Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

ThinkPwn: System Management Mode arbitrary code execution

github.com

Post reply on HN
Print view View original

71–80 of 154 posts

Re: ThinkPwn: System Management Mode arbitrary code execution

#71

Post by 0x0 »

geocar wrote: post #14
cdubzzz wrote: post #4

Interesting bit form Lenovo's security advisory on the matter[0]: > Shortly after the researcher stated over social media that he would disclose a BIOS-level vulnerability in Lenovo products, Lenovo PSIRT made several unsuccessful attempts to collaborate with the researcher in advance of his publication of this information. [0] https://support.lenovo.com/us/en/solutions/LEN-8324

Clear as mud. Lenovo has previously sacrificed user security and privacy for money (superfish), so it does not surprise me that they have done it again, and these kinds of weasel words aren't going to get me to buy another Lenovo product again. Here's an idea: How about not putting backdoors in our products? How about making it easier for consumers to replace software on systems they own?

TheRegister is speculating this could be a 3rd party backdoor that has been snuck into several vendor's BIOses - http://www.theregister.co.uk/2016/07/04/lenovo_scrambling_to...

Re: ThinkPwn: System Management Mode arbitrary code execution

#72

Post by [deleted] »

ihsw wrote: post #23
jonwachob91 wrote: post #8

T450S user here. What exactly does this mean for me? I get it's a security issue, but that's about all I understood...

The attack against you would be interdiction, where the NSA (or whomever) would MITM shipping and receiving. What shipping and receiving? Somewhere between where you will receive the package -- be it your home, PO Box, postal office, etc -- and the originating storage facility (ie: warehouse), there is a long list of hands exchanging your product. One of these hands would be an NSA agent's hands. https://en.wikipedia…

[deleted]

Re: ThinkPwn: System Management Mode arbitrary code execution

#73

Post by imglorp »

kuschku wrote: post #54
jsjohns2 wrote: post #32

Quite the hilarious "security advisory" [0] that Lenovo put out. They manage to take zero responsibility, shift blame to the researcher/IBV/Intel, and admit that they ship SMM code of both unknown author and purpose. [0] https://support.lenovo.com/us/en/solutions/LEN-8324

> and admit that they ship code of both unknown author and purpose. That's literally what every vendor does nowadays. Do you think LG can get the code for the firmware of the SoCs they use in their phones? Do you think the coreboot guys can get the source for the Intel Management Engine firmware? Do you think any of the firmware in your system comes from your OEM and is secure? This is a failure in the entire industr…

That's going to get complicated for network interactions and legislative bodies. Two examples come to mind.

First is the FCC vs WIFI channel selection in firmware. They want the choice to interfere be removed from the user in this occasion.

Second is cell carriers are not wild about unknown basebands conversing with their networks. In theory the network should defend against bad phones but they'd rather not test that.

Re: ThinkPwn: System Management Mode arbitrary code execution

#74

Post by AdmiralAsshat »

snuxoll wrote: post #21
geocar wrote: post #14

Earlier quoted context omitted.

Clear as mud. Lenovo has previously sacrificed user security and privacy for money (superfish), so it does not surprise me that they have done it again, and these kinds of weasel words aren't going to get me to buy another Lenovo product again. Here's an idea: How about not putting backdoors in our products? How about making it easier for consumers to replace software on systems they own?

Lenovo has always maintained a higher standard for their Think products, Superfish was only an issue on the Idea line. Doesn't excuse the debacle, but ThinkPad's are their professional line of notebooks and they make every effort to keep a positive image.

Lenovo only maintained the "standard" for their ThinkPads because it was an explicit condition of IBM when they sold the ThinkPad line to Lenovo.

Re: ThinkPwn: System Management Mode arbitrary code execution

#75

Post by yuhong »

dandelion_lover wrote: post #51
JonathonW wrote: post #49

Earlier quoted context omitted.

AKA refurbished Lenovo hardware?

Yes, with BIOS replaced with free software and wi-fi card replaced with a freedom-respecting one. I do not see any problems in that.

I dislike how it does not do microcode updates though.

Re: ThinkPwn: System Management Mode arbitrary code execution

#76

Post by yuhong »

tinco wrote: post #59
loeg wrote: post #45

Earlier quoted context omitted.

It's C generated by disassembling x86 assembler code. It is not an example code from Intel. The function pointer at `v3 + 0x8` is invoked with arguments: (1) the pointer at `v3 + 0x0`, (2) some fixed pointer, and (3) a pointer into the CommunicationBuffer. E.g. here's more idiomatic C code to represent the same idea: struct Thunk { void *argument; void (fp)(void *, DWORD *, void *); }; struct CommunicationBuffer { ui…

What idiomatic C code uses thunks? Is this an interpreter/runtime for a functional language or something? Or do some optimizers introduce thunks?

This likely calls a UEFI protocol, which are typically called this way.

Re: ThinkPwn: System Management Mode arbitrary code execution

#77

Post by gvb »

This should be good news for people looking to getting rid of Computrace, effectively a rootkit, from surplus Thinkpads.

http://forum.thinkpads.com/viewtopic.php?t=114641

Yes, I bought a surplus Thinkpad (T61) and found it had Computrace activated on it. Grrrr.

Yes, I could call the Absolute(R) Software number and they should disable it for me. I have not been willing to sit on hold and jump their hoops to date. Since I run linux on the laptop, is fairly low risk for me, but Absolute(R) Software could inadvertently or intentionally "brick" my laptop. Grrrr.

Re: ThinkPwn: System Management Mode arbitrary code execution

#78

Post by yuhong »

fencepost wrote: post #47

Don't just plaster Lenovo with this - they're getting the splatter because Cr4sh has been researching their firmware, but this is a multi-vendor issue. A few important notes from the article and the releaser's blog post: * This is not a Lenovo problem so much as a problem for multiple vendors who used BIOS based on Intel's reference information. The original problem was with source code provided by Intel. The same pr…

My personal favorite is the UEFI variable bugs that brick laptops. I think many of them are trivial to exploit even under Windows.

Re: ThinkPwn: System Management Mode arbitrary code execution

#80

Post by loeg »

m1el wrote: post #61
loeg wrote: post #45

Earlier quoted context omitted.

It's C generated by disassembling x86 assembler code. It is not an example code from Intel. The function pointer at `v3 + 0x8` is invoked with arguments: (1) the pointer at `v3 + 0x0`, (2) some fixed pointer, and (3) a pointer into the CommunicationBuffer. E.g. here's more idiomatic C code to represent the same idea: struct Thunk { void *argument; void (fp)(void *, DWORD *, void *); }; struct CommunicationBuffer { ui…

do I understand correctly that v3 stores sort-of closure in C?

Maybe. From the assembly we don't know what type the pointer is. The general C style for closures ("thunks") is to store two pointers—a function and `void `. Since `void ` can point to anything, it's fully general. But maybe the original has a less general type and we can't tell from the assembly.
Post reply on HN