6 ms·

perhaps everyone who finds something disappears? </sarcasm> seriously, AMT is stuff of nightmares. runs even when machine is powered off.

by spydum 10y ago

nickpsecurity 10y ago
AMT is the reason I mock anyone here that talks about concerns of backdoors in Intel's RNG's being ridiculous. The whole CPU is backdoored with a backdoor that can run when it's off. Including probably the RNG given debug wires are probably connected to it. Let's not worry about one feature when we have a subversion this big. Biggest irony: they advertise it as a feature for IT management. ;)
- Spooky23 10y ago
  My team spent a bunch of time looking at AMT as a management tool -- it adds lots of complexity and accomplishes almost nothing that cannot be done easier a half dozen other ways. The only functionality we saw any real use for was an always on VPN and remote wake up where networks block WoL. The other thing that's even stranger is Absolute Software, a little company nobody has ever heard of who somehow got every OEM to bundle their code in system BIOS for theft recovery since the 90s.
  - nickpsecurity 10y ago
    re Absolute It seriously reads like a botnet description. I'd have believed them if they said "From the innovators behind Storm comes new endpoint protection..." https://www.absolute.com/en/about/persistence https://www.absolute.com/en/about/persistence
    - teddyc 10y ago
      Glad to see my laptop vendor is not on their list
    - Spooky23 10y ago
      It is pretty disturbing. We were lobbied pretty heavily to evaluate it and did some field tests as a result. You can do some wacky shit with it. There is one mode where you can configure it to delete certain directories or files to screw around with a thief. That can be tweaked to delete files that the system needs. Those modes are persistent, and even after reformatting or replacing the boot media, the agent will reinstall and retrieve its policy file. If you use it with Intel AMT, it can also brick the device permanently. (http://www.intel.com/content/dam/doc/product-brief/mobile-computing-protect-laptops-and-data-with-intel-anti-theft-technology-brief.pdf http://www.intel.com/content/dam/doc/product-brief/mobile-co...) Everyone who tested the product had two questions: "Who is buying this?" and "How do I get this dormant code off my devices?" Laptops aren't cheap, but they aren't expensive enough as an asset to care that much about recovery. And there are arguably better ways to safeguard data assets.
- woodman 10y ago
  I'd argue that a factory backdoored RNG would be infinitely more dangerous. An AMT exploit wouldn't be passive, and it wouldn't weaken every crypto operation proceeding the time of the attack. Between the two, which do you think an entity with a massive surveillance network, and a history of intentionally weakening security infrastructure, would prefer?
  - nickpsecurity 10y ago
    An AMT exploit, if having internal access to CPU, could weaken a RNG plus anything else you can think of. Passive attacks are definitely possible with a backdoor. It just makes a component, hardware or software, do something upon certain trigger conditions. Otherwise it stays silent. Example from high-assurance field: https://calhoun.nps.edu/bitstream/handle/10945/6073/02Mar_AndersonE.pdf;sequence=1 https://calhoun.nps.edu/bitstream/handle/10945/6073/02Mar_An...
    - spydum 10y ago
      I think woodmans argument is that AMT is an active service, you should see network traffic to the management engine and such -- so firewalls/airgaps/SPI should detect and prevent tampering. I think that is a naive view of AMT, it seems far more capable, network management is just one avenue (and it's been proven difficult to comprehensively implement anyways).
      - nickpsecurity 10y ago
        Ahh. I think the hardware parts of my write-up on smartphone risks will help here: https://news.ycombinator.com/item?id=10906999 https://news.ycombinator.com/item?id=10906999 Basically, modern SOC's are mixed-signal systems that have digital, analog, and often RF capabilities. I've imagined, with limited HW knowledge, quite a few attacks on digital subsystems using analog or RF components. HW gurus I know encounter sneaky stuff like that in 3rd party I.P. regularly and have to mitigate it. Most people have no clue it exists. They're mitigating at the networking channel which is a mere abstraction for more complex stuff going on in chip and interface point. You could even embed a radio in the sucker that turned on when it detected a certain signal in a packet header that NIDS certainly wasn't analyzing. Note that NSA TAO catalog includes active attacks with radars that rely on physical materials in counterfeit parts and SOC's with embedded radios hidden in USB connectors. Quite a few attacks at SOC level software people will never see coming.

