>>every Intel platform with AMT, ISM, and SBT from Nehalem in 2008 to Kaby Lake in 2017 has a remotely exploitable security hole in the ME (Management Engine) not CPU firmware.
>>there is literally no Intel box made in the last 9+ years that isn’t at risk
>>SemiAccurate has been begging Intel to fix this issue for literally years
Am I the only one who is so cynical to think it must have been deliberate? Intel dragging their feet for YEARS -- what could justify such a delay? The paranoid side of me asks "Were they waiting to patch this hole, until they found a different one that could be utilized?"
Which begs the next quesion: Where is the NSA in all of this? It's the sort of thing that would be mighty handy to a group wishing to snoop on everyone and everything?
Last question: Why would anyone trust the encrypted management engine after this? (Why would anyone trust it before?)
>> What about embedded devices that are increasingly PC based? Digital signage perhaps? Industrial controls. HVAC. Security systems. Flight controls. Air traffic controls. Medical devices.
What, indeed? Is this the method used to interfere with Iran's nuclear program centrifuges?
Extending the attack surface in the name of alleged convenience seems more a plan to enable hacking than a reasonable design and marketing approach for microprocessors. IoT fanboys with an urge to make home appliances remotely exploitable might be in good faith, but Intel is smarter than them.
It claims that things with IME are (which I'm not sure if Atom has), and lists a series of architectures of which Atom isn't part. (Its architectures have different names.)
It's ambiguous if the Atom line (and which portions) might be impacted, and I would prefer someone comment directly on if Atom has ME and if so, if it was using the dangerous version (and when).
I think anything with an i5 or i7 in the name has the ME onchip. My spare Thinkpad certainly does & it’s four or five years old at this point in time. I turned the ME off in the bios the moment I acquired it, but I doubt Lenovo will be issuing any bios updates for it.
After learning about remote management capabilities I've always suspected it had holes. Large attack surface, any exploit would have a high value, and closed source.
Perhaps one day we'll be able to buy CPU's without this "feature".
I'm betting AMD and ARM are in the same boat.
> After learning about remote management capabilities I've always suspected it had holes. Large attack surface, any exploit would have a high value, and closed source.
Even after reading this, I'm still not convinced it does have holes. It's so high value (pervasive, incredibly powerful, and old) that if it were possible a bad actor would have used it. The spectrum of possibilities is small:
1. The hole does not exist, but SemiAccurate thinks it does.
2. It exists, but only SA has discovered it.
3. SA discovered it along with a few bad actors, who are using it surreptitiously and haven't been caught.
4. It's being used all over the place, it's a widely acknowledged security disaster.
We're not in state 4. The article suggests we're in 2 or 3. 2 seems unlikely - SA does not have special abilities that transcend those of other security research firms. 3 seems especially unlikely: with this much power available, and with the hole being patchable, could they resist using it? Which leaves option 1.
SemiAccurate isn't a security research firm, it's a tech news blog. There's basically no chance that they've discovered anything. If there's an exploit, they would've had to have heard about it from either a source inside Intel or an actual security researcher of some kind.
There are many high profile targets where "if it were possible a bad actor would have used it" has been proven false. See recent publicity about vulnerabilities in printers, antivirus products, etc.
Zero details and zero cross references, zero mentions on Google and zero mentions in any security list I'm on. Charlie blowing nonsensical steam yet again?
The article implies that they have been privately trying to get Intel to fix it, so there is no reason it would have been mentioned publicly anywhere.
Now a patch is coming out but Intel is still trying to keep it quiet, so he's trying to warn people disable AMT and be ready to apply patches ASAP.
Presumably he didn't even want to disclose the existence of the vulnerability publicly until there was some sort of fix, and he still won't want to disclose details before the fix is released.
Of course, you can doubt the veracity of this story, but I'm just pointing out that there would be no reason to expect details, cross references, or mentions on Google or security lists yet if it is true.
It does seem suspicious to me that this hugely critical flaw deep in the firmware stack has been discovered by the writing staff of a tech news website rather than an infosec research team...
The article sort of reads like he has thought (not known) there was an issue for a long time.
Then, he saw that Intel released a patch related to the management engine, and took that as confirmation? Maybe he has access to the release notes via a source at an OEM?
He got the affected version numbers exactly right, but according to Intel he got the affected hardware wrong (consumer hardware unaffected).
That tells me he got the information from an unmentioned source. If he had the details himself he would be able to confirm what hardware it is present on by testing it.
The explanation for that error code be that the source have been vague about it or not tested it on a lot of hardware, or isn't even a firsthand source, or that the journalist misunderstood it.
