45 ms·

Intel patches new ME vulnerabilities

633 points by nh2 8y ago

flingo 8y ago
Is ME enabled by default? I ask because I've never seen its webserver on my home network. Heck, I don't even get how it could connect to the internet on a powered off device without Ethernet.
- kawsper 8y ago
  > Is ME enabled by default? Yes, and it can't be disabled on all newer systems. The Active Management Technology (AMT) application, part of the Intel “vPro” brand, is a Web server and application code that enables remote users to power on, power off, view information about, and otherwise manage the PC. It can be used remotely even while the PC is powered off (via Wake-on-Lan). The ME is present on all Intel desktop, mobile (laptop), and server systems since mid 2006. Before version 6.0 (that is, on systems from 2008/2009 and earlier), the ME can be disabled by setting a couple of values in the SPI flash memory. The ME firmware can then be removed entirely from the flash memory space. libreboot does this on the Intel 4 Series systems that it supports, such as the Libreboot X200 and Libreboot T400. ME firmware versions 6.0 and later, which are found on all systems with an Intel Core i3/i5/i7 CPU and a PCH, include “ME Ignition” firmware that performs some hardware initialization and power management. If the ME’s boot ROM does not find in the SPI flash memory an ME firmware manifest with a valid Intel signature, the whole PC will shut down after 30 minutes. (snipped from https://libreboot.org/faq.html#intel https://libreboot.org/faq.html#intel)
nh2 8y ago
Intel advisory: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00112.html https://www.intel.com/content/www/us/en/security-center/advi... CVE-2018-3628 - "Buffer overflow in HTTP handler" Affected processor list (simplified reordered by me to reflect relevance and improve readability): • Core i3/i5/i7, generation 1-8 (that is, all of them) • Xeon E3-1200 v5/v6 • Xeon Scalable • Xeon W • Core 2 Duo vPro, Centrino 2 vPro
- geggam 8y ago
  Every time I am about to upgrade this happens. cpu0: Intel(R) Pentium(R) D CPU 3.00GHz, 2993.01 MHz
  - philjohn 8y ago
    Grab an AMD Ryzen then - you can disable most of the PSP (their ME) via a BIOS setting, and even then, it doesn't do half of the scary stuff ME does.
- Macha 8y ago
  Also worth noting that they're not patching it for 1st, 2nd or 3rd generation Core CPUs. I'm sure there's plenty of Sandy Bridge/Ivy Bridge CPUs in the wild, and it's not like you have an option to discontinue use of the Intel ME :(
  - nebulous1 8y ago
    My i7-2600 is still a beast (well, still gong strong anyway). They did the same thing with Meltdown/Spectre fixes.
    - NullPrefix 8y ago
      Grandpa, it's time to upgrade.
      - coaxial 8y ago
        Why? Because it's been longer than intel would like since parent gave them money?
        bhouston 8y ago
        If Intel has made currently processes ultra fast recently that wouldn't be an issue, but the Intel Core i7 2700 is actually not that slow. Roughly comparable, at least within 20%, of other 4 core + 4 HT Intel processors.
deathhand 8y ago
Do we really need remote code execution on the bios level? Is this a case of 'we can, but should we?'
- nine_k 8y ago
  Think about managing tens of thousands of server in a datacenter. An ability to do everything you can do form a local console (and preferably more), without physical access or a KV switch, is very important. Remotely managing a corporate desktop or laptop, e.g. fixing an OS-level problem remotely, may also be important. OTOH I'd prefer this functionality clearly delineated, usinf strong encryption, and with an explicit reliable "off" switch (preferably physical).
  - pdkl95 8y ago
    > Think about managing tens of thousands of server in a datacenter. The proper solution is an optional management chip on the motherboard, not the CPU. PCI bus mastering NICs with wake-on-lan and other management features have existed for decades; it wouldn't be particularly difficult add the rest of the ME features.
  - alexandercrohde 8y ago
    Frankly, I don't give a fuck about datacenters. I'd rather pay $100 more and NOT have remote functionality in my hardware. There is no universe where what we have now is a good solution. There is no universe where there aren't superior alternatives (like custom bios for datacenter users, like just spending a little bit more money and having two versions)
  - Too 8y ago
    > fixing an OS-level problem remotely If this is a problem, configure your OS better, or get a better OS. Otherwise you'll soon get need another ME on top of your ME to "fix an ME-level problem remotely". How many layers of machines do we really need???! most datacenters already run in VMware with dockers inside running Java VM inside executing Javascript inside.
  - mrweasel 8y ago
baybal2 8y ago
I wonder, who ever uses these "management engines," let alone put them open on WANs? When first news of IME being compromised, I was surprised that Shodan showed such a small number of machines.
- Covzire 8y ago
  IME, most large organizations are extremely bad at preventing their employees from allowing strangers into their buildings.
- dictum 8y ago
  When dealing with consumer-grade network equipment, this is the same question that always comes to my mind: who decided these devices should have their management features open for WAN access by default? I'm still not sure if it was an early 2000s fad that nobody really thought about, or it was deliberate (and if so, why).
  - chris_wot 8y ago
    Most of the routers I've seen only have their management interfaces open on the local network, not on the WAN port.
- acdha 8y ago
  Most organizations big enough to have an IT department which isn’t in the same room like them because you can do things like restart them remotely to ensure software upgrades or installs happen on schedule. Unfortunately many of those places historically didn’t have things like separate management LANs, good filtering, etc. because everything was setup around convenience and the desktop support people probably weren’t security experts.
  - close04 8y ago
    I use this simply because I need to have power on/off and remoting capabilities on machines running environments where I cannot configure such capabilities (meaning I have 0 recourse, no RDP, no TeamViewer, no VNC,, etc.). The reason they don't show up on Shodan is that the search engine doesn't scan private networks and you have to explicitly configure it to be internet accessible. You have to configure AMT/ME in BIOS, you have to allow the connection through your router. Very few people will actually do that.
Dinux 8y ago
Here we go again
ganzuul 8y ago
My CPU has an HTTP server? But why?
- gpvos 8y ago
  Good question. It has been asked many times here. The most likely answer is apparently: Intel thinks that enterprises want a remote management system.
- rhencke 8y ago
  Your CPU actually runs its own entire, separate operating system - MINIX. https://www.cs.vu.nl/~ast/intel/ https://www.cs.vu.nl/~ast/intel/
  - ganzuul 8y ago
    This is known, but that link has no information relevant to the HTTP protocol. Do you know more about that?
    - close04 8y ago
      Well, the ME can be accessed via a web GUI (16992/16993 ports). That's the web server. https://software.intel.com/en-us/node/632310 https://software.intel.com/en-us/node/632310 I have multiple machines with AMT and I'm actively using it every day. Some get patches, some won't because they're gen 3 CPUs or lower. Luckily I can be reasonably confident that the local network is secure so the bug isn't exploitable. This time. I'm sure hoping AMD does better with their support of the PSP.
      - lurker456 8y ago
        That's to access AMT. AMT is a module running on top of ME and is disabled by default.
        close04 8y ago
        And it's exactly what the CVEs are about, isn't it? From the article: vulnerability enables full-blown remote code execution in the AMT process of the Management Engine. From Intel: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00112.html https://www.intel.com/content/www/us/en/security-center/advi... Buffer overflow in HTTP handler in Intel® Active Management Technology in Intel Converged Security Manageability Engine
dsabanin 8y ago
