Slo-Tech - Google se zadnje čase ukvarja z zanimivim problemom. S procesorjev, ki poganjajo njegove strežnike, želi odstraniti operacijski sistem Minix. To pa je precej teže, kot se sliši, saj Minix teče v varnostnem obroču (ring) -3. Res je, Intel je Minix zakopal v čisto vse moderne procesorje in to tako globoko, da ne le da ga praktično ne moremo odstraniti, večina sploh ne ve, da na njihovih računalnikih teče ta drugi, vsemogočni operacijski sistem.
Varnostni obroči so namenjeni točno temu, kar pove ime. Varujejo sistem pred napakami in zlonamerno programsko opremo tako, da nima kar vsak kos kode dostop do vsega. V obroču 0 je jedro operacijskega sistema, ki ima največ privilegijev. V višjih obročih so potem gonilniki (1, 2) in uporabniški programi (3), ki imajo omejene pravice. Nekateri sistemi tudi ne uporabljajo vseh štirih nivojev, ker jih ne potrebujejo. Toda to niso vsi obroči, ki obstajajo. V -1 je Xen. Še niže najdemo -2, kjer prebiva UEFI. Že ta ni ravno zgled varnosti, saj jo dosega bolj s prikrivanjem kakor dizajnom. V UEFI-ju, ki se zažene takoj po zagonu računalnika in je aktiven tudi kasneje, so že odkrivali malware. Zato je Google začel secirati UEFI in odstranjevati nepotrebne komponente.
Toda obstaja tudi obroč -3. V Intelovih procesorjih Minix teče v obroču -3, do kamor uporabnik sploh nima dostopa, Minix pa ima absoluten nadzor nad računalnikom. Koda, do katere nimamo dostopa, a ki vse vidi in vse ve, seveda kar kliče po zlorabah. Google je odkril, da v Minixu na Intelovih procesorjih obstajajo datotečni sistemi, številni gonilniki (tudi za USB in mrežo), omrežna povezljivost (networking stack) in spletni strežnik. Imeti nedostopen kos programske opreme, ki poganja spletni strežnik, v svojem procesorju, pa je zelo slaba ideja. Google sicer pravi, da AMD-jevi procesorji niso nič kaj boljši, saj so enako zaklenjeni. Se torej sploh še lahko zaščitimo?
Ring -1 se uporablja pri HW assisted virtualizaciji, torej esxi, hyper-v, kvm, bhyve, xen in verjetno še kak hipervizor.
Sicer pa je tole popolen fail, naj se še tako trudiš zavarovati svoj OS, spodaj pa imaš vsaj 2 ringa, ki izvajata kodo nad katero nimaš nobene kontrole
Torej je "leto minixa na namizju" prišlo čisto potiho in skozi stranska vrata ... In zdaj se bodo morali blackhati naučiti še enega obskurnega zastarelega unix like sistema ... fun times ahead.
Waaav! Huda rešitev. Torej lahko z minixiom prilagodijo obstoječe rezine, da simulira katerokoli arhitekturo. Pa še napake v proizvodnji popravijo, da je manj izmeta. Pišuka, carji so. Če pa minix uporabljajo za namene, ki so sugerirani zgoraj je pa kriminal. Le kako, te morajo srbeti prsti, če kontroliraš cel svet?
ARMji imajo TrustZone, AMD pa PSP. Mobilni telefoni imajo še baseband procesor, ki prosto in neovirano komunicira s stolpi. To vse že desetletje, vi se pa prebujate šele sedaj, žalostno.
ARMji imajo TrustZone, AMD pa PSP. Mobilni telefoni imajo še baseband procesor, ki prosto in neovirano komunicira s stolpi. To vse že desetletje, vi se pa prebujate šele sedaj, žalostno.
Za baseband to ne velja povsem, določeni mobilci imajo baseband kar ustrezno izoliran, tako da nima dma do userlanda itn. Qualcommovi pa gotovo imajo.
