Intel patches new ME vulnerabilities • Hacker News Board

Re: Intel patches new ME vulnerabilities

#61

Post by ajross » Sun, Jul 22, 2018, 2:29 PM UTC

exikyut wrote: post #41

nh2 wrote: post #2

Intel advisory: https://www.intel.com/content/www/us/en/security-center/advi... CVE-2018-3628 - "Buffer overflow in HTTP handler" Affected processor list (simplified reordered by me to reflect relevance and improve readability): • Core i3/i5/i7, generation 1-8 (that is, all of them) • Xeon E3-1200 v5/v6 • Xeon Scalable • Xeon W • Core 2 Duo vPro, Centrino 2 vPro

Wow. The Web really has won. We have HTTP parsing failures in our CPUs .

No, this is a firmware bug. It just happens to be firmware that runs on the ME and not the main cores. The code is stored externally to the CPU along with the BIOS, and looks like it's being patched via a BIOS update.

Re: Intel patches new ME vulnerabilities

#62

Post by hlandau » Sun, Jul 22, 2018, 2:30 PM UTC

nh2 wrote: post #33

chris_wot wrote: post #23

Aside from applying updates, how else can these vulnerabilities be mitigated? Genuinely curious...

As far as I understand: * In general you cannot. * You can try to remove ME with non-official tools like https://github.com/corna/me_cleaner * Some vendors ship specific laptops with ME disabled ( https://fossbytes.com/laptops-intel-me-chip-disabled/ ) * For servers or desktops, you can plug in a separate PCI network adapter instead of using the one on the mainboard (please correct me if this is wrong or confirm it a…

me_cleaner does not disable the ME. It is a partial disablement of ME functionality, but some functionality remains enabled. The ME firmware is an Intel-signed proprietary binary blob part of which is instrumental in the system boot process, so complete removal is impossible.

me_cleaner and/or the HAP bit, or the services offered by laptop vendors which is basically doing the very same for you, may certainly reduce the degree of attack surface and the extent to which the ME poses a threat, but it is not a complete disablement or removal, and you are still reliant on a non-modifiable binary blob to bring up your system; referring to it as removal is misleading.

Since the firmware is proprietary, it's hard to make any guarantees to what extent a reduced-size ME (via me_cleaner and/or the HAP bit) reduces attack surface in practical terms. My understanding is that even with the HAP bit and me_cleaner applied, the ME continues running at least some functionality after system boot is completed.

Re: Intel patches new ME vulnerabilities

#63

Post by nine_k » Sun, Jul 22, 2018, 2:30 PM UTC

deathhand wrote: post #4

Do we really need remote code execution on the bios level? Is this a case of 'we can, but should we?'

Think about managing tens of thousands of server in a datacenter. An ability to do everything you can do form a local console (and preferably more), without physical access or a KV switch, is very important.

Remotely managing a corporate desktop or laptop, e.g. fixing an OS-level problem remotely, may also be important.

OTOH I'd prefer this functionality clearly delineated, usinf strong encryption, and with an explicit reliable "off" switch (preferably physical).

Re: Intel patches new ME vulnerabilities

#64

Post by nine_k » Sun, Jul 22, 2018, 2:35 PM UTC

close04 wrote: post #53

acdha wrote: post #35

Earlier quoted context omitted.

Most organizations big enough to have an IT department which isn’t in the same room like them because you can do things like restart them remotely to ensure software upgrades or installs happen on schedule. Unfortunately many of those places historically didn’t have things like separate management LANs, good filtering, etc. because everything was setup around convenience and the desktop support people probably weren’…

I use this simply because I need to have power on/off and remoting capabilities on machines running environments where I cannot configure such capabilities (meaning I have 0 recourse, no RDP, no TeamViewer, no VNC,, etc.). The reason they don't show up on Shodan is that the search engine doesn't scan private networks and you have to explicitly configure it to be internet accessible. You have to configure AMT/ME in BI…

Does this mean that if you configure ME in your BIOS in a certain way, it is not exposed to the network?

It sounds almost too good to be true: the attack surface is removed by a BIOS switch?

Re: Intel patches new ME vulnerabilities

#65

Post by monochromatic » Sun, Jul 22, 2018, 2:36 PM UTC

Filligree wrote: post #50

avuton wrote: post #15

Earlier quoted context omitted.

I'm oddly lucky that I based my fanless server off an old Atom platform.

AMD seems considerably more on top of the security game. As for ME, make sure you avoid any system on which it is enabled.

https://en.wikipedia.org/wiki/AMD_Platform_Security_Processo...

