5 ms·

Could you elaborate on why you think its apparent that AMT has 'terrible code quality'? Specifically, versus other high profile products that continue to have m

by ksk 9y ago

Could you elaborate on why you think its apparent that AMT has 'terrible code quality'? Specifically, versus other high profile products that continue to have multiple security bugs being introduced every release cycle - Windows, iOS, Android, Linux, etc.

Animats 9y ago
It has a classic C buffer overflow - there's a read where the amount read can exceed the buffer size. This is a consequence of C's biggest design flaw - the language doesn't know the size of arrays. That's the root cause of most buffer overflow vulnerabilities. It also means that Intel didn't do much code review. There are automated tools which recognize that specific class of bug.
- adrianN 9y ago
  I doubt that there is a tool that recognizes buffer overflows without a terrible false positive rate. Otherwise there would be far fewer such bugs.
  - mmjaa 9y ago
    Coverity does a pretty good job. Of course it requires human interaction - but then, thats the only way to good code quality anyway.
    - jahnu 9y ago
      This is true but experience shows us that optional safe practices don't seem to be enough. A safe by default language looks like it makes the most sense in practice.
  - jahnu 9y ago
    I'd wager that only a minority of projects use linters, static analysers, etc in continuous integration. I'd also wager that only a minority treat warnings as errors.
    - tripzilch 9y ago
      I mean, it's only a piece of software that will literally run on nearly every PC in the world ...
      - Animats 9y ago
        With total control over the PC, external network access, and critical security functions. And Intel couldn't be bothered to run Coverity. Or this was a deliberately inserted but deniable backdoor.
saulrh 9y ago
Every description I've heard of it has language like this: AMT is a large module with a huge number of different network protocols of various levels integrated into it. This module contains a great deal of legacy code but can only be found in business systems. In absolute terms it's probably not as bad as a desktop operating system, which is laboring under sisyphean compatibility constraints on top of huge attention from researchers and a nearly totally intractable threat model. Relatively speaking, though, those same things must be taken into account - their attack surfaces are thousands of times bigger and they attract thousands of times more attention. Seeing about as many critical vulns in the AMT as in, say, the entire Linux kernel... yeah, I'd call that "awful code quality". Plus there's the fact that the original vulnerability was literally "you can get in by sending an empty password". A culture that lets a bug like that through cannot be conducive to good code.
- ksk 9y ago
  >Seeing about as many critical vulns in the AMT as in, say, the entire Linux kernel... yeah, I'd call that "awful code quality". But that is not the case. Linux has had 400+ security bugs this year (as you point out, in part due to its greater attack surface) versus the 2 from AMT. I'm trying to reconcile this idea that "ME = BAD" in a practical way by comparing it to software that's in mass use and already being exploited. The tech press over time has needlessly over-hyped such security issues making it harder to put things in perspective. So far, I'm not seeing anything special about ME that would also not apply to many many other products. https://www.cvedetails.com/vulnerability-list/vendor_id-238/product_id-41573/year-2017/Intel-Active-Management-Technology.html https://www.cvedetails.com/vulnerability-list/vendor_id-238/... https://www.cvedetails.com/vulnerability-list/vendor_id-33/product_id-47/year-2017/Linux-Linux-Kernel.html https://www.cvedetails.com/vulnerability-list/vendor_id-33/p... >Plus there's the fact that the original vulnerability was literally "you can get in by sending an empty password". A culture that lets a bug like that through cannot be conducive to good code. I don't see the tech press not recommended OSX anymore ! https://www.theregister.co.uk/2017/11/28/root_access_bypass_macos_high_sierra/ https://www.theregister.co.uk/2017/11/28/root_access_bypass_...
  - saulrh 9y ago
deleted 9y ago
[deleted]
zaxomi 9y ago
I can give you an example of why I think the code quality is questionable: At my work we use AMT for legitimate purposes: remote administration and support (we have offices in different cities). A big problem for us is that the AMT crashes by itself and the computer needs to be power-cycled for the AMT to work again. Sometimes the web-interface don't answer, sometimes the passwords doesn't match anymore. I think there is a process that is writing where it shouldn't, because it works again after the computer is power-cycled by removing the power-cord. I now have a script that checks every registered computer twice a day , to see if it is still possible to login to the AMT, and if not, it sends an email to a person at the local office requesting them to restart the computers that fails. When it works it is a great tool, allowing us to fix computers and give support without the need to travel to each city.
- ksk 9y ago
  Thanks for that ! I'm looking to implement AMT (or something like it) at our office. I'm a developer but as the defacto sysadmin I was looking into how stable the AMT platform is. I occaisionally have to re-image machines, and I figured I could just ask people to plug it into a network jack and let me remotely take care of it.
- katastic 9y ago
  That's really pathetic that a "consumer ready" embedded piece of software whose whole job is remote-management... needs to be remotely managed because it crashes all the time.
- acdha 9y ago
  It's sad hearing that it hasn't changed much in over a decade — back when I was primarily doing sysadmin work, of the various manufacturers, only Sun's ILOM (on the V20z/V40z Opteron servers) seemed to reflect the existence of a QA department. IBM, Dell, HP, etc. all had problems like you described where the management processor would hang after receiving unexpected traffic (e.g. nmap scans), too many simultaneous logins, etc. and, naturally, nobody had thought to implement a watchdog timer to reboot if it became unresponsive even if they had the same functionality available for the actual server.
zkms 9y ago
> Specifically, versus other high profile products that continue to have multiple security bugs being introduced every release cycle - Windows, iOS, Android, Linux, etc. This is not the correct comparison. AMT has terrible code quality compared to the gateware/microcode of your average x86_64 CPU. That ME/AMT is as insecure as some consumer OSes is no excuse, especially given it's certainly quite possible to install an OS on your x86 machine that is far more secure than your average consumer OS (or than the code AMT runs, which apparently falls to 1990s-vintage buffer overflows).
- lcampbell 9y ago
  > This is not the correct comparison. I think comparing the code quality of the AMT to that of another OS is a fair comparison, given that the current-gen AMT is running a modified version of MINIX[1]. [1] https://en.wikipedia.org/wiki/Intel_Active_Management_Technology#Design https://en.wikipedia.org/wiki/Intel_Active_Management_Techno...
  - Buge 9y ago
    It shouldn't be compared based on what software it's running, but instead based on what purpose it's serving.

