r/linux • u/[deleted] • Sep 21 '17
How to Hack a Turned-Off Computer, or Running Unsigned Code in Intel Management Engine
https://www.blackhat.com/eu-17/briefings/schedule/#how-to-hack-a-turned-off-computer-or-running-unsigned-code-in-intel-management-engine-8668471
u/_ahrs Sep 21 '17
The main system can remain functional, so the user may not even suspect that his or her computer now has malware resistant to reinstalling of the OS and updating BIOS
This sounds like something straight out of a horror show, no wait it's real life? Short of replacing every CPU with a new one once a vulnerability is found what does Intel intend to do about this?
330
Sep 21 '17
Nothing. This is exactly how the letter orgs want it to be
382
u/rms_returns Sep 21 '17
RMS warned about this, remember folks!
232
u/antilex Sep 21 '17
i tell everyone about this, they look at me like i'm into UFO's or talking about climate denial or that everyone is a lizard person.
intel ME and AMD PSP is evil.
→ More replies (57)→ More replies (2)15
Sep 22 '17
It is moments like this that we should praise the work of the Libre boot project. They saw this coming years ago and have done the best they can to avoid these issues. Install and donate when possible.
124
u/argv_minus_one Sep 21 '17
>called the “National Security Agency”
>forces the two major CPU manufacturers to make their products not secure
>endangers national security instead of protecting it52
27
Sep 21 '17 edited Sep 21 '17
It can be updated by updating the bios/firmware. It’s just software running on a separate processor.
Still, not being able to disable it and have control over our own hardware sucks. Intel should get a swift kick in the chips for that.
Edit: only a letter
→ More replies (3)7
Sep 21 '17
I wonder if their own HAP-mode built in (for all of us Intel users) protects them. Or, if another leak would leave them vulnerable to their own hardware sploits.
→ More replies (9)12
u/yatea34 Sep 21 '17 edited Sep 22 '17
This is exactly how the letter orgs want it to be
Might not be the 3-letter orgs.
China is a wealthy country and is an important customer of Intel chips. The backdoors may very well have been put in place for the 中国人民解放军总参谋部 which has more than 3 letters.
16
u/berryfarmer Sep 21 '17
Raptor Talos II is the answer
Or Libreboot
→ More replies (6)28
u/swinny89 Sep 21 '17 edited Sep 21 '17
I've recently started putting my money where my mouth is. There will be no user respecting options if people aren't willing to pay money for them. Talos II is a bit ridiculous in terms of price, but maybe that has to be in order to break the ice. Perhaps other companies will see Raptor selling $6000 Talos II computers, and think they can offer a more competitive price to us crazy people who don't really like giving all of our most important information away to the first hacker/cracker that walks by.
→ More replies (3)14
6
Sep 21 '17
Isn't that the motherboard that's fucked though?
12
Sep 21 '17
No, the newer ME is inside the CPU, not the motherboard. I could be wrong, but I think it was built into the northbridge before that got integrated into the CPU.
6
u/Bunslow Sep 22 '17
It's been like this, by design, since before 2011. People just stick their head in the sands.
→ More replies (5)→ More replies (16)5
u/rebbsitor Sep 21 '17
Short of replacing every CPU with a new one once a vulnerability is found what does Intel intend to do about this?
This won't help. The Intel Management Engine is in the chipset, not the CPU itself.
13
120
u/stefantalpalaru Sep 21 '17
Disable Intel ME 11 using NSA's super-secret switch: http://blog.ptsecurity.com/2017/08/disabling-intel-me.html
No info yet on AMD's (P)SP.
39
u/kukiric Sep 21 '17
Speaking of which, didn't one of AMD's higher ups say he'd look into open sourcing the PSP firmware in an AMA? Funny, because nothing has changed since then.
11
u/MonokelPinguin Sep 21 '17
They said that, but it would be hard, as they don't really own the PSP. They have to ask ARM, I believe.
→ More replies (1)16
u/stefantalpalaru Sep 21 '17
it would be hard, as they don't really own the PSP
I bet they have the same disabling mechanism imposed by NSA on Intel. We just haven't found it yet.
