17 ms·
Exploiting Intel’s Management Engine
- nes350 7y agoSeems to be hugged to death. https://archive.is/ty7Yu https://archive.is/ty7Yu
- msla 7y agohttps://web.archive.org/web/20191115161514/https://kakaroto.homelinux.net/2019/11/exploiting-intels-management-engine-part-1-understanding-pts-txe-poc/ https://web.archive.org/web/20191115161514/https://kakaroto.... archive.is is nice, but the Wayback Machine makes URLs which are a lot more transparent.
- egdod 7y agoarchive.is also breaks if you use Cloudflare DNS.
- Jonnax 7y agoSo I keep hearing that the IME can do remote KVM. I've got an old laptop lying around, could I hook at up to my router and access it without remote desktop software from another PC on my network? Or does this require some expensive intel software with a subscription?
- deleted 7y ago[deleted]
- mopsi 7y agoStandard VNC is enough. If you want other fancy features too (power control, remote media mounting, re-configuration), use Intel Manageability Commander (free): https://downloadcenter.intel.com/download/27807/Intel-Manageability-Commander https://downloadcenter.intel.com/download/27807/Intel-Manage...
- close04 7y agoThis would be a much better option: https://www.meshcommander.com/meshcommander https://www.meshcommander.com/meshcommander It works if the computer is fully vPro compliant. There are castrated versions of vPro for small businesses that lack the KVM feature. It’s all free and you just need to do the initial provisioning in the MEBx (post UEFI). Again, having the ME in the CPU is not enough. The chipset, NIC, and BIOS/UEFI support matter.
- snagglegaggle 7y ago> The chipset, NIC, and BIOS/UEFI support matter. True but it has been shown a lot of motherboards that should not support these things do, or at least that they are software enabled features.
- close04 7y agoSome do have a subset of features enabled or that can be enabled (maybe, somehow). But my post was not meant to be generic or for a hacker, rather for a person who would like to use a Lenovo T450 with (AMT) KVM. While all Intel CPUs have the ME, this is not enough. The chances of "hacking" the rest of the features on such a system without explicit vPro support are slim to none for all intents and purposes.
- vbezhenar 7y agoKey words: AMT, vPro. You should have compatible CPU and board. Remote KVM is provided via VNC protocol, so any VNC viewer should work. You need to open web interface and proceed from there. Basically it's a business feature and usually not available on consumer laptops.
- rwmj 7y agoAnd very annoyingly not available on the Intel NUC, even though remote-managing those would be very useful. I guess something about not wanting to canabalise their server market. If IME could be reprogrammed then maybe there would be a way to add these features.
- dleslie 7y agoIntel NUC are weird little devices; for my home file server, which at most ever has one user accessing at a time, I replaced an old PC tower with a NUC and a 5 disk USB3 SATA dock. It works better, has excellent Linux support, and uses less power. The device is weird because it strikes me as the perfect HTPC, and yet it isn't really marketed as such.
- rwmj 7y agoI've bought something like 10 of them (the oldest two are Gigabyte Brix, but I'll count those with them). There are a few home servers, but the main use is as a pool of machines to use for oVirt, Open Stack, Kubernetes and RHEL work. The machines get wiped and repurposed quite a bit. They're a lot more convenient for this than actual 19" servers, since they take up a tiny fraction of the space and power of even a single server. However they would be so much more useful if I could remote IPMI into them rather than having to find a monitor, keyboard, HDMI cable and mouse every time I want to fix them. They would also be reasonable for home theatre since they are silent and low power, while at the same time having decent CPUs, but they use Intel graphics so I guess they probably can't drive 4K + 60Hz displays, although I've never actually tried.
- 7y ago
- unixhero 7y agoI always wondered this and I never ever got to trying it. Ever since Intel introduced vPro.
- snagglegaggle 7y agoYes. You can do most anything you can do with IPMI which includes loading a CD over the network to reinstall the OS or redirecting the serial port. On newer machines you can set the IME to connect to a IPsec tunnel when some conditions are met and keep the IME enabled when the machine is on battery power and a wireless network. This allows you to administer the device when it is "outside of the office."
- ta999999171 7y ago> M.E. > VNC > IPsec tunnel This being the state of enterprise, no wonder every Fortune listed company is getting their doors blown off.