Finally it happened. Here's to hoping that after being exposed to this kind of risk, enterprises and regular customers start being more inquisitive about what code gets embedded into their hardware and why.
- nine_k 8y ago
  I heard Google spends a lot of money and effort to (slowly) move to Power9. It does have a management processor but it's open for inspection and modification. Maybe other cloud providers, and/or private clouds, would consider that.
  - scruffyherder 8y ago
    Source on that? I'd love to use that as a prodding stick to shove all my java/node stuff off of x86..
    - PeCaN 8y ago
      Google Confirms POWER9 Processor Data Center Deployment At OpenPOWER Summit 2018 https://www.forbes.com/sites/patrickmoorhead/2018/03/19/headed-into-its-fifth-year-openpower-has-momentum-into-the-power9-generation/ https://www.forbes.com/sites/patrickmoorhead/2018/03/19/head... IBM Begins Power9 Rollout with Backing from DOE, Google https://www.hpcwire.com/2017/12/06/ibm-begins-power9-rollout-backing-doe-google/ https://www.hpcwire.com/2017/12/06/ibm-begins-power9-rollout... Google's Data Centers Now Have IBM Inside https://www.fool.com/investing/2018/03/22/googles-data-centers-now-have-ibm-inside.aspx https://www.fool.com/investing/2018/03/22/googles-data-cente... Introducing Zaius, Google and Rackspace’s open server running IBM POWER9 https://cloudplatform.googleblog.com/2016/10/introducing-Zaius-Google-and-Rackspaces-open-server-running-IBM-POWER9.html https://cloudplatform.googleblog.com/2016/10/introducing-Zai... They're also a platinum-level member of the OpenPOWER consortium (i.e. they have a position on the board of directors).
      - scruffyherder 8y ago
        Thanks! Time to poke the bees! What is crazy is that we sent people to Google about moving stuff to their cloud offering, and when I asked about the Power9 thing nobody knew anything!
ipsin 8y ago
Has Intel offered an official "disable ME" patch? I'd like to close the door once and not worry about it again.
- kawsper 8y ago
  There are no official ways of disabling the ME. The Coreboot project and the Hardenedlinux project have worked on it, and here are some resources on their progress: https://hardenedlinux.github.io/firmware/2016/11/17/neutralize_ME_firmware_on_sandybridge_and_ivybridge.html https://hardenedlinux.github.io/firmware/2016/11/17/neutrali... https://www.coreboot.org/Intel_Management_Engine https://www.coreboot.org/Intel_Management_Engine And here is a general writeup on the Intel chips and their "features": https://libreboot.org/faq.html#intel https://libreboot.org/faq.html#intel If Intel aren't going to patch old systems, here to hoping that they will let us disable it, but it probably won't happen.
  - chasil 8y ago
    There is a Python script that can take a BIOS image (either from a vendor or scanned from a running system) and remove all ME components that are not absolutely required to operate the CPU. I have never tried it. https://github.com/corna/me_cleaner https://github.com/corna/me_cleaner
    - smolder 8y ago
      I used it with no apparent issues on two of my computers.
    - Kliment 8y ago
      Worked for me on two machines, no ill effects at all
  - FredFS456 8y ago
    There's also the leaked NSA "high assurance" bit, that completely disables the ME. Also included in the excellent me_cleaner tool.
  - 8y ago
ramshanker 8y ago
It looks like every 6 month some bad news for Intel.
- ksec 8y ago
  At the moment it is looking like every 6 weeks. One more Reason why CEO was fired. ( So no one to blame )
chris_wot 8y ago
Aside from applying updates, how else can these vulnerabilities be mitigated? Genuinely curious...
- nh2 8y ago
  As far as I understand: * In general you cannot. * You can try to remove ME with non-official tools like https://github.com/corna/me_cleaner https://github.com/corna/me_cleaner * Some vendors ship specific laptops with ME disabled (https://fossbytes.com/laptops-intel-me-chip-disabled/ https://fossbytes.com/laptops-intel-me-chip-disabled/) * For servers or desktops, you can plug in a separate PCI network adapter instead of using the one on the mainboard (please correct me if this is wrong or confirm it as I'm unsure about it). That would at least disconnect the ME from the network by default. But anybody could still walk up to your machine, plug a cable into the mainboard ethernet port and own you at the deepest level.
  - hlandau 8y ago
    me_cleaner does not disable the ME. It is a partial disablement of ME functionality, but some functionality remains enabled. The ME firmware is an Intel-signed proprietary binary blob part of which is instrumental in the system boot process, so complete removal is impossible. me_cleaner and/or the HAP bit, or the services offered by laptop vendors which is basically doing the very same for you, may certainly reduce the degree of attack surface and the extent to which the ME poses a threat, but it is not a complete disablement or removal, and you are still reliant on a non-modifiable binary blob to bring up your system; referring to it as removal is misleading. Since the firmware is proprietary, it's hard to make any guarantees to what extent a reduced-size ME (via me_cleaner and/or the HAP bit) reduces attack surface in practical terms. My understanding is that even with the HAP bit and me_cleaner applied, the ME continues running at least some functionality after system boot is completed.
    - paulie_a 8y ago
      At this point ME should simply be considered malware.
orblivion 8y ago
So how did they go about making these fixes? Is this another thing where I have to download something from my OEM? The biggest problem I have by far with any of this is that it's not trivial to update all firmware involved. Everything else is forgivable, people make mistakes.
- rectang 8y ago
  How can you classify a deliberate architectural decision to trade away security for all for the convenience of some as a mistake? That the ME would eventually be exploited was completely foreseeable, and was surely foreseen and discussed within Intel. This isn't like some subtle software bug that went undetected. The consequences were known and Intel deliberately chose them.
  - orblivion 8y ago
    > a deliberate architectural decision This is the "not trivial to update" part. The "mistake" part is all the vulns that come out.
iokanuon 8y ago
Can we use this vulnerability to somehow disable the Intel ME on our own machines?
- Filligree 8y ago
  In principle, of course, but not yet.
brian_herman 8y ago
I finally pushed the button on my lenovo T450S there is a setting in the bios to delete the AMT. While the best route is to reprogram... I would just rather click one button and set bios passwords afterwards.
- close04 8y ago
  The ME (AMT) is never actually disabled or deleted as long as the FW is there and running. Plus you should take advantage of the fact that the 450 is still supported and gets a ME FW update. Yesterday I updated all my machines with Gen 4 CPU with new BIOS, new ME FW, and (surprisingly) new TPM FW. The Gen 3 CPU machines barely got a BIOS update for Metldown/Spectre and that's it.
  - brian_herman 8y ago
    So I would just update the bios and it will return back to normal?
    - close04 8y ago
      Updating the BIOS if you have this option goes without saying. TBH, the BIOS and various FW in your machine should always be kept up to date. Just give them 1 month from launch and let others test it to make sure it doesn't have any serious issues, then just update. And as long as you are not using it and don't need it you might as well disable and unconfigure it in BIOS. Of course in this state your machine is ready for reconfiguring it and it will accept the default "admin" ME password. Which means you have to make sure you have a good BIOS password. This will prevent someone who has 2 minutes alone with your machine from reenabling and configuring it without you even noticing.
eutropia 8y ago
Is it possible to mitigate this by blocking traffic on the ports that the ME uses for communication at the router level?
- danr4 8y ago
  would like to know as well
- 6d6b73 8y ago
  AFAIK this work only if the attacker is on the same subnet as you, this means that your router can't stop the attack.
  - hsivonen 8y ago
    Does the attack work if AMT has not been provisioned?
thepumpkin1979 8y ago
Can MacBook owners do something to disable or cripple Intel ME? Is Apple disabling it for us? I can’t find Apple responses to these issues.
