Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The hijacking flaw that lurked in Intel chips is worse than anyone thought

arstechnica.com

Post reply on HN
Print view View original

61–70 of 96 posts

Re: The hijacking flaw that lurked in Intel chips is worse than anyone thought

#61

Post by coldtea »

stevenh wrote: post #44
megadollar wrote: post #17

Earlier quoted context omitted.

That's fine. I will literally give you $10,000 if¹ you can give me a MD5 preimage attack. Take your attack vector to be that particular md5sum that you are making fun of. MD5 is not broken for the usage that you think it's broken for. Please don't snipe on things like this again. People like you who say things like "md5 is always bad" or "you should bcrypt, duh" are literally cargo culting the idea of computer securi…

Hello fellow ordinary person using an account created a year ago and finally posting today for the very first time with comically irrational outrage over the possibility of people ever moving away from md5sum thus rendering useless whatever subset of shady tools you or your employer has that we don't know about yet. Consider making innocuous comments in various threads for a few weeks before you switch to psyop mode…

Tin foil much? As if what will ...really help NSA and co are 1-2 random comments of technical pedantry regarding MD5 on an insignificant (in the grand scheme of things) forum people go to discuss the latest startup news, JS frameworks, the benefits of functional programming, Golang, tech industry developments, and some CS related news.

Re: The hijacking flaw that lurked in Intel chips is worse than anyone thought

#62

Post by deathhand »

lima wrote: post #21

I disagree with the article. If anything, it's much less severe than many people thought. - It's a logic bug (authentication bypass) instead of a memory corruption. An authentication bypass is bad, but a full compromise would have been much worse. - It's a bug in the opt-in AMT management, which means that the default config is not vulnerable.

The bug is not 'opt-in'. If you need a processor with TPM then it will have AMT. The only question is if the vulenarability is local or accessible online.

Re: The hijacking flaw that lurked in Intel chips is worse than anyone thought

#63

Post by qb45 »

coldtea wrote: post #60
qb45 wrote: post #43

Earlier quoted context omitted.

It has to be MD5. They use HTTP digest auth, which uses MD5. You send a nonce, the browser throws a popup asking for password and returns md5(nonce+pass). No way around it.

Very easy way around it: do NOT use digest auth.

Sure, which brings us to the second point: HTTP's MD5 digest auth is still good enough to keep passive eavesdroppers from learning the password when TLS isn't used, which is its only purpose.

Re: The hijacking flaw that lurked in Intel chips is worse than anyone thought

#65

Post by Neliquat »

dataminded wrote: post #64

This is a dream come true for AMD.

AMD has a similar system, likely with simular issues. Their smaller footprint means they just take longer for people to notice than an Intel snafu. Hopefully this will give them a preemptive heads up to harden theirs before an exploit is discovered.

Re: The hijacking flaw that lurked in Intel chips is worse than anyone thought

#66

Post by lisper »

megadollar wrote: post #17
lisper wrote: post #2

It just keeps getting better: Intel's diagnostic tool is published with an MD5 checksum.

That's fine. I will literally give you $10,000 if¹ you can give me a MD5 preimage attack. Take your attack vector to be that particular md5sum that you are making fun of. MD5 is not broken for the usage that you think it's broken for. Please don't snipe on things like this again. People like you who say things like "md5 is always bad" or "you should bcrypt, duh" are literally cargo culting the idea of computer securi…

> I will literally give you $10,000 if¹ you can give me a MD5 preimage attack.

It's almost certainly a question of when, not if, I will be able to collect on that offer.

Re: The hijacking flaw that lurked in Intel chips is worse than anyone thought

#67

Post by tyingq »

ComodoHacker wrote: post #49

So where all this authentication and web UI code resides? Is it in the BIOS? Is there somewhere a packed JQuery or something?

It's in the AMT code, written in C, in the management engine processor...which is separate from the main processor. See: https://software.intel.com/en-us/node/631399

They are using HTTP Digest Authentication, which is built into browsers. The purpose was to keep passwords from being clear text over regular http connections.

So, the code on the client side is in the browser. The code on the server side is in the management processor, and it is a C implementation of HTTP Digest Auth.

The bug is that they used strncmp, but used the length of the incoming hash from the client as the string length to compare, versus the actual length that the hash string is supposed to be. The exploit is to send an empty hash. That requires a proxy, or browser plugin, since the browser creates the Digest Auth Headers. The empty hash causes something like strncmp(expected, received_hash_string, 0), and of course, two zero length strings are equal.

Re: The hijacking flaw that lurked in Intel chips is worse than anyone thought

#68

Post by lima »

DKnoll wrote: post #59
lima wrote: post #57

Earlier quoted context omitted.

> Intel ignoring it after being given years of notice Sure about that? From what I can tell, it's a recently discovered vulnerability that was promptly fixed.

According to SemiAccurate (terrible name for a source) they reported it to Intel some time ago.

As far as I know, Embedi and not SemiAccurate found and reported the issue.

https://www.embedi.com/files/white-papers/Silent-Bob-is-Sile...

> An authentication bypass vulnerability, which will be later known as CVE-2017-5689, was originally discovered in mid-February of 2017 while doing side-research on the internals of Intel ME firmware. The first objects of interest were network services and protocols.

Re: The hijacking flaw that lurked in Intel chips is worse than anyone thought

#69

Post by lima »

deathhand wrote: post #62
lima wrote: post #21

I disagree with the article. If anything, it's much less severe than many people thought. - It's a logic bug (authentication bypass) instead of a memory corruption. An authentication bypass is bad, but a full compromise would have been much worse. - It's a bug in the opt-in AMT management, which means that the default config is not vulnerable.

The bug is not 'opt-in'. If you need a processor with TPM then it will have AMT. The only question is if the vulenarability is local or accessible online.

Sure, but AMT is off by default. How would you exploit it locally if it's not enabled?

Re: The hijacking flaw that lurked in Intel chips is worse than anyone thought

#70

Post by tyingq »

lima wrote: post #69
deathhand wrote: post #62

Earlier quoted context omitted.

The bug is not 'opt-in'. If you need a processor with TPM then it will have AMT. The only question is if the vulenarability is local or accessible online.

Sure, but AMT is off by default. How would you exploit it locally if it's not enabled?

There's a second bug that allows local, non root users to provision AMT.
Post reply on HN