• This is a political forum that is non-biased/non-partisan and treats every person's position on topics equally. This debate forum is not aligned to any political party. In today's politics, many ideas are split between and even within all the political parties. Often we find ourselves agreeing on one platform but some topics break our mold. We are here to discuss them in a civil political debate. If this is your first visit to our political forums, be sure to check out the RULES. Registering for debate politics is necessary before posting. Register today to participate - it's free!

Massive flaw in Intel chips..

P

PeteEU

DP Veteran
Joined
Mar 11, 2006
Messages
39,003
Reaction score
14,344
Location
Denmark
Gender
Male
Political Leaning
Centrist
https://www.techrepublic.com/articl...illions-of-devices-at-risk-of-total-takeover/

Got to love how so many news outlets are being Intels bitch and not reporting the severity of this flaw... it is huge...I can see governments and businesses going ape**** at the moment, trying to stay ahead of hackers.

Basically what it means is that anyone with access to your PC, either directly or via a network can install malware and spyware without you or the OS knowing that it has happened. So all a hacker has to do, is get on the network of the target. Once on, then he/she has full access to hack any machine with affected unpatched processors. No anti-virus or OS will prevent it, since it is done directly into the chip system before any OS boots up. There is also speculation that they can effectively snoop live passwords and actions on affected PCs.. which is..

Now Intel states that they have a fix... well wupti du... That fix has to be distributed via a bios update, which requires the following.

1) Intel makes the fix.
2) Motherboard manufactures and PC OEMs implement said fix in a Bios update.
3) People apply that Bios update.

Both nr 2 and 3 are big maybes. Sure newer motherboards might get the bios update, but Gen 6 motherboards? Sure...

And then it comes down to consumers not only applying the bios update, but knowing how to do it! OEMs also have to push their patch, but again requires people apply it.. and people who buy OEM PCs can often barely turn on the machine, let alone patch a bios...
 
PeteEU said:
https://www.techrepublic.com/articl...illions-of-devices-at-risk-of-total-takeover/

Got to love how so many news outlets are being Intels bitch and not reporting the severity of this flaw... it is huge...I can see governments and businesses going ape**** at the moment, trying to stay ahead of hackers.

Basically what it means is that anyone with access to your PC, either directly or via a network can install malware and spyware without you or the OS knowing that it has happened. So all a hacker has to do, is get on the network of the target. Once on, then he/she has full access to hack any machine with affected unpatched processors. No anti-virus or OS will prevent it, since it is done directly into the chip system before any OS boots up. There is also speculation that they can effectively snoop live passwords and actions on affected PCs.. which is..

Now Intel states that they have a fix... well wupti du... That fix has to be distributed via a bios update, which requires the following.

1) Intel makes the fix.
2) Motherboard manufactures and PC OEMs implement said fix in a Bios update.
3) People apply that Bios update.

Both nr 2 and 3 are big maybes. Sure newer motherboards might get the bios update, but Gen 6 motherboards? Sure...

And then it comes down to consumers not only applying the bios update, but knowing how to do it! OEMs also have to push their patch, but again requires people apply it.. and people who buy OEM PCs can often barely turn on the machine, let alone patch a bios...
Click to expand...

While not literate on these things, not illiterate- downloaded the tool, scan say not affected.
So am I missing something???
 
The government loves this "flaw" It makes it very easy for them!
 
That flaw is nothing compared to Windows 10 and Microsoft's unlimited access to your PC.
 
JANFU said:
While not literate on these things, not illiterate- downloaded the tool, scan say not affected.
So am I missing something???
Click to expand...

Depends on what Intel Chip you have. It is Skylake and forward, so any chip made from August 2015.. so i3-7 with 6XXX number and i9 7XXX.
 
PoS said:
That flaw is nothing compared to Windows 10 and Microsoft's unlimited access to your PC.
Click to expand...

Bull****, it is far worse. FAR worse. Means anyone can access your ****, remotely whenever they want... as long as they have access to your network.

Oh and this fault.. is OS independent.. so Linux and Apple machines are also affected.
 
