9 ms·
Secrets of Intel Management Engine – Hidden code in your chipset
- jesrui 12y agoSlides can be downloaded without registration at http://recon.cx/2014/slides/Recon%202014%20Skochinsky.pdf http://recon.cx/2014/slides/Recon%202014%20Skochinsky.pdf
- jcr 12y agoThe video of Igor's talk at Recon 2014 is here: https://www.youtube.com/watch?v=Y2_-VXz9E-w https://www.youtube.com/watch?v=Y2_-VXz9E-w
- ollybee 12y agoMy second thought on reading this was how can a server be PCI compliant with Intel management engine installed? but a quick search shows that Intel have thought of this: http://www.intel.co.uk/content/dam/www/public/us/en/documents/white-papers/vpro-pci-dss-retail-paper.pdf http://www.intel.co.uk/content/dam/www/public/us/en/document... My first thought was that it seems increasingly clear that Stallman has been right all along.
- morganvachon 12y ago> My first thought was that it seems increasingly clear that Stallman has been right all along. The problem is that being philosophically right doesn't always mean being practically right. In order to create the perfect Stallman-esque machine, one would have to design everything from the logic chips up from scratch, because in the end, no third party can be trusted. He says this himself about the Loongson system he uses daily; he considers it a compromise but one heavily weighted in his favor. In short, Stallman has been right all along, but there's little we can do about it from a practical standpoint.
- throwaway2048 12y agoWe can certainly do a lot better than this, an attitude of "unless its perfect its futile to even try" is defeatist bullshit, and not what Stallman endorses at all.
- morganvachon 12y ago> "unless its perfect its futile to even try" I didn't say that. I said there's little we can do, not nothing we can do. And there are people, Stallman and others, who are doing something. I'm simply acknowledging that it's a mountain, not a foothill.
- deleted 12y ago[deleted]
- deleted 12y ago[deleted]
- sinetek 12y agothere's plenty we can do. Bunnie's Novena laptop is a great example of moving in the right direction. It all depends on speed I guess; you could have a completely open hardware laptop using an FPGA, but speed would be an issue for sure
- sp332 12y agoThe Novena has a quad-core Cortex A9 as well as the FPGA. A lot of people who buy it probably won't use the FPGA at all. In fact, the Spartan-6 FPGA might have more secrets than the CPU.
- pakled_engineer 12y agorms doesn't have the Loongson netbook anymore, he rolls with a Gluglug X60 now I believe.
- 12y ago
- astrange 12y agoWhy would the newest version of the ME use SPARC ISA? Does someone out there need register windows?
- lambda 12y agoWhere did everyone get SPARC from? The slides clearly say ARC, not SPARC.
- cm3 12y agoslide 16 and 50
- wiml 12y agoDifferent versions of this slideshow have different information. The table titled "ME Core Evolution" (slide 15/16), for example, shows two generations in the version on slideshare, but three generations in the PDF on recon.cx. There is also more discussion of the SPARC architecture in the PDF version. I did wonder if SPARC refers to the Sun architecture, or if it's an evolution of ARC that simply collides with the other name. He doesn't mention having successfully disassembled any of the BayTrail/TXE versions' firmware yet.
- astrange 12y agoFrom the pdf version linked at: https://news.ycombinator.com/item?id=8813925 https://news.ycombinator.com/item?id=8813925 The author clearly believes it's SPARC in Bay Trail, since he seems surprised by it. A coincidence does seem pretty likely but you'd think Oracle would object.
- pgeorgi 12y agoSPARC is maintained by SPARC International, so Oracle doesn't have too much to say about that. However, Intel isn't part of that group (at least according to the website), and that doesn't fit their MO when adopting external technology.
- userbinator 12y agoWow. SPARC and Java, two things you wouldn't ever expect Intel hardware to ship with! The mention of SOAP-based protocols is also rather surprising, since they have rather high overhead, and this means ME is not just a little 8051-class MCU but almost a fully-featured PC itself... The amount of complexity - and the opportunities to hide things in that - has increased so much compared to earlier PCs that in some ways I think the development of computer systems is headed on a rather treacherous path. When systems are so complex that no single person can understand them entirely, it's easier to make them behave against their owner's will.
- walterbell 12y agoDo fewer people know how to write SPARC shellcode than x86?
- nine_k 12y agoFortunately, a number of non-PC systems exist (one is probably in your pocket).
- lambda 12y agoNot SPARC, ARC: https://en.wikipedia.org/wiki/ARC_International https://en.wikipedia.org/wiki/ARC_International
- calvin_ 12y agoactually, also SPARC
- Maakuth 12y agoWhat, SPARC and Java in Intel motherboards? Is this some elaborate gag on Sun/Oracle? I hope they'll demo it by running Solaris there for good measure.
- lambda 12y agoARC, not SPARC. Did the title on HN say "SPARC" originally or something? Because the slides never mentions SPARC, they discuss ARC, an embedded ISA.