- jerheinze 8y ago
  You can't disable ME.
  - inawarminister 8y ago
    I thought you can in C2D (Nehalem?) era ThinkPads? https://libreboot.org/ https://libreboot.org/ and you can minimize ME in Sandy and Ivy Bridge, using ME_Cleaner? edit: according to sounds' comment* in HN (2016), The ME is purportedly placed in "recovery" mode [*] https://news.ycombinator.com/item?id=13056997 https://news.ycombinator.com/item?id=13056997
    - std_throwaway 8y ago
      Is that an official tool supported by intel?
      - inawarminister 8y ago
        No, it's a reverse engineer by the open source community AFAIK. But very stable, I am looking to flash my X220 soon for what it's worth.
        _emacsomancer_ 8y ago
        I did this about a year ago on my X230. Works fine.
    - jerheinze 8y ago
      Minimize != Disable.
lurker456 8y ago
Does this affect ME or ME with AMT enabled ? The article talks about ME but it's AMT that runs the http server.
- RaleyField 8y ago
  Neither does Intel's advisory (which is something we have come to expect from Intel - complete nonchalant disregard for details/quality/security/customers). They could specify whether I'm good with AMT turned off or they went extra stupid and AMT processes packets even when it's off. My bet is on the later because otherwise they'd say to disable AMT otherwise. My next processor will be AMD.
ksec 8y ago
>Perhaps the only consolation is that for CVE-2018-3628, Intel says that exploitation is possible only from the same subnet. That is at least a little more comforting.
- zzzcpan 8y ago
  Javascript in your browser is running in the same subnet.
- ams6110 8y ago
  I understand the temptation, but you really shouldn't trust even your own internal subnets if you really care about security.
- norcalli 8y ago
  But if I managed to compromise a single machine on your subnet, then that means all Intel machines I can touch are also vulnerable, no?
elorant 8y ago
Time to build a Ryzen rig.
- brian_herman 8y ago
  https://libreboot.org/faq.html#amdpsp https://libreboot.org/faq.html#amdpsp Sorry man you would still be SOL :(
iknowverylittle 8y ago
>CVE-2018-3628, Intel says that exploitation is possible only from the same subnet So if I understand correctly, at the moment, these CPUs are vulnerable on a local network but not currently over the internet? Fortunately then various groups have already been working to remove and nullify as much of ME as possible.
- keyme 8y ago
  "... only from the same subnet" What about DNS rebinding (decade old unpached vuln)? It allows websites to issue requests onto your local subnet. Actually... Issuing a request doesn't even require any vuln, it's not a SOP violation...
nine_k 8y ago
I wonder what other (somehow) laptop-worthy CPUs offer a better management engine story? * AMD processors do have an equivalent management engine (PSP), but I didn't hear anything about remote exploits for it. * Beefier ARM CPUs also have something like a management engine ("trustzone" only accessible to the manufacturer). I have no idea if it has any remote-access capabilities on any common hardware. On RPi the trustzone is absent. * Power9 does have a management engine, but it's open and you can upload your own management code. The CPU is not an option for a laptop, and hardly even for a desktop, though. (Edited: spelling.)
- zzzcpan 8y ago
  I believe AMD lets you disable it from BIOS.
  - ttctciyf 8y ago
    I've seen this claim a few times but never seen it solidly verified. Can anyone make the case either way?
    - zzzcpan 8y ago
      Well, we don't know what disabling PSP does, but we know there is an option in BIOS to do that: https://www.google.com/search?q=BIOS+psp+support&tbm=isch https://www.google.com/search?q=BIOS+psp+support&tbm=isch
      - ttctciyf 8y ago
        Yeah, I'm aware of the BIOS option, but haven't seen any reliably sourced info on what its exact effect is.
- rectang 8y ago
  In order to support reliable mass-remote-update, what is needed is an ME which is disabled by default but can be enabled via a non-reversible opt-in, such as breaking off a pin. Then a supplier could configure bulk orders to enable the ME and it would be left up to the customer to choose the security-for-convenience tradeoff.
std_throwaway 8y ago
I don't want a patch. I don't use that thing for anything. I want them to disable that thing by default! Leaving those backdoors open in older products should lead to a recall because the flaw was there all along.
- rectang 8y ago
  Certainly if the lifespan of Intel chips turns out to be much shorter than the marketplace expected (because Intel is unable to provide security updates), that affects the value of Intel products and ought to inform future buying decisions. Whether it is the unfortunate materialization of Spectre-style bugs or the deliberately insecure-by-design ME, Intel's inability to support its products is dismaying.
  - brudgers 8y ago
    The ordinary life cycle of an Intel CPU is the five t̶h̶r̶e̶e̶ year depreciation schedule in the US tax system. The life cycle for Intel's most important customers is less and is based on operating cost in large data centers and these are driven by density, throughput, and energy utilization. Traditionally this has been two years or less as reflected in Intel's tick-tock iteration strategy. The critical life cycle for Intel is not consumer/SMB sales which don't generate sales frequencies and volumes of leading edge products.
    - ec109685 8y ago
      Do you have any citations that companies are replacing their intel processors every 2 years? That is not inline with what I have seen.
      - ams6110 8y ago
        More like 5 years, or even longer, where I work. We have some 7 year old Dell servers that are still chugging along, performing their duties as well as ever.
nine_k 8y ago
As far as I could find out from Intel AMT docs [1], remotely accessible AMT requires an AMT-enabled network adapter. I suppose built-in adapters of Intel chipsets have this feature (at least if marked as vPro). This means that there's a quite decent chance that your not Intel-branded PCI-Expess NIC is NOT AMT-enabled. Most likely your USB-attached WiFi adapter is also inaccessible to AMT. This, if correct, means that your home machine, or your laptop, can be protected from this or any future remotely-activated AMT vulnerabilities by disabling the built-in NICs in BIOS, and using a third-party NIC, either for wired or wireless communication. (For a server fleet, it's different, but you likely don't want to lose AMT remote access if you have a few racks full of servers anyway.) [1]: https://software.intel.com/en-us/articles/getting-started-with-intel-active-management-technology-amt#_Toc451350766 https://software.intel.com/en-us/articles/getting-started-wi...
- close04 8y ago
  Unless your machine is branded as vPro it most likely means that it simply lacks the FW part to run AMT. So it will have the ME in the chipset, it might as well have the correct CPU and NIC for vPro (usually the NICs with M for management in the model name), but it's missing the firmware. Outside of OEM machines the only time I managed to build a vPro enabled system was in Haswell times when Intel had desktop motherboards with the correct chipset and NIC combination, and the BIOS to run it. Right around that time Intel exited the motherboard business and most manufacturers don't bother with shipping the firmware anyway.
cmurf 8y ago
Could Intel ME be disabled in UEFI firmware setup (if the firmware were to offer a UI for it?) Or it is something that's physically enabled/disabled on the CPU and totally orthogonal to UEFI firmware? Ergo, could the computer manufacturer release a firmware update providing such an interface option in firmware setup if they really wanted to? Or are they stuck once the product is released?
- Kliment 8y ago
  You can disable ME by giving it a firmware image to run that does nothing. The me_cleaner approach is to keep the module that brings up the hardware and then give it a command causing it to crash, which is as good as that. A firmware update can definitely do this too.
qop 8y ago
Sure they did...
amelius 8y ago
Sometimes I wonder why we even worry about things like Meltdown/Spectre when there is this gaping hole called ME.
arnaudsm 8y ago
