7 ms·

Reverse-Engineering the Intel Management Engine

273 points by laamalif 9y ago

ReverseCold 9y ago
Hopefully we can get a fully libre boot on purism laptops soon. I feel like there would be legal problems though...
- d33 9y ago
  What kind of legal problems would you anticipate?
  - cryptarch 9y ago
    Perhaps by ways the DMCA, for "p0wning" DRM('d) modules?
    - Buge 9y ago
      Only the people actually subverting the DRM would have legal problems. The people manufacturing the laptop would be fine.
      - cryptarch 9y ago
        What sections of the law and precedents make you so sure about that?
        Buge 9y ago
        I tend to take the view that if the law doesn't prevent it, it's ok to do. I don't need legal permission to do something, I just need to avoid things that the law specifically bans.
        marssaxman 9y ago
        If someone with a lot of money has a problem with what you're doing, they'll hire lawyers to discover some way that the law prevents you from doing it. If the ensuing lawsuit, which will bankrupt you regardless of its outcome, doesn't serve as a sufficient warning for anyone else who wants to do whatever it was you did, they'll proceed to buy a law that prevents you from doing it.
  - eikenberry 9y ago
    My guess would be DMCA anti-circumvention issues.
- wolfgke 9y ago
  Just develop it anonymously and make information on how to flash it yourself either on an .onion page or on a server in a jurisdiction that does not care (so much) about US American intellectual property.
turbohedgehog 9y ago
Did the author notify Intel about the bug they found?
- mmastrac 9y ago
  Respectfully, why would they? The goal here is to find exploits in ME and use them to make Intel chips more end-user friendly. When we were rooting Android devices we sat on a lot of exploits that we believed we could use to give end-users freedom. There were a handful that were bad enough to warrant disclosure [1], but we still offered them as ways for users to control their own devices with a few layers of obfuscation on top. [1] http://www.unrevoked.com/rootwiki/doku.php/public/unrevoked1_disclosure http://www.unrevoked.com/rootwiki/doku.php/public/unrevoked1...
  - qb45 9y ago
    Publishing a blog post isn't exactly sitting on a vuln. I would understand if they kept it to themselves and I would understand if they reported to Intel, but this?
    - bigiain 9y ago
      I'm not entirely sure the same "responsible disclosure" arguments for software apply to hardware. With software, a patch release is a common enough thing that it's a solid argument that letting companies like Microsoft or Apple or Google or others who've demonstrated they'll actually fix security bugs (so, maybe not Oracle, for example), or any of the hundreds or thousands of widely-used OSS projects - I'm _much_ less convinced that any company like Intel will ever manage to get even a single digit percentage of their users to reflash CPU firmware - if that's even possible - and I've never heard of a hardware company freely replacing all user's CPUs where remote exploits are known. Where the option of "give them 90 days to get a patch out - possibly give them an extension if they ask and explain why, but otherwise sit on the bug with the vendor until it's fixed or being actively exploited in the wild" à la Google Zero & Tavis seems to work reasonably well enough of the time for software bugs - it seems to me unlikely to be as beneficial for hardware bugs which are much much harder to get fixes to end users - and early disclosure giving the opportunity to mitigate with firewalls or unplugging the device seems more likely to be the better choice.
prodmerc 9y ago
Meanwhile I'm trying to find a way to remove the hard lock on CPU and RAM frequencies (extreme CPUs can't be overclocked, RAM is locked at 1333 MHz) :) Looks like it can be done through Management Engine, which has access to everything apparently. Only success so far is unlocking BCLK, but the overclock is small and unstable that way. Another roadblock was the read only lock, which can fortunately be bypassed on POST on xx67/77 chipsets.
- jlg23 9y ago
  e_context? but good luck anyway.
- floatboth 9y ago
  > extreme CPUs can't be overclocked You mean non-extreme? > unlocking BCLK, but the overclock is small and unstable that way On desktop Skylake, BCLK can get you to anywhere you want (I run an i5-6400 at 4.5GHz daily, over 4.7 for benchmarks). You're talking about laptops, right?
  - Namidairo 9y ago
    > On desktop Skylake, BCLK can get you to anywhere you want I thought Intel shut this down with microcode updates.
    - floatboth 9y ago
      Microcode can't know anything if all power management is completely disabled :P You need a special firmware build for that: http://overclocking.guide/intel-skylake-non-k-overclocking-bios-list/ http://overclocking.guide/intel-skylake-non-k-overclocking-b...
  - dogma1138 9y ago
    BCLK overclocking is heavily motherboard dependent, you need a very good external clock reference and in any case once you go over 3-5mhz you drop your PCIE rates from 3.0 to 2.0. Intel's HEDT platform supports proper CPU strap overclocking withou adverse effects, but even then it's usually not recommended unless you are doing extreme OC and that's liquid nitro :)
Animats 9y ago
This is nice, but it just allows you to replace some of the the Management Engine code. What we need to know in detail is what it's doing. There's probably a backdoor in there that hasn't been discovered yet.
- wolfgke 9y ago
  On the other hand, if we get "our" code into the IME, we can really do interesting stuff. For example reading out data that one should not be read out? ;-)

