Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Intel ME Manufacturing Mode: obscured dangers and MacBook vulnerability

blog.ptsecurity.com

Post reply on HN
Print view View original

51–60 of 85 posts

Re: Intel ME Manufacturing Mode: obscured dangers and MacBook vulnerability

#51

Post by dragonwriter »

turblety wrote: post #49
Leace wrote: post #45

Earlier quoted context omitted.

> If Intel would just allow an owner to build and flash their own Intel ME version using their own private/public keys then no one would have an issue with that. Note that unless you manufacture the CPU yourself you still cannot be sure if there are no hidden backdoors. For example the ME could pretend it's really running your firmware but at the same time running some hidden code only delegating some operations to y…

I understand and agree with you to a certain extent, but we're not just talking about a couple of assembly commands that could be misused. The Intel ME is a FULL Operating System running MINIX Linux (edit: MINIX is not Linux, as corrected by @dragonwriter). It has it's own network and apps, that run inside a running kernel, of which you have no access to. Even if the intentions are 100% legit, this is an operating sy…

> The Intel ME is a FULL Operating System running MINIX Linux.

MINIX is a completely different OS than Linux, not a flavor of Linux.

“MINIX Linux” makes as much sense as “MacOS Linux”.

Intel ME just runs MINIX.

Re: Intel ME Manufacturing Mode: obscured dangers and MacBook vulnerability

#52

Post by turblety »

turblety wrote: post #49
Leace wrote: post #45

Earlier quoted context omitted.

> If Intel would just allow an owner to build and flash their own Intel ME version using their own private/public keys then no one would have an issue with that. Note that unless you manufacture the CPU yourself you still cannot be sure if there are no hidden backdoors. For example the ME could pretend it's really running your firmware but at the same time running some hidden code only delegating some operations to y…

I understand and agree with you to a certain extent, but we're not just talking about a couple of assembly commands that could be misused. The Intel ME is a FULL Operating System running MINIX Linux (edit: MINIX is not Linux, as corrected by @dragonwriter). It has it's own network and apps, that run inside a running kernel, of which you have no access to. Even if the intentions are 100% legit, this is an operating sy…

@dragonwriter Would UNIX make more sense?

Re: Intel ME Manufacturing Mode: obscured dangers and MacBook vulnerability

#53

Post by mrweasel »

turblety wrote: post #5
bcaa7f3a8bbc wrote: post #3

Does ME Manufacturing mode allow the user to change all the configuration? Does it mean that hackers who incidentally purchased such a machine (but probably not Apple's) with ME Manufacturing mode enabled, can theoretically port coreboot to the machine, then flash their own public key fingerprints into ME, using Boot Guard to protect firmware signed by themselves instead of OEM's? I remember several bunches of Lenovo…

Exactly. Remember Intel ME is a great utility and has some awesome abilities. The issue that people have is not the fact there is a CPU running another CPU that looks after the main one. It's that it's closed source and has remote control capabilities that can not be controlled by the user. If Intel would just allow an owner to build and flash their own Intel ME version using their own private/public keys then no one…

Is the Intel ME that great? I mean I never heard anyone say that they actually use it. The explanation of its capabilities make it seem like a great tool for fleet management, yet nobody seems to be using it.

With other alternatives available, combined with low usage, I’m not sure that neither Intels ME nor AMDs PSP needs to be embedded in every CPU.

Re: Intel ME Manufacturing Mode: obscured dangers and MacBook vulnerability

#54

Post by M_Bakhtiari »

tlb wrote: post #18
debt wrote: post #6

"The weakness of "security through obscurity" is so well known as to be obvious. Yet major hardware manufacturers, citing the need to protect intellectual property, often require a non-disclosure agreement (NDA) before allowing access to technical documentation. " I believe the actual reason for "security through obscurity" is that it's a delay tactic used against well-funded adversaries. There's an inherent problem…

It's also possible to build systems that are correct, such that no adversary with any amount of resources could find a security hole. Many CPUs in the past have been correct. Probably most major commercial ones before 2000 were. So it's not mathematically impossible.

>Probably most major commercial ones before 2000 were.

I find that hard to believe. For instance, what makes you think they got speculative execution more correct before 2000 than after? At least it seems impossible to get rid of the timing side-channel since the whole point of the exercise is to change the amount of time it takes to run the program.

Surely you'd have to go back to at least 1980. I suppose one could start a production line of 1970s supercomputers for personal use, and put it on the programmers to figure out how to parallelise everything, but it would be very painful and expensive.

Re: Intel ME Manufacturing Mode: obscured dangers and MacBook vulnerability

#55

Post by turblety »

mrweasel wrote: post #53
turblety wrote: post #5

Earlier quoted context omitted.

Exactly. Remember Intel ME is a great utility and has some awesome abilities. The issue that people have is not the fact there is a CPU running another CPU that looks after the main one. It's that it's closed source and has remote control capabilities that can not be controlled by the user. If Intel would just allow an owner to build and flash their own Intel ME version using their own private/public keys then no one…

Is the Intel ME that great? I mean I never heard anyone say that they actually use it. The explanation of its capabilities make it seem like a great tool for fleet management, yet nobody seems to be using it. With other alternatives available, combined with low usage, I’m not sure that neither Intels ME nor AMDs PSP needs to be embedded in every CPU.

I think the specific part you're referring to is Intel AMT (Active Management Technology) which allows the user to remote control into their computer. AMT is a module that runs within the Intel ME operating system.

