The author dismisses CPU-level backdoors in favor of Intel ME backdoors mainly on the basis that, since CPUs can't save state, they can't protect themselves against replay-"attacks", and hence Intel would lose any sort of plausible deniability once an "activation sequence" was ever found in the wild.
But I don't really see how ME is protected against replay-"attacks" either. Sure, you might not be able to replay the sequence to the same CPU, but you can definitely replay it to a different CPU - unless every single CPU out there has a different activation sequence, which is possible, but would be vastly less efficient (if you want to hack someone you now have to know / guess some sort of unique production ID of the CPUs he's using?).
I'm really not seeing the big argument in favor of an ME backdoor here. A backdoor directly in the CPU would work just as well.
Arguably better in fact, since the CPU can just look for the activation sequence in the data it reads (if you send an e-mail or website it's very likely the plaintext string gets copied, and therefore read, by the CPU at some point), whereas the ME processor would only be able to watch specific offsets in memory.
I thought everything in it would be backdoored with each one looking like an intermittent failure, a timing error, something like MMU failing in long-lasting system due to silicon aging, "honest mistakes" all over networking-connected code in ME, something similar in its hardware, etc.
The one they'd use the most was deniable looking flaws in ME. They'd reserve their best ones for most important cases with lowest chances of detection. Maybe even with personal physically there activating it with a RF signal. Could integrate wireless in something called Centrino to make that easier. Take a pile of hard cash and lots of defense sales as a thank you.
Right, this is from 2015, I'm aware that "transistor-hidden" backdoors have been created since then... at least as proofs of concept ?
But while these are a future possibility, I doubt that any of those are already in place already now, much less were in 2008, when Intel introduced IME...
supply chain tracking is extremely difficult even for entire ecosystems that make it their near maximum priority (such as say, military procurement).
There isn't a hope in hell you can reliably keep track of who has which Intel CPU.
Think of all the stages involved, and how each one has to cooperate and how many times Intel's CPU is sitting on "undifferentiated palette of X units".
Of course one device can be tracked. But not every CPU can be tracked, I consider that quite infeasible indeed. If you already know the target, and know that target is looking to buy a new PC/laptop, you can feed it a specific CPU, sure. But you could just as well feed it some sort of modified BIOS that doesn't require any special hardware, and would be pretty much just as hard to detect for someone that isn't specifically looking for that kind of modification.
But that's usually not the interesting case. The interesting case is that you find a new target, and that target already has a PC/laptop, and you want to gain access to it without having to physically infiltrate. Now, you might be able to manipulate their network in some way, or send them an E-Mail, or get them to visit a website that contains an activation code. But having to backtrack which CPU that laptop contains seems impossible to me in the vast majority of cases. Even if you can somehow figure out where he bought it, most stores aren't even going to be able to tell you the serial number of the product they sold, and even if they can, now you have to match that serial number to a CPU, which is... impossible? How would you get that information? Retailers buy hundreds of thousands of CPUs, and they probably don't tell Intel which CPU they put into which device, or even who buys which individual CPU. If you send a CPU back on Amazon, they don't even check if it's the same goddamn model! (Hence the surprise of some people who bought a $550 CPU and got a $550 CPU box with a $50 CPU in it.) And if the CPU or laptop was bought used, now you're really out of luck. I really don't see how this is very useful, when instead of doing that you can just force Intel to give up plausible deniability and hack everything in sight. If you get caught (which is incredibly unlikely in the first place), you just say "we did it for America!" and that's it, nobody would care. I mean Intel would be kinda fucked, but the NSA wouldn't be.
You restated your position instead of addressing my question and then added irrelevant speculation in a different direction.
The issue with supply chain tracking is the sharing of information. If every part of the supply chain is hacked then you have all of the info. You also need to look at it backwards: instead of "who has X" ask "where did X go" which is easier to answer. It starts at the source, the factory, which can know which serial was in which lot. Then you know where that got shipped, etc.
Maybe occasionally units get "lost" but you do have error bounds on their location.
The author dismisses CPU-level backdoors in favor of Intel ME backdoors mainly on the basis that, since CPUs can't save state, they can't protect themselves against replay-"attacks", and hence Intel would lose any sort of plausible deniability once an "activation sequence" was ever found in the wild.
But I don't really see how ME is protected against replay-"attacks" either. Sure, you might not be able to replay the sequence to the same CPU, but you can definitely replay it to a different CPU - unless every single CPU out there has a different activation sequence, which is possible, but would be vastly less efficient (if you want to hack someone you now have to know / guess some sort of unique production ID of the CPUs he's using?).
I'm really not seeing the big argument in favor of an ME backdoor here. A backdoor directly in the CPU would work just as well.
Arguably better in fact, since the CPU can just look for the activation sequence in the data it reads (if you send an e-mail or website it's very likely the plaintext string gets copied, and therefore read, by the CPU at some point), whereas the ME processor would only be able to watch specific offsets in memory.