Slashdot Mirror
Researchers Find a Way To Disable Intel ME Component Courtesy of the NSA (bleepingcomputer.com)
An anonymous reader writes:Researchers from Positive Technologies -- a provider of enterprise security solutions -- have found a way to disable the Intel Management Engine (ME), a much-hated component of Intel CPUs that many have called a secret backdoor, even if Intel advertised it as a "remote PC management" solution. People have been trying for years to find a way to disable the Intel ME component, but have failed all this time. This is because disabling Intel ME crashes computers, as Intel ME is responsible for the initialization, power management, and launch of the main Intel processor.
Positive Technologies experts revealed they discovered a hidden bit inside the firmware code, which when flipped (set to "1") will disable ME after ME has done its job and booted up the main processor. The bit is labelled "reserve_hap" and a nearby comment describes it as "High Assurance Platform (HAP) enable." High Assurance Platform (HAP) is an NSA program that describes a series of rules for running secure computing platforms. Researchers believe Intel has added the ME-disabling bit at the behest of the NSA, who needed a method of disabling ME as a security measure for computers running in highly sensitive environments.
The original submission linked to a comment with more resources on the "Intel CPU backdoor" controversy.
Positive Technologies experts revealed they discovered a hidden bit inside the firmware code, which when flipped (set to "1") will disable ME after ME has done its job and booted up the main processor. The bit is labelled "reserve_hap" and a nearby comment describes it as "High Assurance Platform (HAP) enable." High Assurance Platform (HAP) is an NSA program that describes a series of rules for running secure computing platforms. Researchers believe Intel has added the ME-disabling bit at the behest of the NSA, who needed a method of disabling ME as a security measure for computers running in highly sensitive environments.
The original submission linked to a comment with more resources on the "Intel CPU backdoor" controversy.
In the early 2000s, my CD tray went out, and somebody started typing on my screen to me. It was such a violation that somebody had put a trojan on my machine and snooped around for who knows how long silently before revealing themselves. And since the trojan has no username/password, he not only opened my computer up to his sick self to sit there and watch my private computing environment and download files and watch screenshots of my desktop and all kinds of things -- he also let the entire world connect as they pleased as long as they found my IP address (ICQ advertised this to every contact back then, for example).
And now, with as much security knowledge I've been able to collect for all these years since, my HARDWARE enables some assholes to remotely spy and watch me in real time... it makes me physically sick to think about it. I wouldn't be surprised if it turns out that anything I've ever seen on my computers is all available in some enormous data collection cave in lossless fullscreen video. All ready to blackmail me the minute I gain any sort of power...
Some "friends" I had, who would do such a thing. People don't respect you or your privacy one single little bit.
Not much-hated by the people who buy Intel CPUs by the train-load.
"I don't know, therefore Aliens" Wafflebox1
I think we should call it the anti-evil bit https://www.ietf.org/rfc/rfc3514.txt !
I don't want to sound paranoid, but...
Given the history of this organisation, there is a possibility that the 'disable Intel ME, block the nefarious attackers' bit is a decoy.
(Disclaimer: I use a 2008 thinkpad with the SOIC-16 personally reprogrammed using a beaglebone. So maybe I'm paranoid.)
The bleepingcomputer's article is informative, the researcher's blog post is full of technical details... but how do I actually disable Intel ME? Where is the how-to for that?
Do Apple computers have the ME enabled? How do you've access it?
"High Assurance Platform" sounds to me like it's a mode to ensure that the CPU doesn't receive SMM interrupts. This is one of the reasons why Intel is not the platform of choice for safety-critical systems that depend on hard real-time guarantees.
sub f{($f)=@_;print"$f(q{$f});";}f(q{sub f{($f)=@_;print"$f(q{$f});";}f});
... indicates it's likely beholden in a similar fashion now.
...or does it seem slightly meta that, in a sense, Intel's backdoor has it's own backdoor.
-It is by will alone I set my mind in motion.
Is the Intel Management Engine present in all AMT versions? Is the Intel ME problematic in all versions of AMT in which it exists? Does AMT require Intel ME in the first place?
Slashdot: Playing Favorites Since 1997
Wisdom, (not knowledge) prevents you from being an arrogant idiot like you have just been, knowing what intel ME is exactly (which you clearly do not) is not necessary to suppose there might be so much controversy and research into intel ME because there is no supported way to remove the vulnerable nature of having a whole closed source, obfuscated, signed OS and CPU in control of your CPU... Just to be clear: No, you cannot remove disable intel ME from EFI or BIOS, try at least to not be so condemning next time.
wow why didn't they think of that huh? I guess we should all ask you how IME works then. So this BIOS option prevents the ME OS from booting I presume? otherwise you are still fucked.
What baffles me most is that the regular consumer is not offered this option for the devices they purchased.
