Slashdot Mirror
Malware Uses Obscure Intel CPU Feature To Steal Data and Avoid Firewalls (bleepingcomputer.com)
An anonymous reader writes: Microsoft's security team has come across a malware family that uses Intel's Active Management Technology (AMT) Serial-over-LAN (SOL) interface as a file transfer tool. The problem with Intel AMT SOL is that it's part of Intel's ME, a separate chip inside Intel CPUs that runs its own OS and stays on even when the main CPU is off.
Inside Intel's ME, AMT SOL opens a virtual network interface which works even when the PC is turned off. Furthermore, because this virtual network interface runs inside ME, firewalls and security products installed on the main OS won't detected malware using AMT SOL to exfiltrate data.
The malware was created and used by a nation-state cyber-espionage unit codenamed PLATINUM, active since 2009, and which has targeted countries around the South China Sea. PLATINUM is by far one of the most sophisticated hacking groups ever discovered. Last year [PDF], the OS maker said the group was installing malware by abusing hotpatching — a mechanism that allows Microsoft to issue updates that tap into active processes and upgrade applications or the operating system without having to reboot the computer.
Details about PLATINUM's recent targets and attacks are available in a report [PDF] Microsoft released yesterday.
Inside Intel's ME, AMT SOL opens a virtual network interface which works even when the PC is turned off. Furthermore, because this virtual network interface runs inside ME, firewalls and security products installed on the main OS won't detected malware using AMT SOL to exfiltrate data.
The malware was created and used by a nation-state cyber-espionage unit codenamed PLATINUM, active since 2009, and which has targeted countries around the South China Sea. PLATINUM is by far one of the most sophisticated hacking groups ever discovered. Last year [PDF], the OS maker said the group was installing malware by abusing hotpatching — a mechanism that allows Microsoft to issue updates that tap into active processes and upgrade applications or the operating system without having to reboot the computer.
Details about PLATINUM's recent targets and attacks are available in a report [PDF] Microsoft released yesterday.
This is exactly what was said was going to happen when it came to light that Intel was sticking extra shit to motherboards no one was asking for. And at the time, Intel said no one would be capable of getting to it. Guess what?
So tired of this crap.
Workstation class machines are the ones that usually have the ME installed and enabled and these machines are also the most likely to have juicy information on them compared to sally-sue's facebook machine.
Also, Stallman was right all along.
Modern app appers only use App Runtime Modules (ARM), NOT LUDDITE Intel processors with LUDDITE software!
Apps!
...with the computer-within-a-computer model. Instead of doing one thing and doing it well, and to use a cliche, putting all of one's eggs in one basket and then watching the basket, a fragmented model means that inevitably pieces get missed, as the proliferation of extra and possibly extraneous systems makes it impossible to keep-up with everything going on.
More and more layers are piled-on, and more and more points are created for there to be problems.
Do not look into laser with remaining eye.
Fuck AMT (and AMD's PSP).
They have almost zero real world benefit, and are just absurdly dangerous.
I thought they said it was 100% secure, and this would never happen.. lol fools they are.
The goal of this report is to make the existence of Intel CPU backdoors a common knowledge and provide information on backdoor removal.
What we know about Intel CPU backdoors so far:
TL;DR version
Your Intel CPU and Chipset is running a backdoor as we speak.
The backdoor hardware is inside the CPU/Bridge and the backdoor firmware (Intel Management Engine) is in the chipset flash memory.
30C3 Intel ME live hack:
@21m43s, keystrokes leaked from Intel ME above the OS, wireshark failed to detect packets.
[Video Link] 30C3: Persistent, Stealthy, Remote-controlled Dedicated Hardware Malware
[Quotes] Vortrag:
"DAGGER exploits Intel's Manageability Engine (ME), that executes firmware code such as Intel's Active Management Technology (iAMT), as well as its OOB network channel."
"the ME provides a perfect environment for undetectable sensitive data leakage on behalf of the attacker. Our presentation consists of three parts. The first part addresses how to find valuable data in the main memory of the host. The second part exploits the ME's OOB network channel to exfiltrate captured data to an external platform and to inject new attack code to target other interesting data structures available in the host runtime memory. The last part deals with the implementation of a covert network channel based on JitterBug."
"We have recently improved DAGGER's capabilites to include support for 64-bit operating systems and a stealthy update mechanism to download new attack code."