Antifašizem je danes poslednje pribežališče ničvredneža, je ideologija ničesar
in neizprosen boj proti neobstoječemu sovražniku - v zameno za državni denar
in neprofitno najemno stanovanje v središču Ljubljane. -- Tomaž Štih, 2021
Šele 10. komentator je opazil, da ni glavni problem v lokalnih privilegijih. Ccc. Sicer pa članek jasno navede, da Minix vključuje
omrežna povezljivost (networking stack) in spletni strežnik
.
Vsi tisti, ki radi nosite aluminijaste kape: opravičujemo se, očitno ste imeli prav.
PS: vsemu nadzoru navkljub večine strelcev v cerkvah, na stadionih in voznikom kombijev ter tovornjakov ne morejo preprečiti v njihovih nakanah. No, saj, morda pa jih pravzaprav niti ne želijo? Izredne razmere, izredni ukrepi. Ovce se najlažje strižejo, ko jim pokažeš sliko volka. Ali Goldsteina. Ali Janše/Kučana. Ipd.
Antifašizem je danes poslednje pribežališče ničvredneža, je ideologija ničesar
in neizprosen boj proti neobstoječemu sovražniku - v zameno za državni denar
in neprofitno najemno stanovanje v središču Ljubljane. -- Tomaž Štih, 2021
V edino olajšanje nam je lahko to, da razne backdoor v takem ekstremnem low levelu najbrž skrbno šparajo za najnujnešje primere in ne uporabljajo masovno(ker kar uporabljaš masovno pride v javnost).
To vse že desetletje, vi se pa prebujate šele sedaj, žalostno.
Ja meni je kr malo smesno, ko se folk prepira kera platforma je bolj luknjasta...vsi pa dejansko spimo z neko napravo, ki vsebuje mic, kamero itd, vedno povezano v splet, nad katero nimamo nobene kontrole...ne glede na to ali je open source, ali ne Dejansko se pa je vse zacelo dogajat se pred racunalniki in internetom, slednji je kakopak zacel kot vojaski projekt. S smartphone-i so pac dobili perfektno orodje za nadzor, z vsemi potrebnimi senzorji in vso potrebno racunsko moc, konstantno povezana v splet, predvsem pa napravo, kero ima clovek vedno ob sebi
V edino olajšanje nam je lahko to, da razne backdoor v takem ekstremnem low levelu najbrž skrbno šparajo za najnujnešje primere in ne uporabljajo masovno(ker kar uporabljaš masovno pride v javnost).
Ne rabiš dodaten backdoor, ta OS na nivoju procesorja JE backdoor.
V edino olajšanje nam je lahko to, da razne backdoor v takem ekstremnem low levelu najbrž skrbno šparajo za najnujnešje primere in ne uporabljajo masovno(ker kar uporabljaš masovno pride v javnost).
Ne rabiš dodaten backdoor, ta OS na nivoju procesorja JE backdoor.
Ta OS na nivoju procesorja je zgolj to, OS. Backdoori so potem razni servisi v tem OSu ali namerne "ranljivosti", ki omogočajo dostop raznoraznim "interesnim skupinam".
Torej če nekdo pridobi dostop do os-ja na cpu (ring -3), potem so vsi intel x86 računalniki od letnika 2006 dalje, ki so na netu glinasti golobi oz ogromen botnet. J*beš strojne fw, updejte os-ja, acl liste dostopa ter av-je, vse je to pesek v oči.
The reason why most of society hates conservatives and
loves liberals is because conservatives hurt you with
the truth and liberals comfort you with lies.
Mesec dni nazaj mi je nekdo pustil komenta pod YT videom:
Modern Intel and AMD processors (including Ryzen) should not be used under any circumstances as they all have a computing environment, separate from standard cores, in the form of Management Engine (ME) in Intel CPUs and Platform Security Processor (PSP) in AMD CPUs, which have complete control over your PC regardless of the OS. They have full network access, ability to remotely power your system on and off, fully access and control the contents of your RAM, track your keystrokes and mouse movements, see the image currently displayed on the screen and so on.
The firmware will have been put there by the authorities to spy on and track everyone. Both Intel and AMD, despite numerous requests from users, developers and companies, refused to release its source code.
For these reasons modern Intel and AMD processors should be avoided at all costs. [Intel CPUs from 2006~2009 and] AMD family 10h or 15h CPUs before 2013 should be used instead.