Ah. To be fair, that intel.com link is confusing, because it sends you off to see if you have "Intel® vPro", which is certainly on consumer hardware, like various i5 and i7 systems. Which does not jive with the earlier line "This vulnerability does not exist on Intel-based consumer PCs". It sort of depends on your definition of consumer hardware.
Overall, though, it does seem to validate the sequence was something like "he had a suspicion" then "intel released an update".
If Charlie was a security researcher and SemiAccurate was a well-regarded security firm, I would not expect details or cross-references or mentions on security lists. Charlie is not a security researcher, he's a journalist, and SemiAccurate is the tech equivalent of a supermarket tabloid. He is not a credible primary source for anything security-related, particularly given SemiAccurate's reputation for publishing rumors as facts.
None of that means he's necessarily wrong, just that you should be very careful about believing his claims without supporting evidence. A lot of people here on HN have thought that a remote ME exploit was only a matter of time, so an article claiming to validate that belief will not get as much skepticism as it should.
Is there a better source for this than SemiAccurate? The article doesn't really have much beyond self-aggrandizement and "we can't tell you any details, but you're screwed". For something that could be anything from "Charlie Demerjian heard a rumor about a ME patch and wanted some pageviews" to the actual security apocalypse, I'd like credible sources.
The fact that people can stay behind platforms, companies, and technologies that are proven to be so inherently insecure that they can never be trusted just boggles my mind.
Adobe Flash has a new zero-day every week, but we were saddled with it for years past when it should have been retired because some people didn't want HTML5 to have feature-parity with Flash.
Java has a new zero-day every week but we're stuck with it because enterprises are afraid of trying something new.
Windows was wide open to attacks for years, but they got away with it by saying "yeah but Apple is so expensive" and people still parrot that. They said "yeah but Linux is stolen technology/doesn't work right" and people still parrot that.
Android has a new malware/exploit warning every week, the majority of the phones never see security updates, and are running outdated software the minute they're shipped to stores but people say "yeah but Apple is so expensive/locked down" or "Windows Phone doesn't have any apps".
I have friends who lost their credit card numbers at Home Depot but refuse to shop at Lowes because they don't like the NASCAR driver that Lowes sponsors.
People get so caught up in brand loyalty that they're willing to defend "their" company like it's a family member. Even among the tech community, security means nothing. We still use Android phones to get root access, we still use Windows to save some money on our laptops, we still program in PHP because it pays the bills.
Nothing will ever be catastrophic enough. Anyone can get away with it just by creating an "us vs them" mentality with their customers.
>Java has a new zero-day every week but we're stuck with it
Well, Java applets did die. What more do you want? The Java sandbox is only used by extremely legacy software at this point, so it doesn't matter if it has holes in it. Actually, the more holes the better, so we can get rid of the last holdouts.
No it doesn't. The last one was in 2015. Before that I think there was a two year gap to the prior one. Zero days in Java are actually very rare these days.
That doesn't mean bugs are rare - like any large piece of software Java gets regular security patches, but those are flaws found by the developers themselves rather than attackers, so they aren't zero days.
I think it's implied that "a new X every week" is always going to be hyperbole. I'm intentionally overstating the point so someone just like you could hop in and prove it better than I ever could.
Remember in 2012 when Apple stopped shipping Java with their browser because it was so insecure?
>> People get so caught up in brand loyalty that they're willing to defend "their" company like it's a family member.
Long ago I read something about that. The psych came down to the (false) idea that changing brand would confirm that you were wrong. The example was that even if Ford made better cars back in the day so you're a diehard Ford owner, if they quality demonstrably falls behind and Chevy is demonstrably awesome today you still won't change! And that's a case where your prior decision was actually right. So people have these weird internal notions that 1) companies value doesn't change over time, 2) their value doesn't change in light of new evidence, and 3) My own value is somehow tied to making a "correct" decision in spite of cognitive errors #1 and #2.
People are stubborn, and that's being kind about it.
No, that's not how sources work. You don't get to use your assumption that the article is accurate to assert that it will eventually be proven accurate by other sources. That's circular reasoning.
...and if the article's claims aren't true, there wouldn't be any sources to confirm the claims at all. The evidence we've been presented with so far (no sources) is consistent with both possibilities. When you make a claim as big as SemiAccurate did, it's on you to provide sources to back it up. If you can't present any kind of proof, you don't have a story, you have a rumor.
My prediction: At the end of June, Intel announces a fix for a minor non-RCE bug in the LAN code of Intel ME. SemiAccurate proudly and inaccurately announces that it confirms their previous reporting and adds it to the list of things to mention every time they write an article about Intel. There is no follow-up Hacker News thread with 100+ comments, so most of the people who posted here continue thinking that there was a major RCE in Intel ME that we just haven't heard about because it was covered up.