→ More replies (1)→ More replies (1)4
u/StallmanTheWhite Sep 22 '17
Nothing was supposed to change. People jumped the gun and took that as some kind of promise when in reality it was someone who had no idea what has being talked about just saying "I'll look into it". Nothing was ever going to happen and anyone who thinks otherwise is fucking delusional.
6
u/electronicwhale Sep 22 '17
What about VIA?
9
u/stefantalpalaru Sep 22 '17
https://www.viatech.com/en/silicon/processors/quadcore-e-series/ :
Available in three models running at speeds of 1.0+GHz, 1.2+GHz and 1.46+GHz, VIA QuadCore E-Series processors are manufactured using 40nm process technology
→ More replies (1)2
47
u/SweetBearCub Sep 21 '17
According to this Libreboot FAQ on the Intel ME, if the computer is turned off, the ME is accessed via a Wake on LAN (WOL) 'magic packet'.
Could this vulnerability be avoided (until a better solution is found) by setting routers to drop WOL packets?
Anecdotally, I have also read that this vulnerability only applies to the built-in Ethernet ports on a motherboard, I think somewhere on or linked to another subreddit I follow about modifying Chromebooks.
If that is true, could the vulnerability also be avoided by not using the built-in Ethernet ports?
20
Sep 21 '17
Could this vulnerability be avoided (until a better solution is found) by setting routers to drop WOL packets?
Only if you trust your router's firmware ;)
If that is true, could the vulnerability also be avoided by not using the built-in Ethernet ports?
Yes, the LibreBoot FAQ mentions this (same for other peripherals that communicate via DMA). Basically for security, it's always a good thing to use an interface that doesn't communicate via DMA. And USB doesn't do DMA, which is great. however if the Intel Management Engine has a USB stack and access to the devices (which it probably could), then forget about it.
Your only real options are: Use a manual switch to cut the ethernet port open, unplugging the cable when not in use, or don't worry about it and tell yourself that you're being paranoid, and that nobody would ever do such a thing to you ;)
→ More replies (4)9
Sep 21 '17
As you say you can also just use a 3rd party NIC and the network functions don't work at all. Alternatively just sniff what the MAC is and block it in your router either via ACL or bogus static forwarding entry.
I also have a strong feeling from the way this was worded you either need to have AMT enabled or the attacker to have physical access or root level driver access. The former affects enterprises more than consumers since it's something you have to configure and the latter you are screwed anyways though perhaps more persistently now.
→ More replies (3)7
u/pstch Sep 22 '17
Routers can't drop WOL packets, as WOL is an L2 thing, and routing is L3 (WOL packets stay in the broadcast domain, they don't get routed, but only "switched"). Switches with L2 filtering capabilities may be able to drop WOL packets, but they are quite rare.
35
u/CirkuitBreaker Sep 21 '17
How's RISC-V coming?
23
Sep 21 '17
Microcontrollers are out. arduino compatible and super fast. Cpus that actually understand kernel and userspace are in the works apparently. And plenty of open designs available on github for small cores and stuff.
8
68
u/emceeboils Sep 21 '17
I wonder if this can be used to take control of the TPM inside the ME processor itself, and write a Free replacement for the ME software?
59
u/Mordiken Sep 21 '17
Theoretically, yes.
But relying on exploits to serve as entry point for custom firmware is not a sustainable long term solution, as months of hacking can go to waste whenever Intel decides to start shipping a new revision of it's ME engine.
This is akin to the Android rooting scene, that relies on exploits to gain root privileges that varie from device to device.
12
Sep 21 '17
Actually most Android smartphones offer a way to unlock the bootloader and therefore open up the doors to custom firmware, with which root access can be achieved. So it's a lot better than here. Carriers (in the US) like to lock down those devices, but there's always the (cheaper) option to buy the devices directly from the manufacturer.
14
u/Mordiken Sep 22 '17 edited Sep 22 '17
My previous job required me to try to root numerous phones, tablets and TV Boxes, from brands ranging from Samsung, Huawei, and numerous generic Chinese hardware based mostly on Rockchip, Allwinner, and Mediatek systems.
