Items tagged with: issues
Only use computers certified to Respect Your Freedom (RYF)
The #Intel #Management #Engine is present on all Intel #desktop, #mobile ( #laptop ), and #server #systems since mid 2006. It consists of an #ARC #processor core (replaced with other processor cores in later generations of the ME), #code and #data #caches, a #timer, and a secure #internal #bus to which additional #devices are connected, including a #cryptography engine, internal #ROM and #RAM, #memory #controllers, and a direct memory access ( #DMA ) engine to access the host operating system’s memory as well as to reserve a region of protected external memory to supplement the ME’s limited internal RAM. The ME also has #network access with its own #MAC #address through an Intel #Gigabit #Ethernet #Controller. Its #boot program, stored on the internal ROM, loads a #firmware “manifest” from the PC’s SPI #flash #chip. This manifest is signed with a strong #cryptographic #key, which differs between versions of the ME firmware. If the manifest isn’t signed by a specific Intel key, the boot ROM won’t load and execute the firmware and the ME processor core will be halted.
The Active Management Technology ( #AMT ) application, part of the Intel “vPro” brand, is a #Web server and application code that enables #remote #users to #power on, power off, view information about, and otherwise manage the #PC. It can be used remotely even while the PC is powered off ( via #Wake-on-Lan ). Traffic is encrypted using #SSL / #TLS libraries, but recall that all of the major SSL/TLS implementations have had highly publicized vulnerabilities. The AMT application itself has known #vulnerabilities, which have been #exploited to develop #rootkits and #keyloggers and #covertly gain #encrypted #access to the management features of a PC. Remember that the ME has full access to the PC’s RAM. This means that an #attacker exploiting any of these vulnerabilities may gain access to everything on the PC as it runs: all open #files, all running #applications, all #keys pressed, and more.
ME firmware versions 4.0 and later (Intel 4 Series and later chipsets) include an ME application for audio and video DRM called “Protected Audio Video Path” (PAVP). The ME receives from the #host operating system an encrypted #media #stream and encrypted key, decrypts the key, and sends the encrypted media decrypted key to the #GPU, which then #decrypts the media. PAVP is also used by another ME application to draw an #authentication PIN pad directly onto the screen. In this usage, the PAVP application directly controls the graphics that appear on the PC’s screen in a way that the host #OS cannot detect. ME firmware version 7.0 on PCHs with 2nd Generation Intel Core #i3 / #i5 / #i7 (Sandy Bridge) CPUs replaces PAVP with a similar DRM application called “Intel Insider”. Like the AMT application, these DRM applications, which in themselves are defective by design, demonstrate the #omnipotent #capabilities of the ME: this #hardware and its proprietary firmware can access and #control everything that is in RAM and even everything that is shown on the #screen.
The Intel Management Engine with its #proprietary firmware has complete access to and control over the PC: it can power on or shut down the PC, read all open files, examine all running applications, track all keys pressed and #mouse movements, and even #capture or #display #images on the screen. And it has a network interface that is demonstrably #insecure, which can allow an attacker on the network to #inject #rootkits that completely compromise the PC and can report to the attacker all activities performed on the PC. It is a #threat to #freedom, #security, and #privacy that can’t be ignored.
Before version 6.0 (that is, on systems from 2008/2009 and earlier), the ME can be disabled by setting a couple of values in the SPI flash memory. The ME firmware can then be #removed entirely from the flash memory space. Libreboot does this on the Intel 4 Series systems that it supports, such as the Libreboot X200 and Libreboot T400. ME firmware versions 6.0 and later, which are found on all systems with an Intel #Core i3/i5/i7 CPU and a PCH, include “ME Ignition” firmware that performs some hardware #initialization and power management. If the ME’s boot ROM does not find in the SPI flash memory an ME firmware manifest with a valid Intel signature, the whole PC will shut down after 30 minutes.
Due to the signature verification, developing free #replacement firmware for the ME is basically impossible. The only entity capable of replacing the ME firmware is Intel. As previously stated, the ME firmware includes proprietary code licensed from third parties, so Intel couldn’t release the source code even if they wanted to. And even if they developed completely new ME firmware without third-party proprietary code and released its source code, the ME’s boot ROM would reject any modified firmware that isn’t signed by Intel. Thus, the ME firmware is both hopelessly proprietary and #tivoized.
For years, #coreboot has been #struggling against Intel. Intel has been shown to be extremely uncooperative in general. Many coreboot #developers, and #companies, have tried to get Intel to #cooperate; namely, releasing source code for the firmware components. Even #Google, which sells millions of #Chromebooks (coreboot preinstalled) have been #unable to #persuade them.
