Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Rediscovering the Intel AMT Vulnerability

tenable.com

Post reply on HN
Print view View original

31–40 of 94 posts

Re: Rediscovering the Intel AMT Vulnerability

#31

Post by pcwalton »

Animats wrote: post #24
bobsam wrote: post #10

Intel decided they have the right to put a whole secret computer inside your computer that only they can access. God knows what it does when no one is watching. That's the problem you should discuss, not this particular exploit.

Having a "management engine" with direct access to the network and to memory is questionable in itself. Its code being secret indicates there's probably something bad going in. If it only does what Intel says it does, it doesn't need to be secret.

Intel ME has a DRM app called "Protected Audio-Video Path" [1], which obviously has to be secret.

As to whether anything actually uses the PAVP functionality, I have no idea. I wouldn't be surprised if it was something Intel included to try to push Atom-based set top boxes or whatever.

[1]: https://www.slideshare.net/mobile/codeblue_jp/igor-skochinsk...

Re: Rediscovering the Intel AMT Vulnerability

#32

Post by SomeStupidPoint »

logicallee wrote: post #21
SomeStupidPoint wrote: post #19

Earlier quoted context omitted.

I'm not sure what you're trying to say -- we can't discuss IME being a second computing system inside of your computer controlled by someome else? Because I seem to have just done that. We can even talk about why the existence of that system is problematic, since it gives someone else control over "your" computer.

[withdrawn]

Are you just trolling?

I've read literally dozens about how Intel ME is a potential vector and it's problematic to have, particularly when unneeded on consumer devices (a number of them here on HN). There's whole discussions about it from people like Libreboot and others who work on fully open systems. Every security professional I've worked with has been aware that there's a potential hardware level backdoor you can't wipe out the firmware for without bricking your machine, and has opinions about it.

I typed "Intel management engine second computer" in to Google, and found articles calling it a privacy/security threat and potential backdoor ranging back to 2010/2011 timeframe on the first page of results. (That's not even a good phrase to search with to find info, I just wanted to prove the point that you can find pieces with literally the first thing that comes to mind.)

Re: Rediscovering the Intel AMT Vulnerability

#33

Post by Crespyl »

MichaelGG wrote: post #8
bobsam wrote: post #7

Earlier quoted context omitted.

Many enterprise users are affected by this.

Sure but they'd be affected regardless, due to enabling a remote management system. All I'm asking is if there's any real damage because this is built in by Intel. If Intel didn't ship this, then OEMs would, just like e.g. Dell DRAC, right? And that'd have the same attack surface.

I'm not familiar with DRAC, but if it's something added by an OEM wouldn't it have to be in the UEFI/BIOS layer or higher?

AMT/ME and its ilk are a physical coprocessor built into the CPU, whether it's "enabled" or not, not something that can be added or removed after the fact.

Re: Rediscovering the Intel AMT Vulnerability

#34

Post by ethbro »

Animats wrote: post #24
bobsam wrote: post #10

Intel decided they have the right to put a whole secret computer inside your computer that only they can access. God knows what it does when no one is watching. That's the problem you should discuss, not this particular exploit.

Having a "management engine" with direct access to the network and to memory is questionable in itself. Its code being secret indicates there's probably something bad going in. If it only does what Intel says it does, it doesn't need to be secret.

It doesn't matter if we have source if it's not verifiable that that code is running on your management engine.

Re: Rediscovering the Intel AMT Vulnerability

#35

Post by anoother »

thyrsus wrote: post #27

The article says that a Local Management Service (LMS) must be installed for the bug to be demonstrated[0], and describes a Windows package that provides that. Is there a Linux equivalent? [0] I say "demonstrated" instead of "exploited", since I don't understand the details sufficiently to rule out exploitation in the absence of LMS.

Yes, there is.

I haven't looked into the exploit, but if the attack uses AMT's http(s) interface, you could also simply access the AMT port(s) from a remote machine. The service simply allows one to speak to the local ME.

Re: Rediscovering the Intel AMT Vulnerability

#36

Post by angersock »

pcwalton wrote: post #31
Animats wrote: post #24

Earlier quoted context omitted.

Having a "management engine" with direct access to the network and to memory is questionable in itself. Its code being secret indicates there's probably something bad going in. If it only does what Intel says it does, it doesn't need to be secret.

Intel ME has a DRM app called "Protected Audio-Video Path" [1], which obviously has to be secret. As to whether anything actually uses the PAVP functionality, I have no idea. I wouldn't be surprised if it was something Intel included to try to push Atom-based set top boxes or whatever. [1]: https://www.slideshare.net/mobile/codeblue_jp/igor-skochinsk...

> Intel ME has a DRM app called "Protected Audio-Video Path" [1], which obviously has to be secret.

Does it, does it really?

I'm pretty sure security through obscurity is some bullshit.

Re: Rediscovering the Intel AMT Vulnerability

#37

Post by qb45 »

MichaelGG wrote: post #8
bobsam wrote: post #7

Earlier quoted context omitted.

Many enterprise users are affected by this.

Sure but they'd be affected regardless, due to enabling a remote management system. All I'm asking is if there's any real damage because this is built in by Intel. If Intel didn't ship this, then OEMs would, just like e.g. Dell DRAC, right? And that'd have the same attack surface.

For now it's just that, remote management authentication bypass. Whether the ability to power up your machine at night and install Windows Millenium Edition for the lulz qualifies as "real damage" is up to you I guess :)

Anyway, you can't do anything Intel's management software doesn't normally support because this would require gaining arbitrary code execution on the ME and it's not what this exploit is about.

Re: Rediscovering the Intel AMT Vulnerability

#38

Post by Spooky23 »

bobsam wrote: post #10

Intel decided they have the right to put a whole secret computer inside your computer that only they can access. God knows what it does when no one is watching. That's the problem you should discuss, not this particular exploit.

It does very little.

As usual with AMT, there's a lot of noise, but these vulnerabilities to date have only been exploitable with activated AMT. With activation you can patch, etc.

And as I always point out in these stories, if Intel AMT freaks you out, Google "absolute software embedded bios".

Re: Rediscovering the Intel AMT Vulnerability

#39

Post by Spooky23 »

SomeStupidPoint wrote: post #32
logicallee wrote: post #21

Earlier quoted context omitted.

[withdrawn]

Are you just trolling? I've read literally dozens about how Intel ME is a potential vector and it's problematic to have, particularly when unneeded on consumer devices (a number of them here on HN). There's whole discussions about it from people like Libreboot and others who work on fully open systems. Every security professional I've worked with has been aware that there's a potential hardware level backdoor you can…

Did you find an exploit that impacted consumers?

Re: Rediscovering the Intel AMT Vulnerability

#40

Post by xgen »

AMD have something similar to this, and there was some mentioning of this in an ama on reddit here:

https://www.reddit.com/r/Amd/comments/5x4hxu/we_are_amd_crea...

What are the reasons for having this, I mean good business reasons? I get that designing cpus is expensive and they reuse as much they can, and that businesses would want the benefits or remote management. However when weighed up against the damage to trust in a company is it worth it enough that they do not offer a line of chips that do not have this pseudo back door present?

Post reply on HN