perhaps everyone who finds something disappears? </sarcasm> seriously, AMT is stuff of nightmares. runs even when machine is powered off.

by spydum 10y ago

perhaps everyone who finds something disappears? </sarcasm> seriously, AMT is stuff of nightmares. runs even when machine is powered off.

nickpsecurity 10y ago

AMT is the reason I mock anyone here that talks about concerns of backdoors in Intel's RNG's being ridiculous. The whole CPU is backdoored with a backdoor that can run when it's off. Including probably the RNG given debug wires are probably connected to it. Let's not worry about one feature when we have a subversion this big. Biggest irony: they advertise it as a feature for IT management. ;)

Spooky23 10y ago
My team spent a bunch of time looking at AMT as a management tool -- it adds lots of complexity and accomplishes almost nothing that cannot be done easier a half dozen other ways. The only functionality we saw any real use for was an always on VPN and remote wake up where networks block WoL. The other thing that's even stranger is Absolute Software, a little company nobody has ever heard of who somehow got every OEM to bundle their code in system BIOS for theft recovery since the 90s.
- nickpsecurity 10y ago
  re Absolute It seriously reads like a botnet description. I'd have believed them if they said "From the innovators behind Storm comes new endpoint protection..." https://www.absolute.com/en/about/persistence https://www.absolute.com/en/about/persistence
  - teddyc 10y ago
    Glad to see my laptop vendor is not on their list
  - Spooky23 10y ago
    It is pretty disturbing. We were lobbied pretty heavily to evaluate it and did some field tests as a result. You can do some wacky shit with it. There is one mode where you can configure it to delete certain directories or files to screw around with a thief. That can be tweaked to delete files that the system needs. Those modes are persistent, and even after reformatting or replacing the boot media, the agent will reinstall and retrieve its policy file. If you use it with Intel AMT, it can also brick the device permanently. (http://www.intel.com/content/dam/doc/product-brief/mobile-computing-protect-laptops-and-data-with-intel-anti-theft-technology-brief.pdf http://www.intel.com/content/dam/doc/product-brief/mobile-co...) Everyone who tested the product had two questions: "Who is buying this?" and "How do I get this dormant code off my devices?" Laptops aren't cheap, but they aren't expensive enough as an asset to care that much about recovery. And there are arguably better ways to safeguard data assets.
woodman 10y ago
I'd argue that a factory backdoored RNG would be infinitely more dangerous. An AMT exploit wouldn't be passive, and it wouldn't weaken every crypto operation proceeding the time of the attack. Between the two, which do you think an entity with a massive surveillance network, and a history of intentionally weakening security infrastructure, would prefer?
- nickpsecurity 10y ago
  An AMT exploit, if having internal access to CPU, could weaken a RNG plus anything else you can think of. Passive attacks are definitely possible with a backdoor. It just makes a component, hardware or software, do something upon certain trigger conditions. Otherwise it stays silent. Example from high-assurance field: https://calhoun.nps.edu/bitstream/handle/10945/6073/02Mar_AndersonE.pdf;sequence=1 https://calhoun.nps.edu/bitstream/handle/10945/6073/02Mar_An...
  - spydum 10y ago
    I think woodmans argument is that AMT is an active service, you should see network traffic to the management engine and such -- so firewalls/airgaps/SPI should detect and prevent tampering. I think that is a naive view of AMT, it seems far more capable, network management is just one avenue (and it's been proven difficult to comprehensively implement anyways).
    - nickpsecurity 10y ago
      Ahh. I think the hardware parts of my write-up on smartphone risks will help here: https://news.ycombinator.com/item?id=10906999 https://news.ycombinator.com/item?id=10906999 Basically, modern SOC's are mixed-signal systems that have digital, analog, and often RF capabilities. I've imagined, with limited HW knowledge, quite a few attacks on digital subsystems using analog or RF components. HW gurus I know encounter sneaky stuff like that in 3rd party I.P. regularly and have to mitigate it. Most people have no clue it exists. They're mitigating at the networking channel which is a mere abstraction for more complex stuff going on in chip and interface point. You could even embed a radio in the sucker that turned on when it detected a certain signal in a packet header that NIDS certainly wasn't analyzing. Note that NSA TAO catalog includes active attacks with radars that rely on physical materials in counterfeit parts and SOC's with embedded radios hidden in USB connectors. Quite a few attacks at SOC level software people will never see coming.