21 ms·

Escalation of Privilege Advisory

• throwaway2048 10y ago
  Its important to note, that Intel has a VERY strong incentive to downplay the seriousness of this problem. Other sources have indicated that its possible on any post 2008 Intel system, its just not possible remotely. Since we don't know the exact nature of this exploit, things are extremely dangerous for ALL Intel systems right now.
  • wyldfire 10y ago
    Seems like it could be a risk to the GCP/AWSs of the world.
    • wmf 10y ago
      AFAIK Xeons don't have AMT/ISM/SBT and thus aren't affected. Servers may be affected by the absolute shit firmware living in their Aspeed BMCs, however.
      • pquerna 10y ago
        Many Xeon SKUs include the Management Engine, which at times has seemed to share many of the features of AMT/SBT/etc, but its unclear on the exact attack vector for this vulnerability. Having said that, the ME is so opaque, the same type of vulnerability could easily exist.
      • jacquesm 10y ago
        There are Xeons with AMT, at least the 3400, possibly more. edit: E3-1200 as well, same kind of application, single CPU workstation chip.
    • btown 10y ago
      Both GCP/AWS already probably have (or had, if they were alerted before public disclosure) security teams probing their internal systems to see if they're vulnerable, and install firmware patches. The danger is more medium-to-large organizations whose internal clouds and desktop systems are impossible to patch at scale.
    • dom0 10y ago
      If remote management is used for servers, it's normally IPMI with a completely separate baseboard controller that has its own NIC connected to a physically separate network [although some boards cheap out on that, notably older INTEL boards, where the separate NIC is an option you have to buy]. No mainstream (2-way) server has AMT, anyway.
  • kakarot 10y ago
    I'm trying to find out if this applies to enthusiast processors that lack vPro. I purchased my chip with this in mind. Any information would be appreciated. https://www.orwell1984.today/no_vpro_for_me.html https://www.orwell1984.today/no_vpro_for_me.html
    • wmf 10y ago
      "This vulnerability does not exist on Intel-based consumer PCs."
      • kakarot 10y ago
        "There are several features that AMT provides that are present in consumer systems even though the ‘technology’ isn’t there. This is one of the arguments that SemiAccurate has had with Intel security personnel over the years, we have begged them to offer a SKU without the AMT hardware for just this very reason. Intel didn’t, the pressure to lock corporate customers in to their silicon was too high." Intel is playing this down heavily. This seems to be locally exploitable on consumer chips. Correct me if that is wrong, please. EDIT: I'm not one to give a shit about downvotes, but it would be nice if someone could actually respond to me with a legitimate retort instead of trying to bury this post. I am asking to be proved wrong for my own sanity. Let's be mature about this.
        • wmf 10y ago
          Basically you're asking us to prove a negative about undocumented proprietary firmware. Someone could spend years fully reverse-engineering ME firmware to prove these theories wrong, and then people would just say "but what about version N+1?"
          • kakarot 10y ago
            Not really. The evidence currently points to all basically all commercial Intel chips in the last ~10 years being vulnerable to this. In addition to correcting you about Intel's blatant lie, I was asking if anyone more qualified than me could confirm or deny whether it affects certain enthusiast chips that seem to lack certain vPro features. My question was not about if consumer chips are affected, because they are if they have the ME engine. However, the enthusiast chips I reference supposedly do not even have a functioning ME system to reverse-engineer in the first place. Asking for confirmation of such by a qualified individual is reasonable and answerable.
• tomc1985 10y ago
  This advisory should have been published years ago. HN thread from earlier today: https://news.ycombinator.com/item?id=14237266 https://news.ycombinator.com/item?id=14237266
  • deleted 10y ago
    [deleted]
  • Clownshoesms 10y ago
    To be fair, the original post is coming from an AdmiralAsshat. What can anyone do? This corporate free-for-all seems like it's established (de-facto) in the United States, and all countries must bow to the US because of their military might. We pollute, consume, lie, steal and cheat each other like it's normal practice. Where did we go wrong.
    • mtrycz 10y ago
      > Where did we go wron? Closed source. It's a choice. To be fair, some (most?) of the advances wouldn't have been possible without economic competition between manufactors, but closed source/closed design/closed production is bound to produce result like these. So, i don't know... Tradeoffs?
      • jacquesm 10y ago
        > It's a choice. In this case it really isn't and that is a huge problem.
• 1001101 10y ago
  You have to wonder, is this the only/last one of its kind?
  • jacquesm 10y ago
    I'd very much not bet on this being the only or the last bug. See it more as a confirmation that this system is not as secure as they thought it was and that will cause a lot of people to now be encouraged to look at it closer.
    • hackuser 10y ago
      > confirmation that this system is not as secure as they thought it was I wonder if that's true. Intel has many smart security professionals working for it, and probably they expected there would be exploits; they exist on every system. I'm reading a book about Intel Management Engine (the independent subsystem on which includes AMT runs) by an Intel engineer[0], and they are clear that their model mitigates risk but nowhere do they say that it's invulnerable. In fact, they include responses to exploits in their discussion of their security process. It's as secure as I thought it was; of course there are some vulnerabilities. The real issue to me is how effectively they mitigate it. [0] Highly recommended to learn about ME and AMT: Platform Embedded Security Technology Revealed: Safeguarding the Future of Computing with Intel Embedded Security and Management Engine by Xiaoyu Ruan, published by Apress (2014)
      • jacquesm 10y ago
        Systems like this ought to really be bullet-proof. You can do all you want to secure the other layers (the ones that you have regular access to), this one bypasses all of that and gives an attacker the equivalent of physical access to the hardware. To me that's a level above the kind of flaw that can be attributed to faulty system administration, operating system or application bugs. It's essentially a monkey riding along on your shoulder that suddenly turns out to be malicious. To me these systems are accidents waiting to happen. And this won't be the last bug either, you can bet that AMT and ME will receive a lot more hostile attention than they got so far in the next coming months.