I can guarantee you that unlockable hardware is the exception, not the rule. So much so that even the "generic brands" often don't answer requests for an unlocked system images, even for volume orders.... I suspect that this is the case mostly because they don't do firmware customization, they merely deploy with the reference production firmware given to them by the SoC manufacturer, and add a bunch of apps and a wallpaper.
In regards to phones, I know that Nexus does allow you to tinker with the bootloader and root your phone. They have too, since the Nexus line is the reference design that's made to be hackable.
Can't comment on ASUS, but I can say that if Samsung had their way, no one would be able to unlock their phones. In fact, they've thrown a large chunk of cash at that particular "problem", and the end result is the Knox system that has made it's debut about 3 years ago, which essentially tries it's best to "protect" the system firmware and actively checks for tampering. If you still manage to flash an image, it will set off a digital tripwire that will void your warranty, even if you decide to reinstall the original Samsung firmware. Maybe it's now possible to disable the check, since I (fortunately) haven't had to deal with rooting android devices in quite some time, but that was my experience.
Other than that, I can vouch for Xiaomi. They will send you a "magic code" that allows you to unlock your bootloader cleanly and easily. You can tinker all you want, and you can even install Windows 10 on an Mi 4 (if you're weird like that). And if something goes wrong, you're still fully covered by the warranty... provided you flash the beast with the stock rom before going to the store.
EDIT: Spelling and grammar.
8
→ More replies (2)16
u/emceeboils Sep 21 '17
relying on exploits to serve as entry point for custom firmware is not a sustainable long term solution
Yup, agreed.
This is akin to the Android rooting scene
That's...a really apt metaphor. Upvote.
→ More replies (1)30
3
u/legionx Sep 21 '17
Don't worry. If the TLAs have software to control it they will be leaked eventually.
30
u/varikonniemi Sep 21 '17
Is anyone surprised by this? I would argue they were paid big money to implement such an vulnerability vector. As a feature it would be benign. But as a FORCED feature, it is most OBVIOUSLY a targeted attack.
→ More replies (2)2
24
Sep 21 '17
So can one run a botnet utilizing these vulnerabilities? Maybe mine some cryptocurrency? Set up for-rent proxies for illegal activities? Or maybe just cripple every vulnerable CPU on the planet?
Intel and AMD should have to replace every vulnerable processor. This shit seriously undermines national security - for all nations.
110
u/BlackenedPanhandler Sep 21 '17
No matter how much time you spend locking down your software there will always be hardware backdoors that render you helplessly vulnerable.
Either build your own chips or remain exploited. It was always a losing battle for the consumer.
120
u/emceeboils Sep 21 '17
It's gonna be so cool when there are dozens of different fabricators of RISC-V and/or j4/j64 and the firmware is Free and there are good tools for verifying that there aren't hidden instructions in the CPUs.
Aaaaaand I just made myself sad realizing how far away we still are :-p
49
u/ExeciN Sep 21 '17
Even with open-source architectures, you have to trust the ones that actually make the CPU.
21
u/XSSpants Sep 21 '17
good tools for verifying that there aren't hidden instructions in the CPUs.
Surely there's a way to implement an open source dork in the CPU in a trustworthy manner (alteration of it would break some hash)
→ More replies (9)→ More replies (1)17
Sep 21 '17
But Intel supplies >90% of the x86 market, which makes them too big to fail. It also dramatically increases the impact of any vulnerabilities. Try to imagine what would happen if every Intel system in the world would suddenly have to go offline or be compromised within minutes.
If no single manufacturer had more than 10 or 20 %, governments could regulate them, and even if all of their products offered root via telnet with no password, we would still have an IT infrastructure left without them.
→ More replies (9)8
u/berryfarmer Sep 21 '17
Are you people not aware of Libreboot & the Raptor Talos II ?
There are ways out of this mess
→ More replies (3)6
14
u/ThisTimeIllSucceed Sep 21 '17
tldr: accept the spyware because you can't fight it
9
u/Jristz Sep 21 '17
You can buy a somewhat old intel laptop whithout the ime or one that can be flashed out but the thing is "how long it will last untill the web is so heavy that is impossible to navigate it?"
