10 ms·
Malware Uses Obscure Intel CPU Feature to Steal Data and Avoid Firewalls
- mtgx 9y agoIntel AMT strikes again. I imagine this problem will only increase in the future, now that more malware creators know they can try to use this CPU backdoor (okay, this "totally-not-intended-for-bad-things and super-useful remote connection enterprise feature").
- kakarot 9y agoExploiting vPro / AMT / any remote access mechanism from any chip maker is hardly a new idea. AMT and AMD's equivalent (don't remember the name) has been a holy grail for security researchers and malware authors alike for many years. People have been begging Intel for a very long time to make business-tier chips without remote access capabilities. For personal computing, at least we have enthusiast chips. For example, my i7 K model lacks the technology. EDIT: AMD's remote tech is called Platform Security Processor (PSP). Thank you, jacquesm!
- mschuster91 9y agoWho knows if the feature is not still present in silicon but just software-disabled? It's not really new that Intel and AMD do binning to get more yield.
- kakarot 9y agoIt isn't present AFAIK, because Intel cuts corners on enthusiast chips they do not expect to be used in a networked environment in order to save money, and still charge you more than the non-enthusiast counterparts.
- mschuster91 9y agoAh okay. I thought that Intel bins everything from high-grade Xeon to i3 from the same silicon to save costs.
- kakarot 9y agoI couldn't truly say whether Intel bins all of their processors with the same prefab or not, I'm not sure how to find this out either. My working theory however is that since my chip lacks vPRO / AMT and I have not been able to find any indication it exists on the chip even in a dormant state, there may be more than one prefab used for binning. However they could be using the same prefab for all. Thus, "AFAIK".
- rasz 9y agoME is there (ability to execute below ring -1). Go ahead and check it right now, look at lspci/device manager for Management Engine Communications device. Its present on cheapest desktop H81 motherboards, and on highend (at the time) Z87 ones, no matter the cpu.
- kakarot 9y agoI have done that before, and I've just done it again, and I don't get anything. The only thing present on my system related to ME afaik is the MEI linux driver, which is pretty useless without a ME to talk to. According to ARK [0], vPRO is absent. I have done various other system queries and nothing has turned up. Anything else you want me to query? And where do you get this information that ME is present in all chips? Having a motherboard that supports ME is irrelevant, if the chip has no ME. [0] https://ark.intel.com/products/88195/Intel-Core-i7-6700K-Processor-8M-Cache-up-to-4_20-GHz https://ark.intel.com/products/88195/Intel-Core-i7-6700K-Pro...
- rasz 9y agohttps://github.com/zamaudio/intelmetool https://github.com/zamaudio/intelmetool sudo intelmetool -s Im pretty sure Intel BootGuard is ME based
- jacquesm 9y ago> don't remember the name PSP: Platform Security Processor
- _jal 9y ago> People have been begging Intel for a very long time to make business-tier chips without remote access capabilities. Yes. But somehow, any time anyone brings up wanting a device without one, people start poo-pooing the idea. "Just don't use it." "That's paranoid." "Just another CVE, yawn." In a ton of discussions over the years, I have yet to hear a single plausible, benign reason for why the ME's 30 minute timer must be impossible to disable by the owner of the chip.
- tremon 9y agoAMD's PSP does not have any remote access mechanism though, and it is powered off along with the processor.
- mental_ 9y agoIssues with that doesn't seem to have scratched Intel's reputation as much as I expected.
- endymi0n 9y agoMoney Quote: > When contacted by Microsoft, Intel said the PLATINUM group wasn't using any vulnerability in the Intel AMT SOL interface, but this was another classic case of bad guys using a technology developed for legitimate purposes to do bad things. Worst excuse ever. "Look guys, at least it's not a backdoor we left on purpose!!!" m(
- annnnd 9y agoThis just means that it is broken by design and will probably never be fixed. Nice. Does anyone know about similar AMD vulnerabilities?
- HappyTypist 9y agoYes, AMD chips have almost exactly the same features as Intel ME. The cynic in me thinks that some execs got FISA orders.
- hellbanner 9y agoAre there any open hardware computers of comparable computing power? How can the consumer stop someone from exploiting this hack?
- _jal 9y ago1) No, not even close. 2) Disconnect from the network. This, of course, won't stop local attacks on the AMT or ME. This is why I've been complaining about the ME forever. Forcing a privileged black-box that can't be disabled in to every CPU is... not suspicious all. Even worse are some implementations. I have a Supermicro all-in-one MB that I used in building a home storage server. It has two gig-ethernet ports. About two months ago, I was rearranging around the machine, and when I plugged it back in, apparently I switched the ethernet port plugged in to the switch to the "primary" interface. And one of the monitors goes off a few minutes later - there's a new network device on my private network. Turns out a web interface to the ME comes up automatically when using the primary NIC - it got a DHCP lease and was happily waiting to be managed - with the default creds ADMIN/ADMIN. I thought that we had that one figured out, but apparently not. Yes, I should have read the manual for the motherboard, but that's beyond absurd. And, I guess, a good reminder to trust nothing.
- godmodus 9y agoDo ARM cpus have this? Seriously... profanity here
- userbinator 9y agoARMs vary from simple microcontrollers to the SoCs used in smartphones and tablets. The former, probably not. The latter probably have something similar --- and they're even less publicly documented than Intel ME/AMT or AMD's equivalent.
- SXX 9y agoAMD PSP it is ARM TrustZone.
- khedoros1 9y agoAn ARM CPU is just a core. SoCs probably do have this, pretty often. I know the Raspberry Pi's got a separate processor core running closed-source Broadcom software, and which has access to the system's memory.