I'm surprised by the lack of media coverage: Intel is deliberately leaving billions of CPUs vulnerable. For a $200 billion company, refusing to spend some ressources to patch all generations is irresponsible. Think of how many governments still use <2012 CPUs.
- sametmax 8y ago
  Another theory is that other actors have the will and influence to make sure it stays that way. We used to be answer with tin foil hat jokes about jokes on mass surveillance. Then came PRISM and nobody is laughing now. Maybe it's going to be the same with this. We will learn many years later it was enforced by some state or economical entity that benefit greatly to have a standard unpatchable backdoor on most laptop and servers on the planet.
- RaleyField 8y ago
  The greed and irresponsibility is boundless. They could set aside 10 billion and have excellent security. 1 billion could have bought thousand phds digging through their processors and I bet they could dig out boneheaded flaws like Spectre. Out of band management is fine, but have it completely disabled by default, have it run on co-processor optimized for security, not speed, in language optimized for security, not speed and when it's on have it filter all packets that aren't signed to unique secret key. Basic stuff.
mrpippy 8y ago
This feels like the Onion story “‘No Way To Prevent This,’ Says Only Nation Where This Regularly Happens” that they post after every US mass shooting, just with the picture changed. Intel will be fixing ME vulnerabilities forever. It has a huge attack surface, but too obscure to get serious resources from them.
tjoff 8y ago
How can I find out if my system is affected? The CPU list isn't really helping as the answer is just "yes". What remains is what, that my motherboard and NIC plays along? How can I figure that out? Is buying a non-intel NIC guaranteed to be safe? Right about bow running pfsense on intel hardware isn't the best feeling in the world.
yzmtf2008 8y ago
Isn’t this vulnerability based on AMT, which is based on ME but disabled by default? Even then, every setup I’ve seen have AMT (a separate Ethernet interface) behind a firewall and is only accessible via local network. The outrage is hardly justified.
- rainbowmverse 8y ago
  One day it's "[thing] shouldn't be exploitable because [mitigation]", the next it's "welp, [mitigation] has a bug in it and they've exploited [thing]."
  - yzmtf2008 8y ago
    Right, and the network security is always part of the attack surface of an enterprise. What I’m saying, though, is that the component that’s vulnerable is 1) disabled by default and 2) near impossible for a consumer to enable.
- achillean 8y ago
  There are close to 5,000 devices exposing their Intel AMT to the Internet: https://www.shodan.io/report/j3cFHOzs https://www.shodan.io/report/j3cFHOzs
  - yzmtf2008 8y ago
    There are X thousand redis servers exposed to the Internet too. This is hardly intel’s fault (having the ports exposed, not the vulnerability). And again, this is not the main point I’m arguing. What I’m saying is that supposedly “this is something that’s enabled by default on consumer devices” is verifiably wrong.
    - achillean 8y ago
      If you run Redis on a public interface without authentication then it will spit out a bunch of warnings and make you aware of the security implications. The changes antirez has made to Redis both in terms of secure defaults and notifying users of insecure settings has directly lead to a huge reduction in Internet-exposed Redis instances. And I was trying to address this point: > Even then, every setup I’ve seen have AMT (a separate Ethernet interface) behind a firewall and is only accessible via local network. In the past, manufacturers used that defense when a security researcher approached them about a problem and they justified the lack of patching by saying things like "nobody would put this on the Internet". There are simple things a manufacturer can do to encourage good security by the end-user (ex. showing a warning). I don't believe that blaming the end-user is a viable path to fixing the problem. This issue isn't specific to Intel but I would prefer it if the vendor implemented more security safeguards to prevent users from inadvertently increasing their attack surface.
enitihas 8y ago
I think most devices have similar vulnerabilities which aren't well known and hard to defend against, like the separate processor in most phones. Worth reading: https://news.ycombinator.com/item?id=6722292 https://news.ycombinator.com/item?id=6722292
- _emacsomancer_ 8y ago
  Which is a good reason not to feel smug if your device isn't an Intel device, but not an excuse for the behaviour of Intel.
ddtaylor 8y ago
Can JavaScript talk to that HTTP via Ajax?
noja 8y ago
Is there a GDPR angle on this? On by default without consent?
deleted 8y ago
[deleted]
arendtio 8y ago
Someone wants to speculate on what would happen if intel would open source their ME as a reaction to this?
ghthor 8y ago
It's all a scam to make functioning CPUS obsolete. It's a key to turn on a planned obsolescence.
confounded 8y ago
Just a note that if you want to avoid Intel's disastrous Management Engine, there are companies you can support that disable it. Purism[0] sell nice MBP-style, Debian-based laptops with modern Intel processors with the NSA's 'High Assurance Platform' bit set, and as much of the ME code removed as possible. It still runs briefly at boot, but this is the most-disabled you can currently get on any i3/i5/i7 processor[1]. [0]: https://puri.sm/ https://puri.sm/ [1]: https://puri.sm/posts/deep-dive-into-intel-me-disablement/ https://puri.sm/posts/deep-dive-into-intel-me-disablement/ System76 are planning to do something similar[2]. [2]: http://blog.system76.com/post/168050597573/system76-me-firmware-updates-plan http://blog.system76.com/post/168050597573/system76-me-firmw... The last Intel processors where the ME could be removed entirely without bricking, were the non-AMT Core Duos (2008ish), which were used on the Thinkpad T400 (good for your biceps) and the X200/X200T (thick, but compact, even by today's standards). Various companies (most prominently the Ministry of Freedom in the UK) sell these models with the ME completely removed, and a completely Free Software boot process via LibreBoot (a subset of coreboot). You can find a full list of suppliers on the FSF's 'Respects Your Freedom' hardware page[3]. Most of them will also remove the ME from a compatible laptop you send them, as a service. [3]: https://www.fsf.org/resources/hw/endorsement/respects-your-freedom https://www.fsf.org/resources/hw/endorsement/respects-your-f... These machines are also 'naturally' resistant to both Spectre and Meltdown, and obviously have no ME to exploit. None of the Intel horror-shows of the last few years seem to have touched them. I previously thought that running an old-machine for largely hypothetical freedoms was bizarre. After these CVEs, I'm beginning to re-examine how bizarre it really is. And I do miss those old ThinkPad keyboards :)
- casefields 8y ago
  Never heard of these. Thanks for the pointer.
  - BanazirGalbasi 8y ago
    System76 is probably the most well-known Linux laptop distributor in the US, their offerings are pretty popular. I know a few people with one of their laptops and all of them are pretty satisfied. Purism is a bit more "extreme", trying to create an all-libre laptop that avoids proprietary software and hardware. Once their equipment is a bit more stable it's something I'm going to look into more, for now they're still in development though.
8bitsrule 8y ago
Must all solutions be software? How'sa about a desolder-the-chip mitigation? Or a hammer-and-sharp-punch mitigation?
watersb 8y ago
There seems to be confusion about vPro, AMT, BIOS, UEFI, Trusted Boot, and so on. This talk helped me: "Replace Your Exploit-Ridden Firmware with Linux" https://youtu.be/iffTJ1vPCSo https://youtu.be/iffTJ1vPCSo
6ue7nNMEEbHcM 8y ago
Would it suffice to mount and use external Ethernet adapter e.g. on PCIe, leaving the built-in disconnected? I think the ME intercepts only built-in Ethernet, can someone confirm?
DanBlake 8y ago
Does using a USB ethernet adapter mitigate all of the AMT issues? IE- Something like this : https://www.anker.com/products/variant/usb-3-0-to-gigabit-ethernet-adapter/A7610011 https://www.anker.com/products/variant/usb-3-0-to-gigabit-et...

