Slashdot Mirror
Intel Patches Remote Execution Hole That's Been Hidden In Its Chips Since 2008 (theregister.co.uk)
Chris Williams reports via The Register: Intel processor chipsets have, for roughly the past nine years, harbored a security flaw that can be exploited to remotely control and infect vulnerable systems with virtually undetectable spyware and other malicious code. Specifically, the bug is in Intel's Active Management Technology (AMT), Standard Manageability (ISM) and Small Business Technology (SBT) firmware versions 6 to 11.6. According to Chipzilla, the security hole allows "an unprivileged attacker to gain control of the manageability features provided by these products." That means hackers exploiting the flaw can silently snoop on a vulnerable machine's users, make changes to files and read them, install rootkits and other malware, and so on. This is possible across the network, or with local access. These management features have been available in various Intel chipsets for years, starting with the Nehalem Core i7 in 2008, all the way up to Kaby Lake Core parts in 2017. According to Intel today, this critical security vulnerability, labeled CVE-2017-5689, was found and reported in March by Maksim Malyutin at Embedi. To get the patch to close the hole, you'll have to pester your machine's manufacturer for a firmware update, or try the mitigations here. These updates are hoped to arrive within the next few weeks.
I can't help but wonder how many moles CIA/NSA have in tech companies?
NSA/GCHQ retire old abilities as windows 10 gains market share.
Doesn't mean they aren't out to get you. For this many years it had to be an NSA hole. Remote + network exploit working on pretty much every machine.
According to them, they've been trying to get Intel to patch this for YEARS, and apparently they never bothered to practice responsible public disclosure in order to force intels hand.
Still waiting on Serviscope_minor to wake up to fucking reality and realize that Jessica Price isn't going to fuck him.
Since hardware manufacturers are obviously not going to provide updated firmware to all their products, it would be great if OS providers would patch this.
how this is not the worst bug of all time? Most every intel system there is will be vulnerable to this exploit, and how many companies are going to even be aware of this thing let alone patch it. At least with operating system software you could apply a patch immediately.
I think you mean "CIA backdoor".
No phone, computer, router, or any internet connected device has ever been allowed to get sold (at least in the U.S.) without intentional holes and backdoors approved by the 3 letter agencies, period.
Isn't that about how log I've been griping on Slashdot about AMT?
Bantam Dominique roosters crow a four-note song. Once you've heard it as "Happy BIRTHday" you can't NOT hear it that way
Keep in mind that this is a security hole in a system that was always backdoored by Intel.
It's a separate CPU with its own network connection, outside the control of the main CPU, it has full access to all the system and it was put in place deliberately by Intel. It communicates using SOAP over HTTP or HTTPS.
It has been in all server and business chips FROM INTEL for years now....
It can kill a PC, it can wipe harddisks (killing encryption keys used to access encrypted disks), it can read everything, do anything, rewrite the processor software, bypass any encryption and any security.
Hardware vendors had access to this for years.
So NSA would have had access to this for years.
Russian FSB would have had access to this for years.
China would have had access to this for years.
And now every hacker has access.
When you backdoor technology you end up with bad actors putting Orange Julius in office.
What if my "machine" doesn't have a manufacturer and was hand assembled by me?
* Does this affect every PC, or just people who bought special "business class" computers?
* If it affects all PCs, does "pester your machine's manufacturer for a firmware update" mean the same thing as "check your motherboard manufacturer's website for a patch," or does it imply that you're SOL if you built your own PC from parts?
* Intel's patch is Windows only. Does it affect Linux, or is Intel just being lazy?
* Should I tell my family to buy new PCs if their old PCs are out of warranty?
Thankfully, things like the Raspberry pi are becoming powerful enough and ubiquitous enough that we now have the option of using hardware completely free of the Microsoft-Intel taint.
Now that AMD has released Ryzen you once again have the freedom of choice in the x86 space. The only way Intel will ever changes its ways is if people vote with their wallets and support competition.
"try the mitigations here".... you mean the ones that force you to sign a EULA?? is intel having a laugh?
