4 ms·

>Seeing about as many critical vulns in the AMT as in, say, the entire Linux kernel... yeah, I'd call that "awful code quality". But that is not the case. Linu

by ksk 9y ago

>Seeing about as many critical vulns in the AMT as in, say, the entire Linux kernel... yeah, I'd call that "awful code quality". But that is not the case. Linux has had 400+ security bugs this year (as you point out, in part due to its greater attack surface) versus the 2 from AMT. I'm trying to reconcile this idea that "ME = BAD" in a practical way by comparing it to software that's in mass use and already being exploited. The tech press over time has needlessly over-hyped such security issues making it harder to put things in perspective. So far, I'm not seeing anything special about ME that would also not apply to many many other products. https://www.cvedetails.com/vulnerability-list/vendor_id-238/product_id-41573/year-2017/Intel-Active-Management-Technology.html https://www.cvedetails.com/vulnerability-list/vendor_id-238/... https://www.cvedetails.com/vulnerability-list/vendor_id-33/product_id-47/year-2017/Linux-Linux-Kernel.html https://www.cvedetails.com/vulnerability-list/vendor_id-33/p... >Plus there's the fact that the original vulnerability was literally "you can get in by sending an empty password". A culture that lets a bug like that through cannot be conducive to good code. I don't see the tech press not recommended OSX anymore ! https://www.theregister.co.uk/2017/11/28/root_access_bypass_macos_high_sierra/ https://www.theregister.co.uk/2017/11/28/root_access_bypass_...

saulrh 9y ago
Filter Linux's list to "scores > 8" to take the sampling bias into account - the only way to observe an AMT vulnerability in the first place is to gain remote super-root on a widely-deployed core system that may be a PITA to patch. That takes linux down to 27 for 2017. Of those, only about ten are for the kernel itself rather than for binary drivers for nvidia, broadcom, qualcomm, or htc hardware. About half of the total are marked "android"; given that my understanding is that the android kernel has significant changes I wouldn't be surprised if those are android-only exploits. The intersection leaves a grand total of 6 vulnerabilities that are in the actual linux kernel and comparable in severity to the two AMT compromises we've seen. > I don't see the tech press not recommended OSX anymore ! I certainly don't rec apple. Never have, though previously for non-security reasons, and unless they do a lot of changing, never will.
- ksk 9y ago
  Sure but as a user of Linux, I don't particularly care why the bugs are present in Linux. My view is if you ship it, you should own it. Assigning blame to Nvidia or whoever can go both ways. They might point the blame back at the interfaces inside Linux for being unclear or less than adequately documented, or whatever. Or they might blame some other aspect. Nobody knows unless you're the person who actually wrote the code or has intimate knowledge specific to the bug. In any case, my point wasn't to compare Linux vs AMT. I'm considering deploying ME/AMT to manage systems inside our office. After all this news having come out, I'm waiting till the dust settles. I have to unfortunately wade through a lot of hype to get to the meat of the issue. So far I haven't seen anything that would dissuade me from deploying ME internally.
thisacctforreal 9y ago
The problem is the location of the vulnerablities: on the CPU itself. Get pwned in linux? Nuke and pave can usually solve it. The exceptions being BIOSes and hdds/usbs with vulnerable firmwares which can be exploited to restore the malware. However in that case an actor has to target your hardware combination specifically, and there are a plethora of different hdd/usb manufacturers. Get pwned in ME? No longer your hardware. On top of that it applies to all Intel CPUs, and potentially remotely to Intel AMT CPUs.
- ksk 9y ago
  Sure, but I see no reason not to be able to just re-flash the ME firmware in that case. I guess as an embedded developer, maybe I'm just seeing things from a different POV than most people here.
  - saulrh 9y ago
    Well, the easy way to flash the firmware goes through the ME, so that's about as good at removing infected ME firmware as Windows Update is at removing viruses. The other way... I mean, you could simultaneously bring down every computer your company and its employees own, airgap them all, open the cases, expose the SPI headers, flash the firmware, bring them all back online, and hope you don't have to do it again tomorrow because someone didn't get the memo and was working from home that day. And that nobody did anything Bad while they owned your entire corp net. You could do that. I wish you the best of luck.
    - ksk 9y ago
      I dont understand. Why is reinstalling an OS a solution to a rooted OS but re-flashing ME/AMT isn't? You patch the OS bug that lead to it being exploited, and you patch the ME bug that lead to it being expoloited. I'm assuming a scenario where Intel (and/or BIOS/UEFI/MB vendors) behaves like a sane OS vendor and releases regular updates/fixes. Anyway, we're really geting far off topic. I guess I'm replying too :)
      - 9y ago
zkms 9y ago
> versus the 2 from AMT Until very recently, independent researchers had no access at all to the instructions that the ME processor runs; maybe normalise against that? http://blog.ptsecurity.com/2017/12/huffman-tables-intel-me.html http://blog.ptsecurity.com/2017/12/huffman-tables-intel-me.h...
- ksk 9y ago
  You can normalize against anything. Can we normalize Linux against the fact that millions of people potentially could have reviewed the source code, and prevented the bugs? You can bias things with proper justification any which way. At some point, we just have to accept an imperfect method :)
  - deleted 9y ago
    [deleted]