"To be more precise, we show how to conduct a DMA attack using Intel's Manageability Engine (ME)."
"We can permanently monitor the keyboard buffer on both operating system targets."
Backdoor removal:
The backdoor firmware can be removed by following this guide using the me_cleaner script.
Removal requires a Raspberry Pi (with GPIO pins) and a SOIC clip.
Decoding Intel backdoors:
The situation is out of control and the Libreboot/Coreboot community is looking for BIOS/Firmware experts to help with the Intel ME decoding effort.
If you are skilled in these areas, download Intel ME firmwares from this collection and have a go at them, beware Intel is using a lot of counter measures to prevent their backdoors from being decoded (explained below).
Useful links:
The Intel ME subsystem can take over your machine, can't be audited
REcon 2014 - Intel Management Engine Secrets
Untrusting the CPU (33c3)
Towards (reasonably) trustworthy x86 laptops
30C3 To Protect And Infect - The militarization of the Internet
30c3: To Protect And Infect Part 2 - Mass Surveillance Tools & Software
1. Introduction, what is Intel ME
Short version, from Intel staff:
Re: What Intel CPUs lack Intel ME secondary processor?
Amy_Intel Feb 8, 2016 9:27 AM
The Management Engine (ME) is an isolated and protected coprocessor, embedded as a non-optional part in all current Intel chipsets, I even checked wit
The goal of this report is to make the existence of Intel CPU backdoors a common knowledge and provide information on backdoor removal.
What we know about Intel CPU backdoors so far:
TL;DR version
Your Intel CPU and Chipset is running a backdoor as we speak.
The backdoor hardware is inside the CPU/Bridge and the backdoor firmware (Intel Management Engine) is in the chipset flash memory.
30C3 Intel ME live hack:
@21m43s, keystrokes leaked from Intel ME above the OS, wireshark failed to detect packets.
[Video Link] 30C3: Persistent, Stealthy, Remote-controlled Dedicated Hardware Malware
[Quotes] Vortrag:
"DAGGER exploits Intel's Manageability Engine (ME), that executes firmware code such as Intel's Active Management Technology (iAMT), as well as its OOB network channel."
"the ME provides a perfect environment for undetectable sensitive data leakage on behalf of the attacker. Our presentation consists of three parts. The first part addresses how to find valuable data in the main memory of the host. The second part exploits the ME's OOB network channel to exfiltrate captured data to an external platform and to inject new attack code to target other interesting data structures available in the host runtime memory. The last part deals with the implementation of a covert network channel based on JitterBug."
"We have recently improved DAGGER's capabilites to include support for 64-bit operating systems and a stealthy update mechanism to download new attack code."
"To be more precise, we show how to conduct a DMA attack using Intel's Manageability Engine (ME)."
"We can permanently monitor the keyboard buffer on both operating system targets."
Backdoor removal:
The backdoor firmware can be removed by following this guide using the me_cleaner script.
Removal requires a Raspberry Pi (with GPIO pins) and a SOIC clip.
Decoding Intel backdoors:
The situation is out of control and the Libreboot/Coreboot community is looking for BIOS/Firmware experts to help with the Intel ME decoding effort.
If you are skilled in these areas, download Intel ME firmwares from this collection and have a go at them, beware Intel is using a lot of counter measures to prevent their backdoors from being decoded (explained below).
Useful links:
The Intel ME subsystem can take over your machine, can't be audited
REcon 2014 - Intel Management Engine Secrets
Untrusting the CPU (33c3)
Towards (reasonably) trustworthy x86 laptops
30C3 To Protect And Infect - The militarization of the Internet
30c3: To Protect And Infect Part 2 - Mass Surveillance Tools & Software
1. Introduction, what is Intel ME
Short version, from Intel staff:
Re: What Intel CPUs lack Intel ME secondary processor?
Amy_Intel Feb 8, 2016 9:27 AM
The Management Engine (ME) is an isolated and protected coprocessor, embedded as a non-optional part in all current Intel chipsets, I even checked wit
Interest in countries around South China Sea? It was probably East Timor.
The problem always is: if there is a backdoor, the manufacturer is not the only one able to explore it.
AMD has one too. They call theirs the "platform security processor".
Didn't take fucking long at all, now that the infosec companies know what they should've been looking for.