• mastax 10y ago
  This seems to corroborate what SemiAccurate published earlier: https://semiaccurate.com/2017/05/01/remote-security-exploit-2008-intel-platforms/ https://semiaccurate.com/2017/05/01/remote-security-exploit-... Crazy. A lot of the HN discussion was incredulous based on SA's reputation. https://news.ycombinator.com/item?id=14237266 https://news.ycombinator.com/item?id=14237266
  • sjburt 10y ago
    It's rather unclear whether this exploit is related to the one the SA thinks they have found, and at the time SA published their article it was unknown whether any actual exploit existed--the only real public information that SA had in their article was that Intel had distributed a new firmware.
  • colemannugent 10y ago
    I was really hoping that time would prove them wrong, but on the other hand, it was only a matter of time until a vuln like this was discovered.
    • nickpsecurity 10y ago
      Fiora Aeterna posted this about SemiAccurate on Lobsters with a hilarious part about the effect of triangles on SIMD used in graphics pipelines. "Semiaccurate is well-known for posting speculation as fact, but worse, they often have major misunderstandings of the material they report on, leading to errors, incorrect deductions, wild speculation, etc. My favorite example (a real quote, not satire): 'You probably don’t remember but the Midgard architecture you know and love is a four wide architecture four stages deep. Each cycle one thread, aka a triangle or quad, is issued to the execution units. Since they are four wide they can take a full quad a cycle which is a really good thing. Unfortunately most game developers seem stuck on triangles which tend to use only three of the SIMD vector lanes. This is bad but modern power gating means it won’t consume hideous amounts of power, it just doesn’t utilize the hardware to its maximum potential often. The technical term for this is inefficiency.'"
      • 10y ago
• bjt2n3904 10y ago
  The tools they listed are windows executables. Am I vulnerable to this on a Linux System? If so, any way to assess vulnerability, and patch things?
  • biktor_gj 10y ago
    Yes. This affects the management engine, an independent firmware that runs in your system wether it runs linux, windows BSD. It is still running even if your computer is off (in fact, one of its capabilities is to turn it on remotely). Edit to add: independent of what Intel might say about this (given it seems it has taken 5 years to disclose this and 5 major firmware versions I won't trust too much what they say about consumer pcs not being affected). Check if your cpu and motherboard support AMT and if it is enabled. All workstations I've worked with have it, but there are a lot of machines that have it disabled by default unless you specifically turn it on. So, you might be affected if you have a "supported" processor and (I guess) an Intel NIC onboard and wired, and remote capabilities enabled.
    • ryanlol 10y ago
      It's not entirely clear if this'll be exploitable except in the rather rare scenario where someone has actually set up AMT.
    • wiredfool 10y ago
      I'm mostly interested in if servers with ipmi (supermicro in particular) are vulnerable, and to what degree. If it's the network with the ipmi ports, that's one thing, but if it's public facing... Much stuff is going to be hitting fans.
      • amluto 10y ago
        IIUC the SuperMicro BMC is different software on a separate third-party chip. So it's reasonably likely to be vulnerable, but not to this particular vulnerability.
      • ams6110 10y ago
• teoruiz 10y ago
  Is there any indication the vulnerability is present on Intel-based Macs?
  • ryanlol 10y ago
    I don't see any reason why it wouldn't be. However it doesn't seem immediately clear whether or not it'd be exploitable under default configs.
  • wmf 10y ago
    It's not present because Macs don't have AMT.
    • ryanlol 10y ago
      There's been a plenty of Macs with vPRO CPUs. Unless Apple is getting custom CPUs or CPU firmware then it would seem that Macs do have AMT. No? Enabling it is tremendously difficult though AFAIK.
      • wmf 10y ago
        vPro isn't a CPU, it's a particular combination of CPU, PCH (southbridge), Intel NIC/WiFi, and AMT firmware. There's no evidence that Macs have AMT or vPro.
        • apaprocki 10y ago
          Well, Intel does a particularly bad job of explaining whether this exists. My MBP CPU is a Core(TM) i7-4850HQ, and Intel's ark site says it has vPro.
          • wmf 10y ago
            You're right about that. Intel's product lineup is a huge mishmash of optional features that no one understands and now it's going to bite them. (But not really, because what else are you going to buy? A Ryzen laptop?)
• scarybeast 10y ago
  Wow. A _remotely_ exploitable Intel firmware vulnerability? You don't see one of those every day. My instinctive reaction is that this is ridiculously serious, although I'd need to see the full technical details. It's worth noting that the reference to "system privileges" being attained likely refers to something much more privileged than we would normally ascribe to "system privileges". Normally, "system privileges" would mean something SYSTEM on Windows or root on Linux. In the event of "system privileges" in the management component, remember that the main CPU is a slave to this thing.
  • AsyncAwait 10y ago
    Something Richard Stallman, among others, was sounding alarm bells for years.
    • MohammadLee 10y ago
      And yet here we are, unable to properly deactivate "features" such as Intel ME.
      • MichaelGG 10y ago
        ... Here we are, with an exploit that only affects people that enabled a remote management feature. If Intel had made this an optional addon that required a physical switch to enable, approximately the same number of people would be affected today, since it requires provisioning. It's not like every Intel system is silently waiting for an exploit payload.