Because from all indications right now, AMD is on a proprietary embedded OS AND has full image encryption, meaning no pick and choose of modules to disable.
Something else a lot of people haven't considered: The neural network block used in the processors could have intentional or unintentional exploits built into them. The 'bad masks' that are resulting in Ryzen RMAs may not have been unintentional, but rather a widely used piece of code triggered them in an unintended manner causing a crash instead of an exploit. The point at which we will know for certain is after our system security is relying on them.
Same issue with out of order processors in general. By allowing the processor to reorder instructions as it sees fit, you lose the ability to verify intended operation of code, especially when hyperthreading or alternate states made be interacting with it. This is not to say we should take the performance hit of returning to in-order processors, but that there are a lot of inherent risks in computer technology and with the proprietary nature of current designs there is no way for us to be assured of the safety or security of what are rapidly becoming a central focus of the majority's lives.
You access it from another PC by trying to connect to port 16992,16993,16994,16995,623 and 664 on the target machine. Accessing from the PC itself will not prove anything, as generally the access will go via the loopback interface on the same PC, bypassing the network IC that is working together with Intel ME to intercept communication on those ports.
Depending on the response you get, you can determine:
1) Behaviour same as other unused ports: Intel ME probably not available or completely disabled on this processor.
2) Connection rejected or timed out, but behaviour is subtly different than other ports: Intel ME is present, but not provisioned (vulnerabilities in this state are unknown, but cannot be excluded).
3) Connection accepted, and some authentication challenge or active error message given: Intel ME is present and provisioned (mostly this is only if your network admins have licensed some software to make use of it).
The BIOS settings just disable the software that runs on top of Intel ME. Intel ME is still present and intercepting certain network ports, as can be verified by comparing the behaviour of those ports to other unused ports on the same PC. The network stack handling them is different, so the rejection behaviour is different - if you don't see a difference right away, try configuring iptables or other firewall software to change the rejection method for those ports (a change from REJECT to DROP should make connections timeout instead of failing immediately for example).
"As in environments that least have no internet access, or at best are air-gapped."
The Iranians found out the hard way that even a no internet access,air gapped, highly sensitive environment still wasn't enough to protect them from Stuxnet. Stuxnet was technically impressive but getting the virus smuggled into one of Iran's most secure facilities was even more impressive.
AMT runs on top of Intel ME. So yes, Intel ME is present in all AMT versions, and also remains present if you do not even have AMT enabled.
In order to ensure your security the following steps are required:
- The AMT remote maintenance support has to be disabled (you would have had to manually configure and enable this, unless it was a corporate deployment.)
- The ME interface would have to be exposed to the operating system. Not all systems enable this. The ones that do will show a device in either the device manager or via lspci on linux.
- Final:you will have had to make a copy of your bios image, read off using either an FPC or SPI flash reader, or a Raspberry Pi configured to emulate one. Then you have to run me_cleaner on the image to strip out the unnecessary bits from the firmware. For [GQ][34]x chipsets they can strip basically everything. Nehalem/X58 is a bit less clear, although it isn't as bad as Sandy Bridge+.
However, one concern that has been overlooked in the later chipsets is the GPU as an alternative vector of attack instead of the ME. It has a similar level of memory access as the ME, newer models have similarly signed firmware and while they officially have bounded memory access it is not improbable that some undocumented feature provides a method for them to breach that.
Also as a remind for anyone using a GPGPU for cryptographic functions/temporary storage of your keys: Always make sure your cude/OpenCL program manually zeros all sensitive memory ranges before returning the thread. Otherwise there is a danger of other GPU programs finding a way to scan/access/copy/exfiltrate that information to third parties.
Or just y'know, run Windows 10. All these dangers become irrelevant since the OS can do it all for them without any of these pesky engineered backdoors.
Even if it does what it claims to do, it doesn't fully protect you from the ME being exploited. It just prevents exploits against a running ME, but an attacker could still hide code in the ME itself via bogus firmware updates which gives them a powerful rootkit that is difficult to detect or remove.
Lifting the write enable pin on the EEPROM can prevent that.
I also worry that the remaining minimal ME code needed to boot the system could be exploited some how. Bad firmware in another device, bad configuration data...
Still, this is a valuable discovery and one which likely gives ordinary users an easy way to improve their security.
const int one = 65536; (Silvermoon, Texture.cs)
SJW, n: "Someone I don't like, and by the way I'm a fuckwit" - AC
Is this port knocking, or does each port do something different, or is it simply trial-and-error between ports?
Religion is what happens when nature strikes and groupthink goes wrong.
From the article:
"At the hardware level, Intel ME is nothing more than a microcontroller embedded on the Platform Controller Hub (PCH) chip, the component that handles all communication between the actual Intel processor and external devices."