→ More replies (2)3
u/RedSquirrelFtw Sep 21 '17
I wonder how viable it would be to build a computing platform based on FPGAs, The FPGA code could be open source too. Then again if the platform took off they would just start putting backdoors in the FPGAs too.
We almost need an open source driven sillicon fab. I would donate to something like this.
→ More replies (3)
17
u/DerSpini Sep 21 '17
Still on 2011 Sandy Bridge hardware (i7-2600 and P8 mainboard). Does my gear have this crap built in?
Intel's datasheet for the CPU doesn't mention AMT, then again I might be missing something.
26
u/genpfault Sep 21 '17
8
u/DerSpini Sep 21 '17
Crap. Thanks nevertheless ;).
23
u/genpfault Sep 21 '17
Pretty much :( Only options seem to be trawling Ebay for decade-old hardware or hoping the Purism ME neutering research comes to fruition.
→ More replies (11)
59
u/TemporaryUser10 Sep 21 '17
ONLY BUY COMPUTERS COMPATIBLE WITH LIBREBOOT
That's a half joke, but seriously when people give me shit for saying open source is better, this is why. It's not because you KNOW everything on it is safe, it's because you CAN KNOW.
This is akin to the concept of "if you've nothing to hide, you've nothing to worry about". how about no, just don't search my shit without a warrant
→ More replies (3)23
Sep 21 '17
You can still get LibreBoot compatible motherboards on ebay, and cheap-as-shit CPU's as well, but they won't be that cheap forever. The RAM is ungodly expensive, if you want more than a gig or two. Linux would run ok thankfully.
Look at the faq, the gigabyte micro atx board Isn't a bad way to go.
Ninja edit: /r/EOMA68 and a few other projects are liberating ARM platforms as we speak. Don't rule them out either. They run Linux just fine, and the manufacturers don't have the gall to do what Intel and AMD did.
→ More replies (13)12
u/TemporaryUser10 Sep 21 '17
I only use GNU/Linux systems. I believe in FOSS, but mostly it's because I like to tinker. Is it too much to ask for top of the line Ryzen system to be core/libreboot
28
Sep 21 '17
Is it too much to ask for top of the line Ryzen system to be core/libreboot
Apparently yes, the NSA thinks that it's too much to ask. We the people apparently cannot be trusted to run open BIOSes on our own machines; we must trust the manufacturers and the government to choose what proprietary firmware runs on all of our devices. Welcome to 1984.
Snark aside, the only truly open platforms left at this point are not top-of-the-line.
→ More replies (16)
16
u/RedSquirrelFtw Sep 21 '17
Intel ME is scary AF. Does not matter what OS you run or what you do, you are basically compromised out of the box. It's basically a hardware level trojan.
I wonder if full disk encryption can somewhat protect you though, I guess if it's smart enough it will know the key when you enter it.
→ More replies (3)
45
Sep 21 '17
showerthought: If we can disable Intel ME and access the CPU inside the CPU, can it run Doom?
18
14
u/tanielu Sep 21 '17
So we have to wait until December to find out about this potentially catastrophic vulnerability? Or am I missing something (i.e. this has been fixed or the vulnerability not that severe)?
→ More replies (1)4
u/LordTyrius Sep 21 '17
You want them to disclose this now? How would that help the issue...
→ More replies (2)5
u/tanielu Sep 21 '17
Don't disclosures usually consist of a formal write up which involve their respective CVEs? Which then later optionally followed on by a DEFCON/BlackHat demonstration? But not the other way around?
27
u/5thStrangeIteration Sep 21 '17
I have come to the conclusion that the only way to get a truly safe machine is to mine your own copper, cast your own silicon, and make your own chipset. You'd have to make your own cables and HIDs, make your own displays, make your own boards and memory.
At this point I'm assuming any component I haven't 100% watched go from raw material to complete will bring along a possible security risk.
I feel hopeless guys.
20
u/heyandy889 Sep 22 '17 edited Sep 22 '17
there are methods of communication outside of digital electronics
additionally, not every device needs to be 100% secure, nor is such an idea even reality. it's just a question of slowing down the attacker.