        • 0x0 10y ago
          It looks like this also affects systems where the feature is not enabled, but for "local" attackers. Does that mean exec as "www-data" or "nobody" accounts (what about VMs?). Making every little wordpress plugin vulnerability into a CPU-rooting hack?
          • 10y ago
• Sunset 10y ago
  This is just what you would expect would eventually happen with AMT. Frankly it should be possible to physically disconnect a jumper on the motherboard that completely PHYSICALLY disables things like AMT.
  • MichaelGG 10y ago
    And this exploit would have the same impact: you have to set up this feature in order to be affected.
    • rbanffy 10y ago
      Except in large companies it's almost always enabled...
      • palunon 10y ago
        But then these companies wouldn't use the hardware disable, would they ?
        • Sunset 10y ago
          I would. And then I'll play dump when the sysadmin asks why my machine isn't in the list.
          • adrianN 10y ago
            Then the sysadmin enables it and if you disable it again they fire you.
    • Kalium 10y ago
      Not entirely. It's locally exploitable even without configuration. Ideally, a physical disable would prevent that.
    • wfn 10y ago
      No. > An unprivileged local attacker could provision manageability features gaining unprivileged network or local system privileges on Intel manageability SKUs This appears to imply an "exploit $site-backend -> provision AMT -> be vulnerable to network/local attack (for provisioned AMT) -> get AMT system privileges" route.
• tomc1985 10y ago
  Can the remote exploitation aspects of this advisory affect systems behind NAT?
  • jacquesm 10y ago
    That very much depends on the details. The bits that are available right now suggest that someone has figured out how to jump the gap between the 'public' and the 'secure' networks. If that's true a NAT would not help once packets are forwarded. It would really help if Intel came clean and indicated exactly what the exposure is here.
    • tomc1985 10y ago
      It's easy to think of ways to jump NAT -- port forwarding, UPnP, reverse tunnels, so on. To me the real question is whether or not this exploit can jump NAT without needing any of other hacks or techniques or (possibly unwitting) user intervention.
  • dom0 10y ago
    NAT is not a firewall. It's not intended to protect, and usually it doesn't. There are many ways to circumvent it...
    • jacquesm 10y ago
      That's true, but for all intents and purposes NAT is a poor-mans firewall. Many people don't know any better or that's what keeps them safe, they wouldn't know the difference between multiplexing a bunch of machines behind a single IP using port forwarding and firewalling because if a port isn't forwarded it appears as if it is firewalled. That's a legacy bit that a lot of people will have a hard time adjusting to when IPV6 becomes more mainstream. Basically every piece of gear in your house can have a routable IP under that scheme and then suddenly your edge router configuration becomes a lot more important.
      • 5ilv3r 10y ago
• lorenzhs 10y ago
  Thankfully this doesn't look quite as serious as the SemiAccurate article earlier today made it look (it's AMT, not ME), and doesn't affect consumer CPUs. But if you have AMT provisioned, then holy cow this is really really bad. Remotely exploitable is just wow.
  • jacquesm 10y ago
    It's bad enough. And SemiAccurate did live up to its name.
    • lorenzhs 10y ago
      Agreed, it's still very bad. I don't want to imagine how many company PCs are affected by this, and which percentage of those is going to get the firmware update.
    • nobodyorother 10y ago
      Interestingly, they got the versions right, if not the feature (AMT vs ME).
      • deleted 10y ago
        [deleted]
  • kuschku 10y ago
    Apparently, systems with vPRO functionality are also affected, which would include almost all Xeons[1], and many of the upper range consumer chips. If that's the case, this might really become huge. [1] http://ark.intel.com/Search/FeatureFilter?productType=processors&VProTechnology=true http://ark.intel.com/Search/FeatureFilter?productType=proces...
    • jacquesm 10y ago
      VPro is not in all Xeons, AMT is in only two Xeons that I've been able to find so far, 3400 and E3-1200.
• deleted 10y ago
  [deleted]
• 0x0 10y ago
  Where do I find this "Windows Device Manager" in Debian 8?
  • deleted 10y ago
    [deleted]
• Jach 10y ago
  > "This vulnerability does not exist on Intel-based consumer PCs." How does Intel define an Intel-based consumer PC?
  • s_kilk 10y ago
    For example, would a Thinkpad qualify as consumer?
    • jacquesm 10y ago
      Cheap ones: probably yes, business grade ones: probably not. Nice list here: http://www.thinkwiki.org/wiki/Intel_Active_Management_Technology_(AMT) http://www.thinkwiki.org/wiki/Intel_Active_Management_Techno...
      • abecedarius 10y ago
        I have a Thinkpad X1 Carbon; it's not on this list, but it did have AMT enabled in the BIOS when I checked. I wouldn't take that list as definitive.
        • jacquesm 10y ago
          Ugh. Someone should set up a github page of affected systems.
          • kuschku 10y ago
            Starting to believe me now that far more systems are affected? We had a little subthread a few hours ago where you still claimed most consumer and server systems would be unaffected.
            • jacquesm 10y ago
              > Starting to believe me now that far more systems are affected? No, that system still falls under Intel's advisory, it's just the Lenovo page that doesn't help to distinguish. It was already known that laptops could be affected. Your claims were about 'All systems running VPro' and 'All Xeons'. Neither of those claims has - so far - being substantiated, the only Xeons affected are the ones - though there may still be more - that I dug up earlier. Really, you should let this go or come up with actual proof for your claims it is getting annoying. You pollute this whole thread with a bunch of unsubstantiated claims presented as fact. It's almost as if you would love for it to be true that all those other systems would be affected too. Don't get me wrong, I'm very much against ME and any non-free software on my machine starting with the BIOS but I'm also not going to wish for just about every server on the planet to be remotely hacked just to prove my point.
