Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Malware Uses Obscure Intel CPU Feature to Steal Data and Avoid Firewalls

bleepingcomputer.com

Post reply on HN
Print view View original

31–40 of 84 posts

Re: Malware Uses Obscure Intel CPU Feature to Steal Data and Avoid Firewalls

#31

Post by oneplane »

Another round of crappy journalism. It's not obscure, it's not a CPU feature but a platform feature, and there are plenty of out-of-band communication channels out there, this isn't the only one. On top of that, this was already published two DEF CONs ago.

You can exfil data and even do practival bi-directional communication over: SOL, IPMI, ASF, MT's ARC CPU via injected firmware and then via TCP/IP. Any of them will work. Add vendor-specific firmware addons on top of that (i.e. Broadcom tends to have exploitable firmware in their NIC controllers)

Most of them are in a vulnerable state by default because the technology was supposed to be 'easy' and 'user friendly', but 'users' don't even know what they are, and most deployments are done by the WinTel horde that doesn't actually know anything outside the Microsoft framework. (and thus leave the defaults as-is)

I probably posted something similar on https://news.ycombinator.com/item?id=11913379

Is it bad? Yes. Is it new? No. Is it ever reported on correctly? Also no.

Re: Malware Uses Obscure Intel CPU Feature to Steal Data and Avoid Firewalls

#32

Post by ccrush »

It's surprising that everyone is up in arms about AMT and ME while not complaining in the slightest about SGX. SGX allows third parties to run code on your processor that is outside of your control. We're losing our computers to corporate interests. You are buying a device they can remotely manage, exert control with a higher privilege than yours, hide secrets inside your machine, and make all the decisions for you. To be even more dramatic, you are purchasing your own enslavement.

Re: Malware Uses Obscure Intel CPU Feature to Steal Data and Avoid Firewalls

#33

Post by noja »

ccrush wrote: post #32

It's surprising that everyone is up in arms about AMT and ME while not complaining in the slightest about SGX. SGX allows third parties to run code on your processor that is outside of your control. We're losing our computers to corporate interests. You are buying a device they can remotely manage, exert control with a higher privilege than yours, hide secrets inside your machine, and make all the decisions for you.…

SGX https://en.wikipedia.org/wiki/Software_Guard_Extensions

Re: Malware Uses Obscure Intel CPU Feature to Steal Data and Avoid Firewalls

#34

Post by mschuster91 »

kakarot wrote: post #29
mschuster91 wrote: post #7

Earlier quoted context omitted.

Who knows if the feature is not still present in silicon but just software-disabled? It's not really new that Intel and AMD do binning to get more yield.

It isn't present AFAIK, because Intel cuts corners on enthusiast chips they do not expect to be used in a networked environment in order to save money, and still charge you more than the non-enthusiast counterparts.

Ah okay. I thought that Intel bins everything from high-grade Xeon to i3 from the same silicon to save costs.

Re: Malware Uses Obscure Intel CPU Feature to Steal Data and Avoid Firewalls

#35

Post by dmix »

> Intel ME runs even when the main processor is powered off, and while this feature looks pretty shady, Intel built ME to provide remote administration capabilities to companies that manage large networks of thousands of computers.

So they exposed millions of consumer and business computers in order to satisfy a niche enterprise usecase? Why is this not something that has to be manually turned on?

Intel ME has always sounded like a glaring security risk. Another operating system running in the background that can run it's own network stack? This is 100% being exploited by intel agencies.

Re: Malware Uses Obscure Intel CPU Feature to Steal Data and Avoid Firewalls

#36

Post by tyingq »

rufugee wrote: post #17
zkms wrote: post #11

Aaaand I think this is the first public disclosure of malware using the Intel Management Engine / AMT's network connection (that uses SMBus, i talked about it here https://news.ycombinator.com/item?id=14309557 and gave links to appropriate datasheets). Welp. AMT/ME being used by malware created by well-resourced adversaries is no surprise, and is why Intel needed to give an irreversible and verifiable way of complete…

is why Intel needed to give an irreversible and verifiable way of completely disabling it. The article said it comes disabled by default. Isn't this a verifiable way, or is the article incorrect?

There's a second bug that allows a non-privileged local user to provision it.

"An unprivileged local attacker could provision manageability features gaining unprivileged network or local system privileges on Intel manageability SKUs"

https://security-center.intel.com/advisory.aspx?intelid=INTE...

Re: Malware Uses Obscure Intel CPU Feature to Steal Data and Avoid Firewalls

#37

Post by rasz »

kakarot wrote: post #29
mschuster91 wrote: post #7

Earlier quoted context omitted.

Who knows if the feature is not still present in silicon but just software-disabled? It's not really new that Intel and AMD do binning to get more yield.

It isn't present AFAIK, because Intel cuts corners on enthusiast chips they do not expect to be used in a networked environment in order to save money, and still charge you more than the non-enthusiast counterparts.

ME is there (ability to execute below ring -1). Go ahead and check it right now, look at lspci/device manager for Management Engine Communications device. Its present on cheapest desktop H81 motherboards, and on highend (at the time) Z87 ones, no matter the cpu.

Re: Malware Uses Obscure Intel CPU Feature to Steal Data and Avoid Firewalls

#38

Post by MichaelGG »

ccrush wrote: post #32

It's surprising that everyone is up in arms about AMT and ME while not complaining in the slightest about SGX. SGX allows third parties to run code on your processor that is outside of your control. We're losing our computers to corporate interests. You are buying a device they can remotely manage, exert control with a higher privilege than yours, hide secrets inside your machine, and make all the decisions for you.…

SGX, if they allow arbitrary code to be signed, is amazing. It enables remote trust. You could execute jobs "in the cloud" without anyone being able to see your data. You could write a known-correct coin tumbler or trading platform.

If it does only get locked to a few code authors, that would be a tremendous shame.

Re: Malware Uses Obscure Intel CPU Feature to Steal Data and Avoid Firewalls

#39

Post by zkms »

tyingq wrote: post #36
rufugee wrote: post #17

Earlier quoted context omitted.

is why Intel needed to give an irreversible and verifiable way of completely disabling it. The article said it comes disabled by default. Isn't this a verifiable way, or is the article incorrect?

There's a second bug that allows a non-privileged local user to provision it. "An unprivileged local attacker could provision manageability features gaining unprivileged network or local system privileges on Intel manageability SKUs" https://security-center.intel.com/advisory.aspx?intelid=INTE...

Also a privileged local user can provision it -- which is also pretty horrific, and that's not even a bug, it's how it's designed! Also "provision manageability features" is such an awkwardly euphemistic phrase here tbh, it's like reading leaked classified documents talking about "implanting" systems.

Re: Malware Uses Obscure Intel CPU Feature to Steal Data and Avoid Firewalls

#40

Post by zkms »

SXX wrote: post #18
rufugee wrote: post #17

Earlier quoted context omitted.

is why Intel needed to give an irreversible and verifiable way of completely disabling it. The article said it comes disabled by default. Isn't this a verifiable way, or is the article incorrect?

AMT is disabled by default on most consumer PCs or at least it's not expose itself. Though AMT work on top of ME and ME is opposite: it's always active and required for system to operate. If ME firmware not found CPU will shut down every 30 minutes or something. There also way to neutralize some part of ME firmware while keeping system operational, but it's hard to tell how effective this is actually.

A privileged local user can provision AMT to its liking though, which is afaict what this malware did.
Post reply on HN