Unless Intel provides source code for the ME, it is impossible to 100% know whether unauthorized code is running.
https://securingtomorrow.mcafee.com/business/chipsec-support...
It includes a few more details about what was released:
It extracts EFI firmware from flash ROM memory
automatically if the firmware file is not
specified.
We recommend generating an EFI whitelist after
purchasing a system or when you are sure it has
not been infected:
# chipsec_main -m tools.uefi.whitelist -a generate
Then check the EFI firmware on your system
periodically or whenever you are concerned, such
as when a laptop was left unattended:
An analysis of the approach they are taking would lead to some pretty easy improvements.
But...
We recommend generating an EFI whitelist after
purchasing a system or when you are sure it has
not been infected
Next step would be to provide lists of known good signatures from some controlled environment, or at least a consensus system to know whether the version one finds matches the version others have?
In any case having a tool to even perform the check is great.
If you are willing to assume they aren't infecting every computer. Walk into a random brick and mortar store and buy it there.
If you're paranoid to the point where you don't trust the people at a random brick and mortar store, point at a display model (or if they have non-display models visible one of those) and insist on that one in particular, without it leaving your sight at any point in time.
https://en.wikipedia.org/wiki/System_Management_Mode#Problem...
That in combination with the Management Engine are ways in which people have been disowned of their own machines.
AT&T and Verizon don't have 'plant' employees. Much simpler - and legally, safer - to just give the bag of money straight to the corporation.
That said, the main hurdles seem to be managing people and funds, which government agencies seem pretty good at figuring out. So maybe not all that easy, but maybe not particularly hard either. The biggest problem might be keeping it secret, given the number of people that might need to be involved that are clandestinely working for a TLA but not as their main job and not steeped in the culture of secrecy.
The code is here: https://github.com/chipsec/chipsec
Wouldn't the malicious alterations introduced in a scenario like that most likely be exploitable defects that could be explained away as mistakes? If they accumulate too much around certain people that's suspicious of course, but it seems like it would often be difficult to downright prove that someone intentionally broke the security of a rather complex system.
[2] https://github.com/LongSoft/UEFITool/tree/new_engine (use 'new_engine' branch)
[3] https://github.com/XVilka/flashrom/tree/layout_descriptor (use 'layout_descriptor' branch)
[CHIPSEC] Modules failed 1: [-] FAILED: chipsec.modules.common.uefi.s3bootscript
-- clarification
Technically all it means, if the error is as advertised, is that the uefi bootscript failed to match. Now, it could be as simple as that UEFI was customized by a vendor. Or it could be something less innocent.
https://www.theguardian.com/world/2013/jul/11/russia-reverts...
The entire computing ecosystem appears to be P0wned by various intelligence services. And, its not unique to the CIA or NSA. The Chinese are assumed to have backdoors into most of what ships from their country.
Hopefully the Russians still remember how they bugged US typewriters in the US Embassy in Moscow. Then they'll be able to check that their own typewriters aren't bugged in a similar fashion: http://www.cryptomuseum.com/covert/bugs/selectric/
It's pretty bloody sad state that we're in that your comment cannot be dismissed as some tin-foil-hat-lunatic, but very reasonable skepticism nowadays.
EFI binaries though are expected to be signed or they won't execute, that's the point of Secure Boot, and it includes bootloaders and the kernel all being signed. Most Linux distros I'm aware of also sign their modules because permitting unsigned modules could allow you to inject malware right into the kernel just by loading a compromised kernel module.
