Slashdot Mirror
WikiLeaks' New Dump Shows How The CIA Allegedly Hacked Macs and iPhones Almost a Decade Ago (vice.com)
WikiLeaks said on Thursday morning it will release new documents it claims are from the Central Intelligence Agency which show the CIA had the capability to bug iPhones and Macs even if their operating systems have been deleted and replaced. From a report on Motherboard: "These documents explain the techniques used by CIA to gain 'persistenc'' on Apple Mac devices, including Macs and iPhones and demonstrate their use of EFI/UEFI and firmware malware," WikiLeaks stated in a press release. EFI and UEFI is the core firmware for Macs, the Mac equivalent to the Bios for PCs. By targeting the UEFI, hackers can compromise Macs and the infection persists even after the operating system is re-installed. The documents are mostly from last decade, except a couple that are dated 2012 and 2013. While the documents are somewhat dated at this point, they show how the CIA was perhaps ahead of the curve in finding new ways to hacking and compromising Macs, according to Pedro Vilaca, a security researcher who's been studying Apple computers for years. Judging from the documents, Vilaca told Motherboard in an online chat, it "looks like CIA were very early adopters of attacks on EFI."
Nothing like good old BIOS and hardware jumpers
So UEFI is now a Mac only thing, huh?
It seems to me that having a chip, the management unit, in all intel processors that sits above even a hypervisor and can read all memory, have it's own connection to the network, runs java code, and is software reprogrammable, is basically the wet dream of root kits. it's invisible to anything you run on the CPU but sees all and tells all.
Some drink at the fountain of knowledge. Others just gargle.
And now maybee we'll know why it's been so hard for Open Source developers to get information on writing their own against-the-metal drivers for telephony radios and startup modules (BIOS, EFI/UEFI, etc.)
It has long been suspected that was not just proprietary info-walling, but to reduce chances of discovery of backdoors and persistent threats imposed in the name of spying.
Bantam Dominique roosters crow a four-note song. Once you've heard it as "Happy BIRTHday" you can't NOT hear it that way
I've always transposed UEFI to UFIA in my mind. now I know why
Some drink at the fountain of knowledge. Others just gargle.
Prior to this, I'd have thought America and especially its government agencies do not hack.
I guess I was wrong. What troubles me is that the media only talked about the Russians, yet the act was taking place in our backyard!
Question: Will the media put both the left and right to task?
For remote management of OS startup/shutdown and system monitoring and its effectively a small seperate computer. I don't think consumer machines have this installed. Unless I'm getting confused about what you're referring to.
Today has two big stories, get them both.
https://archive.4plebs.org/pol/thread/117886401/
And still, still, not a single major hardware vendor has the guts to offer hardware that has freed, open code from the silicon up. All too cowed by Intel (which, funnily enough, is beginning to look like an all-too apt name for that company), into using UEFI.
To bad you can't get to the UEFI / BIOS menus on a mac to be able to change boot keys.
If you can't audit or maintain it, then you have no reason to suspect it may be secure. And in fact, you really do have good cause for thinking that it is deliberately made to be insecure on purpose -- not even a bug.
This even made it into an episode of "Person of Interest" during its last season - although in that case I believe it was a criminal syndicate adding code to the EFI before the computers were shipped. Oh wait, I guess it was exactly the same after all!
#DeleteChrome
Thank you for your insightful words
If you oppose the CIA installing their software at the firmware level, then you are in cahoots with Trump and Russia.
GO CIA! Your software needs to be in ALL electronics!
Note that both of these hacks require physical access.
Obligatory: Intel CPU Backdoor Report
Intel CPU Backdoor Report (Updated Mar 13, 2017)
The goal of this report is to make the existence of Intel CPU backdoors a common knowledge and provide information on backdoor removal.
What we know about Intel CPU backdoors so far:
TL;DR version
Your Intel CPU and Chipset is running a backdoor as we speak.
The backdoor hardware is inside the CPU/Bridge and the backdoor firmware (Intel Management Engine) is in the chipset flash memory.
30C3 Intel ME live hack:
@21m43s, keystrokes leaked from Intel ME above the OS, wireshark failed to detect packets.
[Video Link] 30C3: Persistent, Stealthy, Remote-controlled Dedicated Hardware Malware
[Quotes] Vortrag:
"DAGGER exploits Intel's Manageability Engine (ME), that executes firmware code such as Intel's Active Management Technology (iAMT), as well as its OOB network channel."
"the ME provides a perfect environment for undetectable sensitive data leakage on behalf of the attacker. Our presentation consists of three parts. The first part addresses how to find valuable data in the main memory of the host. The second part exploits the ME's OOB network channel to exfiltrate captured data to an external platform and to inject new attack code to target other interesting data structures available in the host runtime memory. The last part deals with the implementation of a covert network channel based on JitterBug."
"We have recently improved DAGGER's capabilites to include support for 64-bit operating systems and a stealthy update mechanism to download new attack code."
"To be more precise, we show how to conduct a DMA attack using Intel's Manageability Engine (ME)."
"We can permanently monitor the keyboard buffer on both operating system targets."
