[jaimex2]

God #$%@ing damn it, this is why we can't have nice things. You can do only so much to not get pwned software wise, now you need to be paranoid about the hardware too?!

Going through all Xeon servers is going to be fun tomorrow.

[nom]

Unfortunately, there are too few hardware developers and not enough hardware-awareness, thanks to the good abstraction nowadays. In the modern age, only few software devs cares about the underlying hardware, because it just works. The thing is, software _runs_ on hardware and any bug/backdoor etc in it undermines everything above.

Did you know that the baseband chip in your smartphone runs it's own linux? Or that every SIM card comes with java applications that can communicate with it? I guess not.

Considering how much hardware is required on a modern PC main board, it's really not that surprising that there are backdoors, bugs, or other mechanisms that can be exploited.

[throwaypestban]

> the baseband chip in your smartphone runs it's own ...

Microkernel

In many if not most cases this kernel would be an L4 implementation.

> OKL4 has been deployed on over 2 billion mobile phones (https://en.wikipedia.org/wiki/Open_Kernel_Labs)

[monocasa]

Modern hexagons run a full Linux under L4 also. It seems like the microkernel separation isn't really architected towards security AFAICT, but for running hard real time tasks on the same cores as the rest of the system.

[criddell]

If your servers have multiple network ports and you aren't using them all, don't use the first one. Apparently the ME interface is only exposed on the main network interface.

[wmf]

Xeon servers don't have AMT, but you might want to verify that your BMCs are firewalled and fully patched.

[jaimex2]

Good to know, thanks :)

[Kali909]

It's comical at this stage.

[digi_owl]

I am tempted to go back to dialup style connectivity. Meaning i disconnect the router from the net unless i absolutely need something online.

[mkl]

You absolutely need security updates, or your system will be out of date and extra-vulnerable as soon as you plug it in.

[digi_owl]

Makes a guy wish there was an alternate pathway for getting updates...