• jacquesm 10y ago
  So, who is taking bets here: Accident or Malice?
  • duncan_bayne 10y ago
    Why not both? A vulnerability that's created by accident, and perpetuated and exploited maliciously.
  • mschuster91 10y ago
    Given that no software is error-proof, I'm betting on accident here.
    • AnimalMuppet 10y ago
      I can buy that it's accident that this vulnerability exists. It's still gross stupidity/incompetence/negligence (/malice?) that this vulnerability ever had the possibility of existing. That is, the feature should never have been implemented, to prevent exactly this scenario.
  • wyager 10y ago
    I'm guessing somewhere in between. Putting AMT on chips in the first place was malicious. Even if this was unintentional, it's still intel's fault. If an intentional backdoor is homicide, and a simple software mistake is manslaughter, this is somewhere around negligent homicide.
    • MichaelGG 10y ago
      Ok, so you're Intel, and your business customers say they'd like to remotely fix their workstations via IPKVM and other stuff so they don't need to dispatch a tech each time someone wedges their laptop. Someone suggests adding AMT to certain chips then charging to enable it. You say that's evil. Why and what's your suggestion? With the details released so far, this isn't remotely exploitable unless your company set the feature up. And if Intel didn't provide this feature, you'd get it from the OEM just like Dell's DRAC or HP iLO.
• orblivion 10y ago
  It's beyond pathetic that we're scrambling for rumors on hacker news to figure out if we're affected by this. Security news is in need of serious consideration.
  • altharaz 10y ago
    Unfortunately, Security Advisories are formatted according to the Vendor wills and needs. Some vendors give you a lot a details, some are very obscure. There is a need for a "standard" Security Advisory, on the same base that there is a "standard" emerging from Responsible Disclosure.
    • orblivion 10y ago
      The standard needs a few things like: * Easy, unambiguous way of determining whether you're affected * What risks are for each condition (have an AMT ready CPU, have AMT enabled, etc) * Which patches fix which risks And more. This will require some thought, and hopefully some UX people.
    • noja 10y ago
      What about the CVE?
      • deleted 10y ago
        [deleted]
• rbanffy 10y ago
  Isn't security by obscurity awesome?
  • deleted 10y ago
    [deleted]
• nthcolumn 10y ago
  Luckily my old rack is too old to have ME. But are there alternatives out there when these old power-edge warriors finally die or do I have to start building a beowolf out of raspberry pis?
  • swiley 10y ago
    Ah yes, broadcom, the poster child of openness.
  • wmf 10y ago
    This has nothing to do with servers.
    • jacquesm 10y ago
      Almost. The Xeon 3400 apparently also has AMT but that's hopefully a rare beast in DC's. It's more of a workstation chip.
  • milcron 10y ago
    There is OpenPOWER, or ARM. Unfortunately all new Intel chips have the Management Engine, and all new AMD chips have the equivalent Platform Security Processor.
    • mikehollinger 10y ago
      If you want to inspect the OpenPOWER firmware[1] or OpenBMC[2] - check out github for either project. [1] https://github.com/open-power/docs/blob/master/README.md https://github.com/open-power/docs/blob/master/README.md [2] https://github.com/openbmc/openbmc/wiki https://github.com/openbmc/openbmc/wiki
• nthcolumn 10y ago
  Anyone expecting another shadowbrokers reveal soon...?
• YCode 10y ago
  Is it just me or is there almost no information in this advisory besides telling people to update their firmware? I don't know what this vulnerability is or how it is exploited and I barely know what systems of mine might be affected by it.
  • jacquesm 10y ago
    Yes, which makes it really annoying because the one thing you want to know is how you can see if this has already been exploited which is the difference between a system wipe and just a firmware upgrade.
    • chopin 10y ago
      I would truest the message "has been exploited" but not the message "has not been exploited". Who could state the latter with any sincerity? Intel could do state this only with confidence if they'd monitor every of their systems sold, which I sincerely hope is not the case. If you have vulnerable, critical systems you need to consider them being exploited. The bug was there for years and for all what we know at least state actors have been going to great lengths to exploit vulnerabilities they could get hold of.
      • jacquesm 10y ago
        That's correct. You can't prove a negative, so this is always true in the context of a potential breach.
• mooneater 10y ago
  Can someone confirm, is it possible to tell via inspecting /proc/cpuinfo or similar, if my system may be affected?
  • jacquesm 10y ago
    BIOS settings, check if AMT is enabled. That may not be the whole story though, Intel is really not very helpful with the text of this announcement.
• Glyptodon 10y ago
  They really don't make it easy to parse this. Wish they just had a list of models/skus.
  • reynoldsbd 10y ago
    It's specifically a vulnerability in system firmware, and they provide a nice table listing the affected ranges of firmware versions.
  • hackuser 10y ago
    I would guess you saw this, but just in case: Step 1: Determine if you have an Intel® AMT, Intel® SBA, or Intel® ISM capable system: https://communities.intel.com/docs/DOC-5693 https://communities.intel.com/docs/DOC-5693. If you determine that you do not have an Intel® AMT, Intel® SBA, or Intel® ISM capable system then no further action is required. Step 2: Utilize the Detection Guide to assess if your system has the impacted firmware: https://downloadcenter.intel.com/download/26755 https://downloadcenter.intel.com/download/26755. If you do have a version in the “Resolved Firmware” column no further action is required to secure your system from this vulnerability.