Whether or not you're connected directly to the Internet is irrelevant if the hackers can break into some insecure 'IoT' device on your LAN and use that to launch attacks on everything behind the firewalls.
I vaguely remember seeing that post, and I believe it was on the article here talking about AMD maybe Open Sourcing their version(PSP). But I could be incorrect.
Above and beyond that anybody that knows how computers and the internet really works, has known for years(about 11) that AMT was most likely backdoored.
Stallman was right about governments, businesses, and bad actors using the proprietary back doors in your computer to control you and curtail your freedom.
This is an insecure IoT device that is on your motherboard and therefore on your LAN.
They're hopefully going to open source that portion. Hopefully. there is nothing set in stone, but Lisa Su sounded and looked interested in the idea.. Plus they need to get a better leg up on intel anyways. So I will stay optimistic about it.
Well that's the thing - if you stop working for the bad guys and start working for the "good guys", you'll stop finding these things. You'll spend all your time attending two-hour "standup" meetings, filling out time sheets in 15-minute increments, begging some MBA "project manager" who doesn't understand your job but still makes more money than you do to allow you to charge to a project code so that your time adds up to 40 hours each week, trying to drown out all of the noise in your trendy "collaborative" open office, setting vague profitability annual "goals", writing up "roadmap strategy" documents, justifying how much time you're going to spend doing something before you do it, filing TPS reports, refiling TPS reports with the right covers, and checking to see if the windows open enough that you jump to the sweet release of death, and no time at all studying the haystack of specifications that may or may not yield the needle that you're looking for.
Proud neuron in the Slashdot hivemind since 2002.
Are you sure about "own MAC and IP address"? Common network chip set (e.g. Intel 82574 family) external interfaces include: NC-SI or SMBus connection to a Manageability Controller (MC) with IPMI MC pass through; multi-drop NC-SI. This generally results in UDP/TCP port 623 traffic being re-directed to the Management Controller. The way I have seen this manifested is port 623 on all network interfaces is passed through to the management engine. The IP and MAC for the management engine is the same as for any other normal communications through the same interface.
All port 623 traffic should be kept on the inside of the network and not allowed to transit firewalls.
When can we expect a recall from Intel?
Seven puppies were harmed during the making of this post.
Some days the jokes just write themselves....
All of the AMT systems I have looked at in years past have an option to set a different IP for the AMT endpoint or to snoop on DHCP traffic and use the same IP address as the host OS.
It was too long ago and I never played with it enough to confirm whether the static IP set for the engine would remain active while the host OS was running with its own network config, or if it simply served to provide for communication while the host OS or its network was disabled.
What I did discover is that things went wonky if you told it to snoop on DHCP and then used something like VMware with bridged networking, causing several different IP leases to be taken by stuff running within the machine. The AMT endpoint didn't seem to care about the different MAC address of each VM versus the hardware NIC and instead kept following along with whichever lease it saw most recently.
It gets worse: ARM has its own equivalent called "TrustZone"
1. This is no longer obscure, after having ample coverage here on /. over the past year
2. This cannot be considered a feature - it's an anti-feature like DRM or remote killswitches.
"Nine times out of ten, starting a fire is not the best way to solve the problem." - my wife
and I thought they got rid of the real power switch to save a buck, well, 50 cents anyway...
"PLATINUM is by far one of the most sophisticated hacking groups ever discovered."
There is nothing advanced about sending a NDL and requesting a backdoor be made.
Is it correct that the AMT is fully dependent on the onboard Ethernet, WiFi and 3G chips for communication?
If so, would simply not using those chips be a suitable workaround? If so, I foresee a strong market for PCIe ethernet cards, particularly ones that don't depend on Intel drivers.
"Nine times out of ten, starting a fire is not the best way to solve the problem." - my wife
Thank you, Intel, for subverting my PC hardware in such a way that makes it impossible for me to defend against hackers and government agencies!
You done innovated the SHIT outta that computer stuff!
Just cruising through this digital world at 33 1/3 rpm...
> They're hopefully going to open source that portion
I mean, we can hope man. If AMD actually had this, I'd consider making the switch.
There's a company that says they have found a way to neutralize the ME, overwriting all of its main modules (i.e. the ones that allow DMA and network access like this exploit uses): https://puri.sm/learn/avoiding...
