4 ms·

> allowing a field day for hackers even when your computer was shut down but still receiving power on standby. AFAIK vPro doesn't let anything talk to its mana

by derefr 5y ago

> allowing a field day for hackers even when your computer was shut down but still receiving power on standby. AFAIK vPro doesn't let anything talk to its management interface over the network until you actually do the local setup. I found this out to my irritation, when I once acquired a used workstation with vPro, freshly wiped, and — thinking I could just set it up by plugging its management-network NIC into my switch and talking to it over the LAN — I found out to my dismay that it wouldn't even bother to acquire an IP address for the management interface until I enabled vPro in the BIOS and then told it to use DHCP. (Am I wrong about this? Perhaps, do OEMs ship batches of machines with vPro pre-configured in certain ways, for clients that explicitly specify that they're going to use vPro for remote provisioning? Or does every workstation order have an implicit "unload from the pallet, plug into a KVM, enable vPro, then install at location" step?)

gerdesj 5y ago
Your parent gave an anecdote: "I remember a story a few years past when a full line of CPU's went out with IME having no password set at all" They describe a pretty serious snag. My experience of iDRAC/iLO/vPRO etc etc etc is that they have all had some pretty major problems. Keep your monitoring/management interfaces on their own network/VLAN is my advice. While you are at it, get the logging and firewall rules sorted.
- Zancarius 5y ago
  I think the parent you're referring to was echoing a story that popped up as something of a conspiracy on the vestiges of the Internet, hinted at by the claim that the machines could be accessed when powered off. I don't think that's true, and you'd have to have access to the network they're connected to. Though, I suppose you could power such systems up (maybe?) and then gain access to them if you did have access via, say, a corporate network. The closest analog to the claims that I could find in short order did mention a known AMT exploit[1] in 2017. [1] https://www.theregister.com/2017/05/05/intel_amt_remote_exploit https://www.theregister.com/2017/05/05/intel_amt_remote_expl...
  - R0b0t1 5y ago
    They're talking about potential backdoors, perhaps guised as misconfiguration. Later vPro versions would connect back to a VPN. You shouldn't just trust Intel that it doesn't respond to network access if you tell it to nicely.
    - Zancarius 5y ago
      I agree. I don't want to rehash it here, but if you look at my reply to your sibling, you'll get a better insight into my reasoning. Basically the TL;DR version is that there are some absolutely asinine conspiracists who literally think that government agencies can extract all of their data while the computer is powered off using IME/AMT. Obviously, there's a lot more to it, but I do agree that I don't trust Intel, and IME/AMT are dangerous. I'd link one of the posts I ran into that made this claim, but I don't really want to give the idiots who peddle this garbage any more exposure than necessary, because they appear to be into the 5G "mind control" conspiracies as well. No, I'm not kidding.
  - perl4ever 5y ago
    >I think the parent you're referring to was echoing a story that popped up as something of a conspiracy on the vestiges of the Internet, hinted at by the claim that the machines could be accessed when powered off. If by "vestiges" you mean "fringes", I find that a bit disturbing assuming you are sincere. Whatever thought process led you to think it was an obscure conspiracy theory - did you check Wikipedia? The third sentence of the Wikipedia page on the IME is: "The Intel Management Engine always runs as long as the motherboard is receiving power, even when the computer is turned off." https://en.wikipedia.org/wiki/Intel_Management_Engine https://en.wikipedia.org/wiki/Intel_Management_Engine There isn't a specific source for this given, but I looked at some of the references and found this in Intel documentation: "This interface can retrieve the current power state and change the power state of the hosting machine via commands to Intel AMT." https://software.intel.com/sites/manageability/AMT_Implementation_and_Reference_Guide/default.htm https://software.intel.com/sites/manageability/AMT_Implement... There is also a link to "Black Hat 2017" given as a source for the ability to manipulate computers when they are turned off through the Management Engine. And then, looking at your Register link, I don't see that it says anything about the capability of control when powered off.
- failwhaleshark 5y ago
  iDRAC/iLO typically run some sort of Linux or embedded system that is rarely updated and insufficiently fuzzed for vulnerabilities. The prevailing fallacy in physical infrastructure commodity hardware is that iDRAC/iLO, ethernet switch serial console ports, UPS/PDU management, KVMs, and so forth are supposed to be isolated on a separate, dedicated, and secured internal network and so the endpoints "don't need Defense-in-Depth."
bayindirh 5y ago
> until I enabled vPro in the BIOS and then told it to use DHCP. It may have been disabled by the prior owner of the workstation. The servers we get come with "All management enabled, and will get an IP from DHCP" mode. There's a probability that these workstations left the factory with vPro enabled.
- derefr 5y ago
  I think it’s maybe a difference between servers and workstations, then. I did a full BIOS factory reset, and it was in the “Intel AMT”-disabled state after I did so. To be clear, are you talking about Intel AMT specifically (which I’m not really aware of being a “thing” with Xeon), or just regular server-OEM BMCs (iLO, DRAC, etc.)? BMCs are definitely usually pre-configured. That’s part of the point of BMCs: you can rack the servers and run cable from their management NICs to the management-VLAN switches; then populate their drive bays; and then batch-provision everything at once through the BMCs (including, hopefully, setting up actual security on the BMC.) But Intel AMT isn’t quite the same thing. (For one, vPro-badged computers don’t usually have a separate management NIC — though some do! — but rather Intel AMT usually uses the IOMMU to virtualize another NIC onto the same physical motherboard RJ45 socket. So it’d be a much worse security design to have AMT default-enabled from the factory, since that’d put new machines’ control-plane interfaces out onto your regular-traffic VLAN by default...)

