4 ms·

I disagree with the article. If anything, it's much less severe than many people thought. - It's a logic bug (authentication bypass) instead of a memory corrup

by lima 10y ago

I disagree with the article. If anything, it's much less severe than many people thought. - It's a logic bug (authentication bypass) instead of a memory corruption. An authentication bypass is bad, but a full compromise would have been much worse. - It's a bug in the opt-in AMT management, which means that the default config is not vulnerable.

lightedman 10y ago
"An authentication bypass is bad, but a full compromise would have been much worse." Given the authentication bypass essentially leads to full compromise, where's the difference, here?
- dom0 10y ago
  The ME itself is not compromised. Arbitrary code execution on the ME would mean total control of the host, i.e. privileges above any software you can run on a computer.
  - kogepathic 10y ago
    > would mean total control of the host, i.e. privileges above any software you can run on a computer. You don't need arbitrary code execution, the ME already has privileges above any software you can run on the computer. The ME operates in ring -2 mode [0], whereas the OS kernel has at most ring 0 privileges. With the built-in ME functionality you can: reboot the host, change BIOS settings, re-install the OS, update BIOS (boot FreeDOS & run the vendor utility). Couple this with a vendor vulnerability such as not signing and verifying a BIOS before flashing, and you can easily use the ME to flash a BIOS with malicious components to the computer. So, yes, it's not as bad as using the ME to read arbitrary memory regions while the host is on, but the default ME functionality for remote management is still enough for a malicious actor to cause a lot of harm. [0] https://en.wikipedia.org/wiki/System_Management_Mode https://en.wikipedia.org/wiki/System_Management_Mode
    - pritambaral 10y ago
      > ring -2 mode ME runs below the SMM. So ring -3 or lower.
      - qb45 10y ago
        ME is a separate processor, not a "ring" on the x86. All this talk about "privilege level above normal software" and "ring -7" just muddies the water. It simply is a physically separate core running its own software which has access to all RAM and all PCIe devices and can program the Intel NIC to silently redirect selected packets away from the x86 cores to itself.
  - tyingq 10y ago
    AMT offers basically IPMI though. Boot a recovery image over the net, mount the local drive, and edit away.
- qb45 10y ago
  The difference is, you are no longer limited to functionality normally provided by AMT. Maybe AMT doesn't offer the ability to download arbitrary memory locations from the running OS and applications, with remote code execution on the ME you could do that. You could modify code running on the CPU on-the-fly and make it read files from disk to memory for downloading too - again, I don't think AMT can read disks, especially when the OS is running and using them concurrently.
  - lima 10y ago
    Exactly, AMT is essentially a remote console without any sort of direct access to the running system. You'd have to reboot the system with a remotely recovery media in order to compromise it.
  - tyingq 10y ago
    You can boot a recovery image though, and edit files on the installed OS that way.
    - qb45 10y ago
      It just isn't quite as stealthy if you have to power up the box when it's supposed to be off. I mean, not everybody runs Windows 10 and is used to his machine having a free will of its own ;)
deathhand 10y ago
The bug is not 'opt-in'. If you need a processor with TPM then it will have AMT. The only question is if the vulenarability is local or accessible online.
- lima 10y ago
  Sure, but AMT is off by default. How would you exploit it locally if it's not enabled?
  - tyingq 10y ago
    There's a second bug that allows local, non root users to provision AMT.
tyingq 10y ago
>"much less severe than many people thought" I don't think so. There's a second bug that allows local non-privileged users to provision AMT. And, once it's up and running, you have a full remote KVM where you can boot recovery disks, edit the local files then reboot, etc. Having AMT on isn't that unusual either. It's not the default, but lots of people use it. I know some digital signage units using NUCS have it on, for example. Also, some large company data centers use it instead of IPMI. The ports aren't exposed to the internet, but if hackers get inside a different way, they are off to the races.
- theophrastus 10y ago
  "Having AMT on isn't that unusual either. It's not the default" AMT is on by default in at least a number of the popular thinkpad series[1] (i'm the only owner of a relatively old thinkpad, and only because of this security alert i checked and it was on; never haven't turned it on myself) [1] https://forums.lenovo.com/t5/Security-Malware/Intel-AMT-backdoor-enabled-by-default/td-p/824749 https://forums.lenovo.com/t5/Security-Malware/Intel-AMT-back...