633 points by nh2 8y ago

Is ME enabled by default? I ask because I've never seen its webserver on my home network. Heck, I don't even get how it could connect to the internet on a powered off device without Ethernet.

kawsper 8y ago
> Is ME enabled by default? Yes, and it can't be disabled on all newer systems. The Active Management Technology (AMT) application, part of the Intel “vPro” brand, is a Web server and application code that enables remote users to power on, power off, view information about, and otherwise manage the PC. It can be used remotely even while the PC is powered off (via Wake-on-Lan). The ME is present on all Intel desktop, mobile (laptop), and server systems since mid 2006. Before version 6.0 (that is, on systems from 2008/2009 and earlier), the ME can be disabled by setting a couple of values in the SPI flash memory. The ME firmware can then be removed entirely from the flash memory space. libreboot does this on the Intel 4 Series systems that it supports, such as the Libreboot X200 and Libreboot T400. ME firmware versions 6.0 and later, which are found on all systems with an Intel Core i3/i5/i7 CPU and a PCH, include “ME Ignition” firmware that performs some hardware initialization and power management. If the ME’s boot ROM does not find in the SPI flash memory an ME firmware manifest with a valid Intel signature, the whole PC will shut down after 30 minutes. (snipped from https://libreboot.org/faq.html#intel https://libreboot.org/faq.html#intel)

nh2 8y ago

Intel advisory: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00112.html https://www.intel.com/content/www/us/en/security-center/advi... CVE-2018-3628 - "Buffer overflow in HTTP handler" Affected processor list (simplified reordered by me to reflect relevance and improve readability): • Core i3/i5/i7, generation 1-8 (that is, all of them) • Xeon E3-1200 v5/v6 • Xeon Scalable • Xeon W • Core 2 Duo vPro, Centrino 2 vPro

geggam 8y ago
Every time I am about to upgrade this happens. cpu0: Intel(R) Pentium(R) D CPU 3.00GHz, 2993.01 MHz
- philjohn 8y ago
  Grab an AMD Ryzen then - you can disable most of the PSP (their ME) via a BIOS setting, and even then, it doesn't do half of the scary stuff ME does.
Macha 8y ago
Also worth noting that they're not patching it for 1st, 2nd or 3rd generation Core CPUs. I'm sure there's plenty of Sandy Bridge/Ivy Bridge CPUs in the wild, and it's not like you have an option to discontinue use of the Intel ME :(
- nebulous1 8y ago
  My i7-2600 is still a beast (well, still gong strong anyway). They did the same thing with Meltdown/Spectre fixes.
  - NullPrefix 8y ago
    Grandpa, it's time to upgrade.
    - coaxial 8y ago
      Why? Because it's been longer than intel would like since parent gave them money?
      - bhouston 8y ago
        If Intel has made currently processes ultra fast recently that wouldn't be an issue, but the Intel Core i7 2700 is actually not that slow. Roughly comparable, at least within 20%, of other 4 core + 4 HT Intel processors.

deathhand 8y ago

Do we really need remote code execution on the bios level? Is this a case of 'we can, but should we?'

nine_k 8y ago
Think about managing tens of thousands of server in a datacenter. An ability to do everything you can do form a local console (and preferably more), without physical access or a KV switch, is very important. Remotely managing a corporate desktop or laptop, e.g. fixing an OS-level problem remotely, may also be important. OTOH I'd prefer this functionality clearly delineated, usinf strong encryption, and with an explicit reliable "off" switch (preferably physical).
- pdkl95 8y ago
  > Think about managing tens of thousands of server in a datacenter. The proper solution is an optional management chip on the motherboard, not the CPU. PCI bus mastering NICs with wake-on-lan and other management features have existed for decades; it wouldn't be particularly difficult add the rest of the ME features.
- alexandercrohde 8y ago
  Frankly, I don't give a fuck about datacenters. I'd rather pay $100 more and NOT have remote functionality in my hardware. There is no universe where what we have now is a good solution. There is no universe where there aren't superior alternatives (like custom bios for datacenter users, like just spending a little bit more money and having two versions)
- Too 8y ago
  > fixing an OS-level problem remotely If this is a problem, configure your OS better, or get a better OS. Otherwise you'll soon get need another ME on top of your ME to "fix an ME-level problem remotely". How many layers of machines do we really need???! most datacenters already run in VMware with dockers inside running Java VM inside executing Javascript inside.
- mrweasel 8y ago

baybal2 8y ago

I wonder, who ever uses these "management engines," let alone put them open on WANs? When first news of IME being compromised, I was surprised that Shodan showed such a small number of machines.

Covzire 8y ago
IME, most large organizations are extremely bad at preventing their employees from allowing strangers into their buildings.
dictum 8y ago
When dealing with consumer-grade network equipment, this is the same question that always comes to my mind: who decided these devices should have their management features open for WAN access by default? I'm still not sure if it was an early 2000s fad that nobody really thought about, or it was deliberate (and if so, why).
- chris_wot 8y ago
  Most of the routers I've seen only have their management interfaces open on the local network, not on the WAN port.
acdha 8y ago
Most organizations big enough to have an IT department which isn’t in the same room like them because you can do things like restart them remotely to ensure software upgrades or installs happen on schedule. Unfortunately many of those places historically didn’t have things like separate management LANs, good filtering, etc. because everything was setup around convenience and the desktop support people probably weren’t security experts.
- close04 8y ago
  I use this simply because I need to have power on/off and remoting capabilities on machines running environments where I cannot configure such capabilities (meaning I have 0 recourse, no RDP, no TeamViewer, no VNC,, etc.). The reason they don't show up on Shodan is that the search engine doesn't scan private networks and you have to explicitly configure it to be internet accessible. You have to configure AMT/ME in BIOS, you have to allow the connection through your router. Very few people will actually do that.

Dinux 8y ago

Here we go again

ganzuul 8y ago

My CPU has an HTTP server? But why?

gpvos 8y ago
Good question. It has been asked many times here. The most likely answer is apparently: Intel thinks that enterprises want a remote management system.
rhencke 8y ago
Your CPU actually runs its own entire, separate operating system - MINIX. https://www.cs.vu.nl/~ast/intel/ https://www.cs.vu.nl/~ast/intel/
- ganzuul 8y ago
  This is known, but that link has no information relevant to the HTTP protocol. Do you know more about that?
  - close04 8y ago
    Well, the ME can be accessed via a web GUI (16992/16993 ports). That's the web server. https://software.intel.com/en-us/node/632310 https://software.intel.com/en-us/node/632310 I have multiple machines with AMT and I'm actively using it every day. Some get patches, some won't because they're gen 3 CPUs or lower. Luckily I can be reasonably confident that the local network is secure so the bug isn't exploitable. This time. I'm sure hoping AMD does better with their support of the PSP.
    - lurker456 8y ago
      That's to access AMT. AMT is a module running on top of ME and is disabled by default.
      - close04 8y ago
        And it's exactly what the CVEs are about, isn't it? From the article: vulnerability enables full-blown remote code execution in the AMT process of the Management Engine. From Intel: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00112.html https://www.intel.com/content/www/us/en/security-center/advi... Buffer overflow in HTTP handler in Intel® Active Management Technology in Intel Converged Security Manageability Engine

dsabanin 8y ago

Finally it happened. Here's to hoping that after being exposed to this kind of risk, enterprises and regular customers start being more inquisitive about what code gets embedded into their hardware and why.