So this would have to be provisioned...
its like IPMI (DRAC)
(from wikipedia https://en.wikipedia.org/wiki/Intel_Active_Management_Technology)
"The Management Engine (ME) is an isolated and protected coprocessor, embedded as a non-optional MAC and IP address for the out-of-band interface, with direct access to the Ethernet controller; one portion of the Ethernet traffic is diverted to the ME even before reaching the host's operating system, for what support exists in various Ethernet controllers, exported and made configurable via Management Component Transport Protocol (MCTP).The ME also communicates with the host via PCI interface.Under Linux, communication between the host and the ME is done via /dev/mei "
so you would have to be completely insane to enable this and not be aware on a server, however -
" AMT is designed for client computing systems as compared with the typically server-based IPMI. "
so all those windows deployments are going to have to do an audit...
Apple laptops AFAIK do not enable this...
have fun auditing this if you manage a windows fleet !
regards
John Jones
https://downloadmirror.intel.com/26754/eng/INTEL-SA-00075%20Mitigation%20Guide%20-%20Rev%201.1.pdf
And is a big part of why I only run Penryns and Wolfdales. Kicker here is it is almost as if Intel put this hole in deliberately for the NSA or anyone in the know to drive a truck through! There is something to be said about being a cheapskate that runs older tech. You notice that the upscale server chips did not have this hole but the consumer grade stuff past core two duo seems to have been constructed in such a way that even a boot uefi setup can be compromised.
The CTRL-p menu (after much of the booting had taken place) brought me to a AMT/ME screen where I could turn AMT off after entering a password.
The default password is "admin" which worked with my refurbished HP Xeon box. I have since changed the password.
The affected LMS service is enabled and run at startup by default in Windows 10.
Yes, it has the advertised features etc. But it also has a backdoor for unauthorized parties to simply take control of your system.
You can turn AMT on over the net if it is off. That means the security CPU is always looking for the magic packets. If this exploit makes use of that code, there may be no fix for a large number of old computers. There are talks about this thing at every security conference I've been to.
... need we say more?
If they think it's hard for people to keep their OS up to date man... There will be malware exploiting this for the next 5 years at least
Interesting.
I just watched Rudolf Marek: AMD x86 SMU firmware analysis yesterday afternoon.
slides
These slides are related to the talk, but might not be an exact match.
Funny anecdote: someone got Linux running on an ARM chip inside a disk drive. That would be really useful for beating up on the algorithms inside Intel's new Optame, er, Optane Memory.
My Toshiba which has a high end i7 quad-core CPU was bricked by someone on the net because of this bug. It is a personal laptop which is used only by myself. My laptop would shutdown in less than 30 minutes, the technician told me it is the IME inside my laptop. He connected a raspberry pi with an alligator clip to my Toshiba to disable this stuff. He told me earlier CPU's are easier to disable because IME is not in northbridge and was easy to unsolder. This AMT and IME is a kill switch which is both under the control of Microsoft and Intel.
Lucky for me, the technician was updated and he knew how to get rid of this stuff on my machine, but it hurts my pocket a bit just to recover this mess brought by IME.
It should be "Win10 machines vulnerable to AMT firmware attacks", since this LMS feature is enabled on all Win10 machines by default.
It's funny how many critical security flaws are so devious that they allow state-actors to just walk right in, and when they're found they stick out like sore thumbs. This here is exactly why you shouldn't buy CPUs from NSA-CIA-Intel.
The affected LMS service is enabled and run at startup by default in Windows 10.
Only if you have a CPU and motherboard chipset with vPro, which very few of them do. I had a look at some of the entries on Intel's list of Skylake desktop products for the consumer-level products, but got bored trying to find which of the CPUs had vPro support. I ended up looking at the motherboard chipsets, and only the Q170 supports it. The Z170, H170, Q150, B150, and H110 chipsets do not.
The original poster's point stands, that this does not affect consumer-grade PCs. Most people can happily ignore this vulnerability.
Aka I FUCKING TOLD YOU SO.
Obligatory:Intel CPU Backdoor Report (May 1sts 2017)
The goal of this report is to make the existence of Intel CPU backdoors a common knowledge and provide information on backdoor removal.
Newest update: On May 1st 2017, under pressure from the Vault 7 leak, Intel released a "Critical" security bulletin , admitting Intel Core CPU from 1st gen to 7th gen (2006-2017) all share the same critical vulnerability.
What we know about Intel CPU backdoors so far:
TL;DR version
Your Intel CPU and Chipset is running a backdoor as we speak.
The backdoor hardware is inside the CPU/Bridge and the backdoor firmware (Intel Management Engine) is in the chipset flash memory.
30C3 Intel ME live hack:
@21m43s, keystrokes leaked from Intel ME above the OS, wireshark failed to detect packets.
