12 ms·
How to hack a turned-off computer, or running unsigned code in Intel ME [pdf]
- niceperson 9y agoThe talk was kind of disappointing honestly SORRY
- brndnmtthws 9y agoIntel ME is frequently featured here on HN, but the general population is completely clueless. This is quite possibly the worst and most widespread computing vulnerability that has ever existed, and it's likely that Intel will just maintain the status quo until there's some sort of black swan event.
- jjawssd 9y agoWhat is harmed most directly by publicizing Intel ME vulnerabilities? Is it in the interest of this entity to restrict the publication of Intel ME vulnerabilities to the general public? How does the general public obtain information on a day to day basis? Who runs the mass media? Is the mass media affected by this entity? Is the mass media narrative influenced by this particular entity?
- yread 9y agoWorst vulnerability ever? AMT has to be enabled, attacker has to know AMT password, BIOS password and BIOS has to be misconfigured. I understand clickbait hyperbole and appeal to emotions are good for getting eyeballs but lets keep some perspective. Remember heartbleed, conflicker or blaster?
- jstanley 9y agoME is running regardless of those things.
- ajross 9y agoBut not vulnerable. This is like saying a local root exploit is the Worst Vulnerability Ever in a system that was correctly firewalled from its earliest implementations. "Worst" implies harm, not just potential. It doesn't get to be The Worst until something happens, no matter how much it offends your personal design sensibilities or confirms your conspiracy priors.
- ptero 9y agoSorry, but "running but not vulnerable" is not nearly good enough nowadays. This means that a real exploit (e.g., via yet another insert-your-favorite-spooky-agency tool leak) can be quickly scaled to a large fraction of computers worldwide. If you are saying that when assessing the vulnerabilities, potential harm is not important, only actual is, would you feel that putting remotely activated bombs on all planes is not a major vulnerability as long as no one has a password?
- ksk 9y ago>Sorry, but "running but not vulnerable" is not nearly good enough nowadays. What does that mean practically? What you said applies to every networked device and tech. All routers, all computers, all OSs, all voip phones, etc, etc are 'one vulnerability away'. from total compromise.
- jstanley 9y agoNormally you only run things if you think they are useful, and you are cognizant of the risk. It's very hard to avoid running ME even if you believe it's actively harmful.
- ksk 9y agoThat is a good point. I suppose you could mitigate that if you were building new systems and used AMD products.
- benevol 9y ago> Intel will just maintain the status quo until there's some sort of black swan event. I absolutely hate Intel and AMD for sabotaging their customers like that. Please people, get to that black swan event ASAP.
- Filligree 9y agoIf we're unlucky, the 'black swan event' will be something along the likes of Pluto's Kiss. Imagine a Morris worm equivalent, but which bricks the computers it infects after destroying the filesystem. Even if everyone has backups of everything, offline, it'll be years before all the destroyed computers can actually be replaced. This isn't a scenario I want to happen for real.
- LeoPanthera 9y agoOn the plus side, you can probably guarantee it would only ever happen once.
- Zopieux 9y agoHaha, no, you can't. Since when do humans learn from their mistakes?
- knowaveragejoe 9y agoNot infrequently, but it's in vogue to hold the belief that they don't.
- abecedarius 9y agoYou could do some much more interesting things with a hack than wiping and bricking a bunch of computers, even if the bricking part is doable.
- madez 9y agoI also hate Intel and AMD for that, but I think they'd prefer we didn't hate them. I conclude that there are big reasons to still do what we hate them for. I'm afraid even a black swan event wouldn't make those reasons go away. What I think needs to happen is for other countries to realize this issue is a matter of national security, and to fund development of alternatives.
- eggoa 9y agoYes, but I don't think it's a black swan if you're waiting for it.
- brndnmtthws 9y agoTrue, but I meant for all of those who aren't prepared for or aware of this issue.
- one_redolent 9y agoThis seems to be the status quo when it comes to digital security in general. There isn't enough penalty for massive breaches, even stocks seem to rarely take a hit when a company has a huge security blunder.
