Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Disabling Intel ME 11 via undocumented mode

blog.ptsecurity.com

Post reply on HN
Print view View original

101–110 of 228 posts

Re: Disabling Intel ME 11 via undocumented mode

#101

Post by justinjlynn »

agumonkey wrote: post #95
arca_vorago wrote: post #77

This is why I support Power/MIPS/RISC development going forward. It's just a shame that we allowed intel and amd to both put in cpu backdoors at such an obvious level (I like x86 but it's not the cpu of the future unless it's open). I highly suspect some national security letter type shit is going on in the background, ala Promis and William A. Hamilton who has claimed on Bruce Schneiers blog they (intel agencies) we…

I got a mail from a company doing power9 boards (something eagle ??). A bit pricey but it seems worth it if you have such needs.

Raptor CS?

Re: Disabling Intel ME 11 via undocumented mode

#102

Post by mjg59 »

trhway wrote: post #97
mjg59 wrote: post #96

Earlier quoted context omitted.

AMT is a piece of software that runs on the Management Engine. vPro-enabled platforms are the ones aimed at business laptops and workstations, not consumer stuff. It's important to make the distinction because people can check, find that their machine doesn't have the VNC functionality and then assume that they don't have anything to worry about as far as the ME goes, which is a false sense of security.

i don't think you described the behavior of typical HN reader :) Anyway, vPro with VNC seems to be present on all consumer (ie. with IGP) CPUs, so there is nothing to worry about in the sense that one anyway can't do anything about it, and thus the worrying is futile.

No, it's not. AMT is only shipped on Core-series CPUs when they're accompanied with the business chipset rather than the consumer chipset. It's not an integral part of the ME, it's software that the OEM has to license and ship in their firmware.

Re: Disabling Intel ME 11 via undocumented mode

#103

Post by leggomylibro »

dmitrygr wrote: post #5

The interesting question here is: why undocumented. It was created on request, but nobody was told. Who pushed so hard ME to be on for everything but them? And why? We know the answer :)

Honestly? Chips are full of undocumented commands. It's really, really annoying.

I've been working on getting small TFTs working, for example. Many of them use a common driver chip that supports your basic 8080 parallel interface. The driver manufacturer provides a datasheet documenting the various commands which it will accept.

So of course, to start the chip up, you need to send it a series of magic commands and data values which are not documented in the datasheet.

Adafruit was kind enough to explain the reasoning behind these values to someone who was presumably walking through the same steps as me to bring one of these screens up: https://forums.adafruit.com/viewtopic.php?f=47&t=63229

I guess that maybe it prevents people from buying secondhand stock and getting it working from just the datasheet, without involving the original manufacturer? Anyways, caveat emptor. Even when there's only one seller to emptor from.

Re: Disabling Intel ME 11 via undocumented mode

#104

Post by MaxfordAndSons »

etatoby wrote: post #38
dmitrygr wrote: post #25

Earlier quoted context omitted.

You missed the point. It was added for people with big money. I promise you - it is supported. Just not for you. You need to be backdoorable. They don't

ME itself was added for people with big money. I'm not an engineer experienced in this kind of work, but I fail to see how a company whose core business is manufacturing chips would develop an entire computer (comprising an x86 CPU, its own RAM, MINIX OS, and access to all kinds of I/O) hidden inside each one of their chips and made largely inaccessible to regular users and developers. Unless they are paid very well…

> In retrospect they were kind of naive not to make it much harder to enable this HAP mode

Idk... I suspect this info being publicized won't have much material impact on the effectiveness of the ME as a backdoor. Even among the tiny portion of the population interested enough and capable of understanding what it is and why it's bad, I doubt more than 1% of us will be bothered to go through the trouble of actually disabling it.

Re: Disabling Intel ME 11 via undocumented mode

#105

Post by wolfgke »

What I consider as "interesting" is the fact that much more research (at least if you look at HN headlines/posts) goes into "Intel ME" vs. "AMD Secure Processor" (formerly known as "AMD PSP" ("Platform Security Processor")). I really don't want to badmouth this important research on "Intel ME", but I am a little bit confused from this asymmetry.

Re: Disabling Intel ME 11 via undocumented mode

#106

Post by Taniwha »

cyphar wrote: post #58
codedokode wrote: post #47

Earlier quoted context omitted.

It can be useful for other purposes too, for example for enforcing DRM so that DRM code runs on a ME engine. And of course DRM code can be backdoored too so playing a specially crafted video would run code from it.

Intel ME is not an effective DRM scheme. You need to be exceptionally careful when you mention DRM, because if it becomes commonly believed that Intel ME could be used to implement DRM all of a sudden the DMCA comes into play. Research into Intel ME vulnerabilities becomes a federal crime.

It's only a federal crime in the US ... aren't these guys in the UK?

Re: Disabling Intel ME 11 via undocumented mode

#107

Post by [deleted] »

Narishma wrote: post #86
the8472 wrote: post #70

Earlier quoted context omitted.

> comprising an x86 CPU The ME runs an Argonaut RISC Core instruction set and leverages a lot of the existing infrastructure in the system since it sits directly in the chipset and can ask the main CPU to do some things on its behalf too.

Old versions did. Newer ones, as mentioned in the article, use a 486-derived low-power core (similar to what was used in Edison/Quark platforms) for the ME.

[deleted]

Re: Disabling Intel ME 11 via undocumented mode

#108

Post by rubatuga »

yborg wrote: post #66

Impressive work on reverse engineering this. Am I correct in assuming that since this backdoor chip has access to all of the peripheral I/O that it could even be used on a device with onboard wireless in "power off" mode, which is usually some kind of low-level sleep? So a compromise of this subsystem (or intentional backdoor) would allow one to take control of even a device that is "off". Given the trend to non-remo…

Or remove the wifi chip?

Re: Disabling Intel ME 11 via undocumented mode

#109

Post by userbinator »

Nonetheless, our research team (Dmitry Sklyarov, Mark Ermolov, and Maxim Goryachy)

Dmitry Sklyarov! There's a name I haven't seen in a while... good to see he's still actively doing this stuff.

The immense complexity of the base firmware and hardware in a modern system is astonishing. XML, MINIX, and three(!) complete 486 cores in the PCH.

Given this amazing feat of engineering, and the goals of the ME, it makes me wonder what people would be willing to work on it --- "making the nooses on which to hang ourselves", as the saying goes --- and if perhaps some of those people are actually not too approving of the idea and would, given an opportunity to do it without consequences to themselves, do a Snowden and leak everything that they could...

The fact that such an "ME killswitch" exists doesn't surprise me either; in this case it seems to be an actual feature, but putting such functionalty into debug/test modes is not uncommon. It was only a matter of time before someone would find it.

Re: Disabling Intel ME 11 via undocumented mode

#110

Post by agumonkey »

justinjlynn wrote: post #101
agumonkey wrote: post #95

Earlier quoted context omitted.

I got a mail from a company doing power9 boards (something eagle ??). A bit pricey but it seems worth it if you have such needs.

Raptor CS?

Themselves. The logo is an eagle :)

https://www.raptorcs.com/content/base/products.html

Post reply on HN