Backdoor removal:
The backdoor firmware can be removed by following this guide using the me_cleaner script.
Removal requires a Raspberry Pi (with GPIO pins) and a SOIC clip.
Decoding Intel backdoors:
The situation is out of control and the Libreboot/Coreboot community is looking for BIOS/Firmware experts to help with the Intel ME decoding effort.
If you are skilled in these areas, download Intel ME firmwares from this collection and have a go at them, beware Intel is using a lot of counter measures to prevent their backdoors from being decoded (explained below).
Useful links:
The Intel ME subsystem can take over your machine, can't be audited
REcon 2014 - Intel Management Engine Secrets
Untrusting the CPU (33c3)
Towards (reasonably) trustworthy x86 laptops
30C3 To Protect And Infect - The militarization of the Internet
30c3: To Protect And Infect Part 2 - Mass Surveillance Tools & Software
1. Introduction, what is Intel ME
Short version, from Intel staff:
Re: What Intel CPUs lack Intel ME secondary processor?
Amy_Intel Feb 8, 2016 9:27 AM
The Management Engine (ME) is an isolated and protected cop
As I've long pointed out, that awful, cumbersome scheme that now is the way that Windows prefers to boot PC's is goofy. As we can see now, it's worse than goofy--it can invade our privacy.
Long I've heard the complaint of computer-repair techs that UEFI makes their work much harder.
Buy Apple. It's the American thing to do.
-- Tigger warning: This post may contain tiggers! --
The goal of this report is to make the existence of Intel CPU backdoors a common knowledge and provide information on backdoor removal.
What we know about Intel CPU backdoors so far:
TL;DR version
Your Intel CPU and Chipset is running a backdoor as we speak.
The backdoor hardware is inside the CPU/Bridge and the backdoor firmware (Intel Management Engine) is in the chipset flash memory.
30C3 Intel ME live hack:
@21m43s, keystrokes leaked from Intel ME above the OS, wireshark failed to detect packets.
[Video Link] 30C3: Persistent, Stealthy, Remote-controlled Dedicated Hardware Malware
[Quotes] Vortrag:
"DAGGER exploits Intel's Manageability Engine (ME), that executes firmware code such as Intel's Active Management Technology (iAMT), as well as its OOB network channel."
"the ME provides a perfect environment for undetectable sensitive data leakage on behalf of the attacker. Our presentation consists of three parts. The first part addresses how to find valuable data in the main memory of the host. The second part exploits the ME's OOB network channel to exfiltrate captured data to an external platform and to inject new attack code to target other interesting data structures available in the host runtime memory. The last part deals with the implementation of a covert network channel based on JitterBug."
"We have recently improved DAGGER's capabilites to include support for 64-bit operating systems and a stealthy update mechanism to download new attack code."
"To be more precise, we show how to conduct a DMA attack using Intel's Manageability Engine (ME)."
"We can permanently monitor the keyboard buffer on both operating system targets."
Backdoor removal:
The backdoor firmware can be removed by following this guide using the me_cleaner script.
Removal requires a Raspberry Pi (with GPIO pins) and a SOIC clip.
Decoding Intel backdoors:
The situation is out of control and the Libreboot/Coreboot community is looking for BIOS/Firmware experts to help with the Intel ME decoding effort.
If you are skilled in these areas, download Intel ME firmwares from this collection and have a go at them, beware Intel is using a lot of counter measures to prevent their backdoors from being decoded (explained below).
Useful links:
The Intel ME subsystem can take over your machine, can't be audited
REcon 2014 - Intel Management Engine Secrets
Untrusting the CPU (33c3)
Towards (reasonably) trustworthy x86 laptops
30C3 To Protect And Infect - The militarization of the Internet
30c3: To Protect And Infect Part 2 - Mass Surveillance Tools & Software
1. Introduction, what is Intel ME
Short version, from Intel staff:
Re: What Intel CPUs lack Intel ME secondary processor?
Amy_Intel Feb 8, 2016 9:27 AM
The Management Engine (ME) is an isolated and protected coprocessor, embedded as a non-optional part in all current Intel chipsets, I even checked with the en
Are you people really stupid or just paid shill? Or you have some kind of weak mind that you just can't accept how bad things are?
You really need to look at reality more before talking out of your ass, they've got you by the balls.
I just updated the report:
7. Active Intel ME Example:
Thinkpad X201 has KVM and Anti-Theft (internal 3G) enabled by default
intelmetool -s
ME: Firmware Version 0.996.511.0
ME Capability- Full Network manageability - ON
ME Capability- Regular Network manageability - OFF
ME Capability- Manageability - ON
ME Capability- Small business technology - OFF
ME Capability- Level III manageability - OFF
ME Capability- Intel Anti-Theft (AT) - ON
ME Capability- Intel Capability Licensing Service (CLS) - ON
ME Capability- Intel Power Sharing Technology (MPC) - ON
ME Capability- ICC Over Clocking - ON
ME Capability- Protected Audio Video Path (PAVP) - ON
ME Capability- IPV6 - ON
ME Capability- KVM Remote Control (KVM) - ON
ME Capability- Outbreak Containment Heuristic (OCH) - OFF
ME Capability- Virtual LAN (VLAN) - OFF
ME Capability- TLS - ON
ME Capability- Wireless LAN (WLAN) - OFF
Things got much worse the past few years, it is so bad now they are shipping notebooks with KVM and 3G enabled by default.
