Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Intel patches new ME vulnerabilities

blog.ptsecurity.com

Post reply on HN
Print view View original

141–150 of 337 posts

Re: Intel patches new ME vulnerabilities

#141

Post by throwaway2048 »

turblety wrote: post #82
dsabanin wrote: post #19

Finally it happened. Here's to hoping that after being exposed to this kind of risk, enterprises and regular customers start being more inquisitive about what code gets embedded into their hardware and why.

Finally? That ME thing should be nowhere near private and confidential data. There's constantly bugs being found in it [1][2]. Honestly if you are a large company, organisation, government, etc and you are using Intel or AMD products, then you are being very irresponsible. There is no excuse, enough information is out there that even a non-technical CTO should know better. 1. https://www.wired.com/story/intel-managem…

There is quite literally no viable alternative to x86 for 95% (more like 99.9%, but I am being generous) of the server and workstation market. Pretending like there is and anyone choosing x86 is irresponsible is just being a smug fool.

Re: Intel patches new ME vulnerabilities

#142

Post by mrsteveman1 »

std_throwaway wrote: post #117
iknowverylittle wrote: post #112

Earlier quoted context omitted.

So, what's AMD doing these days? I'm hesitant to switch to AMD since Intel internal graphics play nicely with Linux. However that kind of doesn't matter if my machine isn't mine.

AMD has the PSP which basically is the same thing. But we don't know for sure what either one does.

One thing the PSP doesn't have is AMT style remote management.

AMD has their own kind of management system available on some machines (DASH, using "smart" NICs like Broadcom), but the PSP isn't even involved when DASH is available and in use, as far as I know.

However, on my Intel machine with AMT, there's a network port opened by the ME itself (TCP/16992). It can use the same IP as the main OS, or a different IP entirely if desired. It uses the same ethernet port as the main OS though, splitting the packets that are directed to one of the ME ports and selectively allowing the rest to continue to the main OS (there's a low-level ME firewall[1]).

On that port, there is a full remote desktop with mouse and keyboard, the ability to remotely connect small drives and/or ISO files, a remote serial console, a low level firewall configuration utility, and power/reboot controls. Even on machines where AMT is not even supposed to be available, there have been PoC demonstrated using one of the ME flaws to turn it back on[2].

[1] https://i.imgur.com/Wphopk1.jpg

(slide 68) [2] https://www.blackhat.com/docs/eu-17/materials/eu-17-Goryachy...

Re: Intel patches new ME vulnerabilities

#143

Post by close04 »

Kliment wrote: post #134
close04 wrote: post #130

Earlier quoted context omitted.

Usually a separate patch, an ME firmware patch. The ME is physically located in the chipset but I'm not entirely sure where the FW resides, whether the chipset or a flash on the motherboard (sharing with the system UEFI/BIOS).

The ME firmware lives on an SPI FLASH chip, on the motherboard. It can either be the same chip where the BIOS is stored or a separate one (which is often the case because two smaller chips cost less than one big one)

Actually you're right. Since most of the analysis on the ME FW was done after dumping the flash from the physically removed clip on the motherboard. That might have been more difficult with a chipset embedded one.

Re: Intel patches new ME vulnerabilities

#144

Post by yborg »

close04 wrote: post #94
thepumpkin1979 wrote: post #47

Can MacBook owners do something to disable or cripple Intel ME? Is Apple disabling it for us? I can’t find Apple responses to these issues.

As far as I know while the Management Engine is in all chipsets that accompany Intel CPUs, Apple never shipped any AMT enabled firmware. This is the more exposed component.

Apple is exposed to ME bugs.

https://support.apple.com/en-us/HT208465

See the "EFI" section.

Re: Intel patches new ME vulnerabilities

#145

Post by bobdole12345 »

namibj wrote: post #76
zzzcpan wrote: post #57

Earlier quoted context omitted.

So, old Atoms are the only ones still usable intel systems and not vulnerable to Meltdown/Spectre/ME.

No, the Xeon Phi "accelerators" are usable too, they are basically 486 cores on modern litography (to allow for higher density/clock speeds), with a vector unit attached to them. I don't know how hard it would be to boot linux on one though...

They already run linux as their firmware, you can ssh into the cards.

