5 ms·

A Security Issue in Intel’s Active Management Technology

143 points by buovjaga 9y ago

a2tech 9y ago
The security issue is rebooting the machine and logging in with the default admin password? Thats really not a 'vulnerability'
- tinus_hn 9y ago
  Even if you have a BIOS password and everything locked down and the attacker can actually lock you out or quickly give themselves a backdoor. The problem is that there are a million ways in, they're open by default and it is really hard to keep track of everything you have to lock down, and the manufacturers keep adding new ones while you're not looking. The right way for the manufacturers to set this up is * Everything locked down by default * One master password for complete control * Using the master password you can delegate control for users, technicians, applications etc. * If you forget the master password you can reset it using a switch or something you cannot access without opening up the machine which you cannot do while it is physically locked But in reality there's all these management 'solutions' that have to be on by default and then there are the anti theft solutions, the secure boot restrictions, the 'trusted' platform, the list goes on. And then for the master password there's of course a backdoor password the helpdesk people can get if you can convince them the laptop is yours and you just forgot the password.
  - ComodoHacker 9y ago
    >The right way for the manufacturers to set this up is Is't this the case here? You have master password and you can change it provided physical access.
    - tinus_hn 9y ago
      It's more like an override, provided by a feature many people don't use. If they were using it they'd probably change the password from 'admin'. You can't add a backdoor with a password and then claim that's the new master password.
- Bartweiss 9y ago
  I suppose "update AMT password defaults" is good, non-obvious advice to spread. But it does feel a bit rich to describe physical access and a default password as the stuff of a security professional's "worst nightmares". "Physical access means control" has been a standard assumption for years, and this really just constitutes a failure to secure all login channels. It's a particularly silly description when Spectre and Meltdown are busy being actual "worst nightmares" threats.
  - cjcampbell 9y ago
    It is, however, an incredibly predictable failure. As far as nightmares are concerned, I suppose it depends on the anxiety's of the particular security professional. ;)
tedunangst 9y ago
> By selecting Intel’s Management Engine BIOS Extension (MEBx) Where and how do I do that?
- a2tech 9y ago
  On almost any machine with MEBx you can just mash the boot options key right after power on and while on a properly locked down machine you won't be able to change the boot order you will be able to select MEBx.
- jlgaddis 9y ago
  On a Dell, try CTRL-P when the Dell logo is showing. Used to work on Optiplex machines, I don't have any other Dells to try it on.
oelmekki 9y ago
So, if I understand correctly, it allows to bypass BIOS password? Are there people relying on those? I may understand it's a bit more secure on a laptop, but on a desktop you just have to remove BIOS battery to reset the password, anyway. Better encrypt disks and rely on OS authentication (plus, it's easier to do for non experts). EDIT: on second reading, I realize the real problem of the thing is to allow for remote control, provided one can access machine ports.
- ekianjo 9y ago
  > Are there people relying on those? Having a BIOS password was already one of the mitigation for the Intel AMT-related security issue discovered not too long ago.
- als0 9y ago
  Does a modern laptop still depend on CMOS battery for anything other than an RTC? I thought all BIOS variables today are stored on SPI flash.
  - omgtehlion 9y ago
    If you have access to the battery then you have access to the flash chip as well. Using a right clamp (sop8 usually) you can reflash the thing in a matter of seconds (I did).
luckydude 9y ago
This doesn't seem like an exploit to me, it seems like saying that your WIFI AP has a security flaw because you didn't change the default password from admin/admin. And it is worse than that, you have to have physical access to the machine. If you give a hacker physical access to a machine it's pretty much toast. Am I missing something or is this just clickbait?
- rhubarbtse 9y ago
  It's about enabling a backdoor of sorts in your laptop behind your back. Let's say you're at a hotel with your laptop. It has full device encryption enabled and the BIOS is protected with a password and it has all the shebangs to protect your laptop -- so you should be safe, right? Someone distracts you for 30 seconds while an accomplice backdoors your laptop with this vulnerability. Five minutes later while you're happily browsing Hacker News with your laptop using the hotel WIFI, the attacker has full and unrestricted access to your laptop via the very same hotel WIFI.
  - adtac 9y ago
    The number zero rule in security is that if a malicious adversary has physical access to your device, all bets are off.
    - luckydude 9y ago
      What adtac said. If I let someone have physical access to any computer I own I fully expect to be compromised. And here the issue is, as I understand it, I would have had to have left that AMT part in place with a default password. I get that it is geeky and maybe there should be a process where when you buy a new laptop they set the password to some unique thing and give you a sticky note with the password on it. I get that a lot of people won't know to change the management password, but that's an educational issue, just like people had to be taught to not use "1234" or "admin" as their login password. Still seems like an over hyped issue but I guess that is part of the educational process. I don't feel like this rises to the level of Meltdown or Spectre.
mistaken 9y ago
No shit, Sherlock. You can log in with the default password.
acd 9y ago
I want to be able to buy devices and CPUs without these so called management features which about 100% of them turns out to have security holes. If it can be hacked it will be hacked.
anonymousjunior 9y ago
Am I the only one with IAM fatigue at this point, feels like we get a headline like this at a rate of one a week now
glandium 9y ago
Note there are documented ways to reset that password even if it's not "admin", e.g. http://www.dell.com/support/article/us/en/04/sln49505/how-to-reset-the-mebx-password-kb-article-334711?lang=en http://www.dell.com/support/article/us/en/04/sln49505/how-to...