Edit: Already proven wrong! We're headed for interesting times.
Devil's Advocate here, so you are assuming there is a perfectly secure software implementation in this world, and only Intel has it for their Management Engine? I get your point, SemiAccurate may or may not have an exploit, but I think it goes without saying there is a security hole somewhere in the ME, it just is not publicly known at this point.
That's harder in practice than you make it sound. Firmware updates for Intel ME are handled through OEMs, it's not a file that Intel publishes that an interested person can go to their website and download. The article claims that such a patch has been released to OEMs but is being kept under wraps, which might make it hard to determine when it actually ships in a downstream update. Even if you have a file that you know contains the binary blob of updated firmware, reverse-engineering it to determine what it does differently compared to the previous version is very much non-trivial.
CPU firmware patches have also been released through Microsoft update, and Windows computers may well be patched on the fly in this way. I suppose it would be possible to download the update individually and examine its contents, but, as you point out, it would be extremely difficult to work out what it was doing.
>The details of our new SMM attacks will be made
available once Intel patches its firmware, most
likely we will present them at the Black Hat USA
conference in summer 2009. We will also make the
code of our TXT exploit available.
That is not a source that confirms SemiAccurate's claims, it's a nearly decade-old paper (~2008-2009) describing an attack against a completely different security feature. The "System Management Mode" described and attacked in the paper is unrelated to Intel ME.
> There is an escalation of privilege vulnerability in Intel® Active Management Technology (AMT), Intel® Standard Manageability (ISM), and Intel® Small Business Technology versions firmware versions 6.x, 7.x, 8.x 9.x, 10.x, 11.0, 11.5, and 11.6 that can allow an unprivileged attacker to gain control of the manageability features provided by these products. This vulnerability does not exist on Intel-based consumer PCs.
The short version is that every Intel platform with AMT, ISM, and SBT from Nehalem in 2008 to Kaby Lake in 2017 has a remotely exploitable security hole in the ME (Management Engine) not CPU firmware.
We knew this would happen. We knew that the Management Engine was a backdoor, and we knew it was only a matter of time before someone would figure out how to exploit it. This is exactly the reason why Libreboot exists (https://libreboot.org/faq.html#intel). And now, far from being the tinfoil hat distro that is often portrayed, it will become a bare necessity.
Let's hope one of the other CPU manufacturers (e.g. AMD) starts supporting LibreBoot and allows to officially disable the ME-equivalent hardware feature, so that Intel get's forced by market-pressur to follow.
Intel needs more competition - thanks to AMD latest new 8-core CPU Intel got forced to release a new CPU the had in their basement for years - suddently it's possible for them to release i7 notebook CPUs with more then two cores!! Even back in 2010 it would have been viable to produce 4 core notebook CPUs - but the went away because the had no competition.
- releasing the source doesn't tell you what's on the chip.
- PSP is kind of "Ring ∞", so there would be no good outcome from providing general-purpose access to it. So, the keys will never be released.
- it's thusly not possible to map the signed (encrypted) firmware to the source.
- even if the source had a clearly documented "master off" in it, you can never know if the firmware's copy reads "master-except-if-A-and-B-say-C off" :(
Indeed (have some of those too), but I assumed we'd artificially limited ourselves to talking about i7. I'm not sure why I assumed that, because you're right of course.
> release i7 notebook CPUs with more then two cores
U-series i7s have two cores. HQ-series i7s have four cores. Both are mobile CPUs. Remember though that more cores generally means more power consumption which generally means less wallclock time on battery power.
Intel's U-8XXX CPUs are rumored to offer 4 cores with a variable TDP from 18-45W this autumn.
It's my tinfoil hat theory why MS waits for an earnest update on their highend Surfacebook. A high-end quad-core Surfacebook with a 10-series GPU and 32GB LPDDR with real Thunderbolt 3 Ports would make for a 13" dreammachine...
The procedure seems far from trivial and requires special hardware(?). Is there a guide or some resources I could follow as a person with no hardware/low-level technical knowledge?
I'm having fun, I finally have an excuse to dust off my Libreboot X200 (refurbished and modded Thinkpad with Libreboot firmware).
However, I strongly disrecommend buying from Leah Rowe unless you enjoy waiting months for payment confirmation and delivery. The worst webshop experience I've ever had.
I recommend you build/flash your own, contract it out or look for a different vendor.