    • eikenberry 10y ago
      Step 2 is pretty useless if you don't use Windows.
• wyager 10y ago
  Are Apple computers with Intel CPUs vulnerable? It seems like everyone in the security community saw this coming. I hope this serves as enough of a warning to, at the very least, get Intel to stop putting spyware in all their CPUs. Ideally, this helps push large hardware manufacturers away from proprietary CPU manufacturers entirely. Open source hardware collaborations could (and should) do to Intel what open source OSs did to Microsoft. Doesn't mean that Intel will go away, but their presence should absolutely be reduced.
  • chillydawg 10y ago
    The spyware is there due to customer demand. All the biggest customers of Intel buy in vast quantity and need these features for their fleet management. It ain't going nowhere.
    • pmontra 10y ago
      I understand what those customers need AMT for but the end result is that somebody else could be managing their fleets too and this is not something they want. I expect to see some lock down in the next years.
• berberous 10y ago
  If I have a personal computer at home (not managed by an IT department), is it at risk, or does Intel ME need to be enabled somehow? What was Intel ME trying to solve that couldn't be done without it?
  • hackuser 10y ago
    > What was Intel ME trying to solve that couldn't be done without it? ME is an independent platform that runs parallel with the main CPU. ME has it's own CPU, memory, bus, etc. The general purpose is to provide an isolated subsystem on which to run security and management applications. AMT's out-of-band remote access allows support to access the computer when the OS isn't or can't be loaded. From the IT and security perspectives, these features are very valuable. EDIT: If you want more info: https://news.ycombinator.com/item?id=14242213 https://news.ycombinator.com/item?id=14242213
• ChuckMcM 10y ago
  I had an interesting experience with the AMT technology fairly recently. I had updated my desktop's windows partition from Win7 to Win10 when it was free to do so, and then gone back to Linux. And because some tax information was in Quickbooks I booted it into Windows mode and it was trying to update to the latest Win10 and failing. I checked with Microsoft support and they had me download a tool to allow them to fix it, which kept failing to work. Eventually I tracked it down to the fact that I had previously disabled "Intel Management Engine Interface" in my device manager (back when there was a lot of discussion about it). Re-enabling it allowed their tool to loot through the system and fix what ever bits had given the OS fits, and then once it was running and current again, I disabled it again :-). Based on the Intel documentation, my Surface Pro 4 is vulnerable (its a 7th gen with 11.6.0.1042) but its also disabled and I'm not sure whether or not that 'saves' me here (as the driver in the OS is disabled but it is unclear if a local network attack would work or not).
  • microwavecamera 10y ago
    It says on the page "This vulnerability does not exist on Intel-based consumer PCs." I'm not sure if that's true or not but Intel seems to think you'll be ok. EDIT: Ok so it seems all Intel CPUs that have AMT from Nehalem processors to the current Kaby Lake's are vulnerable. Even if AMT isn't enabled, it's still vulnerable to a local privilege escalation to ring 0. So all you people that have Celeron or AMD CPUs and got picked on for years, enjoy your moment of schadenfreude. https://semiaccurate.com/2017/05/01/remote-security-exploit-2008-intel-platforms/ https://semiaccurate.com/2017/05/01/remote-security-exploit-...
    • kbenson 10y ago
      I have a feeling we'll all know soon enough the exact definition Intel uses for "consumer PCs" and how it differs from the reality of what consumers end up buying.
      • microwavecamera 10y ago
        I know! I have a thinkpad with a 3rd gen core i5 and it has AMT. Once this exploit gets out in the wild it would be only a matter of time before it expands to other Intel CPUs with AMT.
• zie 10y ago
  on windows you can run this: netstat -na | findstr "\<16993\> \<16992\> \<16994\> \<16995\> \<623\> \<664\>" to see if you have LMS running, which apparently is required to remotely exploit it. PDF with details here: https://downloadmirror.intel.com/26754/eng/INTEL-SA-00075%20Mitigation%20Guide%20-%20Rev%201.1.pdf https://downloadmirror.intel.com/26754/eng/INTEL-SA-00075%20...
• orblivion 10y ago
  /r/netsec pointed to what seems to be the mitigation guide. It has the same "SA-00075": https://www.reddit.com/r/netsec/comments/68oy3q/pdf_intelsa00075_mitigation_guide/ https://www.reddit.com/r/netsec/comments/68oy3q/pdf_intelsa0... It talks about turning something off with a Windows executable. Was it necessarily on to begin with? Anybody familiar with this product? I thought this was a sub-OS level thing.
  • zie 10y ago
    one most of our windows machines it's on. You can run this: netstat -na | findstr "\<16993\> \<16992\> \<16994\> \<16995\> \<623\> \<664\>" to see if it's actively running. the binary is LSM.exe. Intel recommends you erase the file. see the PDF for details. Apparently this will make it locally exploitable only now and A firmware fix is required to completely fix the problem.