If you knew what governed our planet you would know why they are so interested in torturing, manipulating and killing people.
Intel are not who they appear to be. Intel isn't a processor manufacturer. It exists solely to destroy all other processor manufacturers. Can Intel use illegal tricks to be the only company allowed to make & sell processors? And Intel pays Dell, HP, Sony, Acer, Samsung & all the others to not buy AMD's processors? And keep all their practices secret? Then AMD spends ALL of its money trying to sue Intel since 1987?
Intel's compiler software? Written to perform fast ONLY on Intel CPUs.
Intel's compiler is the most used one. My guess: Intel bribed the major gaming-software makers to use its compiler, who all kept quiet about the bribes.
This let Intel suppress the speed of its own processors & inflate their prices, which they then use for more bribes.
Someone on a youtube comment: "For anyone needing proof Intel cheats in benchmarks. Look up "SPEC2006 results". For some reason the supposedly non-profit SPEC organization that puts out benchmarking tools requires these tools to be benched with the Intel compiler (and not, say, GCC). There's a hard-coded test for one of these benchmarks-libquantum (a quantum computer simulator)- in the Intel compiler code and if it finds it it rewrites it to run about 15 times faster... but only on Intel CPUs. This test is used when benchmarking all server CPUs and leads to a major boost on the average Intel server CPU results."
Intel dominate server processors. They paid SPEC. They know who writes benchmarking software. Intel are not stupid.
It prices its CPUS not to benefit the public but to knock out its competition.
Tablets? Makers paid to not use competitors' CPUs. Bribes were paid to Europe's biggest computer seller.
Game-console makers were given free Intel CPUs so AMD could not compete. Later AMD broke through.
Intel's processors are now in the Asus Zenfone 2. How?
Amazingly HP, Dell and Lenovo are now offering laptops with AMD's Ryzen processors.
35-minute talk made after decades of research on the evil, global, faceless, corporate Intel:
I'm willing to guess that Intel doesn't pay taxes or have to obey any laws. It's part of the global corporate empire with Monsanto, Amazon, Google, Starbucks, Facebook, McDonalds etc. Yes, Amazon. They're in on it too.
Intel make SSDs too. Someone mentioned "the upgrade key scheme that Intel wants to implement, forcing users to pay hundreds of dollars to unlock RAID 1, 10, and 5 on M.2 drives. They will be softlocked to RAID 0 only without this key, and they will also be restricted to only using Intel SSDs." In other words Intel will be the only maker of SSDs in future if there's no processor competitor. So even if you have an Intel SSD it won't work any longer as you will need a new one that will work with Intel's latest chipset.
Intel's new Coffee Lake CPUs won't use the Intel-made z270 chipset so won't work with the Sky/Kaby Lake 1151 boards. Angry Intel users, who sensed they've been scammed:
(My old AM2 motherboard used AMD's AM2 processors and with BIOS upgrades could also use AM2+ & AM3 processors. AM3+ motherboards can also use AM3 processors.)
Had Intel destroyed AMD they would have taken out Nvidia and been left as the only manufacturer of graphics units. I read Intel grossed $52 billion last year.
Who makes the chipset in the motherboards for Intel processors? Intel. If Intel knock out AMD then they can charge whatever they like for them. I read that the AMD chipsets are made by someone else, not AMD.
Intel gave AMD a tiny $1.4 billion as a settlement. They now want that huge sum back.
Zanimivo branje, ki je s tem člankom dobilo na teži.
Does this mean they have complete access to Intel ME? Yes. How much fucked are we? Six ways through Sunday.
What's that?
A JTAG debugger has chipset-level access to a system. Think of root, then a level above that, then kind of another level above that. Intel CSME is basically a master security and manageability controller. USB DCI is a potential JTAG interface. It allows access with a simple plug into a compatible USB port. I believe it also doesn't show up as anything happened to the OS. So, it seems that they're saying people can have nearly undetectable uber-root access to the entire security and management engine of a recent Intel system by plugging in a USB device.
The reason why most of society hates conservatives and
loves liberals is because conservatives hurt you with
the truth and liberals comfort you with lies.
inception anyone? 