I don't own anything by Libiquity but I'd be happy to ask answer any questions about my Libreboot/Minifree X400, which is based off the Lenovo Thinkpad T400, including diagnostics and/or benchmarks if I can get them set up in less than 30 minutes.
Somewhere you have to externalize trust. What use is the open HDL code for a chip if you cannot be sure someone down in the manufacturing chain hasn't... modified it?
Certainly this kind of attack is not your average script kiddy but nation-level instead, but I wouldn't put it past the NSA to pull this off.
Correct, you do need to externalize trust somewhere, but the Richard Stallman level of "chips are ok but firmware is not" is not the correct place for it.
Are remote management functions of portable consumer electronics (i.e.: remotely wiping your iPad) also supported by similar hardware chips from other vendors?
There is a laptop theft recovery/tracking software called LoJack for Laptops (AKA CompuTrace). Some laptop manufactures have added BIOS support for this service (Dell, HP, Lenovo, etc). According to the Wikipedia article [1] this BIOS service copies a downloader into the System32 folder on Windows, which then downloads the full service. It doesn't appear that the BIOS service itself is remotely exploitable, however it can be used for persistent root-kits [2].
I've got a Lenovo T530 and a Lenovo T450s. I wonder if they've released a firmware update yet...?
I can't say I'm surprised, but I am surprised at the fact that finally, after all these years, someone finally got down to patching some vulnerabilities in this area.
One nice feature of (some) Thinkpads is that the AMT and ME can be "permanently disabled" through the BIOS, presumably by blowing a fuse or similar. Check if yours has this capability.
Patching is going to be a nightmare considering that many OEMs drop support for a motherboard after 3 years. There will be unpatched systems floating around for a very, very long time.
Let's hope Intel and all the other chipmakers will learn this lesson (unless it's done on purpose, in which case they won't care about any lessons learned - they'll do it anyway).
Security is a cost center and most OEMs run on margins too thin
to bother with security patches even if they cared. Most simply don’t care.
I think that sums up pretty well why downstream vendors are treating security casually. So the billion dollar question is, how do we fix this, as a tech community?
I'm not sure the tech community is able to fix this, short of the brickerbot mentioned by another poster. Frankly, I think this situation will only resolve if and only if there are dire financial consequences to OEMs that pay lip service to security.
Open architectures are a solution, even if there is no single common solution. Diversity is something we have been missing since windows became popular, and although security through obscurity is not a strategy, diversity certainly serves well at limiting the scope of damage possible for a single attack.
At least USB doesn't have device-initiated DMA, but USB descriptor parsing bugs have in the past led to exploits (I remember the PlayStation jailbreak).
Even without any newly discovered backdoor. The Intel ME was always a fuing security issue. A BACKDOOR. It is completely naive to think the NSA can't use the ME to get access to anything, but hey it needs another Snowden for people to listen again.
From the perspective of an everyday user these things came out of nowhere to evolve into this para-computer running along side me that I cannot see and have no control of. It is on literally ALL hardware
Why is it that any attempts to disable it knock your whole computer out?
And this is the world of technology that we want? I'm so sick of technology companies appearing to work for their customers but secretly working against them.
The functionality ME attempts to provide is lights out a.k.a. out-of-band management (like IPMI) to the desktop.
If, for example, an admin needed to add a dual-boot-to-Ubuntu option to every PC on a floor, he could, through ME, remotely reboot (force power reset if necessary) or power on every machine, have the machines boot to a (remote) OS install disk, run the install, and reboot.
ME allows one to do almost anything remotely to a PC, regardless of what the main processor is doing. That is both useful and frightening.
How many corporate IT environments buy off-the-shelf motherboards and CPUs from the same channels as consumers? OEMs get an entirely different set of parts and enterprise sales works in completely different channels. If there is such a clean separation between corporate and consumer markets then why is this hardware on everything, and why does it need to pull power on the machine if it's disabled?
It isn't on all hardware. Intel has two ME firmwares, a small one for consumer systems, and a big one for corporate/enterprise systems. The small one does not (or at least, should not; is not supposed to) include the remote management features.
In other words, the separation that you describe exists.
Systems with the full firmware sport things such as the vPro branding, and only certain combinations of CPU and chipset support it.
I'd be careful with assumptions on what "consumer hardware" means. There are desktops, NUC units, etc, that shipped with i5 and i7 chips that had vPro.
Even with the CPU, you also need the right chipset and the right firmware to actually light this stuff up. While especially in the laptop sector there are consumer devices that include this, it's far from universal.
Can't all that be done from the main OS? Repartition, modify the boot stuff, reboot from an image in a new partition, etc... Why did they need to add another processor with closed source and all the potential security issues?
