4 ms·

As another example, take the newer remote management "features" included in modern BIOSes that run on a separate microcontroller in the system and allow access

by 1001101 10y ago

As another example, take the newer remote management "features" included in modern BIOSes that run on a separate microcontroller in the system and allow access to network, memory, peripherals, etc., even if the computer is shut down (but still on mains). Let's imagine someone had an exploit or the keys for that. With that hole, you could never fully lock down. Sneakernet over a wide airgap is a good policy.

Bartweiss 10y ago
Ugh, yep. I totally forgot about how many machines come with entire parallel communication systems. The Intel Management Engine, for example, is horrific. It's a machine-compromising threat built into the CPU and (as far as I know) totally unremovable. I haven't heard about any kind of compromise, but it's far from impossible. Well-meant, sure (why make two production runs at higher expense), but that's not very comforting. We already know the US government intercepts some machines in transit; silently enabling and owning the IME would be an elegant way to beat a physical inspection on delivery. It's only reasonable to assume China and similar players do the same. (If the IME is disabled, will the CPU still complain if you physically destroy the thing? Does anyone know?) There's also the rather nasty proof-of-concept attack where air-gapped machines output audio data at ultrasonic frequencies to beat the gap. Sure, it takes initial compromise to activate, but that's a plausible risk for someone running nation-state defense. Sneakernet continues to be a solid policy. I don't remember who, but some notable security researcher talking about Lulzsec summarized the issue with "If I were crossing a government, my opsec would be a stolen library card in a city I don't live in."
- cryptarch 10y ago
  Slideshow on level -3 rootkit: http://me.bios.io/images/6/61/Ring_-3_Rootkits.pdf http://me.bios.io/images/6/61/Ring_-3_Rootkits.pdf This slideshow discusses a rootkit in the old Intel ME chipset (which comes with most Core2Duo/Core2Quad processors). The Intel ME can't fully be disabled because the CPU expects a heartbeat from it. There have been successful attempts to disable large portions of the Intel ME code, but not all of it. These guys are looking to replace the Intel ME's firmware with a fully open-source version: http://me.bios.io/Main_Page http://me.bios.io/Main_Page
- khedoros1 10y ago
  > If the IME is disabled, will the CPU still complain if you physically destroy the thing? Does anyone know? If I'm remembering correctly, if the CPU doesn't receive a heartbeat from IME within 30 minutes, it shuts down the hardware.[1]. There are also different levels of the thing. There's a basic level that handles some kind of low-level system monitoring. The remote access stuff is usually marketed as "vPro", and it's sold as a premium feature. That's the one with direct access to the networking hardware, transmitting packets over the same physical interface, but using its own unique MAC address. [1] https://hackaday.com/tag/intel-management-engine/ https://hackaday.com/tag/intel-management-engine/
  - nickpsecurity 10y ago
    With how ASIC & firmware companies do things, best to assume they're all the same thing until proven otherwise. As in, the circuitry and software for doing any of that is there but only made visible/usable to by a configuration that changes the more they pay. This is the most economical thing for hardware makers to do as they build just one thing instead of several things. This was also the trick some hard disk makers use where they put the same platter in all the drives but a firmware option limited how much was visible to user (less money = less visible).
    - khedoros1 10y ago
      So the next question would be whether it's possible to remotely reconfigure the "non-vPro" machine to activate the features, in which case it could be considered a direct equivalent.
      - nickpsecurity 10y ago
        And that's what we don't and can't know the answer to since it's a black box. Hence, that circuitry can't ever be present on a machine if one is worried about potential compromises or subversions of it.
      - Bartweiss 10y ago
        Derefr's answer in this thread suggests that you can insulate against this regardless of how the vPro activation works; not all motherboards support the parallel packet stream, so you can get a vPro incompatible motherboard and trust that even if there is a "wake and activate" command it won't be received.
cryptarch 10y ago
It's already been cracked: http://me.bios.io/images/6/61/Ring_-3_Rootkits.pdf http://me.bios.io/images/6/61/Ring_-3_Rootkits.pdf Ok, not for the latest chipset (just most of the Core2Duo/Core2Quad generation), but if I had that exploit I wouldn't be shouting it off the rooftops.