3. The backdoor is active even when the machine is powered off:
How exactly do they manage to read data from a hard drive which is spun down? (sarcasm)
I'm sure this Intel backdoor could do plenty of nefarious things when the machine is at full power, but it's likely capable of nothing more than a glorified wake-on-lan when the machine is shut down. Of course, to me, "powered off" means you've physically cut power to the machine - and so long as Intel is still producing hardware based on the known laws of physics, that means the backdoor is inaccessible.
---
DRM is like antifreeze, to the MPAA/RIAA it's sweet, to the consumers it's poison.
Nobody tell them it's built into the very assembly code that runs our networks, ok?
-- Tigger warning: This post may contain tiggers! --
Well, assuming you have buffered data into the SPI you can now spool that out steganographically using SoL.
Of note, to disable ME (at least on a basic level, and assuming BIOS supports it) you can configure BIOS do turn it off. While this won't totally disable it, it will turn off the higher level functions like AMT/SoL/IDER etc.
And this is also yet more servings of crow for me to eat after having publically defended ME more than once. :(
whois gawk date unzip strip find touch finger mount join nice man top fsck grep eject more yes exit umount sleep dump
At least SOMEONE is using the feature, MS certainly doesn't seem to use it... ever.
To err is human; effective mayhem requires the root password!
I am wondering, what did you smoke to get this full retard?
'they don't understand that you can't build a fast CISC processor in analog'
' you have to actually build a big mishmash of multiple RISC processors that together simulate a single CISC processor'
'it even has fake timing semantics that are phrased as if it is a traditional digital logic circuit built from analog parts'
'those analog parts are actually multiple levels of code below the interface you can touch'
'This goes back to the 1950s!'
' If you don't want microcode, stick to running RISC processors'
'You can have tight real-time timing, but you won't get high total throughput or a useful cache'
Do you actually realise that pretty much every statement you made is completely false bordering on hilarious?
Or did I miss the fact that this is some kind of joke where you make up ludicrous claims to be funny?
I mean, if so it is quite well done, each of the completely insane claims is based on the tiniest kernel of truth, before it is bent and stretched so far away from reality that it becomes insanity...
However, I am rather concerned that you actually believe this crap. That truly is scary.
Yes, but the OEMs have full control of the code in TrustZone. As an example, there are at least four different commercially available kernels that run in Trustzone, making it a PITA to support anything connected to it.
And the worms ate into his brain.
The AMT has to have the cooperation of the network chipset to access the network. I have crawled through petabytes of netflow from tens of thousands of routers supporting nearly a million computers and have never seen port 623 traffic associated with an IP that did not also have other traffic on other ports. I could have missed this since I wasn't explicitly looking for this though. It did amaze me that the AMT has its own list of servers for services such as NTP (which allows the manufacturer to see the heartbeats of their customer's servers if this is not blocked/NAT-redirected at the firewall). So clearly it is capable of full network stack interaction and could have its own MAC and IP if the network card provided a way to accept the configuration for this. I just haven't seen this and suspect that in general network cards don't provide this service to the AMT. Maybe it would be a good idea to not use motherboard network chips and use network cards from chipsets from a different manufacturer than the CPU chipset.
When I ordered my laptop from HP a couple years ago, the system configuration page had an option to either enable or disable vPro. I chose to disable vPro, which means I don't have SOL. I remember Dell also giving you that option on their web site.
Do you also think the "close" button works on elevators? Do you think turning off telemetry in Windows 10 turns it off?
The ME is running regardless of what you set your BIOS to. Whether it can reach the outside world seems like it is motherboard dependent. It's true that you aren't vulnerable to THIS vuln. But what about the others? We know there are others. We just don't know exactly where they are. The bad guys sure do though.
Well vPro isn't a BIOS setting. There isn't any setting in the BIOS that you can use to enable or disable it. It's something the manufacturer configures at the factory, and once it's disabled, it's impossible to enable it. At least that's what they say...
Interesting that Microsoft comes out with this report just as Intel is throwing around some not-so-vague legal threats.
Nope, no sig
There are actually a number of Intel Core chipsets released every year that are not cursed with vPro and AMT. You may want to choose from those. Not sure how to pick the right Xeon though. http://ark.intel.com/Search/Fe...
In Soviet Russia, our new overlords are belong to all your base.