Am I right to be concerned about this, if only in principle? I don't like having a mysterious embedded chip that can access the network when my computer's off.
[deleted]
Intel ME: The Way of Static Analysis
11–20 of 29 posts
Re: Intel ME: The Way of Static Analysis
#12Am I right to be concerned about this, if only in principle? I don't like having a mysterious embedded chip that can access the network when my computer's off.
Exactly. What is Intel's supposed reason for having such a feature?
Re: Intel ME: The Way of Static Analysis
#13I found some accompanying slides: https://www.troopers.de/downloads/troopers17/TR17_ME11_Stati...
That said, please note that this is partially outdated information (even to the extent of warranting a mod edit even though it's so recent) - the parts that mention how some compressed modules are unreadable are now irrelevant.
The URL for this article is /2017/04/ (April).
More recently (July, three months later), this same group has somehow (??) managed to derive the Huffman compression tables for the previously-inaccessible modules: https://github.com/ptresearch/unME11
I haven't read anything that explicitly states this (on HN; I don't read anywhere else), but I get the impression this is the holy grail, or at least one of the major pieces of the puzzle.
I found this random comment about actually using unME11: https://news.ycombinator.com/item?id=15447841
This recent HN article suggests that it's also possible to get arbitrary remote code execution, but no details are (yet) forthcoming. https://news.ycombinator.com/item?id=15298833
Re: Intel ME: The Way of Static Analysis
#14Am I right to be concerned about this, if only in principle? I don't like having a mysterious embedded chip that can access the network when my computer's off.
Exactly. What is Intel's supposed reason for having such a feature?
It's in the name, it's for management of enterprise deployments of machines that have Intel CPUs[1]. It's a fairly important thing for most enterprises (sort of like IPMI but it's not just for servers), as it allows you to do a variety of things to all computers that you manage.
Now, whether that feature should be part of every consumer CPU is a valid question and concern -- one that nobody has the answer to. Likely the reason for this is that modern versions of ME also do hardware initialisation[2], so it would make sense for Intel to not require manufacturers to rewrite all of that code for their consumer machines. There have been exploits in Intel ME in the past, which are quite concerning (and the fact it's proprietary is obviously a concern, given how many privileges it has over the system).
You can neuter Intel ME on old machines (pre-BootGuard) using me_cleaner[3], but it requires attaching a flash programmer to your motherboard. If you have coreboot you can do it from userspace.
[1]: https://en.wikipedia.org/wiki/Intel_Active_Management_Techno... [2]: https://www.coreboot.org/Intel_Management_Engine [3]: https://github.com/corna/me_cleaner
Re: Intel ME: The Way of Static Analysis
#15Doing an open source version of ME is the way forward to get proactive security. So let's replace it with our own compilation of MINIX :D
Re: Intel ME: The Way of Static Analysis
#16This post seems outdated considering these more recent HN posts:
Disabling Intel ME 11 via undocumented mode (ptsecurity.com) https://news.ycombinator.com/item?id=15116719
How to hack a turned-off computer, or running unsigned code in Intel ME (blackhat.com) https://news.ycombinator.com/item?id=15298833
Personally I am extremely curious about the upcoming blackhat presentation. If it is really true this might be very big.
Re: Intel ME: The Way of Static Analysis
#17Earlier quoted context omitted.
The JVM runs as process on the OS. Older MEs used ThreadX on an ARC CPU. Current ME is the Quark x86 core (~486 class, in-order execution) running MINIX. Probably still running their JVM for applets (the off-CPU McAfee compliance manager is probably built that way).
We put an x86 in your x86 so you can... never mind. :)
Does the quark have its own ME? :)
Re: Intel ME: The Way of Static Analysis
#18This post seems outdated considering these more recent HN posts: Disabling Intel ME 11 via undocumented mode (ptsecurity.com) https://news.ycombinator.com/item?id=15116719 How to hack a turned-off computer, or running unsigned code in Intel ME (blackhat.com) https://news.ycombinator.com/item?id=15298833 Personally I am extremely curious about the upcoming blackhat presentation. If it is really true this might be very…
Being able to run unsigned code in ME might allow (depending on how the exploit works) for either a replacement of the ME firmware entirely or just doing a disable that exceeds even the HAP bit (and the rest of magic that me_cleaner does to remove different sections of the firmware). But we'll have to wait for the slides, I'm hoping there's something really useful there for the coreboot community.
Re: Intel ME: The Way of Static Analysis
#19This post seems outdated considering these more recent HN posts: Disabling Intel ME 11 via undocumented mode (ptsecurity.com) https://news.ycombinator.com/item?id=15116719 How to hack a turned-off computer, or running unsigned code in Intel ME (blackhat.com) https://news.ycombinator.com/item?id=15298833 Personally I am extremely curious about the upcoming blackhat presentation. If it is really true this might be very…
Well, it is technically a little outdated. The article OP posted is from April of this year, and the one you linked to was posted in August.
Re: Intel ME: The Way of Static Analysis
#20This post seems outdated considering these more recent HN posts: Disabling Intel ME 11 via undocumented mode (ptsecurity.com) https://news.ycombinator.com/item?id=15116719 How to hack a turned-off computer, or running unsigned code in Intel ME (blackhat.com) https://news.ycombinator.com/item?id=15298833 Personally I am extremely curious about the upcoming blackhat presentation. If it is really true this might be very…
In addition to those two discussions (Aug 2017, 218 comments) & (Sep 2017, 239 comments), the following came up this week:
Disabling the Intel Management Engine | https://news.ycombinator.com/item?id=15444607 (Oct 2017, 219 comments)
If nothing else, the BlackHat talk has stirred up interest in the Intel ME which had remained in relative obscurity for quite some time.