Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Malware Uses Obscure Intel CPU Feature to Steal Data and Avoid Firewalls

bleepingcomputer.com

Post reply on HN
Print view View original

41–50 of 84 posts

Re: Malware Uses Obscure Intel CPU Feature to Steal Data and Avoid Firewalls

#41

Post by SXX »

tyingq wrote: post #36
rufugee wrote: post #17

Earlier quoted context omitted.

is why Intel needed to give an irreversible and verifiable way of completely disabling it. The article said it comes disabled by default. Isn't this a verifiable way, or is the article incorrect?

There's a second bug that allows a non-privileged local user to provision it. "An unprivileged local attacker could provision manageability features gaining unprivileged network or local system privileges on Intel manageability SKUs" https://security-center.intel.com/advisory.aspx?intelid=INTE...

Isn't it supposed to be enabled in BIOS in order to provision it? On most laptops and desktop motherboards such features simply disable by default like VT-d (IOMMU).

Re: Malware Uses Obscure Intel CPU Feature to Steal Data and Avoid Firewalls

#42

Post by CapacitorSet »

hellbanner wrote: post #21
endymi0n wrote: post #4

Money Quote: > When contacted by Microsoft, Intel said the PLATINUM group wasn't using any vulnerability in the Intel AMT SOL interface, but this was another classic case of bad guys using a technology developed for legitimate purposes to do bad things. Worst excuse ever. "Look guys, at least it's not a backdoor we left on purpose!!!" m(

Are there any open hardware computers of comparable computing power? How can the consumer stop someone from exploiting this hack?

>How can the consumer stop someone from exploiting this hack?

[Remove Intel ME](https://github.com/corna/me_cleaner) to the largest extent possible. I don't know of equivalent tools for AMD, though, which also has similar systems in place.

Re: Malware Uses Obscure Intel CPU Feature to Steal Data and Avoid Firewalls

#43

Post by woah »

MichaelGG wrote: post #38
ccrush wrote: post #32

It's surprising that everyone is up in arms about AMT and ME while not complaining in the slightest about SGX. SGX allows third parties to run code on your processor that is outside of your control. We're losing our computers to corporate interests. You are buying a device they can remotely manage, exert control with a higher privilege than yours, hide secrets inside your machine, and make all the decisions for you.…

SGX, if they allow arbitrary code to be signed, is amazing. It enables remote trust. You could execute jobs "in the cloud" without anyone being able to see your data. You could write a known-correct coin tumbler or trading platform. If it does only get locked to a few code authors, that would be a tremendous shame.

If Intel is the one source of ultimate trust, why not just run your secure whatever on Intel's servers? Seems a lot less complex than jumping through all these SGX hoops.

Re: Malware Uses Obscure Intel CPU Feature to Steal Data and Avoid Firewalls

#44

Post by SXX »

MichaelGG wrote: post #38
ccrush wrote: post #32

It's surprising that everyone is up in arms about AMT and ME while not complaining in the slightest about SGX. SGX allows third parties to run code on your processor that is outside of your control. We're losing our computers to corporate interests. You are buying a device they can remotely manage, exert control with a higher privilege than yours, hide secrets inside your machine, and make all the decisions for you.…

SGX, if they allow arbitrary code to be signed, is amazing. It enables remote trust. You could execute jobs "in the cloud" without anyone being able to see your data. You could write a known-correct coin tumbler or trading platform. If it does only get locked to a few code authors, that would be a tremendous shame.

Yeah it's will bring new amazing spyware and ransomware on millions of PCs.

Re: Malware Uses Obscure Intel CPU Feature to Steal Data and Avoid Firewalls

#45

Post by zer0tonin »

kakarot wrote: post #29
mschuster91 wrote: post #7

Earlier quoted context omitted.

Who knows if the feature is not still present in silicon but just software-disabled? It's not really new that Intel and AMD do binning to get more yield.

It isn't present AFAIK, because Intel cuts corners on enthusiast chips they do not expect to be used in a networked environment in order to save money, and still charge you more than the non-enthusiast counterparts.

ME is always there even if you don't have any of its features.

Re: Malware Uses Obscure Intel CPU Feature to Steal Data and Avoid Firewalls

#46

Post by mycall »

oneplane wrote: post #31

Another round of crappy journalism. It's not obscure, it's not a CPU feature but a platform feature, and there are plenty of out-of-band communication channels out there, this isn't the only one. On top of that, this was already published two DEF CONs ago. You can exfil data and even do practival bi-directional communication over: SOL, IPMI, ASF, MT's ARC CPU via injected firmware and then via TCP/IP. Any of them wil…

Of these techs, which does AMD support? Would switching to AMD make us more secure?

Re: Malware Uses Obscure Intel CPU Feature to Steal Data and Avoid Firewalls

#47

Post by SXX »

zkms wrote: post #40
SXX wrote: post #18

Earlier quoted context omitted.

AMT is disabled by default on most consumer PCs or at least it's not expose itself. Though AMT work on top of ME and ME is opposite: it's always active and required for system to operate. If ME firmware not found CPU will shut down every 30 minutes or something. There also way to neutralize some part of ME firmware while keeping system operational, but it's hard to tell how effective this is actually.

A privileged local user can provision AMT to its liking though, which is afaict what this malware did.

I posted it below already, but anyway as far as I personally understand to provision AMT you need it actually enabled in BIOS / EFI and it's in fact usually disabled by default.

Am I missing something?

Re: Malware Uses Obscure Intel CPU Feature to Steal Data and Avoid Firewalls

#48

Post by mycall »

SXX wrote: post #44
MichaelGG wrote: post #38

Earlier quoted context omitted.

SGX, if they allow arbitrary code to be signed, is amazing. It enables remote trust. You could execute jobs "in the cloud" without anyone being able to see your data. You could write a known-correct coin tumbler or trading platform. If it does only get locked to a few code authors, that would be a tremendous shame.

Yeah it's will bring new amazing spyware and ransomware on millions of PCs.

Or plausible deniability.

Re: Malware Uses Obscure Intel CPU Feature to Steal Data and Avoid Firewalls

#49

Post by SXX »

mycall wrote: post #46
oneplane wrote: post #31

Another round of crappy journalism. It's not obscure, it's not a CPU feature but a platform feature, and there are plenty of out-of-band communication channels out there, this isn't the only one. On top of that, this was already published two DEF CONs ago. You can exfil data and even do practival bi-directional communication over: SOL, IPMI, ASF, MT's ARC CPU via injected firmware and then via TCP/IP. Any of them wil…

Of these techs, which does AMD support? Would switching to AMD make us more secure?

It's answered in comments multiple times.

Read about AMD PSP / ARM TrustZone.

Re: Malware Uses Obscure Intel CPU Feature to Steal Data and Avoid Firewalls

#50

Post by mycall »

hellbanner wrote: post #21
endymi0n wrote: post #4

Money Quote: > When contacted by Microsoft, Intel said the PLATINUM group wasn't using any vulnerability in the Intel AMT SOL interface, but this was another classic case of bad guys using a technology developed for legitimate purposes to do bad things. Worst excuse ever. "Look guys, at least it's not a backdoor we left on purpose!!!" m(

Are there any open hardware computers of comparable computing power? How can the consumer stop someone from exploiting this hack?

Dense RISC-V will eventually happen, although its supporting chipset will probably have its own vulnerabilities.
Post reply on HN