Intel's latest problem...

[science_man_88]

https://www.yahoo.com/news/intel-apo...142100896.html

Intel has confirmed previous reports that its recent PC, internet of things and server chips are vulnerable to remote hacking. The problem is with the onboard "Management Engine," which has multiple holes that could let remote attackers run malicious software, get privileged access and take over computers. The vulnerability affects sixth, seventh and eighth generation Core chips (Skylake, Kaby Lake and Kaby Lake R), along with Pentium, Celeron, Atom and multiple Xeon chips.

[retina]

And you can't update it, or remove it, or turn it off, or mitigate it, or bypass it. The CPU won't run unless you allow the ME to run first. Insecure by design.

The best option is to have a good external firewall, or just don't connect it to any network.

[CRGreathouse]

http://www.mersenneforum.org/showthread.php?t=21382

[science_man_88]

Originally Posted by CRGreathouse

http://www.mersenneforum.org/showthread.php?t=21382

That just shows how little I remember forum threads already existing.

[Dubslow]

Originally Posted by science_man_88

The vulnerability affects sixth, seventh and eighth generation Core chips (Skylake, Kaby Lake and Kaby Lake R), along with Pentium, Celeron, Atom and multiple Xeon chips.

Not strictly true. Similar vulnerabilities can be found for hardware dating all the way back to the Core 2 days. "management engine" crapware is very old.

This is my go-to link on the matter: https://libreboot.org/faq.html#intel

[retina]

Originally Posted by Dubslow

This is my go-to link on the matter: https://libreboot.org/faq.html#intel

Good link

[Dubslow]

Originally Posted by retina

Good link

Very few people I show it to take it seriously

[kladner]

Originally Posted by Dubslow

Very few people I show it to take it seriously

I take it seriously, but see no escape from the situation.

[Dubslow]

Originally Posted by kladner

I take it seriously, but see no escape from the situation.

Any computer running libreboot is free of the problem, though as the link states, such hardware is ancient. You *can* buy such anciently old hardware with the crap removed, but... yeah, it's ancient.

Recently, a lot of the current crapware has been *mostly* disabled; Purism is one of the companies funding the work (though much of said work remains volunteer), and its line of laptops is modern Intel hardware with the crapware disabled to the best of current ability, though as retina notes elsewhere, the usefulness of partial solutions is debatable. If I had money for a new laptop, I would probably buy from there, because 1) as far as I can tell, the company has so far been as good as their word, which is saying actually a fair bit these days, and 2) at least some of that purchase price goes to ensuring further on totally removing the crapware from the chip/motherboard, and 3) having the modern hardware would be such a boon compared to the old Core2 laptops available that are totally crapware free.

But, as ever, don't take my word for it.

For reference, RMS has used an ARM-based laptop in recent years, though I don't know specifics. Er, scratch that, straight from the source: he used to use something like that, but then switched to the liberated Core 2 laptops I mentioned when they were first liberated.

[kladner]

I am pretty much hooked on 'desktop' machines, as in 'a big tower that sits under the desk.'

I am also pessimistic that rolling back to hardware that old would make one that much safer. There are still plenty of Internet hazards to stumble into. To be invulnerable one must not connect.

While this crapware is really egregious, being built into the chipset, as well as the CPU, our whole digital environment is under scrutiny in a multitude of ways. If repressive forces want information, they get it.

[xilman]

Originally Posted by Dubslow

Any computer running libreboot is free of the problem, though as the link states, such hardware is ancient. You *can* buy such anciently old hardware with the crap removed, but... yeah, it's ancient.

Not necessarily free from the problem but you can go a long way towards protecting yourself from external attacks by running a packet filtering firewall at (each of) your incoming network cables. Needless to say, the filters have to be running a safe cpu and OS but that's not too difficult to arrange. Back in the mid-90's my office was firewalled off from the rest of the university with a 386SX-25 running MS-DOG 3.1. Admittedly I only had a 10Mb ethernet connection but it shows how little hardware is needed for a simple firewall.

The above does not provide any protection against WiFi attacks, unfortunately.