeons only would be an insanely stupid move.

Also this "they could not have hidden it" is kinda moot, the number of people that can scan down to nanometres AND also make some sense out of interconnections among 4.2bn transistors are easily counted and those same people would be far more capable of finding any nefarious design in the small area of the ME thanks to Intel showing exactly where on the chip it is. This whole fear mongering that it was put there due to demand from NSA was shutdown when we got the Snowden files since there isn't a trace of this there plus that it also showed that this is not how they operate, they instead perform targeted attacks where they capture hardware in transit and modify it before it reaches the customer (which is much more logical since it reduces the number of possible whistleblowers).

There are not "it can edit the bios" feature, not more than what you can do from userspace.

I can find no information on that the US army required Intel ME to be disabled. What I do know happened however is that the NSA requires that it is disabled to meet their "High Assurance Platform Mode" standard but that is not strange, that is simply them requiring all venues where code can be injected and run that is not neccessary for their operation to be disabled, in a HAP the very term remote administration is a big nono to begin with.

To date no one have found a shred of evidence that Intel ME or AMD PSP is used as a backdoor for anyone despite having existed for 16 years and it's not that people haven't tried to find any.

during that period [External Link]they grew 6 percent [External Link]and made faster chips [External Link], while when they still had market dominance, but slower chips and their competition had AMT too it cost them 10% market share. [External Link].
I internally explained that with people buying faster cpus, but maybe you're right and the only feature the profitable customers care about is AMT or AMT is needed feature for faster chips.
If any of those is the case I would be quite sad, but maybe you're right.

I don't need to scan down to the silicon level to activate an option in the bios. This is a feature they disabled later when users like myself started using it. [External Link]
On the ease of hiding
A. Universities have access to such ability and they publish most to all things they find.
B. Also you don't need to scan up to silicon space to find software(and you need software to keep it updateable, which they need and did for something with full control of the entire device).
C. Also it's always active, so it could've been easily detected by power draw.
Generic storage chips take quite a lot more space than a few hard wired instructions and storing it on existing chips means someone only has to scan that chip

I've personally used the permanently disable feature on my older computer where this was still an option. [External Link]

There are not "it can edit the bios" feature, not more than what you can do from userspace.

Than it has no advantage to openssh in workspace machines and as such they should make it Xeon specific.

On the backdoor question:
A. Bootguard, secureboot and drm are backdoory enough for me personally(they took control of my bios/computer).
B. Distinquishing an actively exploited vulnerability from a backdoor is really hard especially when the attacker has resources on par with intel. It has at least been actively exploited by the PLATINUM group.
C. Often western government attacks are aimed at specific targets(often called "spear fishing"), so just because the kind of people who actively publish their internet traffic aren't currently under attack doesn't mean nobody is and all the other signs are there.
All you need for AMT access is a code provided by intel(I read in on the public procedure).
They put real effort in sabotaging all removing efforts.
We didn't get access to the source code(not even source available).
It has access to the entire device.
The thing was introduced 3 years in the PRISM program(changing the fabs for new chip features costs 2 years).
(Also if you want to get truly paranoid:
For as long they only had it they made the fastest chips in the world and once that stopped they didn't, it doesn't sound like a very speed inducing feature, so maybe they got heavy R&D funding or access to classified technology from the government for introducing it.
I don't think it's the case, but it's an argument someone might use.)

The thing you have missed with PRISM is that it was leaked (on several occasions), now show me the Intel ME / AMD PSP leaks. And please show me a single university with this capability.

Holy quote tree! :woot:

Yeah It's my shame.
I can't resist it.
What I should have done was let them have the last word, but I didn't, because I can't resist flexing my web search skills and am quite addicted to the smug feeling I get from being convinced that I'm right.
Also they're the first actual AMT user I've encountered in my life, so their perspective is actually quite refreshing.

Edit:
I retract all my shame look what I found. It seems to be a description about how to get full read/write access to most of intel ME and at least the advanced method works for us too. The official Intel method(pinmod) works too. [External Link]

I am not an Intel AMT user, not even sure where you got that from. And these new links doesn't prove your case either.

I wasn't trying to proof my case to him and yes this proofs zilch.
On where I got it from

Myself I only use the server side version

Edit:
also the only Intel Me functionality you named was remote control, which is named AMT by Intel.
I would not describe myself as an ME user, much like the average Windows user isn't a Microsoft Telemetry user until they start reading or writing crash rapports.

