Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Rediscovering the Intel AMT Vulnerability

tenable.com

Post reply on HN
Print view View original

51–60 of 94 posts

Re: Rediscovering the Intel AMT Vulnerability

#51

Post by mr_overalls »

Spooky23 wrote: post #38
bobsam wrote: post #10

Intel decided they have the right to put a whole secret computer inside your computer that only they can access. God knows what it does when no one is watching. That's the problem you should discuss, not this particular exploit.

It does very little. As usual with AMT, there's a lot of noise, but these vulnerabilities to date have only been exploitable with activated AMT. With activation you can patch, etc. And as I always point out in these stories, if Intel AMT freaks you out, Google "absolute software embedded bios".

Black Hat Briefings 2009 - researchers show that the implementation of the Computrace/LoJack agent embedded in the BIOS has vulnerabilities and that this "available control of the anti-theft agent allows a highly dangerous form of BIOS-enhanced rootkit that can bypass all chipset or installation restrictions and reutilize many existing features offered in this kind of software."

Black Hat 2014 - Kaspersky demonstrates local and remote exploitation of first-stage CompuTrace agent (small agent, it is used only to install full version of rootkit after activation of LoJack or after reinstallation of Windows)

https://www.blackhat.com/docs/us-14/materials/us-14-Kamlyuk-...

Holy hell.

Re: Rediscovering the Intel AMT Vulnerability

#52

Post by qb45 »

Animats wrote: post #24
bobsam wrote: post #10

Intel decided they have the right to put a whole secret computer inside your computer that only they can access. God knows what it does when no one is watching. That's the problem you should discuss, not this particular exploit.

Having a "management engine" with direct access to the network and to memory is questionable in itself. Its code being secret indicates there's probably something bad going in. If it only does what Intel says it does, it doesn't need to be secret.

Unfortunately, a "management engine" with some degree of control over the CPU is necessary for, well, management. As in remote management, which is something that big corps with thousands of machines want, and the more control it gives the better.

The code itself is as secret as the code of any proprietary Windows-based remote administration tool they could supply as a poor man's substitute if the ME didn't exist. It's just how this industry works.

This doesn't indicate that there is anything "bad" going on. What is bad is that Intel, being the cheap bastards they are, combined this remote management and DRM, virtualization, TPM, CPU initialization and hell knows what else into one blob running on one MCU with no way to separate and disable the unneeded/unwanted/buggy/vulnerable garbage from actually useful functionality. And that such critical part is closed to third party scrutiny.

Re: Rediscovering the Intel AMT Vulnerability

#53

Post by mjg59 »

Godel_unicode wrote: post #49
djsumdog wrote: post #16

Earlier quoted context omitted.

..and HP servers/sans (iLO)

That's a separate system which lives on a daughter board. It's essentially a kvm+usb cdrom+power switch. No disk access, no dma. Not the same thing at all. Edit: and trivially removable if you don't want it.

> No disk access

AMT doesn't provide raw disk access either

> no dma

It's connected to PCI. What makes you so sure that it has no DMA access?

> Not the same thing at all

Indeed - iLo is pretty good, but the implementations provided by other vendors have an even worse track record than AMT does.

Re: Rediscovering the Intel AMT Vulnerability

#54

Post by mjg59 »

walterbell wrote: post #25

If AMT provides remote management of devices that are turned off, what program provides authentication of remote management requests when the OS is powered off? Has that interface been audited for authentication vulnerabilities? If there is an OS-independent, network-accessible AMT management service, when would an admin need to switch from that service to the Windows-hosted web interface? Why can't all AMT operation…

There is no Windows-hosted web interface, the web interface is provided by AMT. LMS is for accessing AMT from the local machine (AMT is listening to the network hardware, so trying to connect to the web UI locally won't work - the OS will shortcut the network hardware)

Re: Rediscovering the Intel AMT Vulnerability

#55

Post by SomeStupidPoint »

rayiner wrote: post #44
SomeStupidPoint wrote: post #32

Earlier quoted context omitted.

Are you just trolling? I've read literally dozens about how Intel ME is a potential vector and it's problematic to have, particularly when unneeded on consumer devices (a number of them here on HN). There's whole discussions about it from people like Libreboot and others who work on fully open systems. Every security professional I've worked with has been aware that there's a potential hardware level backdoor you can…

It seems super useful to me. It lets you do OS installs without a keyboard/screen using VNC. Note that stuff like IPMI is standard in the server world.

Sorry, perhaps I phrased it poorly.

I certainly see the benefit in the server world (eg, managing a data center) and even in the corporate one (eg, managing a lot of workstations), and didn't mean to imply that everyone thought it was a negative. (Though, even in that space, some people do because of the closed source nature where they don't have full control of the system.)

Rather, I meant that everyone who was serious about security was aware that it was there and included it in their threat modeling. It's not worse than other remote management technologies (and may be better, depending on your needs and trade-offs).

However, for certain systems, there's never a need for the remote management capabilities, and hence represents a threat for which there's no upside when included. (I would argue most consumer systems fall under this.)

There are of course, a range of opinions depending on ideological bent, and my main point was that there was a discussion about it happening.

Re: Rediscovering the Intel AMT Vulnerability

#56

Post by cmurf »

FTA: "the discovery of a possible zero-day in widely distributed firmware"

Is this CPU firmware? Or microcode? Or is it logic board firmware (UEFI base)? And if it's CPU firmware, is that replaceable or is it permanently baked into the CPU?

Re: Rediscovering the Intel AMT Vulnerability

#57

Post by denois »

Intel is such an evil company: 1. They are stealing customers data and secretly sending it to their HQ and to NSA 2. They do financially support feminism movements (why I should pay for this?) 3. Abused their monopoly status and sold processors for MUCH higher prices. 4. Reduced investments to CPU research to increase margins. etc... My next CPU will be from AMD.

Re: Rediscovering the Intel AMT Vulnerability

#58

Post by dom0 »

justinclift wrote: post #28
Animats wrote: post #24

Earlier quoted context omitted.

Having a "management engine" with direct access to the network and to memory is questionable in itself. Its code being secret indicates there's probably something bad going in. If it only does what Intel says it does, it doesn't need to be secret.

IPMI falls into similar waters, and also has known design flaws around authentication. :(

IPMI normally has a dedicated NIC (well, on some crappy boards it doesn't), which tends not to be connected to public networks.

Re: Rediscovering the Intel AMT Vulnerability

#60

Post by orblivion »

So does this cut down the attack to people on your network? Would a simple NAT protect me here?

Also it's bizarre that they're disclosing this so soon, given that there are bound to be Lenovo (at least) customers who are not business customers and who don't read hacker news and who aren't exactly going to update their BIOS as an everyday thing.

Post reply on HN