by derefr 5y ago

gerdesj 5y ago

Your parent gave an anecdote: "I remember a story a few years past when a full line of CPU's went out with IME having no password set at all" They describe a pretty serious snag. My experience of iDRAC/iLO/vPRO etc etc etc is that they have all had some pretty major problems. Keep your monitoring/management interfaces on their own network/VLAN is my advice. While you are at it, get the logging and firewall rules sorted.

Zancarius 5y ago
I think the parent you're referring to was echoing a story that popped up as something of a conspiracy on the vestiges of the Internet, hinted at by the claim that the machines could be accessed when powered off. I don't think that's true, and you'd have to have access to the network they're connected to. Though, I suppose you could power such systems up (maybe?) and then gain access to them if you did have access via, say, a corporate network. The closest analog to the claims that I could find in short order did mention a known AMT exploit[1] in 2017. [1] https://www.theregister.com/2017/05/05/intel_amt_remote_exploit https://www.theregister.com/2017/05/05/intel_amt_remote_expl...
- R0b0t1 5y ago
  They're talking about potential backdoors, perhaps guised as misconfiguration. Later vPro versions would connect back to a VPN. You shouldn't just trust Intel that it doesn't respond to network access if you tell it to nicely.
  - Zancarius 5y ago
    I agree. I don't want to rehash it here, but if you look at my reply to your sibling, you'll get a better insight into my reasoning. Basically the TL;DR version is that there are some absolutely asinine conspiracists who literally think that government agencies can extract all of their data while the computer is powered off using IME/AMT. Obviously, there's a lot more to it, but I do agree that I don't trust Intel, and IME/AMT are dangerous. I'd link one of the posts I ran into that made this claim, but I don't really want to give the idiots who peddle this garbage any more exposure than necessary, because they appear to be into the 5G "mind control" conspiracies as well. No, I'm not kidding.
- perl4ever 5y ago
  >I think the parent you're referring to was echoing a story that popped up as something of a conspiracy on the vestiges of the Internet, hinted at by the claim that the machines could be accessed when powered off. If by "vestiges" you mean "fringes", I find that a bit disturbing assuming you are sincere. Whatever thought process led you to think it was an obscure conspiracy theory - did you check Wikipedia? The third sentence of the Wikipedia page on the IME is: "The Intel Management Engine always runs as long as the motherboard is receiving power, even when the computer is turned off." https://en.wikipedia.org/wiki/Intel_Management_Engine https://en.wikipedia.org/wiki/Intel_Management_Engine There isn't a specific source for this given, but I looked at some of the references and found this in Intel documentation: "This interface can retrieve the current power state and change the power state of the hosting machine via commands to Intel AMT." https://software.intel.com/sites/manageability/AMT_Implementation_and_Reference_Guide/default.htm https://software.intel.com/sites/manageability/AMT_Implement... There is also a link to "Black Hat 2017" given as a source for the ability to manipulate computers when they are turned off through the Management Engine. And then, looking at your Register link, I don't see that it says anything about the capability of control when powered off.
failwhaleshark 5y ago
iDRAC/iLO typically run some sort of Linux or embedded system that is rarely updated and insufficiently fuzzed for vulnerabilities. The prevailing fallacy in physical infrastructure commodity hardware is that iDRAC/iLO, ethernet switch serial console ports, UPS/PDU management, KVMs, and so forth are supposed to be isolated on a separate, dedicated, and secured internal network and so the endpoints "don't need Defense-in-Depth."

bayindirh 5y ago

> until I enabled vPro in the BIOS and then told it to use DHCP. It may have been disabled by the prior owner of the workstation. The servers we get come with "All management enabled, and will get an IP from DHCP" mode. There's a probability that these workstations left the factory with vPro enabled.

derefr 5y ago
I think it’s maybe a difference between servers and workstations, then. I did a full BIOS factory reset, and it was in the “Intel AMT”-disabled state after I did so. To be clear, are you talking about Intel AMT specifically (which I’m not really aware of being a “thing” with Xeon), or just regular server-OEM BMCs (iLO, DRAC, etc.)? BMCs are definitely usually pre-configured. That’s part of the point of BMCs: you can rack the servers and run cable from their management NICs to the management-VLAN switches; then populate their drive bays; and then batch-provision everything at once through the BMCs (including, hopefully, setting up actual security on the BMC.) But Intel AMT isn’t quite the same thing. (For one, vPro-badged computers don’t usually have a separate management NIC — though some do! — but rather Intel AMT usually uses the IOMMU to virtualize another NIC onto the same physical motherboard RJ45 socket. So it’d be a much worse security design to have AMT default-enabled from the factory, since that’d put new machines’ control-plane interfaces out onto your regular-traffic VLAN by default...)