View this comment - View article - View full comments

Quoting: F.Ultra

Quoting: LoudTechie

Quoting: BlackBloodRum

Quoting: F.Ultra

Quoting: LoudTechie

Quoting: F.Ultra

Quoting: LoudTechie

Quoting: F.Ultra

Quoting: LoudTechie

Quoting: F.Ultra

Quoting: LoudTechie

Quoting: F.Ultra

Quoting: LoudTechie

Quoting: F.Ultra

Quoting: PublicNuisanceSo the companies that screw me over with Intel ME and AMD PSP are joining forces ? Consider me wanting to get off X86 to RiscV or Power9 even more than before.

yes it is popular to scare people that have no clue on how things work that these are somehow secret spy things when they in reality are nothing but managing devices for enterprise IT departments (just like how we in the server space have full on BMC cards instead).

ME is also what powers fTPM, bios signing and PlayReady drm.
These are all used to restrict your freedom to use your device how you like right now.
ME has been used by Israelian hackers to hack devices.
The procedure for using it requires you to receive an identification key from Intel based on information Intel generated, there is no indication that you can lock Intel out.
Maybe the American government isn't using it as a back door right here, right now, but the only reason we have to believe that is Intels' word.
ME is the reason modern devices can't install coreboot.

Also if it was just for remote management they would've put not such ridiculous amount of effort to counter all the efforts that have been done to remove it, because this is how it went: first you could simply remove the hardware, than they patched that and you could only remove the software, than they patched that and you couldn't, but someone found the secret government switch to turn it off and than they patched that and now the we have clean room reverse engineer it to turn it off without bricking our devices.

Also I'm not an It department and Intel knows that, because they sell a different bussiness and consumer line.
This is a feature they know I will never need, but they added it anyway.

The PlayReady drm does not use Intel ME, it uses SGX which is a completely different thing. fTPM exists only on AMD so again not Intel ME. Nor does it do bios signing.

Various hackers around the world have used every single piece of hw and sw to hack devices so not sure why Intel ME should be singled out for that reason. And for that matter I cannot find any information at all about anyone having hacked Intel ME, Israeli or otherwise, is this you confusing this with something else again or do you have any links?

You also seem a bit confused about coreboot, there are no Intel ME mechanism to prevent the installation of coreboot. The only connection between Intel ME and coreboot is that since Intel ME have it's firmware stored in the BIOS, Intel ME is disabled by coreboot since coreboot does not contain the necessary firmware.

Intel ME have never been a separate piece of hw, it have always been builtin to the cpu and it really have to be in order for it to function the way it's supposed to work.

I think that you are confusing Intel ME with TPM here since TPM started out as a separate chip and was then moved into the CPU after it was discovered that the connection between the TPM and the CPU could be eavesdropped and manipulated in a way that rendered TPM useless.

Intel ME is builtin to every single cpu since #1 Intel does not know which specific cpu a business tends to purchase for their office machines that their IT department wants to perform remote administration on and #2 it would be extremely expensive to have two separate chip fabs for non-ME and have-ME line of CPU:s of the same core design.

I would hope that people would understand that IF intel decided to put some hidden backdoor into their processors that they would have done that _hidden_ and not in a piece of hw that they openly advertise (and with complete guides on how to use like this one: Getting Started with Intel® Active Management Technology [External Link]. Also to date not a single person have been able to see any Intel ME trying to communicate with the outside world (aka phone home), had this ever occurred you would not have missed it since it would have been screamed from rooftops.

In the modules section of the wikipedia BootGuard(bios signing), Protected Audio Video Path, frimware TPM(fTPM) and Secureboot(os signing) are explicitly mentioned as ME modules together with AMT(remote management feature). [External Link]
You seem to be right about your playready thing though.

I'm not confusing ME with the TPM. That's why I specified it served fTPM(the f stands for firmware).
I was though conflating Coreboot with Libreboot. Libreboot/Canoeboot can't run on modern devices, because it doesn't include the properietary ME code.

The problem with the hacking, is that I can flash a new os when my os is hacked, but not a new ME.

wikipedia explanation of how Intel bootguard prevents coreboot. [External Link]

Intel sells the Xeon line for enterprise applications and the I line for consumer applications they can simply only include it in Xeon processors.