Even when Intel does cooperate, they still don’t provide source code. They might provide limited #information (datasheets) under #strict #corporate #NDA ( #non-disclosure #agreement ), but even that is not guaranteed. Even ODMs and IBVs can’t get source code from Intel, in most cases (they will just integrate the blobs that Intel provides).
In summary, the Intel #Management #Engine and its applications are a #backdoor with #total access to and control over the rest of the PC. The ME is a threat to freedom, security, and privacy, and the Libreboot project strongly recommends avoiding it entirely. Since recent versions of it can’t be removed, this means avoiding all #recent #generations of Intel hardware.
Recent Intel graphics chipsets also require firmware blobs
Intel is only going to get #worse when it comes to user freedom. Libreboot has no support recent Intel platforms, precisely because of the problems described above. The only way to solve this is to get Intel to #change their #policies and to be more #friendly to the free software #community. Reverse engineering won’t solve anything long-term, unfortunately, but we need to keep doing it anyway. Moving forward, Intel hardware is a non-option unless a #radical change happens within Intel.
Basically, all Intel hardware from year 2010 and beyond will never be supported by Libreboot. The Libreboot project is actively #ignoring all modern Intel hardware at this point, and focusing on #alternative platforms.
Why is the latest AMD hardware unsupported in Libreboot?
It is extremely unlikely that any post-2013 #AMD hardware will ever be supported in Libreboot, due to severe security and freedom #issues; so #severe, that the Libreboot project recommends avoiding all modern AMD hardware. If you have an AMD based system affected by the #problems described below, then you should get rid of it as soon as possible.
AMD Platform Security Processor (PSP)
This is basically AMD’s own version of the Intel Management Engine. It has all of the same basic security and freedom issues, although the #implementation is wildly different.
The Platform Security Processor (PSP) is built in on all Family 16h + systems (basically anything post-2013), and controls the main #x86 core #startup. PSP firmware is cryptographically signed with a strong key similar to the Intel ME. If the PSP firmware is not present, or if the AMD signing key is not present, the #x86 cores will not be #released from #reset, rendering the system #inoperable.
The PSP is an ARM core with TrustZone #technology, built onto the main CPU die. As such, it has the ability to #hide its own program code, scratch RAM, and any data it may have taken and stored from the lesser-privileged x86 system RAM (kernel encryption keys, #login data, #browsing #history, #keystrokes, who knows!). To make matters worse, the PSP theoretically has access to the entire system memory space (AMD either will not or cannot deny this, and it would seem to be required to allow the DRM “features” to work as intended), which means that it has at minimum MMIO-based access to the #network controllers and any other PCI/PCIe peripherals installed on the #system.
In theory any #malicious entity with access to the AMD signing key would be able to install persistent #malware that could not be eradicated without an external flasher and a known good PSP image. Furthermore, multiple security vulnerabilities have been demonstrated in AMD #firmware in the #past, and there is every #reason to assume one or more zero day vulnerabilities are lurking in the PSP firmware. Given the extreme privilege level (ring -2 or ring -3) of the PSP, said vulnerabilities would have the ability to #remotely #monitor and control any PSP enabled machine completely outside of the user’s #knowledge.
A reliable way to avoid Intel and AMD’s universal backdoors is to use computers with such spyware effectively removed or disabled like the ones certified to Respect Your Freedom (RYF).
#NSA #spyware #spy #mass #surveillance #FSF #GNU #GNULinux #RYF #technology #laptops #CPU #processor #universal #backdoor #malware #Corei3 #Corei5 #Corei7
The #Intel Management Engine (frequently abbreviated as ME) is a separate #computer within Intel computers, which denies users #control by forcing them to run #nonfree #software that cannot be modified or replaced by anyone but Intel. This is #dangerous and #unjust. It is a very serious #attack on the #freedom, #privacy, and #security of computer users.
The Management Engine started to appear in Intel computers around 2007.
It could, for instance, be used to remotely:
- Power the computers on and off.
- Boot computers from remote #storage located on the system administrator's #machine or on a #server, and take control of the computer that way.
- Retrieve and store various #serial #numbers that #identify the computer hardware.
It now constitutes a #separate computing environment that is designed to deny users the control of their computer. It can even run #applications that implement Digital Restrictions Management ( #DRM ). See Defective by Design to learn why DRM is bad.
The remote administration is done through applications running inside the Management Engine, such as AMT (Active Management Technology). AMT gives #remote system administrators the same control they would have if sitting in front of the computer. AMT can also control Intel #Ethernet #interfaces and #Wi-Fi cards to #filter or #block #network traffic from going in or out of the computer.