Re: Intel patches new ME vulnerabilities

#66

Post by chasil » Sun, Jul 22, 2018, 2:38 PM UTC

kawsper wrote: post #32

ipsin wrote: post #20

Has Intel offered an official "disable ME" patch? I'd like to close the door once and not worry about it again.

There are no official ways of disabling the ME. The Coreboot project and the Hardenedlinux project have worked on it, and here are some resources on their progress: https://hardenedlinux.github.io/firmware/2016/11/17/neutrali... https://www.coreboot.org/Intel_Management_Engine And here is a general writeup on the Intel chips and their "features": https://libreboot.org/faq.html#intel If Intel aren't going to patch old…

There is a Python script that can take a BIOS image (either from a vendor or scanned from a running system) and remove all ME components that are not absolutely required to operate the CPU. I have never tried it.

https://github.com/corna/me_cleaner

Re: Intel patches new ME vulnerabilities

#67

Post by nine_k » Sun, Jul 22, 2018, 2:43 PM UTC

I wonder what other (somehow) laptop-worthy CPUs offer a better management engine story?

* AMD processors do have an equivalent management engine (PSP), but I didn't hear anything about remote exploits for it.

* Beefier ARM CPUs also have something like a management engine ("trustzone" only accessible to the manufacturer). I have no idea if it has any remote-access capabilities on any common hardware. On RPi the trustzone is absent.

* Power9 does have a management engine, but it's open and you can upload your own management code. The CPU is not an option for a laptop, and hardly even for a desktop, though.

(Edited: spelling.)

Re: Intel patches new ME vulnerabilities

#68

Post by close04 » Sun, Jul 22, 2018, 2:44 PM UTC

avuton wrote: post #46

close04 wrote: post #40

Earlier quoted context omitted.

"Luckily" most old Atoms will never get mitigations for Meltdown/Spectre :). So if you're using an Intel CPU today you'll just have to pick your poison.

I was under the impression that they weren't susceptible.

There's a non-exhaustive list here: https://www.intel.com/content/www/us/en/security-center/advi...

Intel® Atom™ Processor C Series

Intel® Atom™ Processor E Series

Intel® Atom™ Processor A Series

Intel® Atom™ Processor x3 Series

Intel® Atom™ Processor Z Series

This being said, this is the current status for my old Atom N270 (2008): https://imgur.com/a/pbeJ306

Unless the tool is wrong, but I think it was generally marketed as a reliable source. In which case maybe someone can recommend a reliable one to test the vulnerability.

Re: Intel patches new ME vulnerabilities

#69

Post by inawarminister » Sun, Jul 22, 2018, 2:45 PM UTC

jerheinze wrote: post #60

thepumpkin1979 wrote: post #47

Can MacBook owners do something to disable or cripple Intel ME? Is Apple disabling it for us? I can’t find Apple responses to these issues.

You can't disable ME.

I thought you can in C2D (Nehalem?) era ThinkPads? https://libreboot.org/

and you can minimize ME in Sandy and Ivy Bridge, using ME_Cleaner?

edit: according to sounds' comment* in HN (2016), The ME is purportedly placed in "recovery" mode

[*] https://news.ycombinator.com/item?id=13056997

Re: Intel patches new ME vulnerabilities

#70

Post by rrdharan » Sun, Jul 22, 2018, 2:46 PM UTC

some_account wrote: post #48

nh2 wrote: post #2

Intel advisory: https://www.intel.com/content/www/us/en/security-center/advi... CVE-2018-3628 - "Buffer overflow in HTTP handler" Affected processor list (simplified reordered by me to reflect relevance and improve readability): • Core i3/i5/i7, generation 1-8 (that is, all of them) • Xeon E3-1200 v5/v6 • Xeon Scalable • Xeon W • Core 2 Duo vPro, Centrino 2 vPro

I guess I should not be surprised that the HN community doesn't really seem to care. Intel put the Management Engine into every CPU with no choice from consumers to opt out. That alone is fairly surprising, since they knew it was a big chance it would have exploits and consumers would have no defense. But nobody reacts. Nobody cares.

I'm curious what would you consider to count as an acceptable "reaction" from the HN community?

At any rate I'm unlikely to provide one. Personally I probably won't care until a Snowden-like disclosure that demonstrates exploitation of the ME in a scenario that directly affects me. i.e. I wouldn't be surprised that nation states are exploiting this in targeted fashion, but nation states already have all kinds of ways to get my data in ways that I'm unlikely to be available to defend myself against if I'm targeted.

I'd be more interested in hearing about how ME vulnerabilities are being used in US State-level dragnet surveillance or perhaps to subtly manipulate the population by changing their Google/Twitter/Facebook results or something of that nature. If you find any evidence of that, let me know.