PeteEU said:
Bull****, it is far worse. FAR worse. Means anyone can access your ****, remotely whenever they want... as long as they have access to your network.

Oh and this fault.. is OS independent.. so Linux and Apple machines are also affected.
Click to expand...

Bzzt. This flaw can be patched, and it will only affect you if they breach your firewall, network or through a 3rd party exploit.

MS on the other hand continuously gets data from your PC because the Win10 OS has full access and doesnt require user permissions to access the internet. If someone at MS decides to screw with your PC or if hackers breach MS then all Win 10 users will be affected.
 
PoS said:
Bzzt. This flaw can be patched,
Click to expand...

Yes

and it will only affect you if they breach your firewall
Click to expand...

Nope, since the flaw gives access to the PC before the Firewall is active.

network
Click to expand...

Yea, and have you been following how many flaws there have been in routers lately? And getting access to wifi networks is not hard.

or through a 3rd party exploit.
Click to expand...

Actually no, since that would require the OS to be started up. The whole point is, that this exploit is on the chip/bios, and before the OS is started up.

MS on the other hand continuously gets data from your PC because the Win10 OS has full access and doesnt require user permissions to access the internet. If someone at MS decides to screw with your PC or if hackers breach MS then all Win 10 users will be affected.
Click to expand...

Same with OSX, iOS and Android, and god only knows what Linux Distros do.. zero trust there.
 
PeteEU said:
Yes



Nope, since the flaw gives access to the PC before the Firewall is active.



Yea, and have you been following how many flaws there have been in routers lately? And getting access to wifi networks is not hard.



Actually no, since that would require the OS to be started up. The whole point is, that this exploit is on the chip/bios, and before the OS is started up.



Same with OSX, iOS and Android, and god only knows what Linux Distros do.. zero trust there.
Click to expand...

Linux distros are open source, you decide what is to be updated. MS doesnt allow you to do that, so your usual "everybody else is doing it" excuse doesnt work this time.
 
PoS said:
Linux distros are open source, you decide what is to be updated. MS doesnt allow you to do that, so your usual "everybody else is doing it" excuse doesnt work this time.
Click to expand...

Open source also means slow security updates. Dont even try to deny that. Regardless, this bug is also effects Linux machines.
 
PeteEU said:
Open source also means slow security updates. Dont even try to deny that. Regardless, this bug is also effects Linux machines.
Click to expand...

Open source doesnt need to update much because they have less than 1/100 of the security vulnerabilities that MS has. :mrgreen:
 
PoS said:
Linux distros are open source, you decide what is to be updated. MS doesnt allow you to do that, so your usual "everybody else is doing it" excuse doesnt work this time.
Click to expand...

Open source also means slow security updates. Dont even try to deny that. Regardless, this bug is also effects Linux machines.
 
PoS said:
Open source doesnt need to update much because they have less than 1/100 of the security vulnerabilities that MS has. :mrgreen:
Click to expand...

That's a myth. Open source systems, both because of common code available to all, and flaws in customized server and front ends, are the recipients of more targeted attacks than any OS's per deployment basis. They are also the most vulnerable for the same reasons.

I have six distinct systems running in my home. The only one which has never been cracked, a slightly modified MacPlus, last updated to MacOs 8.2.1 in use as a family e-mail server and a FAX server. At this point in time, the system is so obscure as to be outside any targeting range. There has also never been anything on it worth going after. Nothing more than a machine ID and a customized e-mail server setup for children's chatter. FAX's are not retained in memory after delivery.

My Linux server receives between 5-6k attacks weekly, my Windows 10 machine (a white box), 3-4k attacks weekly, my mid 2011 iMac, with slight modifications, my daily machine I'm using right now, 100-150 attacks weekly. My highly customized UNIX workstation, with a custom front end, modified as new hardware components reach maturity, almost monthly, with almost weekly minor OS updates, is attacked 500-800 times weekly. I use no commercial security packages. No security package can prevent attacks, and the best strategy is to detect penetrations and isolate them prior to loss of data (inclusive of mining) or other damage, when possible reversing the attacks as a general practice (aka revenge). Crackers find Linux servers the easiest to penetrate, I suggest that is because of the splintering of Linux installations, lack of consistency with protocols in use, and common source code known to whoever wants to learn it. No reverse engineering needed.

