4 ms·

Just be mindful of the fact that you've only increased the difficulty of an attack, the vulnerability still exists. I've got a lenovo that regularly sends out

by woodman 10y ago

Just be mindful of the fact that you've only increased the difficulty of an attack, the vulnerability still exists. I've got a lenovo that regularly sends out dhcp broadcasts, despite no dhcp code being on disk - it could just as easily call home with dns (sending recursive requests to the same ip as the last successful user initiated query). The only way to fix a ring -N rootkit is to remove ring -N.

lucb1e 10y ago
> sends out dhcp broadcasts, despite no dhcp code being on disk Woah, that's not just sitting there but actually actively doing stuff while bypassing your kernel. This sounds a lot more scary even though I know nothing about this Lenovo dhcp thing, observing it just makes it a lot more real to me. Do you have any more information on this?
- woodman 10y ago
  It has been several years since I dug into it, so I can really only offer keywords: AMT[0], which is a component within ME[1]. Also see https://media.ccc.de/v/30C3_-_5380_-_en_-_saal_2_-_201312291830_-_persistent_stealthy_remote-controlled_dedicated_hardware_malware_-_patrick_stewin https://media.ccc.de/v/30C3_-_5380_-_en_-_saal_2_-_201312291... EDIT: I forgot to mention Computrace, the BIOS anti-theft service. IIRC that interacts with ME. [0] https://en.wikipedia.org/wiki/Intel_Active_Management_Technology https://en.wikipedia.org/wiki/Intel_Active_Management_Techno... [1] https://www.kernel.org/doc/Documentation/misc-devices/mei/mei.txt https://www.kernel.org/doc/Documentation/misc-devices/mei/me...
Animats 10y ago
It would be useful to boot the machine with FreeDOS (which has no networking code) and see what, if anything, comes out the Ethernet port.
- woodman 10y ago
  No need, everything is compiled from source, no dhcp to be found, and the kernel's network stack shows no traffic - but the switch does. It is no secret that Intel ME does whatever it wants with the ethernet port.

by woodman 10y ago

lucb1e 10y ago

> sends out dhcp broadcasts, despite no dhcp code being on disk Woah, that's not just sitting there but actually actively doing stuff while bypassing your kernel. This sounds a lot more scary even though I know nothing about this Lenovo dhcp thing, observing it just makes it a lot more real to me. Do you have any more information on this?

woodman 10y ago
It has been several years since I dug into it, so I can really only offer keywords: AMT[0], which is a component within ME[1]. Also see https://media.ccc.de/v/30C3_-_5380_-_en_-_saal_2_-_201312291830_-_persistent_stealthy_remote-controlled_dedicated_hardware_malware_-_patrick_stewin https://media.ccc.de/v/30C3_-_5380_-_en_-_saal_2_-_201312291... EDIT: I forgot to mention Computrace, the BIOS anti-theft service. IIRC that interacts with ME. [0] https://en.wikipedia.org/wiki/Intel_Active_Management_Technology https://en.wikipedia.org/wiki/Intel_Active_Management_Techno... [1] https://www.kernel.org/doc/Documentation/misc-devices/mei/mei.txt https://www.kernel.org/doc/Documentation/misc-devices/mei/me...

Animats 10y ago

It would be useful to boot the machine with FreeDOS (which has no networking code) and see what, if anything, comes out the Ethernet port.

woodman 10y ago
No need, everything is compiled from source, no dhcp to be found, and the kernel's network stack shows no traffic - but the switch does. It is no secret that Intel ME does whatever it wants with the ethernet port.