You can't change the boot media or turn on a turned-off machine via the OS. The whole point is to get underneath it, so you can even do initial OS install with it.
It might not be trivial, but you can do this w/o the ME. My understanding is that most ethernet cards support a "Wake-on-LAN" feature to turn off machines on, and from there you can trigger the machine to reboot and then netboot (by writing to its boot config to instruct whatever boots it that it should take that action).
Even if you assert that the ME is absolutely necessary for such a use-case, I don't have that use case, it isn't work the risk for me, and I should be able to disable the ME because I, as the owner of the machine, want to. (Or really, otherwise interact with it and use it for creative use-cases.)
That disqualifies a lot of otherwise really good hardware. My current Thinkpad, for example, and all current MBPs, I believe. Some manufacturers also aren't very clear about the exact hardware in their machines, either. (For example, Apple doesn't list the exact CPU on their tech specs page, only the somewhat vague "2.4GHz dual-core Intel Core i7, Turbo Boost up to 3.4GHz, with 4MB shared L3 cache". That might be unambiguous enough to map back to an actual piece of hardware, but it's still a considerable amount of work to do so.)
I think the problem is not that this technology exists but rather that the operation of this engine is not transparent, the user cannot examine or disable the software in this engine, cannot write his own software.
IME should exist on an external TPM chip so it's only for those that want it, like enterprises.
I really don't understand why the would just shove it into every chipset out there. I understand it needs to get its claws all over the system, but the core should be external and optional.
"It is this last point that has been causing some political unrest in the US, and the rest of the Western world. As you undoubtedly know, China is very nearly the sole producer of all electronic goods. It would be very, very easy for the Chinese government to slip a hardware backdoor into the firmware of every iPad, smartphone, PC, and wireless router." 2012 https://www.extremetech.com/computing/133773-rakshasa-the-ha...
Made in China, designed in the USA. Everyone wants their own backdoor.
I think it is high time for companies who make hardware be financially fined for lapses like this. In this particular case, the manufacturer was warned and did nothing for years.
This is negligence especially considering these chips control critical devices that can cause damage or even loss of life if they are successfully exploited.
Can you imagine if car maker didn't fix a hardware defect they knew for years. Oh wait...
I'm running Windows and I just disabled the service. There are a couple of them, one is Local Management Service and the other is User Notification Service.
> For obvious reasons we couldn’t publish what we found
It's not obvious to me why anyone not under an NSL or NDA would sit on this vulnerability for 5 years and wait until it's actively being exploited in the wild before public disclosure.
It's extremely negligent to global security for SemiAccurate to not immediately publicly disclose the vulnerability 5 years ago after Intel refused to fix it. Of course this is ignoring the root of the problem, which is that the US government has deeply compromised Intel since the very first security management interfaces were added to Intel chips in the early 90s.
The real solution to the root issue is legislation that forces security disclose timelines of 90 days or less for government-found vulnerabilities, and prevents the stockpiling of vulnerability exploit kits.
This was my thought too as I read it. If they didn't feel they could handle the disclosure, Google Project Zero could have been a good recipient to report to Intel.
That seems strange. Since it's a security hole you can exploit on your very own Intel computer, there's no issue about "hacking" into someone else's system. Researching this is legally safe. There should have been a Defcon talk and a CERT advisory years ago.
One wonders if they knew of this particular vulnerability 5 years ago or they just knew that there must be vulnerabilities lurking in the ME somewhere.
I interpret that as SA got wind something like this was going down, guessed some of the details and possibly forced Intel to disclose but they didn't actually find anything themselves nor do they have the details. Which explains why Intel credits someone else and they overplayed their hand by claiming that either ME or VPro are breached when it really is AMT. (Bad enough...)
189 comments
[ 3.1 ms ] story [ 248 ms ] thread>>there is literally no Intel box made in the last 9+ years that isn’t at risk
>>SemiAccurate has been begging Intel to fix this issue for literally years
Am I the only one who is so cynical to think it must have been deliberate? Intel dragging their feet for YEARS -- what could justify such a delay? The paranoid side of me asks "Were they waiting to patch this hole, until they found a different one that could be utilized?" Which begs the next quesion: Where is the NSA in all of this? It's the sort of thing that would be mighty handy to a group wishing to snoop on everyone and everything?
Last question: Why would anyone trust the encrypted management engine after this? (Why would anyone trust it before?)
>> What about embedded devices that are increasingly PC based? Digital signage perhaps? Industrial controls. HVAC. Security systems. Flight controls. Air traffic controls. Medical devices.
What, indeed? Is this the method used to interfere with Iran's nuclear program centrifuges?
