Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

An in-depth security review of the Intel Management Engine

security-center.intel.com

Post reply on HN
Print view View original

81–90 of 192 posts

Re: An in-depth security review of the Intel Management Engine

#81

Post by revelation »

It's bad enough Intel have created the ultimate trojan, but their detection tool can't even fix the problem!

The tool rightly points out that my desktop consumer system is vulnerable (from the list, no Intel CPU manufactured in the last 5 years isn't), then suggests I contact the manufacturer for an update. Here is what the tool says my system manufacturer is:

    Manufacturer: To Be Filled By O.E.M.
    Model: To Be Filled By O.E.M.
I will get right on that and bug "To Be Filled By O.E.M." for an update! It's an ASRock motherboard, by the way. But with this approach they are not going to patch even 5% of personal computers out there..

Re: An in-depth security review of the Intel Management Engine

#82

Post by mysterypie »

jlgaddis wrote: post #69
beefhash wrote: post #2

Good times when kernel privilege escalation was the worst you had to fear. I'm not familiar enough with the Intel ME to tell, but could this possibly be exploited with the arbitrary code execution in the ME being used to set the HAP bit without requiring hardware intervention?

That'd be pretty sweet, wouldn't it? Maybe I'll hold off on patching for a bit.

> Maybe I'll hold off on patching for a bit.

I think you're suggesting extremely interesting but I'm not totally clear on it. So someone[1] has come up with some code to either disable (kill switch) or remove the Intel ME. (Setting the HAP bit is the kill switch.)

Now Intel and its vendors are going to issue a patch for the Intel ME. Are you saying that as a result of applying this patch we might not be able disable or remove the Intel ME? In other words, we'll end up with a slightly more secure Intel ME, but be worse off since we can't exploit any bugs to get rid of it?

If I'm understanding you correctly, this sounds like the iPhone situation: upgrade to a newer iOS and lose the ability to jailbreak.

[1] https://github.com/corna/me_cleaner/wiki/HAP-AltMeDisable-bi...

Re: An in-depth security review of the Intel Management Engine

#84

Post by subway »

rwmj wrote: post #74
blacksmith_tb wrote: post #61

Earlier quoted context omitted.

I agree with your overall conclusions, but I am having a hard time imagining the 'normal users' who would use remote administration... though perhaps if that were normal-for-HN users...

I guess I'm "Normal-for-HN". IPMI is so useful that I wouldn't buy a server without it, even one I'm going to use in the same building.

IPMI is fantastic, so long that the understanding is in place that access to your IPMI vlan may as well be considered root access to the node. BMCs tend to be pretty miserable when it comes to security. It's generally a good idea to have ACLs in place to ensure BMCs can only communicate with a secured management node, and importantly that BMCs cannot communicate with each other.

Re: An in-depth security review of the Intel Management Engine

#85

Post by benevol »

aeleos wrote: post #8

Wow all 6th, 7th and 8th gen are all vulnerable along with a bunch of Xeon processors. Even the laptop I am typing this on is vulnerable, this is going to be messy. Plus all the fun vulnerabilities like arbitrary code execution, unauthorized access to privileged content. These must be related to the blackhat talk coming up in December about hacking a turned-off computer and running unsigned code on ME [0]. Yep and th…

> these are the kind of vulnerabilities that the NSA would salivate over.

Are you really suggesting the IME and AMD's similar component are not the fruit of a collaboration between these market dominating companies and the NSA?

Re: An in-depth security review of the Intel Management Engine

#86

Post by khedoros1 »

disconnected wrote: post #48
thg wrote: post #17

Earlier quoted context omitted.

Well, maybe AMD does at least some security reviewing on their own? /s ARM could be a affordable alternative to x86 if that works for you.

> ARM could be a affordable alternative to x86 if that works for you. Even the open source friendly Raspberry Pi relies on proprietary blobs and proprietary firmware, with vast parts of the documentation only being available to system integrators (meaning: not you) under an NDA. Theirs is a Broadcom chip, but my understanding is that the scenario is pretty much the same for other ARM vendors. If the chip is anything…

The stuff running on the ARM itself is all open, but the firmware blob runs on a separate CPU with a different instruction set, which has a view of the entire memory map of the device and ultimate control over the device's behavior (sound familiar?).

I may be wrong, but my impression is that a lot of the other ARM boards out there have the ARM chip as the main CPU, and without a management chip watching it. In any case, a board like that, or a Pi with a reverse-engineered firmware blob (currently in development) would be better than the Raspberry Pi as it is now.

Re: An in-depth security review of the Intel Management Engine

#87

Post by mysterypie »

When I run the detection tool, I get:

Based on the analysis performed by this tool: Detection Error: This system may be vulnerable, please install the Intel(R) MEI/TXEI driver (available from your system manufacturer).

Does that mean that the Intel ME is disabled, so I don't have to worry about it? I certainly don't want to install anything that might enable the Intel ME if it's already disabled!

What a quandary. This reminds me of all the information I was asked to give to get a detailed credit report. If I didn't give it, they weren't going to give me the report. If I gave it, they would add to my credit file even if they never had it before.

Re: An in-depth security review of the Intel Management Engine

#88

Post by jlgaddis »

mysterypie wrote: post #82
jlgaddis wrote: post #69

Earlier quoted context omitted.

That'd be pretty sweet, wouldn't it? Maybe I'll hold off on patching for a bit.

> Maybe I'll hold off on patching for a bit. I think you're suggesting extremely interesting but I'm not totally clear on it. So someone[1] has come up with some code to either disable (kill switch) or remove the Intel ME. (Setting the HAP bit is the kill switch.) Now Intel and its vendors are going to issue a patch for the Intel ME. Are you saying that as a result of applying this patch we might not be able disable…

Basically, yeah.

Hold off on patching this vulnerability so that it can be exploited later in order to disable ME entirely. Their firmware updates could very well close off these existing "known holes", making them impossible to exploit.

If we can take advantage of them to kill the ME entirely, that's even better than Intel releasing this fix.

Re: An in-depth security review of the Intel Management Engine

#89

Post by jlgaddis »

morpheuskafka wrote: post #78
jlgaddis wrote: post #62

Earlier quoted context omitted.

Go for the "bootable CD" option, if it's available. You don't need Windows for that. My ThinkPads all run Linux and I have no problems updating them.

I think that's only for BIOS updates, not ME. ME uses an Intel provided flash EXE. It would probably run on PE or definitely Windows to Go though.

Ahhh, my bad, sorry!
Post reply on HN