Re: Intel patches new ME vulnerabilities

#146

Post by hlandau »

Kliment wrote: post #132
hlandau wrote: post #62

Earlier quoted context omitted.

me_cleaner does not disable the ME. It is a partial disablement of ME functionality, but some functionality remains enabled. The ME firmware is an Intel-signed proprietary binary blob part of which is instrumental in the system boot process, so complete removal is impossible. me_cleaner and/or the HAP bit, or the services offered by laptop vendors which is basically doing the very same for you, may certainly reduce t…

This is correct but misleading. The me_cleaner approach, with all options, wipes the entirety of the ME firmware except the module needed for hardware bringup. It then causes the ME to crash as soon as hardware bringup has happened. The host system cannot communicate with the ME processor and the ME processor does not execute any further code after this point. This is the current gold standard. The next stage would b…

How can the functionality be implemented independently when the modules must be signed?

Complete reverse engineering could at least serve as an effective audit though.

Re: Intel patches new ME vulnerabilities

#147

Post by mrsteveman1 »

close04 wrote: post #129
mtgx wrote: post #118

Earlier quoted context omitted.

It's much worse than that. This "Intel patches" thing is a lie - or at least it doesn't mean that your systems are patched, which is what 99.9% of people reading such headlines believe happened. Intel only patches its own firmware, but it's normally up to manufacturers to update that firmware for devices. So most PC/laptops users really won't even see these patches. And I agree with your main point. For one of the mo…

In all honesty "most PC/laptops users" will never need these patches because their systems don't have the ME firmware. You need specific CPU, specific chipset, specific NIC, and the ME FW. Which you're only going to find in OEM systems marked as such - vPro. It's the same as the Meltdown/Spectre patches where Intel updates the code but it's up to the manufacturer to include it where applicable. A regular desktop moth…

> In all honesty "most PC/laptops users" will never need these patches because their systems don't have the ME firmware. You need specific CPU, specific chipset, specific NIC, and the ME FW.

Every Intel system shipped in the last few years has the correct CPU, chipset and some version of the ME firmware (it's involved in initial platform boot, including Boot Guard which validates the BIOS before the CPU even gets a chance to run it), however some of them have "diet" ME firmware with fewer modules present.

The supported NIC is the only one that common desktops and laptops may not have at all. There's a side-channel required between the NIC and ME for certain features like AMT (remote desktop/management), and some NICs don't/can't support it. However, I recall seeing something about Intel allowing non-Intel NICs to be used at some point.

> Which you're only going to find in OEM systems marked as such - vPro.

See slide 68:

> Our Achievements

> • Switched-on AMT on non-vPro systems

https://www.blackhat.com/docs/eu-17/materials/eu-17-Goryachy...

Re: Intel patches new ME vulnerabilities

#149

Post by zorkw4rg »

std_throwaway wrote: post #72

I don't want a patch. I don't use that thing for anything. I want them to disable that thing by default! Leaving those backdoors open in older products should lead to a recall because the flaw was there all along.

Maybe someone could clarify some things, because I think the impression that I got from reading about this vulnerability is completely wrong. Isn't vPro just something in server hardware? At least the CPU, Mainboard and NIC all need to be certified/from Intel to support this?

You could get the impression that every single computer with a Intel CPU is vulnerable to be hacked over the network. Which I really doubt.

> I want them to disable that thing by default!

When you say this is enabled by default, do you literally mean that they open up a HTTP server without you doing anything?

I don't know much about the Intel ME but the things people are saying about it just seem totally unbelievable.

Re: Intel patches new ME vulnerabilities

#150

Post by mrsteveman1 »

close04 wrote: post #94
thepumpkin1979 wrote: post #47

Can MacBook owners do something to disable or cripple Intel ME? Is Apple disabling it for us? I can’t find Apple responses to these issues.

As far as I know while the Management Engine is in all chipsets that accompany Intel CPUs, Apple never shipped any AMT enabled firmware. This is the more exposed component.

I've seen some indication that the HECI (mailbox between the main OS and the ME) is disabled as well on most/all Apple machines.

I don't think they've ever used the Intel NIC hardware either, wired or wireless.

Post reply on HN