by ksk 9y ago

Animats 9y ago

It has a classic C buffer overflow - there's a read where the amount read can exceed the buffer size. This is a consequence of C's biggest design flaw - the language doesn't know the size of arrays. That's the root cause of most buffer overflow vulnerabilities. It also means that Intel didn't do much code review. There are automated tools which recognize that specific class of bug.

adrianN 9y ago
I doubt that there is a tool that recognizes buffer overflows without a terrible false positive rate. Otherwise there would be far fewer such bugs.
- mmjaa 9y ago
  Coverity does a pretty good job. Of course it requires human interaction - but then, thats the only way to good code quality anyway.
  - jahnu 9y ago
    This is true but experience shows us that optional safe practices don't seem to be enough. A safe by default language looks like it makes the most sense in practice.
- jahnu 9y ago
  I'd wager that only a minority of projects use linters, static analysers, etc in continuous integration. I'd also wager that only a minority treat warnings as errors.
  - tripzilch 9y ago
    I mean, it's only a piece of software that will literally run on nearly every PC in the world ...
    - Animats 9y ago
      With total control over the PC, external network access, and critical security functions. And Intel couldn't be bothered to run Coverity. Or this was a deliberately inserted but deniable backdoor.

saulrh 9y ago

Every description I've heard of it has language like this: AMT is a large module with a huge number of different network protocols of various levels integrated into it. This module contains a great deal of legacy code but can only be found in business systems. In absolute terms it's probably not as bad as a desktop operating system, which is laboring under sisyphean compatibility constraints on top of huge attention from researchers and a nearly totally intractable threat model. Relatively speaking, though, those same things must be taken into account - their attack surfaces are thousands of times bigger and they attract thousands of times more attention. Seeing about as many critical vulns in the AMT as in, say, the entire Linux kernel... yeah, I'd call that "awful code quality". Plus there's the fact that the original vulnerability was literally "you can get in by sending an empty password". A culture that lets a bug like that through cannot be conducive to good code.