nine_k 8y ago
I heard Google spends a lot of money and effort to (slowly) move to Power9. It does have a management processor but it's open for inspection and modification. Maybe other cloud providers, and/or private clouds, would consider that.
- scruffyherder 8y ago
  Source on that? I'd love to use that as a prodding stick to shove all my java/node stuff off of x86..
  - PeCaN 8y ago
    Google Confirms POWER9 Processor Data Center Deployment At OpenPOWER Summit 2018 https://www.forbes.com/sites/patrickmoorhead/2018/03/19/headed-into-its-fifth-year-openpower-has-momentum-into-the-power9-generation/ https://www.forbes.com/sites/patrickmoorhead/2018/03/19/head... IBM Begins Power9 Rollout with Backing from DOE, Google https://www.hpcwire.com/2017/12/06/ibm-begins-power9-rollout-backing-doe-google/ https://www.hpcwire.com/2017/12/06/ibm-begins-power9-rollout... Google's Data Centers Now Have IBM Inside https://www.fool.com/investing/2018/03/22/googles-data-centers-now-have-ibm-inside.aspx https://www.fool.com/investing/2018/03/22/googles-data-cente... Introducing Zaius, Google and Rackspace’s open server running IBM POWER9 https://cloudplatform.googleblog.com/2016/10/introducing-Zaius-Google-and-Rackspaces-open-server-running-IBM-POWER9.html https://cloudplatform.googleblog.com/2016/10/introducing-Zai... They're also a platinum-level member of the OpenPOWER consortium (i.e. they have a position on the board of directors).
    - scruffyherder 8y ago
      Thanks! Time to poke the bees! What is crazy is that we sent people to Google about moving stuff to their cloud offering, and when I asked about the Power9 thing nobody knew anything!

ipsin 8y ago

Has Intel offered an official "disable ME" patch? I'd like to close the door once and not worry about it again.

kawsper 8y ago
There are no official ways of disabling the ME. The Coreboot project and the Hardenedlinux project have worked on it, and here are some resources on their progress: https://hardenedlinux.github.io/firmware/2016/11/17/neutralize_ME_firmware_on_sandybridge_and_ivybridge.html https://hardenedlinux.github.io/firmware/2016/11/17/neutrali... https://www.coreboot.org/Intel_Management_Engine https://www.coreboot.org/Intel_Management_Engine And here is a general writeup on the Intel chips and their "features": https://libreboot.org/faq.html#intel https://libreboot.org/faq.html#intel If Intel aren't going to patch old systems, here to hoping that they will let us disable it, but it probably won't happen.
- chasil 8y ago
  There is a Python script that can take a BIOS image (either from a vendor or scanned from a running system) and remove all ME components that are not absolutely required to operate the CPU. I have never tried it. https://github.com/corna/me_cleaner https://github.com/corna/me_cleaner
  - smolder 8y ago
    I used it with no apparent issues on two of my computers.
  - Kliment 8y ago
    Worked for me on two machines, no ill effects at all
- FredFS456 8y ago
  There's also the leaked NSA "high assurance" bit, that completely disables the ME. Also included in the excellent me_cleaner tool.
- 8y ago

ramshanker 8y ago

It looks like every 6 month some bad news for Intel.

ksec 8y ago
At the moment it is looking like every 6 weeks. One more Reason why CEO was fired. ( So no one to blame )

chris_wot 8y ago

Aside from applying updates, how else can these vulnerabilities be mitigated? Genuinely curious...

nh2 8y ago
As far as I understand: * In general you cannot. * You can try to remove ME with non-official tools like https://github.com/corna/me_cleaner https://github.com/corna/me_cleaner * Some vendors ship specific laptops with ME disabled (https://fossbytes.com/laptops-intel-me-chip-disabled/ https://fossbytes.com/laptops-intel-me-chip-disabled/) * For servers or desktops, you can plug in a separate PCI network adapter instead of using the one on the mainboard (please correct me if this is wrong or confirm it as I'm unsure about it). That would at least disconnect the ME from the network by default. But anybody could still walk up to your machine, plug a cable into the mainboard ethernet port and own you at the deepest level.
- hlandau 8y ago
  me_cleaner does not disable the ME. It is a partial disablement of ME functionality, but some functionality remains enabled. The ME firmware is an Intel-signed proprietary binary blob part of which is instrumental in the system boot process, so complete removal is impossible. me_cleaner and/or the HAP bit, or the services offered by laptop vendors which is basically doing the very same for you, may certainly reduce the degree of attack surface and the extent to which the ME poses a threat, but it is not a complete disablement or removal, and you are still reliant on a non-modifiable binary blob to bring up your system; referring to it as removal is misleading. Since the firmware is proprietary, it's hard to make any guarantees to what extent a reduced-size ME (via me_cleaner and/or the HAP bit) reduces attack surface in practical terms. My understanding is that even with the HAP bit and me_cleaner applied, the ME continues running at least some functionality after system boot is completed.
  - paulie_a 8y ago
    At this point ME should simply be considered malware.

orblivion 8y ago

So how did they go about making these fixes? Is this another thing where I have to download something from my OEM? The biggest problem I have by far with any of this is that it's not trivial to update all firmware involved. Everything else is forgivable, people make mistakes.

rectang 8y ago
How can you classify a deliberate architectural decision to trade away security for all for the convenience of some as a mistake? That the ME would eventually be exploited was completely foreseeable, and was surely foreseen and discussed within Intel. This isn't like some subtle software bug that went undetected. The consequences were known and Intel deliberately chose them.
- orblivion 8y ago
  > a deliberate architectural decision This is the "not trivial to update" part. The "mistake" part is all the vulns that come out.

iokanuon 8y ago

Can we use this vulnerability to somehow disable the Intel ME on our own machines?

Filligree 8y ago
In principle, of course, but not yet.

brian_herman 8y ago

I finally pushed the button on my lenovo T450S there is a setting in the bios to delete the AMT. While the best route is to reprogram... I would just rather click one button and set bios passwords afterwards.

close04 8y ago
The ME (AMT) is never actually disabled or deleted as long as the FW is there and running. Plus you should take advantage of the fact that the 450 is still supported and gets a ME FW update. Yesterday I updated all my machines with Gen 4 CPU with new BIOS, new ME FW, and (surprisingly) new TPM FW. The Gen 3 CPU machines barely got a BIOS update for Metldown/Spectre and that's it.
- brian_herman 8y ago
  So I would just update the bios and it will return back to normal?
  - close04 8y ago
    Updating the BIOS if you have this option goes without saying. TBH, the BIOS and various FW in your machine should always be kept up to date. Just give them 1 month from launch and let others test it to make sure it doesn't have any serious issues, then just update. And as long as you are not using it and don't need it you might as well disable and unconfigure it in BIOS. Of course in this state your machine is ready for reconfiguring it and it will accept the default "admin" ME password. Which means you have to make sure you have a good BIOS password. This will prevent someone who has 2 minutes alone with your machine from reenabling and configuring it without you even noticing.

eutropia 8y ago

Is it possible to mitigate this by blocking traffic on the ports that the ME uses for communication at the router level?

danr4 8y ago
would like to know as well
6d6b73 8y ago
AFAIK this work only if the attacker is on the same subnet as you, this means that your router can't stop the attack.
- hsivonen 8y ago
  Does the attack work if AMT has not been provisioned?

thepumpkin1979 8y ago

Can MacBook owners do something to disable or cripple Intel ME? Is Apple disabling it for us? I can’t find Apple responses to these issues.

jerheinze 8y ago
You can't disable ME.
- inawarminister 8y ago
  I thought you can in C2D (Nehalem?) era ThinkPads? https://libreboot.org/ https://libreboot.org/ and you can minimize ME in Sandy and Ivy Bridge, using ME_Cleaner? edit: according to sounds' comment* in HN (2016), The ME is purportedly placed in "recovery" mode [*] https://news.ycombinator.com/item?id=13056997 https://news.ycombinator.com/item?id=13056997
  - std_throwaway 8y ago
    Is that an official tool supported by intel?
    - inawarminister 8y ago
      No, it's a reverse engineer by the open source community AFAIK. But very stable, I am looking to flash my X220 soon for what it's worth.
      - _emacsomancer_ 8y ago
        I did this about a year ago on my X230. Works fine.
  - jerheinze 8y ago
    Minimize != Disable.

lurker456 8y ago

Does this affect ME or ME with AMT enabled ? The article talks about ME but it's AMT that runs the http server.