The backdoors progressed so quickly most people can't even wrap their mind around it, all you hear are shills or morons pretending nothing has happened.
How Intel came to be Israel's best tech friend
A newly found cache of photographs shows the development of one of the country's most important ongoing business relationships
Intel Invests $6 Billion In Israel To Create Advanced Chip Manufacturing Facility
LOL why do you think Intel installed 3G and WiFi inside their chips.
So was this a build-in backdoor or a hack?
Please read this: https://en.m.wikipedia.org/wiki/Unified_Extensible_Firmware_Interface UEFUI was developed for PC/Windows compatibility for those that liked EFI boards. Intel specifically used EFI in Macs. If your system uses UEFI, it's because you used boot camp to install Windows, did something with rEFIt, or you own a factory built PC in the last seven years or so. Wikileaks focused on Mac, but it's not jus a Mac problem.
You have to be really naive to believe when the BIOS tells you the backdoor is turned off, it is really turned off, and there is no way to access it, even by an exploit.
Way above my pay grade. Privacy is no more real than the mythological creature, a unicorn
And we thought they gave up on the Clipper Chip.
Who knew they just got the CPU makers to build it into the product?
EFI and UEFI is the core firmware for Macs, the Mac equivalent to the Bios for PCs.
Not just for Mac's: All current PC's use UEFI - instead of BIOS - as well as Mac's do.
The whole San Bernadino shooter "showdown" between Apple and the FBI was a show piece meant for public consumption. I just knew it. I could smell a grandstanding CEO a million miles away. You don't get to be a company of ANY size and give the Feds the finger. Just ask Joe Nacchio.
I am not saying this is bad BTW. I have mixed feelings about all of this because I do think we face existential threats from small groups of individuals and frankly we need to do EVERYTHING to protect ourselves.
I just wish we could talk about it openly - not actual details- but broadly, like, OK the govt IS going to know everything you say and do and because of that THIS is how we are going to maintain our civil liberties.
We are NOT HAVING that conversation because we want to live in pretend-o-land where things are as they were when they're not.
this is new news?
this class of attacks were described in detail before EFI was even in production
you people and your business cases
People, people, people.. why are you arguing about backdoors and boots and Russians when you should be praising the Heroic Mr Assange? He didn't arrange for someone else to leak this just for the fun of it, you know!
If you *REMOVE* *EVERY* Intel ME firmware blob on Nehalem+ model CPUs (Q35/(Q|G|GM)4x can have it removed without issues other than maybe the ethernet adapter settings.) then the processor will shut down after either 30 seconds or 30 minutes as a 'safety precaution'. Despite the fact that more than a few seconds online without a heatsink or proper power management could be enough to send your processor smoking if you were unlucky enough (more common on pre-thermal sensor AMD processors, but possible on both AMD and Intel with cheap motherboards, lower binned chips, and bad luck.)
If you just 'disable it in the bios' you have to trust that Intel/the OEM/bios vendor fully disabled all ME modules other than the ThreadX kernel required to keep the system from powering off, and didn't in fact leave it waiting for a special packet to come over the network to bring it to life to begin slurping up interesting sections of memory, or file checksums to look through that large directory of torrents so many millenials and some of their parents have sitting on their hard disk, just waiting for Microsoft, or Intel, or the *A (BSA only has one A after all...) organizations to come and find an excuse to kick down your door, or steam your encryption keys, or even remote brick your computer (Intel, or someone with signing privileges would be needed for this one..)
Point being, you are placing a lot of faith in something that you might have difficult in catching the anomalous behavior of, unless you are a truly paranoid individual with a few terabytes of disk space, and a known-secure system in use performing transparent bridging and packet inspection, and even then it couldn't tell you if that weird https stream you say going to google.com or microsoft.com, or nsa.gov was due to an OS hack, or something deeper.
All current and future generations of AMD processors have AMD PSP, which is an ARM Cortex (A5?) core running as an exclusive TrustZone processor/software TPM inside of all AMD SoCs. Furthermore, unlike the Intel processors, firmware for said processor is *MANDATORY* for the system to even initialize. It has a factory encryption key similiar to Intel ME, no method to disable either the encryption or PSP and similiar 'ring -3' level privileges.
captcha was 'forfeit' Such an apt word, since owning any modern computer, gpu, or peripheral card/device is really forfeiting your personal security.
It contains a signed firmware image which disallows the owner of the hardware from reflashing it, short of getting and hot air/flow soldering a replacement chip onto the motherboard that never had a signing key fused in.
Without that signing key leaking, and documentation/a copy of the firmware (barring a massive effort to reverse engineer the signed image after decrypting, decompressing and decompiling it.) it is impossible to fully analyze the firmware for exploits, backdoors, proof of current measures disabling it, etc.