by 1001101 10y ago

Bartweiss 10y ago

Ugh, yep. I totally forgot about how many machines come with entire parallel communication systems. The Intel Management Engine, for example, is horrific. It's a machine-compromising threat built into the CPU and (as far as I know) totally unremovable. I haven't heard about any kind of compromise, but it's far from impossible. Well-meant, sure (why make two production runs at higher expense), but that's not very comforting. We already know the US government intercepts some machines in transit; silently enabling and owning the IME would be an elegant way to beat a physical inspection on delivery. It's only reasonable to assume China and similar players do the same. (If the IME is disabled, will the CPU still complain if you physically destroy the thing? Does anyone know?) There's also the rather nasty proof-of-concept attack where air-gapped machines output audio data at ultrasonic frequencies to beat the gap. Sure, it takes initial compromise to activate, but that's a plausible risk for someone running nation-state defense. Sneakernet continues to be a solid policy. I don't remember who, but some notable security researcher talking about Lulzsec summarized the issue with "If I were crossing a government, my opsec would be a stolen library card in a city I don't live in."

cryptarch 10y ago
Slideshow on level -3 rootkit: http://me.bios.io/images/6/61/Ring_-3_Rootkits.pdf http://me.bios.io/images/6/61/Ring_-3_Rootkits.pdf This slideshow discusses a rootkit in the old Intel ME chipset (which comes with most Core2Duo/Core2Quad processors). The Intel ME can't fully be disabled because the CPU expects a heartbeat from it. There have been successful attempts to disable large portions of the Intel ME code, but not all of it. These guys are looking to replace the Intel ME's firmware with a fully open-source version: http://me.bios.io/Main_Page http://me.bios.io/Main_Page
khedoros1 10y ago
> If the IME is disabled, will the CPU still complain if you physically destroy the thing? Does anyone know? If I'm remembering correctly, if the CPU doesn't receive a heartbeat from IME within 30 minutes, it shuts down the hardware.[1]. There are also different levels of the thing. There's a basic level that handles some kind of low-level system monitoring. The remote access stuff is usually marketed as "vPro", and it's sold as a premium feature. That's the one with direct access to the networking hardware, transmitting packets over the same physical interface, but using its own unique MAC address. [1] https://hackaday.com/tag/intel-management-engine/ https://hackaday.com/tag/intel-management-engine/
- nickpsecurity 10y ago
  With how ASIC & firmware companies do things, best to assume they're all the same thing until proven otherwise. As in, the circuitry and software for doing any of that is there but only made visible/usable to by a configuration that changes the more they pay. This is the most economical thing for hardware makers to do as they build just one thing instead of several things. This was also the trick some hard disk makers use where they put the same platter in all the drives but a firmware option limited how much was visible to user (less money = less visible).
  - khedoros1 10y ago
    So the next question would be whether it's possible to remotely reconfigure the "non-vPro" machine to activate the features, in which case it could be considered a direct equivalent.
    - nickpsecurity 10y ago
      And that's what we don't and can't know the answer to since it's a black box. Hence, that circuitry can't ever be present on a machine if one is worried about potential compromises or subversions of it.
    - Bartweiss 10y ago
      Derefr's answer in this thread suggests that you can insulate against this regardless of how the vPro activation works; not all motherboards support the parallel packet stream, so you can get a vPro incompatible motherboard and trust that even if there is a "wake and activate" command it won't be received.

cryptarch 10y ago

It's already been cracked: http://me.bios.io/images/6/61/Ring_-3_Rootkits.pdf http://me.bios.io/images/6/61/Ring_-3_Rootkits.pdf Ok, not for the latest chipset (just most of the Core2Duo/Core2Quad generation), but if I had that exploit I wouldn't be shouting it off the rooftops.