Of course that makes this "component" even more ominous.
"By the way if anyone here is in advertising or marketing... kill yourself." -- Bill Hicks
See subject: Stop it's ability to send info. outward via router port filtering ala ports 16992-16995 that Intel AMT/ME uses so filter those ports in a modem/router external to OS/PC. Intel ME/AMT operates from your mobo but has NO CONTROL OF YOUR MODEM/ROUTER!
(This stops it cold talking in/out permanently OR being able to remotely 'patch' it to use other ports by Intel OR malicious actors/malware makers etc.!)
Additionally, once you disable the AMT engine's software interface (ez via software these articles note)? A malware to 'repatch' this = impossible (bios updaters require it in usermode ware, e.g. ASUS).
(I only allow 80, 8080 & 443 in/out here on a SINGLE stand-alone system (no home LAN but TCP/IP connected online in BOTH my modem or router port filters or software firewalls))
HOWEVER - Be CERTAIN your modem/router's internal ware is "solid" as well (turn off things like UPnP etc. & CHECK router/modem HAS NO KNOWN BACKDOOR EXPLOITS (tons do unfortunately)) - get it patched ASAP if it's KNOWN exploited & TONS of routers, ARE https://it.slashdot.org/comments.pl?sid=9995967&cid=53488785/
* GOOD ROUTERS/MODEMS HAVE PORT FILTERING OPTIONS (crappy ones do not)!
APK
P.S.=> Good luck - it's the BEST EASIEST & CHEAPEST DEFENSE using what you already have (hopefully, again as not ALL modems have port filtering but most do & certainly GOOD ONES DO) vs. this threat by stopping it being able to communicate in/out period, from OUTSIDE of the INTEL chipset external to it via a router/firewall hardware... apk
1. What if you can't change the router?
2. What if you forget to change the router?
3. What if you connect to another network?
4. What about the versions that use mobile phones built into the motherboard
It's bullshit. Intel's Management Engine is a hardware backdoor into every Intel system. You cannot trust Intel-based PCs. It's that simple.
Frankly, it's shocking that Intel have gotten away with this as long as they have.
In my experience, sensitive areas are run by people who did not know about this. So it must have been more like a Sig int input site, gathering external data, like a Twitter scraper. Something partially exposed that needed protection.
Funny how they'd like Intel to have all that extra real estate on a chip to help them monitor the rest of us, but don't want that same capability turned on them. Sauce for the goose is ketchup for the gander!
So easy to do on a laptop or an AIO. Other than gamers, how many people still use desktops where one can plug in a NIC into a PCIe slot?
Does that still work if one uses an Ethernet-USB adaptor on a laptop, where one can't plug in a second NIC card?
I downloaded and compiled mei-amt-check from github, which was last compiled 4 months ago.
"A simple tool that tells you whether AMT is enabled and provisioned on Linux systems. Requires that the mei_me driver (part of the upstream kernel) be loaded."
The mei_me.ko is loaded when the program is run.
It gave me this on my Intel(R) Core(TM) i7-3610QM :
"sudo ./mei-amt-check
[sudo] password for jerry:
Error: Management Engine refused connection. This probably means you don't have AMT"
The "Management Engine" is still there and working or it couldn't have returned that msg.
Stallman's note on 12-19-2016 was more than eight months ago. The patch was compiled four months ago. Plenty of time for the folks who installed the back door to patch it so the mei-amt-check doesn't return truthful results. ???
Running with Linux for over 20 years!
You posted anonymously... and then signed your post??????
From a post by Stallman:
"3. The backdoor is active even when the machine is powered off:
Intel rolled out something horrible [hackaday.com]
The ME has network access, access to the host operating system, memory, and cryptography engine. The ME can be used remotely even if the PC is powered off. If that sounds scary, it gets even worse: no one knows what the ME is doing, and we canâ(TM)t even look at the code.
4. Onboard ethernet and WiFi is part of the backdoor:
The ME has its own MAC and IP address for the out-of-band interface, with direct access to the Ethernet controller; one portion of the Ethernet traffic is diverted to the ME even before reaching the host's operating system
If your CPU has Intel Anti-Theft Technology enabled, it is also possible to directly access the backdoor from cell towers using 3G.
5. The backdoor uses encrypted communication:
https://en.wikipedia.org/wiki/... [wikipedia.org]
AMT version 4.0 and higher can establish a secure communication tunnel between a wired PC and an IT console outside the corporate firewall. In this scheme, a management presence server (Intel calls this a "vPro-enabled gateway") authenticates the PC, opens a secure TLS tunnel between the IT console and the PC"
Running with Linux for over 20 years!
Don't use the onboard NIC then. If it ain't plugged in it can't be used and if it is a random NIC from a different vendor than Intel it's unlikely that Intel ME will be able to make use of it.