RaleyField 8y ago
Neither does Intel's advisory (which is something we have come to expect from Intel - complete nonchalant disregard for details/quality/security/customers). They could specify whether I'm good with AMT turned off or they went extra stupid and AMT processes packets even when it's off. My bet is on the later because otherwise they'd say to disable AMT otherwise. My next processor will be AMD.

ksec 8y ago

>Perhaps the only consolation is that for CVE-2018-3628, Intel says that exploitation is possible only from the same subnet. That is at least a little more comforting.

zzzcpan 8y ago
Javascript in your browser is running in the same subnet.
ams6110 8y ago
I understand the temptation, but you really shouldn't trust even your own internal subnets if you really care about security.
norcalli 8y ago
But if I managed to compromise a single machine on your subnet, then that means all Intel machines I can touch are also vulnerable, no?

elorant 8y ago

Time to build a Ryzen rig.

brian_herman 8y ago
https://libreboot.org/faq.html#amdpsp https://libreboot.org/faq.html#amdpsp Sorry man you would still be SOL :(

iknowverylittle 8y ago

>CVE-2018-3628, Intel says that exploitation is possible only from the same subnet So if I understand correctly, at the moment, these CPUs are vulnerable on a local network but not currently over the internet? Fortunately then various groups have already been working to remove and nullify as much of ME as possible.

keyme 8y ago
"... only from the same subnet" What about DNS rebinding (decade old unpached vuln)? It allows websites to issue requests onto your local subnet. Actually... Issuing a request doesn't even require any vuln, it's not a SOP violation...

nine_k 8y ago

I wonder what other (somehow) laptop-worthy CPUs offer a better management engine story? * AMD processors do have an equivalent management engine (PSP), but I didn't hear anything about remote exploits for it. * Beefier ARM CPUs also have something like a management engine ("trustzone" only accessible to the manufacturer). I have no idea if it has any remote-access capabilities on any common hardware. On RPi the trustzone is absent. * Power9 does have a management engine, but it's open and you can upload your own management code. The CPU is not an option for a laptop, and hardly even for a desktop, though. (Edited: spelling.)

zzzcpan 8y ago
I believe AMD lets you disable it from BIOS.
- ttctciyf 8y ago
  I've seen this claim a few times but never seen it solidly verified. Can anyone make the case either way?
  - zzzcpan 8y ago
    Well, we don't know what disabling PSP does, but we know there is an option in BIOS to do that: https://www.google.com/search?q=BIOS+psp+support&tbm=isch https://www.google.com/search?q=BIOS+psp+support&tbm=isch
    - ttctciyf 8y ago
      Yeah, I'm aware of the BIOS option, but haven't seen any reliably sourced info on what its exact effect is.
rectang 8y ago
In order to support reliable mass-remote-update, what is needed is an ME which is disabled by default but can be enabled via a non-reversible opt-in, such as breaking off a pin. Then a supplier could configure bulk orders to enable the ME and it would be left up to the customer to choose the security-for-convenience tradeoff.

std_throwaway 8y ago

I don't want a patch. I don't use that thing for anything. I want them to disable that thing by default! Leaving those backdoors open in older products should lead to a recall because the flaw was there all along.

rectang 8y ago
Certainly if the lifespan of Intel chips turns out to be much shorter than the marketplace expected (because Intel is unable to provide security updates), that affects the value of Intel products and ought to inform future buying decisions. Whether it is the unfortunate materialization of Spectre-style bugs or the deliberately insecure-by-design ME, Intel's inability to support its products is dismaying.
- brudgers 8y ago
  The ordinary life cycle of an Intel CPU is the five t̶h̶r̶e̶e̶ year depreciation schedule in the US tax system. The life cycle for Intel's most important customers is less and is based on operating cost in large data centers and these are driven by density, throughput, and energy utilization. Traditionally this has been two years or less as reflected in Intel's tick-tock iteration strategy. The critical life cycle for Intel is not consumer/SMB sales which don't generate sales frequencies and volumes of leading edge products.
  - ec109685 8y ago
    Do you have any citations that companies are replacing their intel processors every 2 years? That is not inline with what I have seen.
    - ams6110 8y ago
      More like 5 years, or even longer, where I work. We have some 7 year old Dell servers that are still chugging along, performing their duties as well as ever.

nine_k 8y ago

As far as I could find out from Intel AMT docs [1], remotely accessible AMT requires an AMT-enabled network adapter. I suppose built-in adapters of Intel chipsets have this feature (at least if marked as vPro). This means that there's a quite decent chance that your not Intel-branded PCI-Expess NIC is NOT AMT-enabled. Most likely your USB-attached WiFi adapter is also inaccessible to AMT. This, if correct, means that your home machine, or your laptop, can be protected from this or any future remotely-activated AMT vulnerabilities by disabling the built-in NICs in BIOS, and using a third-party NIC, either for wired or wireless communication. (For a server fleet, it's different, but you likely don't want to lose AMT remote access if you have a few racks full of servers anyway.) [1]: https://software.intel.com/en-us/articles/getting-started-with-intel-active-management-technology-amt#_Toc451350766 https://software.intel.com/en-us/articles/getting-started-wi...

close04 8y ago
Unless your machine is branded as vPro it most likely means that it simply lacks the FW part to run AMT. So it will have the ME in the chipset, it might as well have the correct CPU and NIC for vPro (usually the NICs with M for management in the model name), but it's missing the firmware. Outside of OEM machines the only time I managed to build a vPro enabled system was in Haswell times when Intel had desktop motherboards with the correct chipset and NIC combination, and the BIOS to run it. Right around that time Intel exited the motherboard business and most manufacturers don't bother with shipping the firmware anyway.

cmurf 8y ago

Could Intel ME be disabled in UEFI firmware setup (if the firmware were to offer a UI for it?) Or it is something that's physically enabled/disabled on the CPU and totally orthogonal to UEFI firmware? Ergo, could the computer manufacturer release a firmware update providing such an interface option in firmware setup if they really wanted to? Or are they stuck once the product is released?