273 points by laamalif 9y ago

ReverseCold 9y ago

Hopefully we can get a fully libre boot on purism laptops soon. I feel like there would be legal problems though...

d33 9y ago
What kind of legal problems would you anticipate?
- cryptarch 9y ago
  Perhaps by ways the DMCA, for "p0wning" DRM('d) modules?
  - Buge 9y ago
    Only the people actually subverting the DRM would have legal problems. The people manufacturing the laptop would be fine.
    - cryptarch 9y ago
      What sections of the law and precedents make you so sure about that?
      - Buge 9y ago
        I tend to take the view that if the law doesn't prevent it, it's ok to do. I don't need legal permission to do something, I just need to avoid things that the law specifically bans.
        marssaxman 9y ago
        If someone with a lot of money has a problem with what you're doing, they'll hire lawyers to discover some way that the law prevents you from doing it. If the ensuing lawsuit, which will bankrupt you regardless of its outcome, doesn't serve as a sufficient warning for anyone else who wants to do whatever it was you did, they'll proceed to buy a law that prevents you from doing it.
- eikenberry 9y ago
  My guess would be DMCA anti-circumvention issues.
wolfgke 9y ago
Just develop it anonymously and make information on how to flash it yourself either on an .onion page or on a server in a jurisdiction that does not care (so much) about US American intellectual property.

turbohedgehog 9y ago

Did the author notify Intel about the bug they found?

mmastrac 9y ago
Respectfully, why would they? The goal here is to find exploits in ME and use them to make Intel chips more end-user friendly. When we were rooting Android devices we sat on a lot of exploits that we believed we could use to give end-users freedom. There were a handful that were bad enough to warrant disclosure [1], but we still offered them as ways for users to control their own devices with a few layers of obfuscation on top. [1] http://www.unrevoked.com/rootwiki/doku.php/public/unrevoked1_disclosure http://www.unrevoked.com/rootwiki/doku.php/public/unrevoked1...
- qb45 9y ago
  Publishing a blog post isn't exactly sitting on a vuln. I would understand if they kept it to themselves and I would understand if they reported to Intel, but this?
  - bigiain 9y ago
    I'm not entirely sure the same "responsible disclosure" arguments for software apply to hardware. With software, a patch release is a common enough thing that it's a solid argument that letting companies like Microsoft or Apple or Google or others who've demonstrated they'll actually fix security bugs (so, maybe not Oracle, for example), or any of the hundreds or thousands of widely-used OSS projects - I'm _much_ less convinced that any company like Intel will ever manage to get even a single digit percentage of their users to reflash CPU firmware - if that's even possible - and I've never heard of a hardware company freely replacing all user's CPUs where remote exploits are known. Where the option of "give them 90 days to get a patch out - possibly give them an extension if they ask and explain why, but otherwise sit on the bug with the vendor until it's fixed or being actively exploited in the wild" à la Google Zero & Tavis seems to work reasonably well enough of the time for software bugs - it seems to me unlikely to be as beneficial for hardware bugs which are much much harder to get fixes to end users - and early disclosure giving the opportunity to mitigate with firewalls or unplugging the device seems more likely to be the better choice.

prodmerc 9y ago

Meanwhile I'm trying to find a way to remove the hard lock on CPU and RAM frequencies (extreme CPUs can't be overclocked, RAM is locked at 1333 MHz) :) Looks like it can be done through Management Engine, which has access to everything apparently. Only success so far is unlocking BCLK, but the overclock is small and unstable that way. Another roadblock was the read only lock, which can fortunately be bypassed on POST on xx67/77 chipsets.

jlg23 9y ago
e_context? but good luck anyway.
floatboth 9y ago
> extreme CPUs can't be overclocked You mean non-extreme? > unlocking BCLK, but the overclock is small and unstable that way On desktop Skylake, BCLK can get you to anywhere you want (I run an i5-6400 at 4.5GHz daily, over 4.7 for benchmarks). You're talking about laptops, right?
- Namidairo 9y ago
  > On desktop Skylake, BCLK can get you to anywhere you want I thought Intel shut this down with microcode updates.
  - floatboth 9y ago
    Microcode can't know anything if all power management is completely disabled :P You need a special firmware build for that: http://overclocking.guide/intel-skylake-non-k-overclocking-bios-list/ http://overclocking.guide/intel-skylake-non-k-overclocking-b...
- dogma1138 9y ago
  BCLK overclocking is heavily motherboard dependent, you need a very good external clock reference and in any case once you go over 3-5mhz you drop your PCIE rates from 3.0 to 2.0. Intel's HEDT platform supports proper CPU strap overclocking withou adverse effects, but even then it's usually not recommended unless you are doing extreme OC and that's liquid nitro :)

Animats 9y ago

This is nice, but it just allows you to replace some of the the Management Engine code. What we need to know in detail is what it's doing. There's probably a backdoor in there that hasn't been discovered yet.

wolfgke 9y ago
On the other hand, if we get "our" code into the IME, we can really do interesting stuff. For example reading out data that one should not be read out? ;-)