[Video Link] 30C3: Persistent, Stealthy, Remote-controlled Dedicated Hardware Malware
[Quotes] Vortrag:
"DAGGER exploits Intel's Manageability Engine (ME), that executes firmware code such as Intel's Active Management Technology (iAMT), as well as its OOB network channel."
"the ME provides a perfect environment for undetectable sensitive data leakage on behalf of the attacker. Our presentation consists of three parts. The first part addresses how to find valuable data in the main memory of the host. The second part exploits the ME's OOB network channel to exfiltrate captured data to an external platform and to inject new attack code to target other interesting data structures available in the host runtime memory. The last part deals with the implementation of a covert network channel based on JitterBug."
"We have recently improved DAGGER's capabilites to include support for 64-bit operating systems and a stealthy update mechanism to download new attack code."
"To be more precise, we show how to conduct a DMA attack using Intel's Manageability Engine (ME)."
"We can permanently monitor the keyboard buffer on both operating system targets."
Backdoor removal:
The backdoor firmware can be removed by following this guide using the me_cleaner script.
Removal requires a Raspberry Pi (with GPIO pins) and a SOIC clip.
Decoding Intel backdoors:
The situation is out of control and the Libreboot/Coreboot community is looking for BIOS/Firmware experts to help with the Intel ME decoding effort.
If you are skilled in these areas, download Intel ME firmwares from this collection and have a go at them, beware Intel is using a lot of counter measures to prevent their backdoors from being decoded (explained below).
Useful links:
The Intel ME subsystem can take over your machine, can't be audited
REcon 2014 - Intel Management Engine Secrets
Untrusting the CPU (33c3)
Towards (reasonably) trustworthy x86 laptops
30C3 To Protect And Infect - The militarization of the Internet
30c3: To Protect And Infect Part 2 - Mass Surveillance Tools & Software
1. Introduction, what is Intel ME
Short version, from Inte
LOL you said taint.
Coming soon, the Raspberry Pi 5, now with firmware enhanced by Genuine Microsoft Windows 10 Pi Edition. ...I jest, but I can see it happening.
Fake name fucks are fake. That is that.
See subject: I kept seeing your posts on AMT & did read them, disabling this in the BIOS of my system & making sure the driver never was installed (or enabled) + to be SURE if it was to not only disable it but remove it in Computer Mgt. in Windows "DEVICES" section.
APK
P.S.=> IF it were installed (wasn't), wouldn't doing the above be enough vs. this potential threat? Thanks for answering THIS question too... apk
www.j-core.org
And RISC-V too.
Just say'n.
I may be a shill, but you are a plain nut-job! I provided a list of non-server Skylake CPUs and motherboard chipsets along with a list of the chipset model numbers that have vPro facility. All you provided was a strongly worded and unsupported assertion. If you had wanted to prove me wrong and actually believed your own rantings then you would have gone through the entire list and counted how many do and don't support vPro. Then you could have gloated about how wrong I was. But you didn't, so I will. Of the desktop CPUs, 6 support vPro while 22 do not. And as I said before only 1 in 6 of their chipsets would actually allow the CPUs to use that feature. You are wrong.
I do wonder why would you say we shouldn't trust Intel's word on their deliberate backdoors when they have been completely upfront (and even boasted) about the remote access facility of AMT! Nothing about this latest revelation shows that Intel have lied about anything.
If you have no evidence to support your notion that every Intel chip is secretly spying on you then don't swear at people who don't share your paranoid ravings. Some of us would rather have proof before we dusted off our pitchforks. That said, I would never buy a CPU that had remote access built in simply to avoid a potential attack vector. But there is a big difference between prudence and paranoia.
If the thing works by intercepting traffic from the chipset's ethernet wired interface, then would using either a separate PCI card or USB-based ethernet adapter mitigate the issue?
...all silicon was vulnerable?
AMD isn't secure, either.
I told you people there was a game-changing vulnerability out there that resided in pretty much all modern silicon.
Loving those downmods, now, because here I am, shown right. Vindication is always sweet.
Still waiting on Serviscope_minor to wake up to fucking reality and realize that Jessica Price isn't going to fuck him.
Does the bug affect Linux?
What a disappointingly predictable response. A reply that provides no evidence, and fails to address anything that I said. All we get is name calling and vulgarities. You don't even have the wit to make your insults amusing.
