Same problem. EVERYTHING that Dragos Ruiu claimed is plausible, and it could be a great cyberpunk plot written by Neal Stephenson. But there is ZERO evidence that the malware actually exists.
And finding an actual incident in real life is much more important than theoretical possibilities. For example, almost everyone knows that it's very possible for semiconductor vendors to include a silicon-level backdoor since the 1980s, but finding an actual Intel/AMD chip with such backdoor (not ME, something like a secret instructions) is another matter.
ME has a debug mode that might be possible to enable with a signal sent through the 3.5mm jack on some laptops[1]. I'd be pretty concerned about ME bugs and backdoors disguised as ME bugs.
I meant, finding a backdoor in its full form on the main system would be a much more significant find, and its impact and newsworthiness is greater than any hypothetical or baseless speculations, such as Bloomberg's BMC affair.
The impact of the BMC affair, if true, is showing real evidence and real demonstration that such an attack has happened, has been used in the wild, rather than showing that the attack is possible (we all know). Unfortunately, bad journalism at work.
P.S: I'm not saying that the ME subsystem, or buggy speculation (pun not intended) isn't a threat, just to make a point.
> I'd be pretty concerned about ME bugs and backdoors disguised as ME bugs.
Same consequences. I'd say they're effectively the same thing.
Well, a year later, we still haven't seen the backdoor chip in question being taken to a lab or DEFCON yet... Even the photograph was fake, just a stock photo...
I was excited to read the news story, and it was a huge disappointment.
Remember BadBIOS?
* https://en.wikipedia.org/wiki/BadBIOS
Same problem. EVERYTHING that Dragos Ruiu claimed is plausible, and it could be a great cyberpunk plot written by Neal Stephenson. But there is ZERO evidence that the malware actually exists.
And finding an actual incident in real life is much more important than theoretical possibilities. For example, almost everyone knows that it's very possible for semiconductor vendors to include a silicon-level backdoor since the 1980s, but finding an actual Intel/AMD chip with such backdoor (not ME, something like a secret instructions) is another matter.