143 points by buovjaga 9y ago

The security issue is rebooting the machine and logging in with the default admin password? Thats really not a 'vulnerability'

tinus_hn 9y ago
Even if you have a BIOS password and everything locked down and the attacker can actually lock you out or quickly give themselves a backdoor. The problem is that there are a million ways in, they're open by default and it is really hard to keep track of everything you have to lock down, and the manufacturers keep adding new ones while you're not looking. The right way for the manufacturers to set this up is * Everything locked down by default * One master password for complete control * Using the master password you can delegate control for users, technicians, applications etc. * If you forget the master password you can reset it using a switch or something you cannot access without opening up the machine which you cannot do while it is physically locked But in reality there's all these management 'solutions' that have to be on by default and then there are the anti theft solutions, the secure boot restrictions, the 'trusted' platform, the list goes on. And then for the master password there's of course a backdoor password the helpdesk people can get if you can convince them the laptop is yours and you just forgot the password.
- ComodoHacker 9y ago
  >The right way for the manufacturers to set this up is Is't this the case here? You have master password and you can change it provided physical access.
  - tinus_hn 9y ago
    It's more like an override, provided by a feature many people don't use. If they were using it they'd probably change the password from 'admin'. You can't add a backdoor with a password and then claim that's the new master password.
Bartweiss 9y ago
I suppose "update AMT password defaults" is good, non-obvious advice to spread. But it does feel a bit rich to describe physical access and a default password as the stuff of a security professional's "worst nightmares". "Physical access means control" has been a standard assumption for years, and this really just constitutes a failure to secure all login channels. It's a particularly silly description when Spectre and Meltdown are busy being actual "worst nightmares" threats.
- cjcampbell 9y ago
  It is, however, an incredibly predictable failure. As far as nightmares are concerned, I suppose it depends on the anxiety's of the particular security professional. ;)

tedunangst 9y ago

> By selecting Intel’s Management Engine BIOS Extension (MEBx) Where and how do I do that?

a2tech 9y ago
On almost any machine with MEBx you can just mash the boot options key right after power on and while on a properly locked down machine you won't be able to change the boot order you will be able to select MEBx.
jlgaddis 9y ago
On a Dell, try CTRL-P when the Dell logo is showing. Used to work on Optiplex machines, I don't have any other Dells to try it on.

oelmekki 9y ago

So, if I understand correctly, it allows to bypass BIOS password? Are there people relying on those? I may understand it's a bit more secure on a laptop, but on a desktop you just have to remove BIOS battery to reset the password, anyway. Better encrypt disks and rely on OS authentication (plus, it's easier to do for non experts). EDIT: on second reading, I realize the real problem of the thing is to allow for remote control, provided one can access machine ports.

ekianjo 9y ago
> Are there people relying on those? Having a BIOS password was already one of the mitigation for the Intel AMT-related security issue discovered not too long ago.
als0 9y ago
Does a modern laptop still depend on CMOS battery for anything other than an RTC? I thought all BIOS variables today are stored on SPI flash.
- omgtehlion 9y ago
  If you have access to the battery then you have access to the flash chip as well. Using a right clamp (sop8 usually) you can reflash the thing in a matter of seconds (I did).

luckydude 9y ago

This doesn't seem like an exploit to me, it seems like saying that your WIFI AP has a security flaw because you didn't change the default password from admin/admin. And it is worse than that, you have to have physical access to the machine. If you give a hacker physical access to a machine it's pretty much toast. Am I missing something or is this just clickbait?

rhubarbtse 9y ago
It's about enabling a backdoor of sorts in your laptop behind your back. Let's say you're at a hotel with your laptop. It has full device encryption enabled and the BIOS is protected with a password and it has all the shebangs to protect your laptop -- so you should be safe, right? Someone distracts you for 30 seconds while an accomplice backdoors your laptop with this vulnerability. Five minutes later while you're happily browsing Hacker News with your laptop using the hotel WIFI, the attacker has full and unrestricted access to your laptop via the very same hotel WIFI.
- adtac 9y ago
  The number zero rule in security is that if a malicious adversary has physical access to your device, all bets are off.
  - luckydude 9y ago
    What adtac said. If I let someone have physical access to any computer I own I fully expect to be compromised. And here the issue is, as I understand it, I would have had to have left that AMT part in place with a default password. I get that it is geeky and maybe there should be a process where when you buy a new laptop they set the password to some unique thing and give you a sticky note with the password on it. I get that a lot of people won't know to change the management password, but that's an educational issue, just like people had to be taught to not use "1234" or "admin" as their login password. Still seems like an over hyped issue but I guess that is part of the educational process. I don't feel like this rises to the level of Meltdown or Spectre.

mistaken 9y ago

No shit, Sherlock. You can log in with the default password.

acd 9y ago

I want to be able to buy devices and CPUs without these so called management features which about 100% of them turns out to have security holes. If it can be hacked it will be hacked.

anonymousjunior 9y ago

Am I the only one with IAM fatigue at this point, feels like we get a headline like this at a rate of one a week now

glandium 9y ago

Note there are documented ways to reset that password even if it's not "admin", e.g. http://www.dell.com/support/article/us/en/04/sln49505/how-to-reset-the-mebx-password-kb-article-334711?lang=en http://www.dell.com/support/article/us/en/04/sln49505/how-to...