The discussion probably went something like:
Person 1: "Should we issue a recall and disable a feature which bought us a several billion dollar customer?"
Person 2: ...
https://www.cia.gov/news-information/featured-story-archive/...
Obviously things like Xeons and Core iXs, but what about things like Atom processors in tablets?
It's ambiguous if the Atom line (and which portions) might be impacted, and I would prefer someone comment directly on if Atom has ME and if so, if it was using the dangerous version (and when).
After learning about remote management capabilities I've always suspected it had holes. Large attack surface, any exploit would have a high value, and closed source.
Perhaps one day we'll be able to buy CPU's without this "feature". I'm betting AMD and ARM are in the same boat.
Even after reading this, I'm still not convinced it does have holes. It's so high value (pervasive, incredibly powerful, and old) that if it were possible a bad actor would have used it. The spectrum of possibilities is small:
We're not in state 4. The article suggests we're in 2 or 3. 2 seems unlikely - SA does not have special abilities that transcend those of other security research firms. 3 seems especially unlikely: with this much power available, and with the hole being patchable, could they resist using it? Which leaves option 1.Also, there is a 5th (more likely) possibility: SA didn't find anything, but undiscovered holes do exist.
5. Somebody else discovered it and told SA. No idea why them rather than telling anybody else.
Now a patch is coming out but Intel is still trying to keep it quiet, so he's trying to warn people disable AMT and be ready to apply patches ASAP.
Presumably he didn't even want to disclose the existence of the vulnerability publicly until there was some sort of fix, and he still won't want to disclose details before the fix is released.
Of course, you can doubt the veracity of this story, but I'm just pointing out that there would be no reason to expect details, cross references, or mentions on Google or security lists yet if it is true.
Then, he saw that Intel released a patch related to the management engine, and took that as confirmation? Maybe he has access to the release notes via a source at an OEM?
That tells me he got the information from an unmentioned source. If he had the details himself he would be able to confirm what hardware it is present on by testing it.
The explanation for that error code be that the source have been vague about it or not tested it on a lot of hardware, or isn't even a firsthand source, or that the journalist misunderstood it.
https://security-center.intel.com/advisory.aspx?intelid=INTE...
Overall, though, it does seem to validate the sequence was something like "he had a suspicion" then "intel released an update".
None of that means he's necessarily wrong, just that you should be very careful about believing his claims without supporting evidence. A lot of people here on HN have thought that a remote ME exploit was only a matter of time, so an article claiming to validate that belief will not get as much skepticism as it should.
I'd guess this would be a lot of interest for "hacker" news; i want to sign my own damn firmware.
Check out https://libreboot.org/docs/hardware/gm45_remove_me.html
Seems legit.
Maybe then we'll finally see hardware companies taking security seriously.
Adobe Flash has a new zero-day every week, but we were saddled with it for years past when it should have been retired because some people didn't want HTML5 to have feature-parity with Flash.
Java has a new zero-day every week but we're stuck with it because enterprises are afraid of trying something new.
Windows was wide open to attacks for years, but they got away with it by saying "yeah but Apple is so expensive" and people still parrot that. They said "yeah but Linux is stolen technology/doesn't work right" and people still parrot that.
Android has a new malware/exploit warning every week, the majority of the phones never see security updates, and are running outdated software the minute they're shipped to stores but people say "yeah but Apple is so expensive/locked down" or "Windows Phone doesn't have any apps".
I have friends who lost their credit card numbers at Home Depot but refuse to shop at Lowes because they don't like the NASCAR driver that Lowes sponsors.
People get so caught up in brand loyalty that they're willing to defend "their" company like it's a family member. Even among the tech community, security means nothing. We still use Android phones to get root access, we still use Windows to save some money on our laptops, we still program in PHP because it pays the bills.
Nothing will ever be catastrophic enough. Anyone can get away with it just by creating an "us vs them" mentality with their customers.
Well, Java applets did die. What more do you want? The Java sandbox is only used by extremely legacy software at this point, so it doesn't matter if it has holes in it. Actually, the more holes the better, so we can get rid of the last holdouts.
No it doesn't. The last one was in 2015. Before that I think there was a two year gap to the prior one. Zero days in Java are actually very rare these days.
That doesn't mean bugs are rare - like any large piece of software Java gets regular security patches, but those are flaws found by the developers themselves rather than attackers, so they aren't zero days.
Remember in 2012 when Apple stopped shipping Java with their browser because it was so insecure?
