Hacker News new | past | comments | ask | show | jobs | submit login

There is a device visible on the PCI bus. How hard is it to imagine that userland programs could somehow pass requests to that device, and have the ME do bad things to the CPU or the RAM?

How hard is it to imagine some special string in RAM could trigger the ME in a similar way? (so many CPU instructions - I would be surprised if there wasn't one to talk to the ME)

Exploits and vulnerability are mitigated by proper analysis and ecological diversity.

Here we have an attack channel present of every single Intel based computer, regardless of the CPU.

Call me an extremist if you want, but this is far from harmless.




If userland processes are passing unauthorized commands to PCI devices, you have bigger problems.


They're called proprietary video drivers, and yes, they pass unknown commands, without user authorization (think DRM) to PCI(e) devices (video cards) all the time.


If you're running highly privileged binary blob drivers, is ME really the attack vector you should be worried about?


How does a userland process communicate with a PCI device?

Asking for a project.


Take a look at the /bus/pci section of sysfs: https://www.kernel.org/doc/Documentation/filesystems/sysfs-p...


I was more interested in Windows but thanks.




Consider applying for YC's Spring batch! Applications are open till Feb 11.

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: