Intel x86s hide another CPU that can take over your machine (you can't audit it)

[ugh]

For all you paranoids: these slides on GitHub are for a presentation detailing techniques for disabling ME / AMT:

How to become the sole owner of your PC

[renke]

@TobinL

I see that HPs iLO is IPMI with extra doodads. Again on a server in a secure environment this is a really cool thing […] Also this can be disabled in BIOS if you don’t want remote access this way.

and it’s a different network connector. don’t want it? don’t plug in a cable.

if I understood the article correctly it sounds as if Intel’s system can piggyback on the normal NIC* managed by the running OS and users have no chance to decide if they want to use the remote management access.

* though I’m unsure how this should work (“sorry OS, you cannot open a socket on port 1234. this one is already in use by me, the mighty ME”)

[PhasmaFelis]

Many forums have rather silly rules about what sort of links you can post.

[renke]

@PhasmaFelis

Many forums have rather silly rules about what sort of links you can post.

fixed : )

[HappyCerberus]

The reason why these problems surfaced was because the projects in question were brutally understaffed and under-financed. Fortunately, now companies finally got a wakeup call (kind of sad that we need security problems of this magnitude to make people care about security) and are finally pumping money and time into these projects.

[fuzzyfungus]

A good resource, thanks for the link. It’s worth noting, though, that (unless I really screwed up in reading it) the moral of the story is “here are a few ways of disabling it without its consent; which all brick the host system; here are the ways to ask it nicely to stop running and hope it responds.” Certainly detail on how it works than one would otherwise have; but this isn’t light outpatient surgery.

[fuzzyfungus]

It certainly appears so. I’d heard that they were looking to use ‘Trustzone’ stuff; but honestly I haven’t dealt with many recent AMD systems. My personal one is a little too old to make the cut; and they…don’t exactly have a commanding presence…in business/enterprise desktops these days. Looks like the implementation is totally different; but the effect is largely the same.

[fuzzyfungus]

@renke

if I understood the article correctly it sounds as if Intel’s system can piggyback on the normal NIC* managed by the running OS and users have no chance to decide if they want to use the remote management access.

• though I’m unsure how this should work (“sorry OS, you cannot open a socket on port 1234. this one is already in use by me, the mighty ME”)

I’ve not had the chance to observe collisions in practice; but yes, the AMT system piggibacks on the hosts NICs(Intel ethernet/wifi required for full functions). By default, either port 16992 or 16993 will have a little http server running on them, courtesy of the AMT chip; and I think that the AMT system can poke at other traffic under certain conditions(I apologize for the vagueness; but ‘AMT’ is versions 1.0-9.0, all with different capabilities, is sold with some features enabled or disabled for product differentiation purposes; and works differently on wired NICs vs. roaming wireless devices, so it’s difficult to make absolute statements about ‘what AMT does’ There’s additional variation because AMT is capable of functioning without a host OS, even with dealbreakers like ‘no RAM installed’; but with suitable drivers can also cooperate in various ways with supported host OSes).

It definitely doesn’t involve a physically distinct management NIC, however.

[renke]

thanks, the more you know : )

@fuzzyfungus

and I think that the AMT system can poke at other traffic under certain conditions

don’t like. don’t want. lights-out management is important and has real purposes, but it’s up to the customer to decide how and when to use it - not some always-on system rooted deep in the hardware.

[TobinL]

@renke

if I understood the article correctly it sounds as if Intel’s system can piggyback on the normal NIC*

Yeah I read a bit more and as I stated, for workstations that generally sit about on site behind firewalls this is iffy… but for laptops that get used on public networks, nope nope nope nope.

ETA Having worked in a huuuuugue enterprise environment I kinda get what they want to do but conversely for security this is not a good thing on a laptop/workstation.

[grimloki]

I disagree. Open source code is half the battle in finding these security flaws… the other half being coders learning how to write secure code.

Heartbleed was a menace. And a theoretically exploitable flaw. But practically?

Tell me… had any luck fixing Microsoft’s security flaws they refuse to acknowledge? No. Because no one has ever. We depend on them to fix them… and that only started happening because security researchers started announcing the flaws after big companies didn’t do shit.

Not so with open source. If the original coders won’t fix it, go ahead and do it yourself.

[Brad_Eckert]

I understand the NSA’s need for backdoors to grow the government’s stock portfolio (easier than raising taxes), but since when is an on-chip ROM secure? Watch two guys de-cap a chip and reverse engineer a masked ROM here: https://www.youtube.com/watch?v=7Q82FkthDx8

[PhasmaFelis]

@Glaurung

Sigh. When are we going to stop seeing this canard bandied about? Yes, I know, it’s an article of some people’s religious faith, but that doesn’t make it true. Heartbleed, shellshock, freak… The list of security flaws in open source software that went unnoticed for years, even decades, is long and getting longer.

Is closed-source software better?

Not many people are saying that open-source is proof against all security problems. But it doesn’t take much to beat e.g. Microsoft’s record on security.

[TobinL]

@PhasmaFelis

But it doesn’t take much to beat e.g. Microsoft’s record on security.

That’s because Microsoft came from a lets share everything very naive approach to the early versions of windows and paid for it for years.
Starting with w2k3/vista (and my headaches with vista were not security related) which was a major kernel rewrite and forward they are a lot better.
As far as things go before then when I was the local security guy back in the NT4 days, I got just as many alerts for linux security patches as I got for Microsoft at least for the server side. So honestly I don’t know which is better.
I think M$ gets the bad rap for being on so so so many desktops that never got patched and users that just installed shit without thinking.

[billstewart]

“ME” is obviously an abbreviation for “Malicious Entity”.

[popobawa4u]

@Glaurung

Open source is no better than closed source at fixing security flaws. Arguably it is worse, to the extent that OSS is coded by volunteers, so there is nobody whose paycheck depends on finding and fixing flaws.

Or - the complete opposite might be more probable. People who need to be bribed into doing a job were never as interested as those who were doing it anyway.

[popobawa4u]

I suspect that this kind of supervisory processor also includes a secret amnesia component as well, because these have been around for at least ten years, and every time there’s an article about them, there are “zomg” responses as if it was always the first time. That might be the most insidious thing about these - nobody ever remembers that they are there!