Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Intel patches new ME vulnerabilities

blog.ptsecurity.com

Post reply on HN
Print view View original

51–60 of 337 posts

Re: Intel patches new ME vulnerabilities

#53

Post by close04 »

acdha wrote: post #35
baybal2 wrote: post #5

I wonder, who ever uses these "management engines," let alone put them open on WANs? When first news of IME being compromised, I was surprised that Shodan showed such a small number of machines.

Most organizations big enough to have an IT department which isn’t in the same room like them because you can do things like restart them remotely to ensure software upgrades or installs happen on schedule. Unfortunately many of those places historically didn’t have things like separate management LANs, good filtering, etc. because everything was setup around convenience and the desktop support people probably weren’…

I use this simply because I need to have power on/off and remoting capabilities on machines running environments where I cannot configure such capabilities (meaning I have 0 recourse, no RDP, no TeamViewer, no VNC,, etc.).

The reason they don't show up on Shodan is that the search engine doesn't scan private networks and you have to explicitly configure it to be internet accessible. You have to configure AMT/ME in BIOS, you have to allow the connection through your router. Very few people will actually do that.

Re: Intel patches new ME vulnerabilities

#54

Post by nine_k »

dsabanin wrote: post #19

Finally it happened. Here's to hoping that after being exposed to this kind of risk, enterprises and regular customers start being more inquisitive about what code gets embedded into their hardware and why.

I heard Google spends a lot of money and effort to (slowly) move to Power9. It does have a management processor but it's open for inspection and modification.

Maybe other cloud providers, and/or private clouds, would consider that.

Re: Intel patches new ME vulnerabilities

#57

Post by zzzcpan »

avuton wrote: post #46
close04 wrote: post #40

Earlier quoted context omitted.

"Luckily" most old Atoms will never get mitigations for Meltdown/Spectre :). So if you're using an Intel CPU today you'll just have to pick your poison.

I was under the impression that they weren't susceptible.

So, old Atoms are the only ones still usable intel systems and not vulnerable to Meltdown/Spectre/ME.

Re: Intel patches new ME vulnerabilities

#58

Post by iknowverylittle »

>CVE-2018-3628, Intel says that exploitation is possible only from the same subnet

So if I understand correctly, at the moment, these CPUs are vulnerable on a local network but not currently over the internet?

Fortunately then various groups have already been working to remove and nullify as much of ME as possible.

Re: Intel patches new ME vulnerabilities

#59

Post by lurker456 »

close04 wrote: post #34
ganzuul wrote: post #21

Earlier quoted context omitted.

This is known, but that link has no information relevant to the HTTP protocol. Do you know more about that?

Well, the ME can be accessed via a web GUI (16992/16993 ports). That's the web server. https://software.intel.com/en-us/node/632310 I have multiple machines with AMT and I'm actively using it every day. Some get patches, some won't because they're gen 3 CPUs or lower. Luckily I can be reasonably confident that the local network is secure so the bug isn't exploitable. This time. I'm sure hoping AMD does better with th…

That's to access AMT. AMT is a module running on top of ME and is disabled by default.
Post reply on HN