The lack of phoning home is indeed the best proof we have about it not being a backdoor, which to me proofs mostly that they're not listening in on the devices of the kind of people who monitor and publish their web traffic.
Intel publishing it isn't that surprising.
Several researchers pull processors apart for new undocumented features finding something new without an explanation is really suspicious, while "we're trying to compete with openssh" is a lot less suspicious.

ok, had somehow missed that boot guard was part of ME, thanks for pointing that out. Yes XEONS are for server and workstation use but 99% of office machines are not Xeons and remote management is something that large companies use to manage their large fleet of office machines. Myself I only use the server side version (so a full BMC on Xeons and Epycs) since where I work we let every one manage their own pc as they see fit, but the servers we have in a remote location and ssh is not fun when the machine is stuck in bios, powered off or kernel hang.

99% of office machines are not Xeons

: extra reason for Intel not to include enterprise specific features in them. A Xeon is an upsell(more expensive), you want those precious enterprise features, pay for them.
On the SSH point:
A. SSH is only not fun in those situations when it's not on a separate already booted controller(just like intel AMT), but that is actually quite easy to build.
Most server racks already have separate controllers.
B. Well, yes that's why they can argue it to be an attempt at competing with SSH. SSH might be free as in freedom and free beer and have more features, but it requires to set up your own separate microcontroller to manage ring 0 crashes.

Also a more generic reason I have against, "but it's for enterprise IT".
In enterprise IT the users don't own their time and/or devices any limitation of software freedoms makes sense in such a situation, because it would directly cost the one who does own these things the software freedom they get from owning these assets.
As a private buyer I do own my time/devices as such I want to control them.

Office desktops outsells consumer desktops by orders of magnitude and is where the money is for companies like Intel. Them removing ME from their consumer grade CPU:s and trying to get companies to upgrade to Xeons would only lead to one outcome: every single company would switch to AMD.

A. For at least a decennium AMD didn't have their own ME/AMT alternative(yes, it does now, but that is much later), so there would still be little reason and on the workstation devices AMD was never a real alternative anyway(, because no seller of prebuild workstation devices includes them, allegedly because intel pays them to).
B. Also Office desktops don't need the, "but I can edit the bios" feature, since there will always be someone who can follow simple instructions behind it and the os can flash the bios if you want to run an update.
For servers it's needed, because you might need to flash a new custom and unsigned bios, but for workstations you don't need that.

Edit: They included the option to turn it off for the American army, they could have simply left the option when it was discovered and used.
It required a special motherboard, so enterprise workstation devices could have avoided it easily by simply not blowing that fuse.
Residential consumers aren't an as profitable market as big enterprise contract, but they're the size of American Army contracts.

Intel added ME in 2008 and AMD added PSP in 2013 so both have had this for 11 years now, and those 5 years in between was Intel taking 100% of the company sales due to AMD not being viable here, Intel breaking that advantage by moving it to Xeons only would be an insanely stupid move.

Also this "they could not have hidden it" is kinda moot, the number of people that can scan down to nanometres AND also make some sense out of interconnections among 4.2bn transistors are easily counted and those same people would be far more capable of finding any nefarious design in the small area of the ME thanks to Intel showing exactly where on the chip it is. This whole fear mongering that it was put there due to demand from NSA was shutdown when we got the Snowden files since there isn't a trace of this there plus that it also showed that this is not how they operate, they instead perform targeted attacks where they capture hardware in transit and modify it before it reaches the customer (which is much more logical since it reduces the number of possible whistleblowers).

There are not "it can edit the bios" feature, not more than what you can do from userspace.

I can find no information on that the US army required Intel ME to be disabled. What I do know happened however is that the NSA requires that it is disabled to meet their "High Assurance Platform Mode" standard but that is not strange, that is simply them requiring all venues where code can be injected and run that is not neccessary for their operation to be disabled, in a HAP the very term remote administration is a big nono to begin with.

To date no one have found a shred of evidence that Intel ME or AMD PSP is used as a backdoor for anyone despite having existed for 16 years and it's not that people haven't tried to find any.

during that period [External Link]they grew 6 percent [External Link]and made faster chips [External Link], while when they still had market dominance, but slower chips and their competition had AMT too it cost them 10% market share. [External Link].
I internally explained that with people buying faster cpus, but maybe you're right and the only feature the profitable customers care about is AMT or AMT is needed feature for faster chips.
If any of those is the case I would be quite sad, but maybe you're right.