by lima 10y ago

lightedman 10y ago

"An authentication bypass is bad, but a full compromise would have been much worse." Given the authentication bypass essentially leads to full compromise, where's the difference, here?

dom0 10y ago
The ME itself is not compromised. Arbitrary code execution on the ME would mean total control of the host, i.e. privileges above any software you can run on a computer.
- kogepathic 10y ago
  > would mean total control of the host, i.e. privileges above any software you can run on a computer. You don't need arbitrary code execution, the ME already has privileges above any software you can run on the computer. The ME operates in ring -2 mode [0], whereas the OS kernel has at most ring 0 privileges. With the built-in ME functionality you can: reboot the host, change BIOS settings, re-install the OS, update BIOS (boot FreeDOS & run the vendor utility). Couple this with a vendor vulnerability such as not signing and verifying a BIOS before flashing, and you can easily use the ME to flash a BIOS with malicious components to the computer. So, yes, it's not as bad as using the ME to read arbitrary memory regions while the host is on, but the default ME functionality for remote management is still enough for a malicious actor to cause a lot of harm. [0] https://en.wikipedia.org/wiki/System_Management_Mode https://en.wikipedia.org/wiki/System_Management_Mode
  - pritambaral 10y ago
    > ring -2 mode ME runs below the SMM. So ring -3 or lower.
    - qb45 10y ago
      ME is a separate processor, not a "ring" on the x86. All this talk about "privilege level above normal software" and "ring -7" just muddies the water. It simply is a physically separate core running its own software which has access to all RAM and all PCIe devices and can program the Intel NIC to silently redirect selected packets away from the x86 cores to itself.
- tyingq 10y ago
  AMT offers basically IPMI though. Boot a recovery image over the net, mount the local drive, and edit away.
qb45 10y ago
The difference is, you are no longer limited to functionality normally provided by AMT. Maybe AMT doesn't offer the ability to download arbitrary memory locations from the running OS and applications, with remote code execution on the ME you could do that. You could modify code running on the CPU on-the-fly and make it read files from disk to memory for downloading too - again, I don't think AMT can read disks, especially when the OS is running and using them concurrently.
- lima 10y ago
  Exactly, AMT is essentially a remote console without any sort of direct access to the running system. You'd have to reboot the system with a remotely recovery media in order to compromise it.
- tyingq 10y ago
  You can boot a recovery image though, and edit files on the installed OS that way.
  - qb45 10y ago
    It just isn't quite as stealthy if you have to power up the box when it's supposed to be off. I mean, not everybody runs Windows 10 and is used to his machine having a free will of its own ;)

deathhand 10y ago

The bug is not 'opt-in'. If you need a processor with TPM then it will have AMT. The only question is if the vulenarability is local or accessible online.

lima 10y ago
Sure, but AMT is off by default. How would you exploit it locally if it's not enabled?
- tyingq 10y ago
  There's a second bug that allows local, non root users to provision AMT.

tyingq 10y ago

>"much less severe than many people thought" I don't think so. There's a second bug that allows local non-privileged users to provision AMT. And, once it's up and running, you have a full remote KVM where you can boot recovery disks, edit the local files then reboot, etc. Having AMT on isn't that unusual either. It's not the default, but lots of people use it. I know some digital signage units using NUCS have it on, for example. Also, some large company data centers use it instead of IPMI. The ports aren't exposed to the internet, but if hackers get inside a different way, they are off to the races.

theophrastus 10y ago
"Having AMT on isn't that unusual either. It's not the default" AMT is on by default in at least a number of the popular thinkpad series[1] (i'm the only owner of a relatively old thinkpad, and only because of this security alert i checked and it was on; never haven't turned it on myself) [1] https://forums.lenovo.com/t5/Security-Malware/Intel-AMT-backdoor-enabled-by-default/td-p/824749 https://forums.lenovo.com/t5/Security-Malware/Intel-AMT-back...