ksk 9y ago
>Seeing about as many critical vulns in the AMT as in, say, the entire Linux kernel... yeah, I'd call that "awful code quality". But that is not the case. Linux has had 400+ security bugs this year (as you point out, in part due to its greater attack surface) versus the 2 from AMT. I'm trying to reconcile this idea that "ME = BAD" in a practical way by comparing it to software that's in mass use and already being exploited. The tech press over time has needlessly over-hyped such security issues making it harder to put things in perspective. So far, I'm not seeing anything special about ME that would also not apply to many many other products. https://www.cvedetails.com/vulnerability-list/vendor_id-238/product_id-41573/year-2017/Intel-Active-Management-Technology.html https://www.cvedetails.com/vulnerability-list/vendor_id-238/... https://www.cvedetails.com/vulnerability-list/vendor_id-33/product_id-47/year-2017/Linux-Linux-Kernel.html https://www.cvedetails.com/vulnerability-list/vendor_id-33/p... >Plus there's the fact that the original vulnerability was literally "you can get in by sending an empty password". A culture that lets a bug like that through cannot be conducive to good code. I don't see the tech press not recommended OSX anymore ! https://www.theregister.co.uk/2017/11/28/root_access_bypass_macos_high_sierra/ https://www.theregister.co.uk/2017/11/28/root_access_bypass_...
- saulrh 9y ago

deleted 9y ago

[deleted]

zaxomi 9y ago

I can give you an example of why I think the code quality is questionable: At my work we use AMT for legitimate purposes: remote administration and support (we have offices in different cities). A big problem for us is that the AMT crashes by itself and the computer needs to be power-cycled for the AMT to work again. Sometimes the web-interface don't answer, sometimes the passwords doesn't match anymore. I think there is a process that is writing where it shouldn't, because it works again after the computer is power-cycled by removing the power-cord. I now have a script that checks every registered computer twice a day , to see if it is still possible to login to the AMT, and if not, it sends an email to a person at the local office requesting them to restart the computers that fails. When it works it is a great tool, allowing us to fix computers and give support without the need to travel to each city.

ksk 9y ago
Thanks for that ! I'm looking to implement AMT (or something like it) at our office. I'm a developer but as the defacto sysadmin I was looking into how stable the AMT platform is. I occaisionally have to re-image machines, and I figured I could just ask people to plug it into a network jack and let me remotely take care of it.
katastic 9y ago
That's really pathetic that a "consumer ready" embedded piece of software whose whole job is remote-management... needs to be remotely managed because it crashes all the time.
acdha 9y ago
It's sad hearing that it hasn't changed much in over a decade — back when I was primarily doing sysadmin work, of the various manufacturers, only Sun's ILOM (on the V20z/V40z Opteron servers) seemed to reflect the existence of a QA department. IBM, Dell, HP, etc. all had problems like you described where the management processor would hang after receiving unexpected traffic (e.g. nmap scans), too many simultaneous logins, etc. and, naturally, nobody had thought to implement a watchdog timer to reboot if it became unresponsive even if they had the same functionality available for the actual server.

zkms 9y ago

> Specifically, versus other high profile products that continue to have multiple security bugs being introduced every release cycle - Windows, iOS, Android, Linux, etc. This is not the correct comparison. AMT has terrible code quality compared to the gateware/microcode of your average x86_64 CPU. That ME/AMT is as insecure as some consumer OSes is no excuse, especially given it's certainly quite possible to install an OS on your x86 machine that is far more secure than your average consumer OS (or than the code AMT runs, which apparently falls to 1990s-vintage buffer overflows).

lcampbell 9y ago
> This is not the correct comparison. I think comparing the code quality of the AMT to that of another OS is a fair comparison, given that the current-gen AMT is running a modified version of MINIX[1]. [1] https://en.wikipedia.org/wiki/Intel_Active_Management_Technology#Design https://en.wikipedia.org/wiki/Intel_Active_Management_Techno...
- Buge 9y ago
  It shouldn't be compared based on what software it's running, but instead based on what purpose it's serving.