Only my UNIX workstation has never been cracked, but it is used for writing security software, and is the test ground for implementation. It is functioning at a level of security beyond the scope of all but .01% of the most advanced cracker minds functioning that I am aware of, and most of those see it as a source of diminished returns, and a battle to protect themselves they don't want to enjoy. That's not a brag, it is a fact. I am responsible for writing the core security coding, but many others have contributed and continue to contribute to its ever improving sophistication. The commercial custom security packages developed from this machine, duplicated in my former company's offices, continue to earn significant profits for that company, of which I retain some equity.

95% of all successful cracks could be ended with simple better use habits by users. Unfortunately, most people are too complacent, and too lazy to learn common sense protocols to securitize their own systems, regardless of the OS.
 
PeteEU said:
Depends on what Intel Chip you have. It is Skylake and forward, so any chip made from August 2015.. so i3-7 with 6XXX number and i9 7XXX.
Click to expand...

Have to check my laptop- desktop is about 6 yrs old. Laptop about 2 years
 
JANFU said:
Have to check my laptop- desktop is about 6 yrs old. Laptop about 2 years
Click to expand...

Desktop not affected, laptop .. depends if it was the new chip at the time (high priced) or older chip... older means not affected.
 
PeteEU said:
Desktop not affected, laptop .. depends if it was the new chip at the time (high priced) or older chip... older means not affected.
Click to expand...

Laptop has an I7 core. Does that change anything?
 
JANFU said:
Laptop has an I7 core. Does that change anything?
Click to expand...

Nope, need the i7 XXXX number to be sure. It all depends on the generation of the i7 chip.
 
OldFatGuy said:
That's a myth. Open source systems, both because of common code available to all, and flaws in customized server and front ends, are the recipients of more targeted attacks than any OS's per deployment basis. They are also the most vulnerable for the same reasons.

I have six distinct systems running in my home. The only one which has never been cracked, a slightly modified MacPlus, last updated to MacOs 8.2.1 in use as a family e-mail server and a FAX server. At this point in time, the system is so obscure as to be outside any targeting range. There has also never been anything on it worth going after. Nothing more than a machine ID and a customized e-mail server setup for children's chatter. FAX's are not retained in memory after delivery.

My Linux server receives between 5-6k attacks weekly, my Windows 10 machine (a white box), 3-4k attacks weekly, my mid 2011 iMac, with slight modifications, my daily machine I'm using right now, 100-150 attacks weekly. My highly customized UNIX workstation, with a custom front end, modified as new hardware components reach maturity, almost monthly, with almost weekly minor OS updates, is attacked 500-800 times weekly. I use no commercial security packages. No security package can prevent attacks, and the best strategy is to detect penetrations and isolate them prior to loss of data (inclusive of mining) or other damage, when possible reversing the attacks as a general practice (aka revenge). Crackers find Linux servers the easiest to penetrate, I suggest that is because of the splintering of Linux installations, lack of consistency with protocols in use, and common source code known to whoever wants to learn it. No reverse engineering needed.

Only my UNIX workstation has never been cracked, but it is used for writing security software, and is the test ground for implementation. It is functioning at a level of security beyond the scope of all but .01% of the most advanced cracker minds functioning that I am aware of, and most of those see it as a source of diminished returns, and a battle to protect themselves they don't want to enjoy. That's not a brag, it is a fact. I am responsible for writing the core security coding, but many others have contributed and continue to contribute to its ever improving sophistication. The commercial custom security packages developed from this machine, duplicated in my former company's offices, continue to earn significant profits for that company, of which I retain some equity.

95% of all successful cracks could be ended with simple better use habits by users. Unfortunately, most people are too complacent, and too lazy to learn common sense protocols to securitize their own systems, regardless of the OS.
Click to expand...

I never made the claim that Linux is invulnerable to hacking, nor was I referring to servers, just regular desktop and laptop users, so youre barking up the wrong tree.
 