- zkms 9y agoAaaand I think this is the first public disclosure of malware using the Intel Management Engine / AMT's network connection (that uses SMBus, i talked about it here https://news.ycombinator.com/item?id=14309557 https://news.ycombinator.com/item?id=14309557 and gave links to appropriate datasheets). Welp. AMT/ME being used by malware created by well-resourced adversaries is no surprise, and is why Intel needed to give an irreversible and verifiable way of completely disabling it.
- rufugee 9y agois why Intel needed to give an irreversible and verifiable way of completely disabling it. The article said it comes disabled by default. Isn't this a verifiable way, or is the article incorrect?
- SXX 9y agoAMT is disabled by default on most consumer PCs or at least it's not expose itself. Though AMT work on top of ME and ME is opposite: it's always active and required for system to operate. If ME firmware not found CPU will shut down every 30 minutes or something. There also way to neutralize some part of ME firmware while keeping system operational, but it's hard to tell how effective this is actually.
- zkms 9y agoA privileged local user can provision AMT to its liking though, which is afaict what this malware did.
- ComodoHacker 9y agoThis site denies access to the article from a German proxy. What a weird reason can be for this?
- userbinator 9y agoIt's funny that the image of the CPU in the article is a P4-era socket 478 model, which AFAIK comes from a time when Intel ME didn't exist in its current form yet... somewhat like showing a late 80s vehicle in an article about hacking self-driving cars. "Intel AMT SOL technology" - a most ironic acronym for this situation...
- siegecraft 9y agoFor those who want to try and disable their ME: https://github.com/corna/me_cleaner https://github.com/corna/me_cleaner
- Cieplak 9y agoI suspect that one can partially mitigate this risk by removing the network card from a laptop motherboard and using a USB network device that requires a software driver.
- oneplane 9y agoAnother round of crappy journalism. It's not obscure, it's not a CPU feature but a platform feature, and there are plenty of out-of-band communication channels out there, this isn't the only one. On top of that, this was already published two DEF CONs ago. You can exfil data and even do practival bi-directional communication over: SOL, IPMI, ASF, MT's ARC CPU via injected firmware and then via TCP/IP. Any of them will work. Add vendor-specific firmware addons on top of that (i.e. Broadcom tends to have exploitable firmware in their NIC controllers) Most of them are in a vulnerable state by default because the technology was supposed to be 'easy' and 'user friendly', but 'users' don't even know what they are, and most deployments are done by the WinTel horde that doesn't actually know anything outside the Microsoft framework. (and thus leave the defaults as-is) I probably posted something similar on https://news.ycombinator.com/item?id=11913379 https://news.ycombinator.com/item?id=11913379 Is it bad? Yes. Is it new? No. Is it ever reported on correctly? Also no.
- mycall 9y agoOf these techs, which does AMD support? Would switching to AMD make us more secure?
- SXX 9y agoIt's answered in comments multiple times. Read about AMD PSP / ARM TrustZone.
- acdha 9y ago> Would switching to AMD make us more secure? That's not quite the right question: this is just standard use of a remote management feature which is disabled by default. If you enable any remote management service, which are extremely common on server class hardware and many enterprise desktop devices regardless of vendor, you have to take responsibility for securing the management features you enable. The only real news would be if this was enabled by default or if the design didn't allow it to be secured.
- microwavecamera 9y ago
- ccrush 9y agoIt's surprising that everyone is up in arms about AMT and ME while not complaining in the slightest about SGX. SGX allows third parties to run code on your processor that is outside of your control. We're losing our computers to corporate interests. You are buying a device they can remotely manage, exert control with a higher privilege than yours, hide secrets inside your machine, and make all the decisions for you. To be even more dramatic, you are purchasing your own enslavement.
- noja 9y agoSGX https://en.wikipedia.org/wiki/Software_Guard_Extensions https://en.wikipedia.org/wiki/Software_Guard_Extensions
- MichaelGG 9y agoSGX, if they allow arbitrary code to be signed, is amazing. It enables remote trust. You could execute jobs "in the cloud" without anyone being able to see your data. You could write a known-correct coin tumbler or trading platform. If it does only get locked to a few code authors, that would be a tremendous shame.
- woah 9y agoIf Intel is the one source of ultimate trust, why not just run your secure whatever on Intel's servers? Seems a lot less complex than jumping through all these SGX hoops.
- 801699 9y agocompanies that make the bios were* the other sources of "ultimate trust". why not let them... *then came uefi. hoop-jumping never a problem with the i.t. market. more complexity is fine so long as managed by someone else. only the sales pitch needs to be simple. why is it unfathomable that users could only trust themselves and other users? continual push toward more complexity helps keep users from ever believing this is achievable.
- SXX 9y ago
- dmix 9y ago> Intel ME runs even when the main processor is powered off, and while this feature looks pretty shady, Intel built ME to provide remote administration capabilities to companies that manage large networks of thousands of computers. So they exposed millions of consumer and business computers in order to satisfy a niche enterprise usecase? Why is this not something that has to be manually turned on? Intel ME has always sounded like a glaring security risk. Another operating system running in the background that can run it's own network stack? This is 100% being exploited by intel agencies.
- JordanFrankfurt 9y agoConsensus when this was released was that intel agency use was the whole point.
- darksim905 9y agoIt does have to be manually turned on.
- theossuary 9y agoExtensions like AMT do need to be manually enabled, but ME itself is always running a big old pile of encrypted code that we'll never get to look at, and yes there's a better than even chance there are exploits in that code only nation states could find (hopefully anyway).
- goosh453 9y agois it possible to avoid this problem by using a good hardware-firewall? Or maybe only surfing through a tunnel on a beaglebone/raspberry?