Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Intel patches new ME vulnerabilities

blog.ptsecurity.com

Post reply on HN
Print view View original

31–40 of 337 posts

Re: Intel patches new ME vulnerabilities

#31

Post by opencl »

PostOnce wrote: post #16
NullPrefix wrote: post #10

Earlier quoted context omitted.

Grandpa, it's time to upgrade.

with an entry-level GPU and slow RAM that works with an i5-2500k, i can play every modern game i have tried on high. Nothing about me opening a text editor, interpreting most code, or compiling the occasional thing require anywhere near that much power. For the overwhelming majority, and i really mean overwhelming, there's really no progress or point to upgrading anything except the gpu in the past 7 years or so in l…

I upgraded my 2500k last year (to a Ryzen system) and the extra cores are very nice sometimes but honestly the biggest improvement was the fact that I also went from 8GB RAM to 16GB. There were a couple of games that benefited substantially from faster memory (Rise of the Tomb Raider, Fallout 4) but generally not so much the actual CPU performance.

Re: Intel patches new ME vulnerabilities

#32

Post by kawsper »

ipsin wrote: post #20

Has Intel offered an official "disable ME" patch? I'd like to close the door once and not worry about it again.

There are no official ways of disabling the ME.

The Coreboot project and the Hardenedlinux project have worked on it, and here are some resources on their progress:

https://hardenedlinux.github.io/firmware/2016/11/17/neutrali...

https://www.coreboot.org/Intel_Management_Engine

And here is a general writeup on the Intel chips and their "features": https://libreboot.org/faq.html#intel

If Intel aren't going to patch old systems, here to hoping that they will let us disable it, but it probably won't happen.

Re: Intel patches new ME vulnerabilities

#33

Post by nh2 »

chris_wot wrote: post #23

Aside from applying updates, how else can these vulnerabilities be mitigated? Genuinely curious...

As far as I understand:

* In general you cannot.

* You can try to remove ME with non-official tools like https://github.com/corna/me_cleaner

* Some vendors ship specific laptops with ME disabled (https://fossbytes.com/laptops-intel-me-chip-disabled/)

* For servers or desktops, you can plug in a separate PCI network adapter instead of using the one on the mainboard (please correct me if this is wrong or confirm it as I'm unsure about it). That would at least disconnect the ME from the network by default. But anybody could still walk up to your machine, plug a cable into the mainboard ethernet port and own you at the deepest level.

Re: Intel patches new ME vulnerabilities

#34

Post by close04 »

ganzuul wrote: post #21
rhencke wrote: post #18

Earlier quoted context omitted.

Your CPU actually runs its own entire, separate operating system - MINIX. https://www.cs.vu.nl/~ast/intel/

This is known, but that link has no information relevant to the HTTP protocol. Do you know more about that?

Well, the ME can be accessed via a web GUI (16992/16993 ports). That's the web server.

https://software.intel.com/en-us/node/632310

I have multiple machines with AMT and I'm actively using it every day. Some get patches, some won't because they're gen 3 CPUs or lower. Luckily I can be reasonably confident that the local network is secure so the bug isn't exploitable. This time.

I'm sure hoping AMD does better with their support of the PSP.

Re: Intel patches new ME vulnerabilities

#35

Post by acdha »

baybal2 wrote: post #5

I wonder, who ever uses these "management engines," let alone put them open on WANs? When first news of IME being compromised, I was surprised that Shodan showed such a small number of machines.

Most organizations big enough to have an IT department which isn’t in the same room like them because you can do things like restart them remotely to ensure software upgrades or installs happen on schedule.

Unfortunately many of those places historically didn’t have things like separate management LANs, good filtering, etc. because everything was setup around convenience and the desktop support people probably weren’t security experts.

Re: Intel patches new ME vulnerabilities

#36

Post by orblivion »

So how did they go about making these fixes? Is this another thing where I have to download something from my OEM?

The biggest problem I have by far with any of this is that it's not trivial to update all firmware involved. Everything else is forgivable, people make mistakes.

Re: Intel patches new ME vulnerabilities

#38

Post by kawsper »

flingo wrote: post #26

Is ME enabled by default? I ask because I've never seen its webserver on my home network. Heck, I don't even get how it could connect to the internet on a powered off device without Ethernet.

> Is ME enabled by default?

Yes, and it can't be disabled on all newer systems. The Active Management Technology (AMT) application, part of the Intel “vPro” brand, is a Web server and application code that enables remote users to power on, power off, view information about, and otherwise manage the PC. It can be used remotely even while the PC is powered off (via Wake-on-Lan).

The ME is present on all Intel desktop, mobile (laptop), and server systems since mid 2006.

Before version 6.0 (that is, on systems from 2008/2009 and earlier), the ME can be disabled by setting a couple of values in the SPI flash memory. The ME firmware can then be removed entirely from the flash memory space. libreboot does this on the Intel 4 Series systems that it supports, such as the Libreboot X200 and Libreboot T400. ME firmware versions 6.0 and later, which are found on all systems with an Intel Core i3/i5/i7 CPU and a PCH, include “ME Ignition” firmware that performs some hardware initialization and power management. If the ME’s boot ROM does not find in the SPI flash memory an ME firmware manifest with a valid Intel signature, the whole PC will shut down after 30 minutes.

(snipped from https://libreboot.org/faq.html#intel)

Re: Intel patches new ME vulnerabilities

#40

Post by close04 »

avuton wrote: post #15
nh2 wrote: post #2

Intel advisory: https://www.intel.com/content/www/us/en/security-center/advi... CVE-2018-3628 - "Buffer overflow in HTTP handler" Affected processor list (simplified reordered by me to reflect relevance and improve readability): • Core i3/i5/i7, generation 1-8 (that is, all of them) • Xeon E3-1200 v5/v6 • Xeon Scalable • Xeon W • Core 2 Duo vPro, Centrino 2 vPro

I'm oddly lucky that I based my fanless server off an old Atom platform.

"Luckily" most old Atoms will never get mitigations for Meltdown/Spectre :).

So if you're using an Intel CPU today you'll just have to pick your poison.

Post reply on HN