• hackuser 10y ago
  I was just doing some research on Intel Management Engine (ME), the independent subsystem on which AMT and other security applications run. Since I have them at my fingertips, perhaps these will be of use: * By far the best place to learn about ME and AMT that I found, though it's a few years old: Platform Embedded Security Technology Revealed: Safeguarding the Future of Computing with Intel Embedded Security and Management Engine by Xiaoyu Ruan (security researcher with the Platform Engineering Group at Intel). Apress (2014) * Intel x86 considered harmful by Joanna Rutkowska, founder of Qubes (2015) http://invisiblethings.org/papers/2015/x86_harmful.pdf http://invisiblethings.org/papers/2015/x86_harmful.pdf * How to Become the Sole Owner of Your PC by Maxim Goryachy, Mark Ermolov, Positive Technologies [haven't read this one in awhile] https://github.com/ptresearch/me-disablement/blob/master/How%20to%20become%20the%20sole%20owner%20of%20your%20PC.pdf https://github.com/ptresearch/me-disablement/blob/master/How... * How Purism avoids Intel’s Active Management Technology by Purism https://puri.sm/learn/avoiding-intel-amt/ https://puri.sm/learn/avoiding-intel-amt/
  • rphlx 10y ago
    > Safeguarding the Future of Computing with Intel ... ME heh, the Ministry of Truth would be proud of that title.
• nisa 10y ago
  Nice. Just after proposing to using AMT for remotely controlling workstations at university. AMT 6.0 up to the current version? are affacted. Here is a handy Wikipedia Table: https://en.wikipedia.org/wiki/Intel_AMT_versions https://en.wikipedia.org/wiki/Intel_AMT_versions Core2 seems to be not affected.
  • jacquesm 10y ago
    Better than after deploying a few hundred machines no?
    • nisa 10y ago
      We just use it for power fencing and serial console. So nothing fancy. However after this exploit a seperative VLAN for AMT just got on the list :) I don't mind AMT but I was an idiot to think it's something you can expose to the Internet.
      • jacquesm 10y ago
        > However after this exploit a seperate VLAN for AMT just got on the list :) It should have been that way anyway.
• faragon 10y ago
  In my opinion all hypervisor-like hidden chips should be always documented, and disabled by default, by law, except for closed appliances (e.g. a video game console). That's crazy and very dangerous stuff.
  • eric_h 10y ago
    > except for closed appliances (e.g. a video game console) My video game console literally has a camera pointed at my living room (PS4, camera is for the VR headset). Given Sony's less then perfect security record, I accepted this as an unfortunate tradeoff for the ability to have VR. I do not think they should be given any special leeway.
    • faragon 10y ago
      Most laptops, tablets, and smartphones do, too. At least, the PS4 camera is optional :-)
• cantrevealname 10y ago
  We need a service to monitor all the published security & privacy issues that vendors like Microsoft, Intel, and Apple don't consider to be bugs, and then offer some kind of automatic disable/fix/patch/uninstall tool. I'd be willing to pay $50-100/year per system so I don't have to personally dig into every security and privacy mitigation. Specifically, the tool or service should: - Check for known vulnerabilities just like Management Engine described in the article, and disable it or patch it (if a patch is available). - Uninstall or disable all tracking, reporting, spyware features (esp. in Windows 8 and 10 for example). - Disable all unnecessary services to harden the OS. Yes, I realize that this has the potential to break things, so it has to be done intelligently. - Etc. I would have thought that anti-virus software would have been a perfect place to build in such capability, but AV software has generally turned into garbage unfortunately.
  • yo-code-sucks 10y ago
    Openscap is a good start.
  • altharaz 10y ago
    Hey there, my company already solves the "known vulnerabilities" problem and lets you either "accept" the vulnerability or patch it. I'd love to get your feedback on our product and how you'd imagine an integration with other features you described. Can we DM on Twitter? (@maximeae)
  • foobiekr 10y ago
    you kind of can't get to _all_ the things, but you can choose to approach the problem with containment. We are one option (see my profile) but there are lots of others. IMHO the problem isn't known vulnerabilities checks and patches but the vulnerabilities you don't know. The problem is, of course, that it is very hard for most people to get to a default-closed model for their servers.
• phkahler 10y ago
  I went ahead and down voted this comment because it's corporate downplaying. This is the official announcement of the extremely critical vulnerability discussed without detail in the semiaccurate blurb linked earlier today. Intel fucked up big-time and to downplay it is well... Downvotable.
  • wtetzner 10y ago
    In what way did he downplay it? By telling an anecdote?
  • jacquesm 10y ago
    He's not downplaying anything. And it's not like Chuck is an employee of Intel.
  • sctb 10y ago
    We detached this subthread from https://news.ycombinator.com/item?id=14242120 https://news.ycombinator.com/item?id=14242120 and marked it off-topic.
• peterwwillis 10y ago
  Neutralizing ME: https://hardenedlinux.github.io/firmware/2016/11/17/neutralize_ME_firmware_on_sandybridge_and_ivybridge.html https://hardenedlinux.github.io/firmware/2016/11/17/neutrali...
• rkwasny 10y ago
  Stallman was right.
  • jacquesm 10y ago
    Did you doubt? If anything Stallman has been right far more often than he was wrong about such things.
  • MikusR 10y ago
    Even Trump is ocasionaly right.
• gravypod 10y ago
  Who's ready for cheap hardware sales?
  • tyingq 10y ago
    Or lucrative short term contract work.
    • gravypod 10y ago
      Very good idea.
