Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Rediscovering the Intel AMT Vulnerability

tenable.com

Post reply on HN
Print view View original

41–50 of 94 posts

Re: Rediscovering the Intel AMT Vulnerability

#41

Post by qb45 »

angersock wrote: post #36
pcwalton wrote: post #31

Earlier quoted context omitted.

Intel ME has a DRM app called "Protected Audio-Video Path" [1], which obviously has to be secret. As to whether anything actually uses the PAVP functionality, I have no idea. I wouldn't be surprised if it was something Intel included to try to push Atom-based set top boxes or whatever. [1]: https://www.slideshare.net/mobile/codeblue_jp/igor-skochinsk...

> Intel ME has a DRM app called "Protected Audio-Video Path" [1], which obviously has to be secret. Does it, does it really? I'm pretty sure security through obscurity is some bullshit.

I'm pretty sure only its keys really need to be secret, but hiding the code may provide some extra security by obscurity if the code happens to have bugs.

Re: Rediscovering the Intel AMT Vulnerability

#42

Post by wmf »

xgen wrote: post #40

AMD have something similar to this, and there was some mentioning of this in an ama on reddit here: https://www.reddit.com/r/Amd/comments/5x4hxu/we_are_amd_crea... What are the reasons for having this, I mean good business reasons? I get that designing cpus is expensive and they reuse as much they can, and that businesses would want the benefits or remote management. However when weighed up against the damage to trus…

Most Intel PCs do not have AMT firmware and thus aren't affected by any AMT firmware vulnerabilities.

Re: Rediscovering the Intel AMT Vulnerability

#43

Post by rayiner »

madez wrote: post #22
bobsam wrote: post #10

Intel decided they have the right to put a whole secret computer inside your computer that only they can access. God knows what it does when no one is watching. That's the problem you should discuss, not this particular exploit.

All in the name of DRM.

As far as I understand it the AMT is like IPMI. It's for remote management, not DRM.

Re: Rediscovering the Intel AMT Vulnerability

#44

Post by rayiner »

SomeStupidPoint wrote: post #32
logicallee wrote: post #21

Earlier quoted context omitted.

[withdrawn]

Are you just trolling? I've read literally dozens about how Intel ME is a potential vector and it's problematic to have, particularly when unneeded on consumer devices (a number of them here on HN). There's whole discussions about it from people like Libreboot and others who work on fully open systems. Every security professional I've worked with has been aware that there's a potential hardware level backdoor you can…

It seems super useful to me. It lets you do OS installs without a keyboard/screen using VNC. Note that stuff like IPMI is standard in the server world.

Re: Rediscovering the Intel AMT Vulnerability

#45

Post by xgen »

wmf wrote: post #42
xgen wrote: post #40

AMD have something similar to this, and there was some mentioning of this in an ama on reddit here: https://www.reddit.com/r/Amd/comments/5x4hxu/we_are_amd_crea... What are the reasons for having this, I mean good business reasons? I get that designing cpus is expensive and they reuse as much they can, and that businesses would want the benefits or remote management. However when weighed up against the damage to trus…

Most Intel PCs do not have AMT firmware and thus aren't affected by any AMT firmware vulnerabilities.

Is management engine not on all modern intel chips, but comes disabled requiring it to be set up in the BIOS?

Re: Rediscovering the Intel AMT Vulnerability

#46

Post by Animats »

pcwalton wrote: post #31
Animats wrote: post #24

Earlier quoted context omitted.

Having a "management engine" with direct access to the network and to memory is questionable in itself. Its code being secret indicates there's probably something bad going in. If it only does what Intel says it does, it doesn't need to be secret.

Intel ME has a DRM app called "Protected Audio-Video Path" [1], which obviously has to be secret. As to whether anything actually uses the PAVP functionality, I have no idea. I wouldn't be surprised if it was something Intel included to try to push Atom-based set top boxes or whatever. [1]: https://www.slideshare.net/mobile/codeblue_jp/igor-skochinsk...

Intel ME has a DRM app called "Protected Audio-Video Path", which obviously has to be secret.

Which you don't need on a headless server. Which is what the "management engine" is supposed to be for.

Re: Rediscovering the Intel AMT Vulnerability

#47

Post by lucb1e »

qb45 wrote: post #6

TL;DR: memcmp(received_passwd_hash, correct_passwd_hash, received_pwd_hs_len) Hey, at least they didn't read past the submitted buffer. edit: Note that this is only pseudocode and rumor has it that ME firmware is actually written mostly in Java. It's not immediately clear to me how to create equivalent bug in Java, the obvious string.equals() method doesn't ignore length mismatch. edit2: s/passwd/passwd_hash to satis…

> [...] how to create equivalent bug in Java, the obvious string.equals() method [...]

Java Card, the Java version made for smart cards, does not have strings, and thus no String.equals().

Thought I remembered this from a CCC conference about EMV chips or SIM cards (don't remember which) a few years ago. Googling seems to confirm it: https://community.oracle.com/thread/1751610?db=5

Re: Rediscovering the Intel AMT Vulnerability

#48

Post by wmf »

xgen wrote: post #45
wmf wrote: post #42

Earlier quoted context omitted.

Most Intel PCs do not have AMT firmware and thus aren't affected by any AMT firmware vulnerabilities.

Is management engine not on all modern intel chips, but comes disabled requiring it to be set up in the BIOS?

The ME is on all chips but the ME doesn't provide remote management. You're confusing two different things.

Re: Rediscovering the Intel AMT Vulnerability

#49

Post by Godel_unicode »

djsumdog wrote: post #16
nullc wrote: post #11

Earlier quoted context omitted.

So has AMD.

..and HP servers/sans (iLO)

That's a separate system which lives on a daughter board. It's essentially a kvm+usb cdrom+power switch. No disk access, no dma.

Not the same thing at all.

Edit: and trivially removable if you don't want it.

Re: Rediscovering the Intel AMT Vulnerability

#50

Post by mjg59 »

Animats wrote: post #46
pcwalton wrote: post #31

Earlier quoted context omitted.

Intel ME has a DRM app called "Protected Audio-Video Path" [1], which obviously has to be secret. As to whether anything actually uses the PAVP functionality, I have no idea. I wouldn't be surprised if it was something Intel included to try to push Atom-based set top boxes or whatever. [1]: https://www.slideshare.net/mobile/codeblue_jp/igor-skochinsk...

Intel ME has a DRM app called "Protected Audio-Video Path", which obviously has to be secret. Which you don't need on a headless server. Which is what the "management engine" is supposed to be for.

This is incorrect. The management engine is used for a wide variety of tasks, from DRM to providing a TPM to anti-theft code. The AMT functionality (which is where this vulnerability is) is intended for remote management of laptops and workstations. It's usually not present on anything but low-end servers.
Post reply on HN