- joe_the_user 9y ago"This is quite possibly the worst and most widespread computing vulnerability that has ever existed." The problem is to make that true, you have to carefully phrase the situation as "this has the potential to give rise to the worst, bad .... etc". And that's the thing. Ignoring this ranks along attitudes like "that cement pool of mining tails right above town is quite sturdy", "we just need a little time to reduce our carbon emissions..." and "we shouldn't kill the IoT with too much regulation..." etc If X isn't a problem right now!, then it seems like X is going to get about zero attention from a world swimming in things that are a problem right now. And that too is going to give rise to further problems down the road, to say the least.
- Crontab 9y ago> Intel ME is frequently featured here on HN, but the general population is completely clueless. That's what they want: a backdoor advertised as a feature.
- MichailP 9y agoWhat can an ordinary person do? Plugging out the network cable? What about laptops? Can this vulnerability hack into Wi-Fi and allow itself to the internet? But then again the moment you plug internet back in you're done.
- zanny 9y agoThe me-cleaner is getting more and more bugfixes over time. For the average person simply sanitizing a firmware image to disable the ME will be enough. The question is more at what point are you confident you won't brick the system doing it. I have not done any research recently in the success rate of ME cleaner, but it isn't that low, it usually works to the best of my knowledge, and once we have good documented statistics saying "this works most of the time" it becomes more feasible for those not directly involved in its development to start using it more proactively to get rid of this vulnerability.
- userbinator 9y agoThe irony is that AFAIK the ME cleaner itself depends on exploiting some vulnerability in ME in order to disable it... so it may get more difficult in the long term.
- CapacitorSet 9y agoAs far as I know it's not exploiting vulnerabilities, just the fact that it won't mind if most modules are not present.
- zanny 9y agoThe good news on that front is most board manufacturers abandon updates after a year or two. My ASUS mobo right now was released in 2013 and saw its last firmware update in late 2014. With the exception of the most modern boards, you can generally assume there will be no more updates for your hardware after a year or so.
- kogepathic 9y ago> What can an ordinary person do? Use non-x86 platforms such as an ARM based Chromebook, or potentially an x86 with the ME partially disabled (coreboot or similar, but it's not a 100% guarantee). > Plugging out the network cable? It depends on the vulnerability scope. If it's over HECI (virtual PCI device between host OS and ME) then removing the network cable won't save you from local malware owning the ME via HECI. > But then again the moment you plug internet back in you're done. Well considering how few people ever update the firmware of their devices, it's unlikely a majority of computers would ever be patched against an ME vulnerability anyway. Starting with ME12 Intel is going to start checking the ME firmware version number in the ME's silicon (read-only) boot ROM to prevent firmware downgrade attacks. [1] This version number is stored in single use eFuses which can only be incremented, and are during an ME update. But it depends on your threat model. As stated in the PDF, there are only 3 known exploits against the ME, and only one results in unsigned code execution. Until someone weaponizes such an exploit, which at the moment it seems physical access is needed, then Intel x86 owners are safe. If your adversary is a three letter agency or nation state attacker, then you've got bigger concerns than someone hacking your ME (starting with, say, your OS). [1] https://github.com/corna/me_cleaner/issues/111#issuecomment-350480591 https://github.com/corna/me_cleaner/issues/111#issuecomment-...
- userbinator 9y agoNote that this document is dated 2017-12-05, so it's not anything new to those who have seen the previous items about ME on HN. According to page 12, one of the conditions for remotely exploiting this is that AMT has to be activated, something which probably isn't going to be true for PCs used at home and not part of a corporate network. Such a vulnerability has the potential to jeopardize a number of technologies, including Intel Protected Audio Video Path (PAVP), Good. Fuck DRM.
- saulrh 9y agoMoney quote, though this may be slightly old news and this is just a summary of known information: One of the most common questions regards the possibility of remote exploitation. We think that remote exploitation is possible if the following conditions are true: 1. The target platform has AMT activated. 2. The attacker knows the AMT administrator password or can use a vulnerability to bypass authorization. 3. The BIOS is not password-protected (or the attacker knows the password). 4. The BIOS can be configured to open up write access to the ME region. If all these conditions are met, there is no reason why an attacker would not be able to obtain access to the ME region remotely. Also note that during startup, the ROM does not check the version of firmware, leaving the possibility that an attacker targeting an up-to-date system could maliciously downgrade ME to a vulnerable version. That list of conditions does not seem incredibly unusual to me. Consumer hardware should have AMT disabled and be safe, but on business machines the highest bar is an AMT vuln, and given the huge size and apparently terrible code quality of the AMT I expect to be seeing auth bypasses for it on a regular basis.