PoS said:
I never made the claim that Linux is invulnerable to hacking, nor was I referring to servers, just regular desktop and laptop users, so youre barking up the wrong tree.
Click to expand...

Understood. Any client machine can unknowingly function as a linux server, or another subsystem layer, meaning any desktop or laptop in use. Don't get caught up in the tech lingua franca, and don't get caught up in the myths. Sometimes we know not what we say.

"Open source doesnt need to update much because they have less than 1/100 of the security vulnerabilities that MS has." - Your words. The most used open source OS in the wild today is Linux. Linux is primarily used for servers. Hackers and crackers do have the tools to hide a Linux server as a secondary system on any machine, unknowingly to the user of the machine. Open source tools in action. Not only is open source in need of rapid updating because of vulnerabilities, it is often the source of vulnerabilities on the part of proprietary systems. To add to the confusion, most vulnerabilities found in the wild are reported by hackers using open source tools to do security research on all systems in use.

Poet Lewis Turco once said, "I start writing a poem about "A," I finish a poem about "B, C & D. I didn't recognize "C & D" until rereading that poem years later, even when my readers had not previously seen "A." I deny saying any of this." :)
 
PeteEU said:
https://www.techrepublic.com/articl...illions-of-devices-at-risk-of-total-takeover/

Got to love how so many news outlets are being Intels bitch and not reporting the severity of this flaw... it is huge...I can see governments and businesses going ape**** at the moment, trying to stay ahead of hackers.

Basically what it means is that anyone with access to your PC, either directly or via a network can install malware and spyware without you or the OS knowing that it has happened. So all a hacker has to do, is get on the network of the target. Once on, then he/she has full access to hack any machine with affected unpatched processors. No anti-virus or OS will prevent it, since it is done directly into the chip system before any OS boots up. There is also speculation that they can effectively snoop live passwords and actions on affected PCs.. which is..

Now Intel states that they have a fix... well wupti du... That fix has to be distributed via a bios update, which requires the following.

1) Intel makes the fix.
2) Motherboard manufactures and PC OEMs implement said fix in a Bios update.
3) People apply that Bios update.

Both nr 2 and 3 are big maybes. Sure newer motherboards might get the bios update, but Gen 6 motherboards? Sure...

And then it comes down to consumers not only applying the bios update, but knowing how to do it! OEMs also have to push their patch, but again requires people apply it.. and people who buy OEM PCs can often barely turn on the machine, let alone patch a bios...
Click to expand...

It's hard to define a feature without defining a loophole.
 
PeteEU said:
Nope, need the i7 XXXX number to be sure. It all depends on the generation of the i7 chip.
Click to expand...

4 processors
All i7-5500U PU @2.40 GHz
 
PoS said:
Open source doesnt need to update much because they have less than 1/100 of the security vulnerabilities that MS has. :mrgreen:
Click to expand...

Not true at all. It is all market share.

When it comes to actual computers, Microsoft is still the largest target, because they have the largest market share.

Unix-Linux and it's various flavors and iterations are largely immune, simply because there are so damned many of them.

I am writing this on my POS terminal, a Core i3 rack mount server running Mint 18.1 Serena. And yes, it has exploits, largely unique to itself. Just as does any other variant of Linux. An exploit for Red Hat will likely not work on Mandrake, or SUSE, or Lindows, or any other variations.

And hackers are ultimately rather lazy. They want to be able to hack the largest number of computers they can, with the least amount of work. So are they going to work for hundreds of hours to create an exploit to access a few dozen thousand machines, or to exploit millions of machines?

Simple, they go with the numbers. So hack for Microsoft it is.

Plus the simple fact that those that use most variations of Unix-Linux (not counting Mac and Chrome users) tend to be along the higher end of the computer user spectrum. We do not call the box your computer sits in the "Hard Drive" or "CPU". We do not confuse bits per second with bytes per second, and most of us can convert between binary, hex and decimal with our eyes closed.

Tell us to go home, we go to 127.0.0.1

Out of all of the thousands of computers I have built over the decades, not a single one has been for a Linux user. Well, other than for myself that is.
 
You must log in or register to reply here.
Back
Top Bottom