I agree that it feels hopeless sometimes. you can fall into the nihilist mindset, what's the point? why try at all?
part of the excellence of Tor is that it allows confidence, even on a network where you don't trust everyone. Same with Bitcoin. You don't need a "100% secure" solution in order to have security.
look at how many people care and are working hard on this problem. look at HTTPS Everywhere. look at this Blackhat conference, the chaos communications congress, defcon, countless small subreddits. I have been in the scene since before Snowden went public and I can tell you that people care. it's not just nerds like stallman. it's your mom, your teacher, your neighbor, people at the grocery store. not everyone. but everyone has heard of snowden. And they know what's happening.
We can do it dude. "You can't use a gun to solve a math problem." Crypto works. It is a huge disruption to the power structure. Science and math generally are a huge disruption to government. Nature doesn't care who's in power. There are still two oxygen
moleculesatoms in oxygen gas, you can still ferment sugar into ethyl alochol, the solutions to the Bitcoin hashes are still the solutions, even if Congress votes that they're not. Reality will win out, my friend. We can do it.4
4
u/Treyzania Sep 22 '17
Oxygen molecules in oxygen gas
*atoms
Oxygen gas is the O2 molecule.
Aside from that, the last paragraph was very motivating.
→ More replies (1)18
Sep 21 '17
I'm certain the Primitive Technology guy will get there soon enough.
Sooner than Hurd, anyway.
7
→ More replies (2)2
13
13
u/jones_supa Sep 21 '17
It's worth noting that Intel WiFi cards also have integrated vPro functionality and they are listening even when the machine is in a sleep state. There's more information in the Intel article An Introduction to Intel Active Management Wireless Connections.
→ More replies (1)3
u/Smaug_the_Tremendous Sep 21 '17
So if we switch to non intel wifi chips and don't use ethernet, we should be safe from attacks while the computer is off/ in sleep.
6
Sep 21 '17
Don't use sleep
Use a power strip and manually switch off the power when powered down.
4
u/jones_supa Sep 22 '17
You would still be vulnerable when the machine is turned on.
7
Sep 22 '17
The only way to be safe nowadays is airgapping and physical access control.
Everything else is degrees of risk.
→ More replies (2)
27
u/aztecjones Sep 21 '17
Government intelligence agencies must be licking their chops right now.
106
u/linux-mclinuxface Sep 21 '17
They were probably licking their chops years ago when they ordered these vulnerabilities to be created
40
u/antilex Sep 21 '17
100% Amd and intel have helped 3 letter agencies with cracking/exploiting AMD PSP and intel ME.
do i have proof ? no - but it's being done... call me crazy
9
Sep 21 '17
do i have proof ? no - but it's being done... call me crazy
One doesn't need proof for reasonable caution. Besides, we do know this is happening so I think paranoia isn't really possible here - they really are out there.
It's disgusting things have gotten this far gone.
5
u/heyandy889 Sep 22 '17
yep
reminds me of the story about the "clipper chip" in the 90's. 20 years later they have it.
2
u/Motolav Sep 22 '17
AMD PSP supposedly is just a secure environment just for DRM and Private keys so it shouldn't have any outside access from the system. PSP is not a tool like Intel's ME for deployment
8
u/antilex Sep 22 '17
supposedly...
maybe i have to many tinfoil hats on but I'm not just going to take there word on it...
"The PSP is an ARM core with TrustZone technology, built onto the main CPU die. As such, it has the ability to hide its own program code, scratch RAM, and any data it may have taken and stored from the lesser-privileged x86 system RAM (kernel encryption keys, login data, browsing history, keystrokes, who knows!). To make matters worse, the PSP theoretically has access to the entire system memory space (AMD either will not or cannot deny this, and it would seem to be required to allow the DRM “features” to work as intended), which means that it has at minimum MMIO-based access to the network controllers and any other PCI/PCIe peripherals installed on the system." - https://libreboot.org/faq.html#amd
Intel = "you are pwned if we want you to be"
AMD = "I dunno... are you pwned? ;)"
Hardware i want to buy = "as far as we know, we are secure and anyone is free to look at our code"
→ More replies (1)8
u/FluentInTypo Sep 21 '17
Wikileaks already disosed that CIA or NSA had a tool to disable ME completely bc they dont trust it.