Intel ME does a lot of things, like the below (we think, no one really knows for sure):

    - Active Management Technology (AMT)
    - Alert Standard Format (ASF)
    - Intel Boot Guard (IBG)
    - Secure Boot
    - Integrated Clock Controller (ICC)
    - Quiet System Technology (QST) / Advanced Fan Speed Control (AFSC)
    - Protected Audio Video Path (used in PlayReady DRM)
    - Intel Security Assist (ISA)
    - Serial over LAN (SOL)
    - Firmware-based Trusted Platform Module (TPM)
Source: https://en.wikipedia.org/wiki/Intel_Management_Engine

I think there is also some power management functionality in there too.

Re: Intel ME Manufacturing Mode: obscured dangers and MacBook vulnerability

#56

Post by [deleted] »

mrweasel wrote: post #53
turblety wrote: post #5

Earlier quoted context omitted.

Exactly. Remember Intel ME is a great utility and has some awesome abilities. The issue that people have is not the fact there is a CPU running another CPU that looks after the main one. It's that it's closed source and has remote control capabilities that can not be controlled by the user. If Intel would just allow an owner to build and flash their own Intel ME version using their own private/public keys then no one…

Is the Intel ME that great? I mean I never heard anyone say that they actually use it. The explanation of its capabilities make it seem like a great tool for fleet management, yet nobody seems to be using it. With other alternatives available, combined with low usage, I’m not sure that neither Intels ME nor AMDs PSP needs to be embedded in every CPU.

[deleted]

Re: Intel ME Manufacturing Mode: obscured dangers and MacBook vulnerability

#57

Post by exikyut »

walterbell wrote: post #26

A couple of small vendors are trying to offer choices with open firmware. They don't yet have the scale for low cost pricing. 1) Purism has been discussed on HN, trying to extend their laptop coreboot success to a phone form factor, http://puri.sm 2) Librebox is a desktop computer with coreboot, from Portugal, https://libretrend.com and https://youtube.com/watch?&v=mHyJCSqWhFw For data centers, OpenCompute server own…

OpenCompute look interesting on the surface, but it seems like the "server owners" listed at https://www.opencompute.org/sp/open-compute-project-solution... consists of mostly larger corporations.

Appears to mostly be an enterprise offering; I'm not quite sure if any of these companies would sell me a server for personal use. And even then I don't think I'd be able to request control over the various keys they're in control of (ie request the work be done to get me keypairs of my own, which I do think is theoretically possible).

Hmph.

Re: Intel ME Manufacturing Mode: obscured dangers and MacBook vulnerability

#58

Post by walterbell »

exikyut wrote: post #57
walterbell wrote: post #26

A couple of small vendors are trying to offer choices with open firmware. They don't yet have the scale for low cost pricing. 1) Purism has been discussed on HN, trying to extend their laptop coreboot success to a phone form factor, http://puri.sm 2) Librebox is a desktop computer with coreboot, from Portugal, https://libretrend.com and https://youtube.com/watch?&v=mHyJCSqWhFw For data centers, OpenCompute server own…

OpenCompute look interesting on the surface, but it seems like the "server owners" listed at https://www.opencompute.org/sp/open-compute-project-solution... consists of mostly larger corporations. Appears to mostly be an enterprise offering; I'm not quite sure if any of these companies would sell me a server for personal use. And even then I don't think I'd be able to request control over the various keys they're in…

Used ones show up on eBay. Don't know about their firmware key management status.

https://www.reddit.com/r/homelab/comments/4f7w82/4node_open_...

Re: Intel ME Manufacturing Mode: obscured dangers and MacBook vulnerability

#59

Post by userbinator »

oneplane wrote: post #12
bcaa7f3a8bbc wrote: post #3

Does ME Manufacturing mode allow the user to change all the configuration? Does it mean that hackers who incidentally purchased such a machine (but probably not Apple's) with ME Manufacturing mode enabled, can theoretically port coreboot to the machine, then flash their own public key fingerprints into ME, using Boot Guard to protect firmware signed by themselves instead of OEM's? I remember several bunches of Lenovo…

You can only flash coreboot if the BootGuard isn't blown. Nothing else will allow you to run coreboot on a mobile Intel platform because the CPU has a hard-fused hash of the public key for the IBB (boot code in the CPU ROM/factory microcode) and via that, the ACM. (Authenticated Code Module, loaded via ME) This means that you cannot run an Intel CPU without getting an ACM signed by Intel. And that ACM only works with…

...only until someone finds a bypass for BootGuard, which might actually exist. I'm not too optimistic, but I hope so --- and seeing the reactions of different groups when/if it happens will be interesting to say the least.

Re: Intel ME Manufacturing Mode: obscured dangers and MacBook vulnerability

#60

Post by Ded7xSEoPKYNsDd »

turblety wrote: post #52
turblety wrote: post #49

Earlier quoted context omitted.

I understand and agree with you to a certain extent, but we're not just talking about a couple of assembly commands that could be misused. The Intel ME is a FULL Operating System running MINIX Linux (edit: MINIX is not Linux, as corrected by @dragonwriter). It has it's own network and apps, that run inside a running kernel, of which you have no access to. Even if the intentions are 100% legit, this is an operating sy…

@dragonwriter Would UNIX make more sense?

Wikipedia says that MINIX is POSIX-certified, so it's pretty close (Unix-like). It doesn't seem anyone has shelled out the money for SUS certification, so it can't officially use the UNIX trademark.
Post reply on HN