Upgrading your CPU 2hs, 300$
Having no secure CPU to upgrade to: priceless
Long ago I read something about that. The psych came down to the (false) idea that changing brand would confirm that you were wrong. The example was that even if Ford made better cars back in the day so you're a diehard Ford owner, if they quality demonstrably falls behind and Chevy is demonstrably awesome today you still won't change! And that's a case where your prior decision was actually right. So people have these weird internal notions that 1) companies value doesn't change over time, 2) their value doesn't change in light of new evidence, and 3) My own value is somehow tied to making a "correct" decision in spite of cognitive errors #1 and #2.
People are stubborn, and that's being kind about it.
I still hope it's true, and that it's catastrophic for Intel. No change can happen otherwise.
If Intel aren't fighting against 5eyes then they aren't taking security seriously.
> That is the end of June for non-Intelspeak people, they will officially issue this guidance then along with OEM disclosures.
We'll know in two months whether the above claim is true or false.
Edit: Already proven wrong! We're headed for interesting times.
Looks like an almost full confirmation. They're saying consumer hardware is unaffected, but everything else matches.
https://security-center.intel.com/advisory.aspx?intelid=INTE...
There's also an Intel advisory https://security-center.intel.com/advisory.aspx?intelid=INTE...
Edit: On the previously-mentioned scale, this sounds like a solid 8 or 9 out of 10.
> There is an escalation of privilege vulnerability in Intel® Active Management Technology (AMT), Intel® Standard Manageability (ISM), and Intel® Small Business Technology versions firmware versions 6.x, 7.x, 8.x 9.x, 10.x, 11.0, 11.5, and 11.6 that can allow an unprivileged attacker to gain control of the manageability features provided by these products. This vulnerability does not exist on Intel-based consumer PCs.
If in doubt, you can check your CPUs here:
https://ark.intel.com/#@Processors
We knew this would happen. We knew that the Management Engine was a backdoor, and we knew it was only a matter of time before someone would figure out how to exploit it. This is exactly the reason why Libreboot exists (https://libreboot.org/faq.html#intel). And now, far from being the tinfoil hat distro that is often portrayed, it will become a bare necessity.
Intel needs more competition - thanks to AMD latest new 8-core CPU Intel got forced to release a new CPU the had in their basement for years - suddently it's possible for them to release i7 notebook CPUs with more then two cores!! Even back in 2010 it would have been viable to produce 4 core notebook CPUs - but the went away because the had no competition.
I'm not sure what you mean by this. My Dell XPS 15 has a i7-6700HQ which is quad core, and it's not like I just bought the thing.
https://www.reddit.com/r/Amd/comments/5x4hxu/we_are_amd_crea...
I wouldn't hold my breath, though.
- releasing the source doesn't tell you what's on the chip.
- PSP is kind of "Ring ∞", so there would be no good outcome from providing general-purpose access to it. So, the keys will never be released.
- it's thusly not possible to map the signed (encrypted) firmware to the source.
- even if the source had a clearly documented "master off" in it, you can never know if the firmware's copy reads "master-except-if-A-and-B-say-C off" :(
https://ark.intel.com/products/64887/Intel-Core-i7-3920XM-Pr...
Predating the i7 entirely, there were also quad core laptops using Core 2 Quad CPUs (Penryn QC) in 2008.
U-series i7s have two cores. HQ-series i7s have four cores. Both are mobile CPUs. Remember though that more cores generally means more power consumption which generally means less wallclock time on battery power.
It's my tinfoil hat theory why MS waits for an earnest update on their highend Surfacebook. A high-end quad-core Surfacebook with a 10-series GPU and 32GB LPDDR with real Thunderbolt 3 Ports would make for a 13" dreammachine...
https://github.com/corna/me_cleaner
The procedure seems far from trivial and requires special hardware(?). Is there a guide or some resources I could follow as a person with no hardware/low-level technical knowledge?
You could sidestep the whole issue by buying a C201 chromebook (quad-core ARM) and putting Linux on it.
> Internal flashing with OEM firmware
> --------------------------------------------
> TODO
However, I strongly disrecommend buying from Leah Rowe unless you enjoy waiting months for payment confirmation and delivery. The worst webshop experience I've ever had.
I recommend you build/flash your own, contract it out or look for a different vendor.
https://shop.libiquity.com/product/taurinus-x200
Certainly this kind of attack is not your average script kiddy but nation-level instead, but I wouldn't put it past the NSA to pull this off.
IPad remote wipe is a function of IOS and the encrypted filesystem it uses on the device, not the CPU.
[1] https://en.wikipedia.org/wiki/LoJack_for_Laptops [2] https://en.wikipedia.org/wiki/LoJack_for_Laptops#Vulnerabili...