We could correct all these problems if the users were able to run fully free software on the Management Engine, or at least, make it not run any code, effectively disabling it. The former is impossible because the Management Engine will only run code that is #cryptographically signed by Intel. This means that unless someone finds a flaw in the #hardware that enables users to bypass the signature check, users are effectively denied the ability to #install the software they wish in the Management Engine.
Despite all Intel's efforts to make the Management Engine inescapable, software developers have had some success with preventing it from loading code. For instance, the #Libreboot project disables the Management Engine by removing all the code that the Management Engine is supposed to load on some #Thinkpad computers manufactured in #2008, including the R400, T400, T400s, T500, W500, X200, X200s, and X200T.
Also, many Intel computers manufactured in 2006 have the ancestor of the Management Engine which is disabled from the start, such as the Lenovo Thinkpads X60, X60s, X60 Tablet and T60, and many more.
A free software program named intelmetool is capable of detecting if the Management Engine is absent or disabled. With more recent hardware, it is not yet possible to fully disable the Management Engine, as some of the hardware needs to be initialized by it. It is however possible to limit the amount of nonfree software running on the Management Engine by removing parts of the #code and/or by configuring it to not run some code.
Independently from the Management Engine, other issues affect computers users in very similar ways:
Many computers use nonfree boot software (like #BIOS or #UEFI or equivalent) and/or require it to be cryptographically signed by the hardware manufacturer. This raises similar concern for the freedom, privacy, and security of computer users because the boot software is responsible for loading the operating system, and has more control over the computer than the operating system. This issue also affects computers using other architectures such as #ARM.
#AMD computers made after 2013 also have a separate computer within the computer, called PSP (Platform Security Processor), which has similar #issues.
Because of Intel's attack on users' freedom, to avoid being denied freedom, privacy, and security, computer users wanting to use a machine with an Intel processor must use older computers with no Management Engine, or whose Management Engine is disabled.
Whenever companies follow Intel's path, we will need to design our own hardware to keep being able to escape such attacks on freedom, by ensuring that users can run fully free software on it. This will also create the necessary building blocks that will enable users to benefit from hardware #freedoms in the #future, when manufacturing technologies are easily available to end users.
At the moment the only way to avoid this universal backdoor is to use computers that have been certified to respect your freedom (RYF).
#NSA #spyware #spy #mass #surveillance #technology #laptops #CPU #processor #universal #backdoor #malware #Corei3 #Corei5 #Corei7
for @firstname.lastname@example.org @zauberstuhl
10 days ago, after the pod joindiaspora.com was completely broken for three weeks, its podmin wrote this post. I usually keep tabs with still unanswered questions open for a while, so I can ping again. Interestingly, when I wanted to check that post for updates, that post didn't exist anymore. It was deleted by the podmin.
Under the post I asked jd's podmin how he plans to prevent similar issues in the future. I commented that obviously asking for help within feneas didn't help as nobody responded to that question for 3 months.
Lukas then responded by calling me a liar, because somebody did indeed respond! And anyway, this was the first time ever that it took him so long to respond or solve such issues!
And .. wtf?
He was right, he got one response, but that response only added more questions, it was no response to the actual question looking for someone to help maintain the pod.
And I have no idea how on earth he could just state that similar issues never took him so long to respond to or resolve. I mean, just scroll #joindiaspora for a while! Joindiaspora completely looses federation almost every three weeks ("JD's a lonely island again", "Finally seeing other pods' content again after x weeks", etc). It constantly gives 502 or 504 errors to its users when trying to publish posts or uploading photos. Stream isn't loading for weeks. At times where it does actually work, it's mostly so slow that one can barely use it.
Users do talk about it. Users send posts with complaints. Users mention the podmin account and the podmin's personal account. And he usually simply ignores them, for weeks. His reaction this time was no exception, but his usual reaction. See screenshots.
Many people already left joindiaspora, because it's so broken. Other users desperately wait for the account migration tool, so that they can finally leave this broken pod.
If you don't ever see these posts: What kind of parallel universe are you living in?
So let me ask this again:
How do you plan to prevent such issues in the future? How do you plan to solve the issue of you being the only person with access to the pod/server - the only person who can fix problems?
Deleting your posts whenever someone in the comments asks about the future of your pod won't make JD's problems disappear.
#joindiaspora #jd #diaspora #pod #pods #podmin #podmins #issue #issues #problem #question #dasgehtsonicht #argh