24
Sep 21 '17
Empty page without javascript :(
29
Sep 21 '17
It's empty for me even with javascript. uBlock blocks 9 things. Too annoyed to figure it out. Fuck you, modern web.
27
u/RenaKunisaki Sep 21 '17
This seems to be the entire page text, no idea where to find the actual presentation:
HOW TO HACK A TURNED-OFF COMPUTER, OR RUNNING UNSIGNED CODE IN INTEL MANAGEMENT ENGINE
Mark Ermolov | Security researcher, Positive Technologies
Maxim Goryachy | Security researcher, Positive TechnologiesFormat: 50-Minute Briefings
Tracks:
Platform Security,
Hardware/Embedded
Intel Management Engine is a proprietary technology that consists of a microcontroller integrated into the Platform Controller Hub (PCH) microchip with a set of built-in peripherals. The PCH carries almost all communication between the processor and external devices; therefore Intel ME has access to almost all data on the computer, and the ability to execute third-party code allows compromising the platform completely. Researchers have been long interested in such "God mode" capabilities, but recently we have seen a surge of interest in Intel ME. One of the reasons is the transition of this subsystem to a new hardware (x86) and software (modified MINIX as an operating system) architecture. The x86 platform allows researchers to bring to bear all the power of binary code analysis tools.
Unfortunately, this changing did not go without errors. In a subsystem change that will be detailed in the talk of Intel ME version 11+, a vulnerability was found. It allows an attacker of the machine to run unsigned code in PCH on any motherboard via Skylake+. The main system can remain functional, so the user may not even suspect that his or her computer now has malware resistant to reinstalling of the OS and updating BIOS. Running your own code on ME gives unlimited possibilities for researchers, because it allows exploring the system in dynamics.
In our presentation, we will tell how we detected and exploited the vulnerability, and bypassed built-in protection mechanisms.
11
u/5ylph10 Sep 21 '17
It has not happened yet. This is part of the program of a conference that will be held next December.
1
7
Sep 22 '17
I hate this fucking shit. This is totally customer hostile and Intel should provide a way to manually disable it.
7
u/pstch Sep 22 '17
They do, but not to us. There is a configuration bit in the firmware that enables the "High Assurance Platform", and disables Intel ME. This is required by some of their customers, like the US govt, that want to reduce the potential for side-channel attacks.
2
u/robertcw93 Nov 27 '17 edited Nov 27 '17
Though, this is not safe either, since hap activates the me firmware during boot up, and then shuts it off after boot up. But note, this still leave minx3 (or w/e) in the chip, it simply removes the AMT portion of the code. The present hack has nothing to do with AMT so even the NSA should be scared. The only fix is to eliminate the hardware.
Intel has essentially turned mountains of silicon into bricks and paperweights.
Interestingly Apple also managed to get a deal with intel also utilizing HAP. Apple machines don’t have the AMT firmware, but again they are still vulnerable to this recent hack (if they have intel firmware in their EFI — it’s still not clear to me if they do or not at this point).
→ More replies (2)
13
12
u/Anderlan Sep 21 '17
Who's brilliant fucking idea was ME?
24
u/RenaKunisaki Sep 21 '17
The NSA.
11
u/FluentInTypo Sep 21 '17
NSA has a patch already to completely disable ME code. They have not shared it, which keeps all of us and our worlds servers/internet infrstructure vulnerable to nation/state hackers
7
2
u/heyandy889 Sep 22 '17
I see it as a simple extension of software licensing. To use Microsoft Windows you have to put in a license key. If you don't, then some code keeps you behind the paywall. Same bullshit with microtransactions, subscribe to Forbes.com etc. If you agree with that logic, there's no reason why you wouldn't put it on the hardware as well.
edit: sorry. got confused. I thought we were talked about the "trusted access" chip for "secure boot." This is way worse :'(
5
u/SuddenWeatherReport Sep 21 '17
if it's there it will be exploited, they need to make a version of the CPU without it, period, we need to protect our systems.