- derefr 9y agoI would presume that in large corporations where AMT isn't actively used for configuration management, corporate IT will almost always have disabled AMT in the BIOS. Am I wrong about this?
- gumby 9y agoI agree, and where AMT is in use the passwords presumably will be managed. So the attack surface doesn’t seem particularly large.
- stusmall 9y agoSome IT shops aren't very on top of BIOS configs. They should be, but just because they should be doesn't mean it matches reality. It doesn't occur to everyone to go into BIOS for any reason other than boot problems, let alone to audit for reducing attack surface area. I can see that falling through the cracks in policy and practice.
- gtcode 9y agoIn the meantime, a high level of technical proficiency is needed to defend against monolithic personal computing environments that are hostile by design. * Assume personal computing environment is hostile * Use an external firewall and have a whitelist-only policy * Use an external NIDS * Physically disable all hard-connected non-wired interconnectivity Monitors and keyboards ("I leave message here on service but you do not call") still leak, of course, but this is a good start, and most people need to be concerned with practical attacks that could be carried out over the internet. New Year's 2018 resolutions: 1) Review backup policy including backup testing procedures 2) Implement personal digital security measures I've often thought that the current mentality of a "convenient" monolithic personal computing environment (whether an iPhone, laptop, or PC) doesn't properly assess threats. When broadband internet first became popular in my area growing up, it was acceptable practice (and recommended by ISP's) to simply plug your non-firewall'ed DSL modem ethernet directly into your computer. It truly was unprotected sex in the worst possible way. Perhaps the next evolution will fundamentally reconsider personal computing design from a security-first perspective.
- marcosdumay 9y ago> Use an external firewall and have a whitelist-only policy How much do you trust that firewall? > ...it was acceptable practice (and recommended by ISP's) to simply plug your non-firewall'ed DSL modem ethernet directly into your computer You have to plug that modem into some non-firewalled computer. Honestly I trust a well kept PC much more than a firewall appliance.
- gtcode 9y agoYour reasoning has merit, of course. And, that's a sad commentary on the current state of affairs, in which one cannot trust a firewall appliance to do its job. Perhaps the movement for open source hardware should focus on minimal security appliances.
- 1001101 9y ago> How much do you trust that firewall? Not very much after seeing some of the Shadow Brokers revelations.
- based2 9y agohttps://www.reddit.com/r/IntelME/ https://www.reddit.com/r/IntelME/
- anonymousDan 9y agoHow does this affect SGX?
- JoshMnem 9y agoWhy aren't companies pressuring Intel to remove or disable the ME? It seems like a huge security risk for entire organizations. It's especially difficult to fix when running Linux, and many organizations/servers use Linux.
- krylon 9y agoI ask myself that question every time I read something about ME. Possible answers, in ascending order of paranoia, are: * A lot of people just don't care. "It's not gonna happen to me" * Some customers like the remote management capabilities without having to spend money on licenses for vendor-specific remote management systems such as HP iLO. If you have to manage hundreds or thousands of machines, it can make your life a lot easier. * The NSA tells Intel (and AMD) to put it in there or else. I assume some customers talk to Intel about this. I vaguely recall reading that the NSA gets servers with ME disabled. So "They" are most certainly aware of the risks. FWIW, a while ago someone posted a video of a talk on HN given by a Google employee who talked about replacing stuff like UEFI firmware in their servers with their own code. If that person keeps going down that road, it's just a matter of time before he runs into the Management Engine. I really hope that this issue generates enough pressure on Intel/AMD to provide a way to disable or replace their proprietary ultra-privileged code. But it is not easy to explain this to people without sounding like a paranoiac.
- snowpanda 9y ago>The NSA tells Intel (and AMD) to put it in there or else. Exactly. And this is where mass surveillance comes in to play: having dirt on anyone and being able to use it as leverage. ie. Intel is forced to put it in there or the NSA will 'leak' how they <insert illegal business practice Intel engaged in that will put them out of business if published.>
- trendia 9y agoIIRC, Google has been flashing the code portion of the ME (rendering it useless)
- 9y ago
- m3kw9 9y agoNow a days, a computer not really off if it has power connected to it.
- unlmtd1 9y agoGrown men nowadays are only given toys to work with. Where is the revolutionary fire?