Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

An in-depth security review of the Intel Management Engine

security-center.intel.com

Post reply on HN
Print view View original

41–50 of 192 posts

Re: An in-depth security review of the Intel Management Engine

#41

Post by aeleos »

toyg wrote: post #25
aeleos wrote: post #8

Wow all 6th, 7th and 8th gen are all vulnerable along with a bunch of Xeon processors. Even the laptop I am typing this on is vulnerable, this is going to be messy. Plus all the fun vulnerabilities like arbitrary code execution, unauthorized access to privileged content. These must be related to the blackhat talk coming up in December about hacking a turned-off computer and running unsigned code on ME [0]. Yep and th…

> I wonder if this will at all dissuade either Intel or AMD into continuing to make these super privileged processors They clearly invested some serious money into this sort of thing and see it as a differentiator (or AMD wouldn't have followed suit). Chances that they'll throw it all away because of a few vulnerabilities are very, very thin.

AMD has had their own version of this for quite some time. Its called the Platform Security Processor (PSP), it has been in anything AMD since around 2013 [0]. I am not sure if Ryzen / Threadripper has it, but I would be surprised if it didn't.

[0] https://libreboot.org/faq.html#amd-platform-security-process...

Re: An in-depth security review of the Intel Management Engine

#42

Post by aeleos »

jlgaddis wrote: post #35

In my case, their Linux detection tool is less than useless: $ sudo ./intel_sa00086.py ... *** Risk Assessment *** Detection Error: This system may be vulnerable, please install the Intel(R) MEI/TXEI driver (available from your system manufacturer). ... Thanks, Intel! If you have a Lenovo machine, check Lenovo's security advisory [0] to see if it is affected. Intel has the wrong URL in their link. Edit: FWIW, the (Li…

I get the exact same thing, I might be wrong but I don't think that the windows version does anything different. According to the website it seems that the vendor needs to provide software to patch the firmware.

Re: An in-depth security review of the Intel Management Engine

#43

Post by Avery3R »

aeleos wrote: post #8

Wow all 6th, 7th and 8th gen are all vulnerable along with a bunch of Xeon processors. Even the laptop I am typing this on is vulnerable, this is going to be messy. Plus all the fun vulnerabilities like arbitrary code execution, unauthorized access to privileged content. These must be related to the blackhat talk coming up in December about hacking a turned-off computer and running unsigned code on ME [0]. Yep and th…

blackhat =/= defcon

Re: An in-depth security review of the Intel Management Engine

#44

Post by nevir »

Sir_Substance wrote: post #34
lwhalen wrote: post #15

Earlier quoted context omitted.

The company who built your motherboard

I'll take your word for it I guess, but I don't see the logic. Why would my motherboard manufacturer be involved in this process? edit: maximum downvotes for a legitimate question, thanks all

It's a chip that your motherboard manufacturer hardwired in (e.g. part of the chipset). Firmware updates need to go through the efi/bios they set up

Re: An in-depth security review of the Intel Management Engine

#45

Post by Sephr »

They still haven't publicly documented and supported the HAP bit.

If Intel actually cared about your security they would document that. It says so right in the security advisory that the external researchers are the reason for the security review, and not due to customer concerns.

Re: An in-depth security review of the Intel Management Engine

#46

Post by criddell »

_x5tx wrote: post #36
jlgaddis wrote: post #26

I prefer the wording in Lenovo's security advisory [0]: > "Potential Impact: An attacker could load and execute arbitrary code outside the visibility of the user, operating system, and hypervisor/virtualization platform; resulting in exfiltration of secrets, subtle manipulation of system operation, or denial of service." [0]: https://support.lenovo.com/us/en/product_security/len-17297

It is nice to know lenovo already has the updates, but sadly I'm gonna have to install windows for that :(

Send me your IP and I'll patch it for you.

Re: An in-depth security review of the Intel Management Engine

#47

Post by artimaeis »

Sir_Substance wrote: post #34
lwhalen wrote: post #15

Earlier quoted context omitted.

The company who built your motherboard

I'll take your word for it I guess, but I don't see the logic. Why would my motherboard manufacturer be involved in this process? edit: maximum downvotes for a legitimate question, thanks all

The motherboard manufacturer integrated the chipset into their board. They worked with Intel, or Intel's spec/API directly. They are responsible for your machine's interaction with the CPU.

The same is true of all the devices directly integrated into your motherboard. Broadcom/Intel wireless chipset, Ethernet, audio, etc.

Re: An in-depth security review of the Intel Management Engine

#48

Post by disconnected »

thg wrote: post #17
xwvvvvwx wrote: post #16

Unreal. Kept scrolling and the vulnerabilities kept coming. Most annoying thing is that there isn’t even a real alternative. If I understand it right then AMD chips have pretty much the same thing?

Well, maybe AMD does at least some security reviewing on their own? /s ARM could be a affordable alternative to x86 if that works for you.

> ARM could be a affordable alternative to x86 if that works for you.

Even the open source friendly Raspberry Pi relies on proprietary blobs and proprietary firmware, with vast parts of the documentation only being available to system integrators (meaning: not you) under an NDA.

Theirs is a Broadcom chip, but my understanding is that the scenario is pretty much the same for other ARM vendors. If the chip is anything more complicated than your average 8-bit micro-controller, expect it to be running some kind of "system" which is, of course, closed source.

Re: An in-depth security review of the Intel Management Engine

#49

Post by wolfgke »

aeleos wrote: post #41
toyg wrote: post #25

Earlier quoted context omitted.

> I wonder if this will at all dissuade either Intel or AMD into continuing to make these super privileged processors They clearly invested some serious money into this sort of thing and see it as a differentiator (or AMD wouldn't have followed suit). Chances that they'll throw it all away because of a few vulnerabilities are very, very thin.

AMD has had their own version of this for quite some time. Its called the Platform Security Processor (PSP), it has been in anything AMD since around 2013 [0]. I am not sure if Ryzen / Threadripper has it, but I would be surprised if it didn't. [0] https://libreboot.org/faq.html#amd-platform-security-process...

> AMD has had their own version of this for quite some time. Its called the Platform Security Processor (PSP),

According to the small footnote at http://www.amd.com/en-gb/innovations/software-technologies/s... AMD does not use the name "Platform Security Processor (PSP)" anymore, but calls it "AMD Secure Processor" instead.

Re: An in-depth security review of the Intel Management Engine

#50

Post by berbec »

dboreham wrote: post #27

Does "attacker with local access to the system" mean "physical access to the system"?? Initially I thought it meant "attacker able to run an unprivileged process on the system" but then I see other wording that seems to imply that case, so does "local access" mean physical access? (e.g. connect a USB drive, boot the box off their own media?)

The examples I've heard about are plugging a usb drive in and that's the ballgame. The big one, that I have not heard of, would be accessing the ME and privilege elevation over network.
Post reply on HN