5 ms·
Igor Skochinsky (of IDA Hex-Rays fame, among others) has been studying Intel ME for quite some time. He gave a nice talk at Breakpoint summarizing what he'd dis
by nneonneo 10y ago
Igor Skochinsky (of IDA Hex-Rays fame, among others) has been studying Intel ME for quite some time. He gave a nice talk at Breakpoint summarizing what he'd discovered (slides here [pdf]: https://github.com/skochinsky/papers/blob/master/2014-10%20%5BBreakpoint%5D%20Intel%20ME%20-%20Two%20Years%20Later.pdf https://github.com/skochinsky/papers/blob/master/2014-10%20%...).
Among other things, he finds that ME is capable of running signed Java code which is pushed to the device. Due to the complexity and size of the Java code, it's quite likely to have bugs.
ME is a bit scary partly because it's a totally closed-source and proprietary component of your computer with full and essentially unfettered access to everything - RAM, peripherals, and network I/O. Any bug in a publicly-accessible component would have the potential to do serious damage. For example, a bug in the network stack might make it possible for attackers to remotely own your box.
- jakeogh 10y agoVery interesting presentation. Is the video available? I had no luck with the standard searches. http://2014.ruxconbreakpoint.com/speakers/#Igor%20Skochinsky http://2014.ruxconbreakpoint.com/speakers/#Igor%20Skochinsky
- tim333 10y agohttps://www.youtube.com/watch?v=4kCICUPc9_8 https://www.youtube.com/watch?v=4kCICUPc9_8 seems to be basically the same talk given at Montreal rather than Melbourne
- Animats 10y agoME is capable of running signed Java code How much firmware is in the thing? Is there a whole JVM in there? An OS? That's a lot of attack surface.
- creshal 10y agoThe ME contains a fully-featured CPU and several MB worth of firmware. That should be able to fit a full Java ME, I think.
- sspiff 10y agoIt is most likely running a Java Card[0] environment, which is a special embedded fork of Java, with a different (more limited) bytecode format. [0]: https://en.wikipedia.org/wiki/Java_Card https://en.wikipedia.org/wiki/Java_Card
- PeCaN 10y agoThere is an embedded RTOS (ThreadX) and an embedded JVM. Curiously the embedded JVM uses JEFF bytecode, a somewhat obscure bytecode format for embedded JVMs. Java Card does _not_ use JEFF¹, meaning it's either an Intel-proprietary JVM or, more likely, they licensed it from an unknown party. And yes, there's a hell of a lot of attack surface. Someone's gonna hack ME one day and have access to an awful lot of computers. ¹ I think. I'm far from an embedded Java expert, but from what I can tell Java Card uses a reduced form of regular Java bytecode and not a totally different format like JEFF. Please correct me if I'm wrong.
- userbinator 10y ago"3 billion devices run Java" indeed.
- danudey 10y ago47% of them intentionally!