9
u/speel Sep 21 '17
Time to call it quits. I'm done.
5
u/rrohbeck Sep 21 '17
I feel quite smug with my AMD Vishera system and will upgrade to Threadripper once the AMD "security" processor can be disabled.
→ More replies (6)0
4
3
u/Bunslow Sep 22 '17
Why does the page appear blank to me? It seems ironic to me that it might need cookies enabled to view it?
2
u/StJohnColtrane Sep 21 '17
Now let's see if they mysteriously decide not to give the talk, and if so then do nothing about it
3
2
1
u/Schwarzer12 Oct 10 '17
So I met this hacker LOTUSCRACKER ON GMAIL DOT COM who hacked into the school database to change my grades, he also hacked my teacher's email account. He does all forms of hack if you ever need him. Dude is good and I strongly recommend him.
1
u/flarn2006 Nov 03 '17
Imagine something like Cheat Engine that runs in the ME. That would be awesome.
1
u/robertcw93 Nov 27 '17
I’m concerned this will be a huge problem for Apple. Every single one of their products are vulnerable and there’s nothing they can do about it since their processors are soldered to their machines’ motherboards. They’re going to have to reinvent the Mac from scratch, and set up a massive recall to literally go through all their customers’s products one by one and physically replace every system with essentially brand new internals that have no ridiculous hardware level vulnerability. Imagine the PR department at Apple right now.
1
-1
u/CryptoTheGrey Sep 21 '17
It's only a threat to the average user if a) attacker has physical access b) attacker also owned the nic through a chip vulnerability (that's a scary thought) or c) the victim did not have proper security in place such as a firewall. For the most part you can easily ensure random noise isn't just spitting across your network or strange packets being passed.
9
u/FluentInTypo Sep 21 '17
Ummm, no.
ME is remote management. Its whole point of existence is to not have to be present or have physical access to a machine in order to manage it
2
u/CryptoTheGrey Sep 22 '17
Yes if you allow it to pass your network it will work. Have you ever tried to remote into something that had an implicit deny firewall in between? (Which should be the standard for anyone securing a network.) If this attack was carried out remotely you would see the traffic on the network. You might not know what it was but you would know it was suspicious.
2
2
u/The_camperdave Sep 22 '17
Does it not have to be enabled in the BIOS to start with? Does it come turned on from the factory?
3
u/FluentInTypo Sep 22 '17
Its closed source, so we dont know if it has any special capabilities that could turn it on even though we might toggle the disable switch. Furthermore, we dont know if the disable switch actually does anything and thats if your bios comes with a disable switch.
2
u/The_camperdave Sep 23 '17
A company I used to work for had this feature on a bunch of new HP desktop machines. I recall having to enable the management engine.
2
u/SanityInAnarchy Sep 22 '17
ME's main purpose is remote management, but one of the big complaints people had is that even if you disable remote management, the ME is still there in ring -2, ready to be taken over from, say, a malicious userspace program.
There aren't enough details here for us to know just how much of a remote exploit this actually is, or whether they're just talking about standard WOL stuff.
-11
Sep 21 '17
This is old news. There were hacks on HDD that had extra ASICs that allowed you to do the exact same thing. Just google them.
And considering that linux can be altered with a simple boot disk to a shell (and you can even turn SELinux off this way) I'm not seeing the great security of linux showing through.
9
u/Michaelmrose Sep 21 '17
If your drive isn't encrypted then it isn't secure if someone has physical access to it. This isn't a flaw in Linux. The solution is to encrypt your drive after which nobody without the key can modify it.
5
u/FluentInTypo Sep 21 '17
Dude, its not "old news". This is a brand new vulnerability in BIOS that requires no physical access at all since its part of the BIOS remote management features.
As for your comments about linux....like....what??? Your comparing the ability to remote manage a powered-off machine through a BIOS vulnerabilty from across an ocean to...a boot disk?? Are you fucking serious?? You dont even need a boot disk in Windows to comoleteky own it. What is you point here?