• microwavecamera 10y ago
  My favorite part is the huge disclaimer at the bottom: INFORMATION IN THIS DOCUMENT IS PROVIDED “AS IS” IN CONNECTION WITH INTEL® PRODUCTS. YOUR USE OF THE INFORMATION IN THE DOCUMENT OR MATERIALS LINKED FROM THE DOCUMENT IS AT YOUR OWN RISK. INTEL RESERVES THE RIGHT TO CHANGE OR UPDATE THIS DOCUMENT AT ANY TIME. EXCEPT AS PROVIDED IN INTEL’S TERMS AND CONDITIONS OF SALE FOR SUCH PRODUCTS, INTEL ASSUMES NO LIABILITY WHATSOEVER, AND INTEL DISCLAIMS ANY EXPRESS OR IMPLIED WARRANTY, RELATING TO SALE AND/OR USE OF INTEL PRODUCTS INCLUDING LIABILITY OR WARRANTIES RELATING TO FITNESS FOR A PARTICULAR PURPOSE Intel: "Hey everyone it's your BFFs at Intel. There's this uber critical bug in our enterprise hardware that will murder you right in the face and you should totally update your firmware right away or face certain doom even though we won't tell you exactly how it works or why it's so critical. Trust us, you totes need to do this asap but if it borks your servers ¯\_(ツ)_/¯. kthnxbye"
  • kogepathic 10y ago
    > even though we won't tell you exactly how it works or why it's so critical This is their entire argument for the ME. Seriously, try to find deeply technical information on the ME. You can't. It's not public. The best you can find are some books about the ME, written by former Intel engineers, who are still shockingly vague about what it actually does. Most "technical" books on the ME just repeat the Intel marketing drivel with marginally more (although still completely useless) technical detail. [0] I've read some books on the ME because I wanted to understand better what it did. All I got was it has some magic sauce for content owners who want to DRM the heck out of their content, and it can emulate a TPM for OEMs who are too cheap to spring for a hardware TPM (although I've never actually seen this done). [0] http://www.apress.com/us/book/9781430265719 http://www.apress.com/us/book/9781430265719
• rxlim 10y ago
  For a system to be affected, both chipset and CPU have to support vPro. For example, a PC with Core i7-7700 CPU and H270 chipset is not affected because only the CPU has support for vPro, but a PC with Core i7-7700 CPU and Q270 chipset is affected because both CPU and chipset have support for vPro.
  • jacquesm 10y ago
    And as far as I can see you'd still have to have AMT enabled in your BIOS.
    • rxlim 10y ago
      At least for it to be exploited remotely. It can still be exploited locally.
      • deleted 10y ago
        [deleted]
• ams6110 10y ago
  What is the network traffic for this management stuff? TCP? UDP? What ports? I presume just blocking it at the switch or router would be an approach to mitigation? EDIT: from the PDF posted in another thread, looks like the Intel ME ports are 16992, 16993, 16994, 16995, 623, and 664.
• dhx 10y ago
  Is there any chance this could be exploitable from within a guest virtual machine, or does Intel's architecture only allow a hypervisor to communicate with the firmware?
  • jacquesm 10y ago
    If it is remotely exploitable that means that if you're on the network you can do damage. So if that guest virtual machine has access to the same LAN or VLAN that your ME sits on then you might be in trouble. That's the whole problem here, this is an issue that allows a remote attack, not just a local one.
    • pritambaral 10y ago
      Even so, it also allows a local attack. One that cannot be fixed without a firmware upgrade (now hope/pray/beg your OEM to release one). Yes, remote exploitability sucks hard, but that's not the "whole problem"; there's a bigger problem that just remote exploitability.
  • tyingq 10y ago
    They don't say how the local exploit works, other than mentioning that an unprivileged user can do it: "An unprivileged local attacker could provision manageability features gaining unprivileged network or local system privileges" I would go ahead and assume it's an issue on guest virtual machines. Maybe not, but since they don't explain the vector...
• tyingq 10y ago
  Intel list of vendor makes and models with vPro. Includes even some laptops. And, guess what? Retail POS systems. Ouch. https://msp.intel.com/find-a-vpro-system https://msp.intel.com/find-a-vpro-system (sha1 cert, so chrome may complain) Edit: also apparently expired cert, but in this case, interesting info there that I didn't see elsewhere, so...
  • low_key 10y ago
    Expired cert, so almost everything should complain.
  • stordoff 10y ago
    Cert. also appears to have expired in April.
  • Clownshoesms 10y ago
    Retail POS could be bad news, but it got me to thinking of all the other possibilities too. Could be disastrous, and I wonder who would wear the egg on the face, Intel or the NSA :) Or no-one is my guess, too big to fail!
• walterbell 10y ago
  From http://mjg59.dreamwidth.org/48429.html http://mjg59.dreamwidth.org/48429.html > What do we not know? We have zero information about the vulnerability, other than that it allows unauthenticated access to AMT. One big thing that's not clear at the moment is whether this affects all AMT setups, setups that are in Small Business Mode, or setups that are in Enterprise Mode. If the latter, the impact on individual end-users will be basically zero - Enterprise Mode involves a bunch of effort to configure and nobody's doing that for their home systems. If it affects all systems, or just systems in Small Business Mode, things are likely to be worse. > What should I do? Make sure AMT is disabled. If it's your own computer, you should then have nothing else to worry about. If you're a Windows admin with untrusted users, you should also disable or uninstall LSM by following these instructions.
  • jacquesm 10y ago
    And that's a good part of the reasons I'm categorically against any 'rider' computers next to the one that I control. It's hard enough to keep a regular system secure, if you have to factor in ghost computers that are effectively running with a privilege level above your local root then the situation becomes untenable. Intel really should allow for a simple way to turn off all this bull-shit without any way for it to be remotely re-enabled. And without any crippling effects on clock frequency or power management or networking. Otherwise we don't really own our computers.