- Maakuth 12y agoSomewhat different set of slides[1] was linked in the comments here, it appears the latest chipsets uses SPARC indeed. 1: http://recon.cx/2014/slides/Recon%202014%20Skochinsky.pdf http://recon.cx/2014/slides/Recon%202014%20Skochinsky.pdf
- icarusmad 12y agoARC[1], not SPARC. It evolved from the SuperFX chip used in some SNES games. [1]: http://en.wikipedia.org/wiki/ARC_International http://en.wikipedia.org/wiki/ARC_International
- userbinator 12y agoThe earlier ME versions used an ARC. The later ones use a SPARC. Look at slide 50.
- tedunangst 12y agoSlide 50 just says "Questions?"
- edmccard 12y agoSlide 16 says that ME v1.x used an ARCTangent-A4 and that ME v2.x uses an ARC 600.
- wiml 12y agoTake a look at the PDF version on recon.cx linked by jesrui— it's substantially different from the slideshare version in a few places, notably that it talks about a third generation (Bay Trail TXE) which uses SPARC and drops the pesky Huffman coder entirely in favor of LZMA.
- WhitneyLand 12y agotldr: Intel's remote management capabilities are obscurely baked into every chipset. The ME has out of band access to the network card and main memory. Since ME also has its own flashable memory in principle a machine could be compromised in a nearly undetectable way. The presentation shows that a lot of interesting details of ME have been brought to light but it has also withstood a first round of attacks. No rootkit has yet been shown to be practical.
- logicallee 12y agowhat an unlikely coincidence. amazing what nature can come up with without any sort of plan or guidance. :)
- bhouston 12y agoIt just has to be a matter of time until it is cracked. I am surprised Intel did this.
- razster 12y agoMy guess is that this was requested and passed by without fully understanding the consequences.
- cfrantz2 12y agoI believe it has already been cracked. See "Persistent, Stealthy, Remote-controlled Dedicated Hardware Malware" from 30c3: https://www.youtube.com/watch?v=Ck8bIjAUJgE https://www.youtube.com/watch?v=Ck8bIjAUJgE
- venomsnake 12y agoLets just hope that intel security teams are better than Sony Pictures' ones. After the sony hack ... lets say that I feel less secure about anything.
- pekk 12y agoWhat was exceptional about the Sony hack? Lots of companies have been owned due to various oversights.
- pdkl95 12y ago"Can be active even when the system is hibernating or turned off (but connected to mains)" On top of the security issues, it seems Intel owes a lot of people some reimbursements for their share of the power bill. Unfortunately, I suspect this theft of electricity will be quietly swept under the rug and forgotten about.
- cm3 12y agoIs it part of vPro or available in every cpu? Can it be disabled like TSX?
- pgeorgi 12y agoThe ME is on _every_ CPU, and you can't easily disable it (there are ways, but it's unclear how much really shuts down, and you might lose power management features). vPro is merely the larger ME firmware: The small one is 1.5-2MB, the vPro one is 5-7. A non-vPro mainboard probably comes without a SOAP-capable webserver (although I wonder what they need 1.5MB of code for), but the chip to run it is all there.
- cm3 12y agoOh no. I thought I could select the right chip like you can do to dodge TSX and HT. What if I get an AMD CPU? Do those also have an IPMI in disguise inside the CPU package wired to a network interface?
- stefantalpalaru 12y ago> What if I get an AMD CPU? Do those also have an IPMI in disguise inside the CPU package wired to a network interface? AMD implements something similar with DASH in some of its APUs: http://www.amd.com/Documents/out-of-band-client-management-overview.pdf http://www.amd.com/Documents/out-of-band-client-management-o... On page 10 in that PDF it says: > DASH support is available in numerous client platforms, including the HP Elitebook 700 series, HP EliteOne 705, HP EliteDesk 705 Mini, HP EliteDesk 705, HP 6305 and Lenovo M78 ThinkCentre. Support is also available in management consoles, including the Symantec/Altiris Client Management Suite v7.5, and Microsoft System Center Configuration Manager (SCCM)*.
- pgeorgi 12y agoThe interesting thing is that they refer to NIC vendors all the time - as if that feature is integrated with the ethernet controller (plus some help of the chipset to keep it alive when everything else is off). However AMD has its own share of extra processors within the CPU and chipset, of which we (at coreboot) know of at least two: SMU and IMC. The firmware for both is still measured in kilobytes, and they seem to have limited access to hardware resources. (for SMU, see http://media.ccc.de/browse/congress/2014/31c3_-_6103_-_en_-_saal_2_-_201412272145_-_amd_x86_smu_firmware_analysis_-_rudolf_marek.html http://media.ccc.de/browse/congress/2014/31c3_-_6103_-_en_-_...) Newer chipsets (than kaveri/kabini) come with TrustZone (that ARM stuff) and a "Platform Security Processor", which indicates that there's at least one new processor, likely ARM based.
- wyager 12y agoWikipedia article: http://en.wikipedia.org/wiki/Intel_Active_Management_Technology http://en.wikipedia.org/wiki/Intel_Active_Management_Technol... It's absolutely horrifying. There's no way this is secure.
- gweinberg 12y agoMy last few computers have used AMD chips. I think I will stick with those.
- cm3 12y agoAs noted in another comment AMD has something similar.