by ksk 9y ago

saulrh 9y ago

Filter Linux's list to "scores > 8" to take the sampling bias into account - the only way to observe an AMT vulnerability in the first place is to gain remote super-root on a widely-deployed core system that may be a PITA to patch. That takes linux down to 27 for 2017. Of those, only about ten are for the kernel itself rather than for binary drivers for nvidia, broadcom, qualcomm, or htc hardware. About half of the total are marked "android"; given that my understanding is that the android kernel has significant changes I wouldn't be surprised if those are android-only exploits. The intersection leaves a grand total of 6 vulnerabilities that are in the actual linux kernel and comparable in severity to the two AMT compromises we've seen. > I don't see the tech press not recommended OSX anymore ! I certainly don't rec apple. Never have, though previously for non-security reasons, and unless they do a lot of changing, never will.

ksk 9y ago
Sure but as a user of Linux, I don't particularly care why the bugs are present in Linux. My view is if you ship it, you should own it. Assigning blame to Nvidia or whoever can go both ways. They might point the blame back at the interfaces inside Linux for being unclear or less than adequately documented, or whatever. Or they might blame some other aspect. Nobody knows unless you're the person who actually wrote the code or has intimate knowledge specific to the bug. In any case, my point wasn't to compare Linux vs AMT. I'm considering deploying ME/AMT to manage systems inside our office. After all this news having come out, I'm waiting till the dust settles. I have to unfortunately wade through a lot of hype to get to the meat of the issue. So far I haven't seen anything that would dissuade me from deploying ME internally.

thisacctforreal 9y ago

The problem is the location of the vulnerablities: on the CPU itself. Get pwned in linux? Nuke and pave can usually solve it. The exceptions being BIOSes and hdds/usbs with vulnerable firmwares which can be exploited to restore the malware. However in that case an actor has to target your hardware combination specifically, and there are a plethora of different hdd/usb manufacturers. Get pwned in ME? No longer your hardware. On top of that it applies to all Intel CPUs, and potentially remotely to Intel AMT CPUs.

ksk 9y ago
Sure, but I see no reason not to be able to just re-flash the ME firmware in that case. I guess as an embedded developer, maybe I'm just seeing things from a different POV than most people here.
- saulrh 9y ago
  Well, the easy way to flash the firmware goes through the ME, so that's about as good at removing infected ME firmware as Windows Update is at removing viruses. The other way... I mean, you could simultaneously bring down every computer your company and its employees own, airgap them all, open the cases, expose the SPI headers, flash the firmware, bring them all back online, and hope you don't have to do it again tomorrow because someone didn't get the memo and was working from home that day. And that nobody did anything Bad while they owned your entire corp net. You could do that. I wish you the best of luck.
  - ksk 9y ago
    I dont understand. Why is reinstalling an OS a solution to a rooted OS but re-flashing ME/AMT isn't? You patch the OS bug that lead to it being exploited, and you patch the ME bug that lead to it being expoloited. I'm assuming a scenario where Intel (and/or BIOS/UEFI/MB vendors) behaves like a sane OS vendor and releases regular updates/fixes. Anyway, we're really geting far off topic. I guess I'm replying too :)
    - 9y ago

zkms 9y ago

> versus the 2 from AMT Until very recently, independent researchers had no access at all to the instructions that the ME processor runs; maybe normalise against that? http://blog.ptsecurity.com/2017/12/huffman-tables-intel-me.html http://blog.ptsecurity.com/2017/12/huffman-tables-intel-me.h...

ksk 9y ago
You can normalize against anything. Can we normalize Linux against the fact that millions of people potentially could have reviewed the source code, and prevented the bugs? You can bias things with proper justification any which way. At some point, we just have to accept an imperfect method :)
- deleted 9y ago
  [deleted]