Kliment 8y ago
You can disable ME by giving it a firmware image to run that does nothing. The me_cleaner approach is to keep the module that brings up the hardware and then give it a command causing it to crash, which is as good as that. A firmware update can definitely do this too.

qop 8y ago

Sure they did...

amelius 8y ago

Sometimes I wonder why we even worry about things like Meltdown/Spectre when there is this gaping hole called ME.

arnaudsm 8y ago

I'm surprised by the lack of media coverage: Intel is deliberately leaving billions of CPUs vulnerable. For a $200 billion company, refusing to spend some ressources to patch all generations is irresponsible. Think of how many governments still use <2012 CPUs.

sametmax 8y ago
Another theory is that other actors have the will and influence to make sure it stays that way. We used to be answer with tin foil hat jokes about jokes on mass surveillance. Then came PRISM and nobody is laughing now. Maybe it's going to be the same with this. We will learn many years later it was enforced by some state or economical entity that benefit greatly to have a standard unpatchable backdoor on most laptop and servers on the planet.
RaleyField 8y ago
The greed and irresponsibility is boundless. They could set aside 10 billion and have excellent security. 1 billion could have bought thousand phds digging through their processors and I bet they could dig out boneheaded flaws like Spectre. Out of band management is fine, but have it completely disabled by default, have it run on co-processor optimized for security, not speed, in language optimized for security, not speed and when it's on have it filter all packets that aren't signed to unique secret key. Basic stuff.

mrpippy 8y ago

This feels like the Onion story “‘No Way To Prevent This,’ Says Only Nation Where This Regularly Happens” that they post after every US mass shooting, just with the picture changed. Intel will be fixing ME vulnerabilities forever. It has a huge attack surface, but too obscure to get serious resources from them.

tjoff 8y ago

How can I find out if my system is affected? The CPU list isn't really helping as the answer is just "yes". What remains is what, that my motherboard and NIC plays along? How can I figure that out? Is buying a non-intel NIC guaranteed to be safe? Right about bow running pfsense on intel hardware isn't the best feeling in the world.

yzmtf2008 8y ago

Isn’t this vulnerability based on AMT, which is based on ME but disabled by default? Even then, every setup I’ve seen have AMT (a separate Ethernet interface) behind a firewall and is only accessible via local network. The outrage is hardly justified.

rainbowmverse 8y ago
One day it's "[thing] shouldn't be exploitable because [mitigation]", the next it's "welp, [mitigation] has a bug in it and they've exploited [thing]."
- yzmtf2008 8y ago
  Right, and the network security is always part of the attack surface of an enterprise. What I’m saying, though, is that the component that’s vulnerable is 1) disabled by default and 2) near impossible for a consumer to enable.
achillean 8y ago
There are close to 5,000 devices exposing their Intel AMT to the Internet: https://www.shodan.io/report/j3cFHOzs https://www.shodan.io/report/j3cFHOzs
- yzmtf2008 8y ago
  There are X thousand redis servers exposed to the Internet too. This is hardly intel’s fault (having the ports exposed, not the vulnerability). And again, this is not the main point I’m arguing. What I’m saying is that supposedly “this is something that’s enabled by default on consumer devices” is verifiably wrong.
  - achillean 8y ago
    If you run Redis on a public interface without authentication then it will spit out a bunch of warnings and make you aware of the security implications. The changes antirez has made to Redis both in terms of secure defaults and notifying users of insecure settings has directly lead to a huge reduction in Internet-exposed Redis instances. And I was trying to address this point: > Even then, every setup I’ve seen have AMT (a separate Ethernet interface) behind a firewall and is only accessible via local network. In the past, manufacturers used that defense when a security researcher approached them about a problem and they justified the lack of patching by saying things like "nobody would put this on the Internet". There are simple things a manufacturer can do to encourage good security by the end-user (ex. showing a warning). I don't believe that blaming the end-user is a viable path to fixing the problem. This issue isn't specific to Intel but I would prefer it if the vendor implemented more security safeguards to prevent users from inadvertently increasing their attack surface.

enitihas 8y ago

I think most devices have similar vulnerabilities which aren't well known and hard to defend against, like the separate processor in most phones. Worth reading: https://news.ycombinator.com/item?id=6722292 https://news.ycombinator.com/item?id=6722292

_emacsomancer_ 8y ago
Which is a good reason not to feel smug if your device isn't an Intel device, but not an excuse for the behaviour of Intel.

ddtaylor 8y ago

Can JavaScript talk to that HTTP via Ajax?

noja 8y ago

Is there a GDPR angle on this? On by default without consent?

deleted 8y ago

[deleted]

arendtio 8y ago

Someone wants to speculate on what would happen if intel would open source their ME as a reaction to this?

ghthor 8y ago

It's all a scam to make functioning CPUS obsolete. It's a key to turn on a planned obsolescence.

confounded 8y ago

Just a note that if you want to avoid Intel's disastrous Management Engine, there are companies you can support that disable it. Purism[0] sell nice MBP-style, Debian-based laptops with modern Intel processors with the NSA's 'High Assurance Platform' bit set, and as much of the ME code removed as possible. It still runs briefly at boot, but this is the most-disabled you can currently get on any i3/i5/i7 processor[1]. [0]: https://puri.sm/ https://puri.sm/ [1]: https://puri.sm/posts/deep-dive-into-intel-me-disablement/ https://puri.sm/posts/deep-dive-into-intel-me-disablement/ System76 are planning to do something similar[2]. [2]: http://blog.system76.com/post/168050597573/system76-me-firmware-updates-plan http://blog.system76.com/post/168050597573/system76-me-firmw... The last Intel processors where the ME could be removed entirely without bricking, were the non-AMT Core Duos (2008ish), which were used on the Thinkpad T400 (good for your biceps) and the X200/X200T (thick, but compact, even by today's standards). Various companies (most prominently the Ministry of Freedom in the UK) sell these models with the ME completely removed, and a completely Free Software boot process via LibreBoot (a subset of coreboot). You can find a full list of suppliers on the FSF's 'Respects Your Freedom' hardware page[3]. Most of them will also remove the ME from a compatible laptop you send them, as a service. [3]: https://www.fsf.org/resources/hw/endorsement/respects-your-freedom https://www.fsf.org/resources/hw/endorsement/respects-your-f... These machines are also 'naturally' resistant to both Spectre and Meltdown, and obviously have no ME to exploit. None of the Intel horror-shows of the last few years seem to have touched them. I previously thought that running an old-machine for largely hypothetical freedoms was bizarre. After these CVEs, I'm beginning to re-examine how bizarre it really is. And I do miss those old ThinkPad keyboards :)

casefields 8y ago
Never heard of these. Thanks for the pointer.
- BanazirGalbasi 8y ago
  System76 is probably the most well-known Linux laptop distributor in the US, their offerings are pretty popular. I know a few people with one of their laptops and all of them are pretty satisfied. Purism is a bit more "extreme", trying to create an all-libre laptop that avoids proprietary software and hardware. Once their equipment is a bit more stable it's something I'm going to look into more, for now they're still in development though.

8bitsrule 8y ago

Must all solutions be software? How'sa about a desolder-the-chip mitigation? Or a hammer-and-sharp-punch mitigation?

watersb 8y ago

There seems to be confusion about vPro, AMT, BIOS, UEFI, Trusted Boot, and so on. This talk helped me: "Replace Your Exploit-Ridden Firmware with Linux" https://youtu.be/iffTJ1vPCSo https://youtu.be/iffTJ1vPCSo

6ue7nNMEEbHcM 8y ago

Would it suffice to mount and use external Ethernet adapter e.g. on PCIe, leaving the built-in disconnected? I think the ME intercepts only built-in Ethernet, can someone confirm?

DanBlake 8y ago

Does using a USB ethernet adapter mitigate all of the AMT issues? IE- Something like this : https://www.anker.com/products/variant/usb-3-0-to-gigabit-ethernet-adapter/A7610011 https://www.anker.com/products/variant/usb-3-0-to-gigabit-et...