I can't say I'm surprised, but I am surprised at the fact that finally, after all these years, someone finally got down to patching some vulnerabilities in this area.
props to whomever forced Intel's hand.
Otherwise check for updates at http://pcsupport.lenovo.com.
I'm don't mean to sound oppositional. I appreciate this being mentioned.
I'm just not willing to trust it without knowing in detail that and how it works.
https://news.ycombinator.com/item?id=11913379
> do the first three steps of thinking for them. Make it really easy for the other person to say yes or no
source: http://firstround.com/review/how-to-become-insanely-well-con... | https://news.ycombinator.com/item?id=14195664
I've agreed to include a bit of detail when spamming all my friends links via e-mail going forward.
So if you're running a desktop that has a physical Ethernet card in it, and the Intel Ethernet isn't connected, are you OK?
And if you're running on a laptop that uses Intel's Ethernet, (and most of them do?) then are you vulnerable?
Let's hope Intel and all the other chipmakers will learn this lesson (unless it's done on purpose, in which case they won't care about any lessons learned - they'll do it anyway).
I've been thinking for years about writing a virus that patches the vulnerability it used to spread as it goes.
here's a good overview of the risk: http://hackaday.com/2016/11/28/neutralizing-intels-managemen...
But I believe newer systems with MMUs acting as "firewalls" for DMA are safe from this vector.
From the perspective of an everyday user these things came out of nowhere to evolve into this para-computer running along side me that I cannot see and have no control of. It is on literally ALL hardware
Why is it that any attempts to disable it knock your whole computer out?
And this is the world of technology that we want? I'm so sick of technology companies appearing to work for their customers but secretly working against them.
If, for example, an admin needed to add a dual-boot-to-Ubuntu option to every PC on a floor, he could, through ME, remotely reboot (force power reset if necessary) or power on every machine, have the machines boot to a (remote) OS install disk, run the install, and reboot.
ME allows one to do almost anything remotely to a PC, regardless of what the main processor is doing. That is both useful and frightening.
How many corporate IT environments buy off-the-shelf motherboards and CPUs from the same channels as consumers? OEMs get an entirely different set of parts and enterprise sales works in completely different channels. If there is such a clean separation between corporate and consumer markets then why is this hardware on everything, and why does it need to pull power on the machine if it's disabled?
In other words, the separation that you describe exists.
Systems with the full firmware sport things such as the vPro branding, and only certain combinations of CPU and chipset support it.
Even if you assert that the ME is absolutely necessary for such a use-case, I don't have that use case, it isn't work the risk for me, and I should be able to disable the ME because I, as the owner of the machine, want to. (Or really, otherwise interact with it and use it for creative use-cases.)
The filter for "Max Turbo Frequency" seems to be broken, BUT searching for "Cache: '4MB L3 SmartCache'" (which I assume means shared!) finds quite a number of results: http://ark.intel.com/Search/FeatureFilter?productType=proces...
The list is column-sortable by Max Turbo Frequency, and there are just 4 results in the 3.40GHz range:
- http://ark.intel.com/products/91169/Intel-Core-i7-6660U-Proc... - the only result with a Processor Base Frequency of 2.4GHz
- http://ark.intel.com/products/91497/Intel-Core-i7-6650U-Proc...
- http://ark.intel.com/products/88192/Intel-Core-i7-6600U-Proc...
- http://ark.intel.com/products/52231/Intel-Core-i7-2620M-Proc...
I really don't understand why the would just shove it into every chipset out there. I understand it needs to get its claws all over the system, but the core should be external and optional.
Made in China, designed in the USA. Everyone wants their own backdoor.
This is negligence especially considering these chips control critical devices that can cause damage or even loss of life if they are successfully exploited.
Can you imagine if car maker didn't fix a hardware defect they knew for years. Oh wait...
I recommend Platform Embedded Security Technology Revealed book [0] from designers and creators of ME for further information.
[0]: https://link.springer.com/book/10.1007/978-1-4302-6572-6
It's not obvious to me why anyone not under an NSL or NDA would sit on this vulnerability for 5 years and wait until it's actively being exploited in the wild before public disclosure.
It's extremely negligent to global security for SemiAccurate to not immediately publicly disclose the vulnerability 5 years ago after Intel refused to fix it. Of course this is ignoring the root of the problem, which is that the US government has deeply compromised Intel since the very first security management interfaces were added to Intel chips in the early 90s.
The real solution to the root issue is legislation that forces security disclose timelines of 90 days or less for government-found vulnerabilities, and prevents the stockpiling of vulnerability exploit kits.
Intel would like to thank Maksim Malyutin from Embedi for reporting this issue and working with us on coordinated disclosure.