• kop316 10y ago
  Seeing this reminded me of something that happened a few weeks ago. I went to a conference where someone very high up in Intel came out to give a presentation what they were doing for security. A few things stuck out to me: - They said they work very hard to work with Linux to make sure their stuff is compatible. - The person also specifically called out that they work with BIOS vendors (and called out Coreboot by name, implying they work with them) - They added that they intend to make sure all of the features are on every chip, and it included the Intel ME. When the talk was over, the first question someone asked was: "Is there any backdoor on your chips?" After a bit of laughter, the presenter said of course there was not and (understandably) got offended by the question. I specifically asked why they don't allow people to completely disable the Intel ME, and I did not get a concrete answer. Seeing the _remotely_ exploitable Intel firmware vulnerability makes me not think that question was so funny. I really hope Intel is held responsible for this.
  • jacquesm 10y ago
    > I really hope Intel is held responsible for this. Watch the stockprice at the opening bell and you'll know if they are being held responsible.
    • rphlx 10y ago
      Like it or not, IMO there is little reason to expect this to have a material effect on the stock price, as it is not a product recall, and it probably will not seriously impact Intel's competitive position (given its main competitor is doing something similar).
      • Natsu 10y ago
        Sadly, I think that was his point...
        • jacquesm 10y ago
          Yep. Of course us tech people would like to see Intel punished for ME but the market really won't care and that's the only thing that would push Intel off this path.
• tmsldd 10y ago
  We're waiting for the manifestation of all manufacturers and cloud service providers, which is equally important at this moment.
• lossolo 10y ago
  If you are on linux: Merely having a "vPRO" CPU and chipset isn't sufficient - your system vendor also needs to have licensed the AMT code. Under Linux, if lspci doesn't show a communication controller with "MEI" in the description, AMT isn't running and you're safe. If it does show an MEI controller, that still doesn't mean you're vulnerable - AMT may still not be provisioned. If you reboot you should see a brief firmware splash mentioning the ME. Hitting ctrl+p at this point should get you into a menu which should let you disable AMT.[1] 1. https://mjg59.dreamwidth.org/48429.html https://mjg59.dreamwidth.org/48429.html
• hoodoof 10y ago
  Do I need to be concerned about my Mac or my Lenovo Windows laptop?
  • jacquesm 10y ago
    That depends: - do you have a VPro enabled mac (probably not) or laptop (could be)? - if so are you running AMT (check bios!)? - if so is it running one of the affected versions? - and even if not check if the machine is running LMS and if it does disable that.
• Will_Parker 10y ago
  A remote attacker can use a backdoor to gain control of any PC? This is great news for malicious AI!
  • mtrycz 10y ago
    That's a great idea for training an AI for, and someone totally has already done it. I'm training myself to (be able to) live off the grid when time comes.
• merpnderp 10y ago
  Looks like Apple machines are safe. "Are Apple Macs impacted by this at all?" "No. Apple hardware has an ME, but Apple don't ship the AMT firmware for it." https://mjg59.dreamwidth.org/48429.html https://mjg59.dreamwidth.org/48429.html
• ohrer 10y ago
  If AMT is enabled it would be listening on ports 16992 and 16933 (TLS). I ran lspci | grep MEI on my machine (an i3-2100, not vPRO as far as I know, running Linux Ubuntu 16.04) and got: 00:16.0 Communication controller: Intel Corporation 6 Series/C200 Series Chipset Family MEI Controller #1 (rev 04) Then ran nmap -p- and the ports didn't show up, and can't access them, so AMT is disabled. You can read more on how enable or disable AMT and how to access it here: http://manpages.ubuntu.com/manpages/zesty/man7/amt-howto.7.html http://manpages.ubuntu.com/manpages/zesty/man7/amt-howto.7.h...
  • ajdlinux 10y ago
    From what i've seen elsewhere - make sure to run nmap on a different machine, because running nmap locally isn't going to go via the NIC.
    • ohrer 10y ago
      I ran nmap and tried to access the ports from my laptop.
  • weinzierl 10y ago
    If you want to run nmap yourself, the correct ports should be 16992 and 16993.
  • weinzierl 10y ago
    If you want to run nmap yourself, the correct ports should be 16992 and 16993.
  • j_s 10y ago
    2009: "The underlying technology that performs a remote power on command [for AMT] uses the http transport, either port 80 or 443" | https://communities.intel.com/thread/2888 https://communities.intel.com/thread/2888 - Ylian Saint-Hilaire, Principal Engineer at Intel Download the Intel AMT SDK and dig a bit for more: https://software.intel.com/en-us/download/intel-active-management-technology-sdk https://software.intel.com/en-us/download/intel-active-manag... (If anyone has a non-sketch non-EULA'd download let me know and I'll update the link.) Or you can review the JavaScript implementation: https://github.com/gomesjj/MeshCommander https://github.com/gomesjj/MeshCommander
• d33rp0ints 10y ago
  AMT was enabled by default on my lenovo x220. I guess it's time to dive into coreboot and me cleaner.
• pmontra 10y ago
  Many people wrote that ME was a potential vulnerability and backdoor along the years. Russia and China have been designing some CPUs for a while even if they are not at the same level of Intel and AMD yet. I remember Russia's Baikal (MIPS and ARM), China's Longsoon (MIPS family) and some ARM chips. I wonder if they planned those chips with national security considerations in mind. The current trend of blocking some Internet services with country level firewalls could be another way to protect from remote attacks. At least spies should spy from within the country as in the old times. They could see the other effects as bonuses (political control, protection of local companies) and being large countries thay maybe don't care much about the consequences of a slowed down information flow.
• hultner 10y ago
  Is there any PoC or similar to test if our own systems are vulnerable?
• tokumei_74 10y ago
  i7 4510U affected?