Go on, give me your best shot! Perhaps if you remove your tinfoil hat the CIA might helpfully beam to you some choice phrases.
it doesnt even have this stuff
no wonder new games dont work :P when your games dont work and your cpu is not on the list of the latest and greatest backdoor, you know its time to upgrade lol
Supposedly so they can be located if stolen, but it sounds pretty sketch to me. i think the functionality is branded vPro.
I imagine some lawyer greasing up his hands with a bacon extravaganza just before getting down and dirty with this vulnerability in a class action lawsuit and maybe force Intel to perform a chipset recall. It's about as bad as the floating point fiasco that Intel made many years ago.
And annon APK posts show that hosts file engine is sad and worthless much like APK.
A middle school dropout who found a copy of VB6 For Drunk Lower Primates could cobble that pile of crap together in a few hours.
All of the hard work was done by others, no original thought by APK but that should be apparent by his tired arguments and spamming.
Do the world a favor you bloody wanker and toss yourself in front of a lorry on the nearest motorway.
Oliver Day (SYMANTEC/SECURITYFOCUS):
http://www.securityfocus.com/c...
"The host file on my day-to-day laptop is now over 16,000 lines long. Accessing the Internet -- particularly browsing the Web -- is actually faster"
"More recently, projects like Spybot Search & Destroy offer lists of known malicious servers to add a layer of defense against trojans & other forms of malware"
OReilly hosts security -> http://oreilly.com/pub/a/windo... & speed -> http://www.oreillynet.com/pub/...
Steve Gibson endorses hosts https://www.grc.com/sn/sn-045....
Aryeh Goretsky/ESET/NOD32: hosts = good security http://it.slashdot.org/comment...
Malwarebytes hpHosts' hosts/RECOMMENDS me!
Brocke Wilders of WILDERS' SECURITY does inferior clone of MY work http://www.wilderssecurity.com...
APK
P.S.=> China = imitation = flattery too http://www.theregister.co.uk/2017/04/26/boffins_supercharge_the_hosts_file_to_save_users_plagued_by_dns_outages/
I'm going to continue using the Host File Engine. Your software is well written, functional. The Host File Engine performs exactly as promised by mmell
his hosts program is actually pretty good by xenotransplant
his hosts tool is actually useful for those cases in which one does indeed want to locally block stuff outright while consuming minimum system resources by alexgieg
I've never tried to belittle (APK's) work, I've flat out said it's good by BronsCon
take a look at the APK hosts file engine by SuperKendall
APK is kinda right. I've tried his hosts file generating software. It works by bmo
I like your host file system by Karmashock
I find your hosts file admirable by vel-ex-tech
* My code's liked + recommended & hosted by Malwarebytes' hpHosts!
APK
P.S.=> If it's "so easy to do" how come YOU can't do better "Brockmire" you FAKE NAME for your FAKE LIFE loser? apk
See subject: ... & how'd EATING YOUR WORDS taste here https://slashdot.org/comments.pl?sid=10557875&cid=54347839/ & here https://slashdot.org/comments.pl?sid=10557875&cid=54347805/ you fake name for your fake blowhard hotair windbag bullshitter life?
* What's the MATTER blowhard Brockmire the bullshitter? Can't face up to a COMPLETELY fair challenge to show you did better than I have (yet you criticize so easily)?? Yes.
APK
P.S.=> Brockmire = "Run, Forrest: RUN!!!" like the FAKE NAME for your FAKE LIFE bitch that you are motherfucker, lmao... apk
See subject: ... & how'd EATING YOUR WORDS taste here https://slashdot.org/comments.pl?sid=10557875&cid=54347839/ & here https://slashdot.org/comments.pl?sid=10557875&cid=54347805/ you fake name for your fake blowhard hotair windbag bullshitter life?
* What's the MATTER blowhard Brockmire the bullshitter? Can't face up to a COMPLETELY fair challenge to show you did better than I have (yet you criticize so easily)?? Yes.
(I see you had to TRY "downmod hide" what's in my subject via your doubtless MANY sockpuppet FAKE accounts (for your fake name life) here too, lmao https://slashdot.org/comments.pl?sid=10557875&cid=54338907/ hahahaha...)
Enjoy EATING YOUR WORDS rammed back down your chicken-neck throat washed down by the bitter taste of SELF-defeat Brock ole' boy, lol!
APK
P.S.=> Brockmire = "Run, Forrest: RUN!!!" like the FAKE NAME for your FAKE LIFE bitch that you are motherfucker, lmao... apk