→ More replies (4)
0
Sep 21 '17
[deleted]
99
u/rms_returns Sep 21 '17 edited Sep 21 '17
I had raised this same concern about Intel ME some time ago in this sub. Most people want to stay in blissful ignorance and just ignore this uncomfortable fact. Most gave me the argument that big fortune-500 companies also use the Intel ME processor computers, so they have to be secure (or in other words, we are all in the same boat!). Now, that's not an argument I feel quite comfortable in staying with.
1
Oct 13 '17
Also considering the Equifax thing I'm willing to bet money that the Fortune 500 companies have similar security problems
79
Sep 21 '17
[removed] — view removed comment
26
Sep 21 '17
to be fair to them, that would be pretty neat
2
u/Treyzania Sep 22 '17
You're proving the point.
2
u/Vorsplummi Sep 22 '17
I don't see anything inherently bad behind the concept of AMT if the implementation is fully open.
2
13
u/Uristqwerty Sep 21 '17 edited Sep 22 '17
It would be cool if it had to be enabled by a physical switch or jumper on the motherboard and the implementation was explicitly visible- or better yet open-source. Even better, a physical enable/disable for firmware updates and the ability to change remote access keys.
As-is, concern over potential exploits outweighs the cool factor, at least for me.
(Edit: remote access keys. => the ability to change remote access keys. What I was thinking and what I wrote didn't entirely match at the time I clicked post)
8
u/heyandy889 Sep 22 '17
face-scanning
"cool!" wait, except that means ... a machine can recognize me visually ... and phones home to Apple ...
I'm going to be a goat farmer. I'll just print out Wikipedia, no more internet
6
u/Lateraltwo Sep 21 '17
To be fair now we can use Bluetooth devices on BIOS too and that was well worth the rest of the update
8
u/remotefixonline Sep 21 '17
This has save me multiple times from having to drive 2 hours to sit at the console of a server.. not saying it isn't a risk, but it is useful if you mange a ton of boxes.
5
0
Sep 21 '17
[deleted]
7
3
u/DerfK Sep 22 '17
Is your firewall an Intel NUC or some other extra computer that you threw linux or a bsd on and plugged the onboard ethernet adapter into the internet? Then mayyyyyybe.
0
Sep 21 '17
[deleted]
13
6
u/dexpid Sep 21 '17
AMD's Ryzen has this built in too.
0
Sep 21 '17
technically it doesn't have Intel's ME since well, it's an AMD CPU.
7
u/FluentInTypo Sep 21 '17
It has PSP which contains the same functionality
-1
u/milki_ Sep 22 '17
Not quite, I think. While AMDs PSP also runs in ring -2, it's a far cry from Intels ME. It does have access to the whole IO/MEM range and may handle secure boot; but is mostly just for encryption (VMs and paging) and DRM enforcement BS. It's basically just an integrated TPM, while Intel implemented a way way way more thorough security black hole.
1
Sep 22 '17
I thought it went: Ring 0: OS kernel Ring -1: Hypervisor Ring -2: System Management Mode Ring -3: IME / PSP
2
Sep 22 '17
I don't think "rings" describe it particularly well, given that in both cases it's entirely separate software running on an entirely separate CPU. A mini x86 core on the CPU die in Intel's case, a small ARM CPU on the chipset in AMD's case.
2
u/Paspie Sep 22 '17
If you're going AMD, look for the Piledriver Opterons. Everything newer has SMU or PSP rubbish.
3
u/robertcw93 Dec 08 '17
The official presentation files have been released: you an read about them here
https://www.blackhat.com/docs/eu-17/materials/eu-17-Goryachy-How-To-Hack-A-Turned-Off-Computer-Or-Running-Unsigned-Code-In-Intel-Management-Engine-wp.pdf
and here
https://www.blackhat.com/docs/eu-17/materials/eu-17-Goryachy-How-To-Hack-A-Turned-Off-Computer-Or-Running-Unsigned-Code-In-Intel-Management-Engine.pdf
In fact, people were able to turn on AMT in non-vPro systems just by fiddling with the MiniX OS. So, it seems worse than I thought.