I didn't think it was possible again, but Intel has yet again surpassed my expectations:
gadgets.ndtv.com
I didn't think it was possible again, but Intel has yet again surpassed my expectations:
Jeremiah Hughes
Other urls found in this thread:
i.blackhat.com
techreport.com
wired.com
techreport.com
twitter.com
Mason Morales
i.blackhat.com
Slides 41 onward. Holy shit.
I remember when people were called paranoid for not trusting the Hardware RNG.
Turns out, they were right not to trust it.
Joshua Watson
Levi Flores
>Listen to intelligence agencies when they tell you to add insecure protocols and methods
>end up with swiss cheese hardware that anyone can break into
>people stop buying your stuff
foolproof genious plan
William Lopez
>Listen to intelligence agencies
>implying intel execs aren't on the boards of those intelligence agencies
Jace Miller
Fucking finally. Maybe this will finally shut up the fags who said IME is fine because no explot exists. Now let's hope it causes enough damage for some positive change to occur.
Tyler Lewis
it doesn't matter to them. now they are going to go back to
>requires local access
and intentionally deflect again
Caleb Anderson
If Zen 2 doesn't sell a lot there is something wrong with this world.
Christian Taylor
>Although Intel doesn't publicly disclose the existence of Intel VISA and is extremely secretive about it, the researchers were able to find several ways to enable the feature on the Intel chipsets and capture the data from the CPU.
>literal security through obscurity
I would find this slightly distressing if my sides weren't in orbit.
Michael Watson
>implying being on the board of an intelligence agency isn't lsitening as;t;etra tkl;gfyhnjk;sernjktrhtrhtrhtrhtrhtrhtrhtrhtrhtrhtrhtrh
Hunter Green
>If Zen 2 doesn't sell a lot there is something wrong with this world.
techreport.com
wired.com
techreport.com
Camden Garcia
>requires physical access
who cares? you can take full control over any CPU if you have physical access to it.
Lucas Wilson
Holy shit user. Intel = botnet confirmed.
Caleb Morgan
"DAL configuration is included in encrypted XML files.
Encryption is performed using PBKDF2 and AES.
The key and salt are hardcoded in DAL."
Intel is fucking retarded.
Justin Perry
can you explain to a brainlet what exactly this means? did they put an encryption key where anyone could read it?
Tyler Lewis
I'm a fucking brainlet so a lot of the slides went over my head, but is it correct that disabling the ME eliminates all remote versions of the vulnerabilities (that we know of right now)? It looks like the rest of the ways to exploit this require physical access to the machine, in which case your shit is fucked regardless. Will my crusty old thinkpad be alright (relatively speaking) considering I ME_Cleaner'd it with coreboot?
Kayden Moore
Not him, but, imagine you've locked your house and left for vacation and I, a burglar want to come and steal things from your place. Under a traditional scenario, I would need to figure out the inner patterning of your lock in order to then make the key to get access to your house and steal your things.
But in this case, even though you've left for vacation, an imprint of the key is available on your door, next to your lock; down to the edge pattern needed to craft the key. With it, I can take a picture, convert it into a 2D stencil, take it to a keyshop and machine a key. Then come back, throw it into the lock, unlock and I have access to everything.
So while you were "smart" to lock the door, you are a fucking retard because you installed a fucking door that had the imprint of your key in it--its hardcoded INTO the door. Anyone can get in with relative ease.
Jackson Sanders
>vulnerabilities
VISA is a feature, not a bug.
Somebody put a fuse, invisible to the user, that if set makes the hw random generator predictable.
Ryan Jackson
JUST
Sebastian Martinez
And the lock can't be removed altogether, slowing your own access to your own house. A simple latch would be better than this.
Easton Moore
All medium-quality embedded device security uses fixed keys. Bonus for using Tiny Encryption Algorithm as hash.
Industry standard should at least be export-grade ECC or 160-bit ECC, stored on offline computers, but that will never happen.
The project leader probably proposed the cheaper solution as a cost cutting measure (of a few cents) and sold the key to blackhats on the darknet.
Landon Jones
Intel is based, nothing surpasses the 9900K!
Jack Gray
It will, all of us Phenom II users have been itching for an upgrade.
I'm going to miss the best cpu generation ever, never going to forget how i got better fps than bulldozer, and i5 users, i can only hope Zen 2 will bring the sound of tears to my ears once again.