I don't need to scan down to the silicon level to activate an option in the bios. This is a feature they disabled later when users like myself started using it. [External Link]
On the ease of hiding
A. Universities have access to such ability and they publish most to all things they find.
B. Also you don't need to scan up to silicon space to find software(and you need software to keep it updateable, which they need and did for something with full control of the entire device).
C. Also it's always active, so it could've been easily detected by power draw.
Generic storage chips take quite a lot more space than a few hard wired instructions and storing it on existing chips means someone only has to scan that chip

I've personally used the permanently disable feature on my older computer where this was still an option. [External Link]

There are not "it can edit the bios" feature, not more than what you can do from userspace.

Than it has no advantage to openssh in workspace machines and as such they should make it Xeon specific.

On the backdoor question:
A. Bootguard, secureboot and drm are backdoory enough for me personally(they took control of my bios/computer).
B. Distinquishing an actively exploited vulnerability from a backdoor is really hard especially when the attacker has resources on par with intel. It has at least been actively exploited by the PLATINUM group.
C. Often western government attacks are aimed at specific targets(often called "spear fishing"), so just because the kind of people who actively publish their internet traffic aren't currently under attack doesn't mean nobody is and all the other signs are there.
All you need for AMT access is a code provided by intel(I read in on the public procedure).
They put real effort in sabotaging all removing efforts.
We didn't get access to the source code(not even source available).
It has access to the entire device.
The thing was introduced 3 years in the PRISM program(changing the fabs for new chip features costs 2 years).
(Also if you want to get truly paranoid:
For as long they only had it they made the fastest chips in the world and once that stopped they didn't, it doesn't sound like a very speed inducing feature, so maybe they got heavy R&D funding or access to classified technology from the government for introducing it.
I don't think it's the case, but it's an argument someone might use.)

The thing you have missed with PRISM is that it was leaked (on several occasions), now show me the Intel ME / AMD PSP leaks. And please show me a single university with this capability.

Holy quote tree! :woot:

Yeah It's my shame.
I can't resist it.
What I should have done was let them have the last word, but I didn't, because I can't resist flexing my web search skills and am quite addicted to the smug feeling I get from being convinced that I'm right.
Also they're the first actual AMT user I've encountered in my life, so their perspective is actually quite refreshing.

Edit:
I retract all my shame look what I found. It seems to be a description about how to get full read/write access to most of intel ME and at least the advanced method works for us too. The official Intel method(pinmod) works too. [External Link]

I am not an Intel AMT user, not even sure where you got that from. And these new links doesn't prove your case either.

I wasn't trying to proof my case to him and yes this proofs zilch.
On where I got it from

Myself I only use the server side version

View this comment - View article - View full comments

Quoting: missingnoThis is why I don't see Proton as a substitute for proper support. Because if they don't actually support the platform, they could break it at any time and say you're outta luck.

Ah, but this is support.
They actively develop for Linux(to break it).

"Not supported" means that you're not going to put effort in functionality for the platform, breaking is functionality, from the perspective of Epic Games it's even desired functionality.

Native games also drop support all the time, so support doesn't mean that much.

View this comment - View article - View full comments

Quoting: dibz

Quoting: LoudTechieThe question is why does everybody use BattleEye, to actively break linux.
I mean all the other anti-cheats offer just as much support for breaking it.
This way the Wine people only have to implement the behavior BattleEye(Windows only edition) depends on.
Not that I'm complaining, but it sounds stupid.

I would assume it's the same reason things like google drive, and similar cloud storage, avoid making official linux clients. The general idea is that linux users are more savvy, and therefor, more likely to use the services to their maximum extent, and for storage using all of what you pay for is considered a bad thing.

In anti-cheat context, I can only assume they're specifically targeting "savvy".

Obviously all of that happens anyway, probably nearly immediately.

Ofcourse they're breaking it because they fear tech savvy users, but why put all your eggs in one basket.
Easy Anti Cheat can break it on Linux too and it's just as hard.
Most anti-cheat providers can break on Linux if that is a feature you want, why use only Battle Eye for it.

Edit: found the answer.
The premise is false: other anti-cheats are used for this.

View this comment - View article - View full comments