- e12e 7y agoYou might find the following helpful, I followed a similar guide for testing on an old laptop a few years back: https://www.cyberciti.biz/faq/remotely-access-intel-amt-kvm-linux-desktop/ https://www.cyberciti.biz/faq/remotely-access-intel-amt-kvm-...
- abumoaaz 7y agoالسلام عليكم ورحمة الله وبركاته
- derefr 7y ago> The ME does have a legitimate function, but it does so much more now, as it takes care of the hardware initialization, the main CPU boot up, control of the clock registers, DRM management for Audio/Video, software based TPM and more. In other words, the ME is to Intel boards as Apple’s T2 chip is to their recent notebooks: an SoC that takes on the real role of being the “system processor”, turning the [rest of the] socketed CPU into effectively an “application processor.” In fact, given that it’s so self-sufficient, it’s interesting that Intel choose to ship the ME as an “IP core” of the CPU itself, rather than making it part of the off-die Intel PCH chipset that they supply to mobo vendors. Is it just to provide the ME with low-latency access to CPU components like ALUs (for TPM encryption circuits) and d-cache (for packet sniffing)? Because it seems like it isn’t really built this way, and an “external ME” would be just fine running without a CPU socketed in at all. (Which would be neat, honestly; if you could exploit an external ME, you could run software on your Intel-chipset motherboard without a “real” CPU!) Given that industry players seem to be all trending toward this design in one way or another (even game consoles did the “system SoC” / “application CPU” split with the last two generations), I wonder if this design pattern will ever be standardized, in the way that interrupt controllers or MMUs were standardized. Will we ever see an open-hardware board with its own open-hardware system-management SoC running FOSS firmware?
- snagglegaggle 7y agoYes, the Raptor Computing POWER systems are almost entirely open. The CPU is entirely open, save the die mask. It's worrying that these vulnerabilities are not disclosed in a way that lets people take control of their devices. That the ME is so tightly integrated seems mainly to be for cost savings. There is also an argument for increased security, as now your attacker must be able to work with a decapped highly integrated CPU. Intel did at one point do what you were suggesting -- if you look at the sandsifter project the author found a family of devices that had a parallel execution unit that was dispatched instructions with a "secret" prefix that had full access to memory. This could still exist in newer processors but be better hidden, it would certainly make a lot of one might want to do with the ME a lot easier.
- aidenn0 7y agoHaving a software implemented TPM strongly encourages this approach, as it makes it easier to deny the main CPU full access to the system.
- elagost 7y agoIt is possible to use an Intel machine without the ME. Since there are constant vulnerabilities and exploits around the ME, many enthusiasts do not like the idea of a vulnerable and secret super-admin computer on their computer. There is the option to disable the ME on supported devices (usually old Thinkpads) using me_cleaner[1]. I personally run Coreboot on my Thinkpad with the ME "disabled" (essentially just broken and stuck in a constant bring-up state), and System76[2], Purism[3], and Dell sell machines with the option of disabling the ME entirely, if one is super-paranoid. [1] https://github.com/corna/me_cleaner https://github.com/corna/me_cleaner [2] https://system76.com/laptops https://system76.com/laptops [3] https://puri.sm/learn/intel-me/ https://puri.sm/learn/intel-me/
- smolder 7y agoYou can also flip the HAP bit in the bios descriptor region on the newest Intel chips (that me_cleaner does not support) using the Intel flashing tools. It's just called "reserved bit" and defaults to false.
- red_phone 7y agoI’m confused... other comments reference ME as the root-of-trust for the system, the chip that brings the CPU out of reset. How can a system be operational without that functionality?
- criddell 7y agoWhy wouldn't it work? Intel-based motherboards didn't always have a ME.
- wolf550e 7y agoCurrent Intel chipsets and CPUs cannot initialize the system without the ME. You can disable all the applications running on the ME, but it is required to bring up the system.
- wmf 7y agoYou can "disable" the ME but you can't disable it. People are being loose with terminology.
- mynameiskyleok 7y agoJust wanted to say that this was written really well. As someone who doesn’t know anything about the subject, I was easily able to follow along and understand. That’s kind of rare around here for me.