3 ms·
Another round of crappy journalism. It's not obscure, it's not a CPU feature but a platform feature, and there are plenty of out-of-band communication channels
by oneplane 9y ago
Another round of crappy journalism. It's not obscure, it's not a CPU feature but a platform feature, and there are plenty of out-of-band communication channels out there, this isn't the only one. On top of that, this was already published two DEF CONs ago.
You can exfil data and even do practival bi-directional communication over: SOL, IPMI, ASF, MT's ARC CPU via injected firmware and then via TCP/IP. Any of them will work. Add vendor-specific firmware addons on top of that (i.e. Broadcom tends to have exploitable firmware in their NIC controllers)
Most of them are in a vulnerable state by default because the technology was supposed to be 'easy' and 'user friendly', but 'users' don't even know what they are, and most deployments are done by the WinTel horde that doesn't actually know anything outside the Microsoft framework. (and thus leave the defaults as-is)
I probably posted something similar on https://news.ycombinator.com/item?id=11913379 https://news.ycombinator.com/item?id=11913379
Is it bad? Yes. Is it new? No. Is it ever reported on correctly? Also no.
- mycall 9y agoOf these techs, which does AMD support? Would switching to AMD make us more secure?
- SXX 9y agoIt's answered in comments multiple times. Read about AMD PSP / ARM TrustZone.
- acdha 9y ago> Would switching to AMD make us more secure? That's not quite the right question: this is just standard use of a remote management feature which is disabled by default. If you enable any remote management service, which are extremely common on server class hardware and many enterprise desktop devices regardless of vendor, you have to take responsibility for securing the management features you enable. The only real news would be if this was enabled by default or if the design didn't allow it to be secured.
- microwavecamera 9y agoIt's not secure, that's the problem. AMT relies on security by obscurity.
- oneplane 9y agoIt also seems to rely on "unexpected functionality by buggy code". There were flaws in basic luxury functionality like JPEG parsing that allows anyone to overwrite certain pieces of memory regardless of it's signature or write protect bits. It was then used as a jumping pad to enter the ARC CPU and have total system control from there. Basically, unless you desolder the flash, it's a rootkit you can't get out.
- julian_1 9y agoNo AMD run an on-die ARM co-processor, with dma access to memory and memory-mapped hardware such as ethernet controllers.
- julian_1 9y agoFrom what I can tell, what's new and correctly reported in the article is that Microsoft have now found active malware exploiting these OOB channels.