Slashdot Mirror
Purism Now Offers Laptops with Intel's 'Management Engine' Disabled (puri.sm)
"San Francisco company Purism announced that they are now offering their Librem laptops with the Intel Management Engine disabled," writes Slashdot reader boudie2. Purism describes Management Engine as "a separate CPU that can run and control a computer even when powered off."
HardOCP reports that Management Engine "is widely despised by security professionals and privacy advocates because it relies on signed and secret Intel code, isn't easily alterable, isn't fully documented, and has been found to be vulnerable to exploitation... In short, it's a tiny potentially hackable computer in your computer that you cannot totally control, nor opt-out of, but it can totally control your system."
Purism writes: Disabling the Management Engine is no easy task, and it has taken security researchers years to find a way to properly and verifiably disable it. Purism, because it runs coreboot and maintains its own BIOS firmware update process, has been able to release and ship coreboot that disables the Management Engine from running, directly halting the ME CPU without the ability of recovery... "Disabling the Management Engine, long believed to be impossible, is now possible and available in all current Librem laptops. It is also available as a software update for previously shipped recent Librem laptops," says Todd Weaver, Founder & CEO of Purism.
HardOCP reports that Management Engine "is widely despised by security professionals and privacy advocates because it relies on signed and secret Intel code, isn't easily alterable, isn't fully documented, and has been found to be vulnerable to exploitation... In short, it's a tiny potentially hackable computer in your computer that you cannot totally control, nor opt-out of, but it can totally control your system."
Purism writes: Disabling the Management Engine is no easy task, and it has taken security researchers years to find a way to properly and verifiably disable it. Purism, because it runs coreboot and maintains its own BIOS firmware update process, has been able to release and ship coreboot that disables the Management Engine from running, directly halting the ME CPU without the ability of recovery... "Disabling the Management Engine, long believed to be impossible, is now possible and available in all current Librem laptops. It is also available as a software update for previously shipped recent Librem laptops," says Todd Weaver, Founder & CEO of Purism.
I am in need of a new laptop now that my poor Lenovo T420 has completely died. I think I will go and buy one of these. Intel's Management Engine is spyware and exploitware and the fact that you cannot disable it is really and truly evil. AMD is no better.
We already knew from their announcement that they were backdoors, and the Intel ME security problems confirmed this. In addition to documentation on how to use and disable the system, we also need software freedom—controlling our own computers requires the freedom to run, inspect, share, and modify the software, and exclusive control over any encryption keys used so we can decide who else gets to control the hardware with us. Until we have software freedom these devices are not good at all, they are a clear threat to our ability to exclusively control our own computers.
This is also why computers with other architectures are so interesting and important. As far as we know POWER, PPC, and other architectures either don't have backdoors built into the hardware or the comparable hardware comes with user-revocable keys and respect for our software freedom. This is a good time to get away from Intel/AMD systems. They're not trustworthy.
Digital Citizen
>>AMD has similar features in theirs as well.
>Do you have any evidence of this? I'd like to learn more about that
A link or two would be nice.
Platform Security Processor (PSP); it is exactly the same as Intel's backdoor- hardware based, secret, non-controllable.
https://hothardware.com/news/a...
https://www.techpowerup.com/23...
https://libreboot.org/amd-libr...
https://en.wikipedia.org/wiki/...
Despite Intel's claims, ME is a backdoor.
If it wasn't a backdoor they would let you completely remove it.
It's a dumpster fire of privacy issues, security problems and blatant government snooping.
All Intel did was added another hidden switch only they know how to switch on, like a unique wifi signal or magic packet on the onboard nic.
The goal of this report is to make the existence of Intel CPU backdoors a common knowledge and provide information on backdoor removal.
What we know about Intel CPU backdoors so far:
TL;DR version
Your Intel CPU and Chipset is running a backdoor as we speak.
The backdoor hardware is inside the CPU/Bridge and the backdoor firmware (Intel Management Engine) is in the chipset flash memory.
30C3 Intel ME live hack:
@21m43s, keystrokes leaked from Intel ME above the OS, wireshark failed to detect packets.
[Video Link] 30C3: Persistent, Stealthy, Remote-controlled Dedicated Hardware Malware
[Quotes] Vortrag:
"DAGGER exploits Intel's Manageability Engine (ME), that executes firmware code such as Intel's Active Management Technology (iAMT), as well as its OOB network channel."
"the ME provides a perfect environment for undetectable sensitive data leakage on behalf of the attacker. Our presentation consists of three parts. The first part addresses how to find valuable data in the main memory of the host. The second part exploits the ME's OOB network channel to exfiltrate captured data to an external platform and to inject new attack code to target other interesting data structures available in the host runtime memory. The last part deals with the implementation of a covert network channel based on JitterBug."
"We have recently improved DAGGER's capabilites to include support for 64-bit operating systems and a stealthy update mechanism to download new attack code."
"To be more precise, we show how to conduct a DMA attack using Intel's Manageability Engine (ME)."
"We can permanently monitor the keyboard buffer on both operating system targets."
Backdoor removal:
The backdoor firmware can be removed by following this guide [github.io] using the me_cleaner [github.com] script.
Removal requires a Raspberry Pi (with GPIO pins) and a SOIC clip.
Decoding Intel backdoors:
The situation is out of control and the Libreboot/Coreboot community is looking for BIOS/Firmware experts to help with the Intel ME decoding effort.
If you are skilled in these areas, download Intel ME firmwares from this collection [win-raid.com] and have a go at them, beware Intel is using a lot of counter measures to prevent their backdoors from being decoded (explained below).
Useful links:
The Intel ME subsystem can take over your machine, can't be audited
REcon 2014 - Intel Management Engine Secrets
Untrusting the CPU (33c3)
Towards (reasonably) trustworthy x86 laptops
30C3 To Protect And Infect - The militarization of the Internet
30c3: To Protect And Infect Part 2 - Mass Surveillance Tools & Software
1. Introduction, what is Intel ME
Short version, from Intel staff:
Re: What Intel CPUs lack Intel ME secondary processor?
Amy_Intel Feb 8, 2016 9:27 AM
The Management Engine (ME) is an isolated and protected coprocessor, embedded as a non-optional part in all current Intel chipsets, I even checked with the engineering department and they confirmed it.
Long version:
On your first question, usually the cheaper processors these days are actually different layouts, a long, long time ago this wasn't the case but then it was a case of binning, you could potentially get lucky but it was usually a more expensive model that got rejected but still ran on slower speeds with large portions of cache and other features disabled (eg. due to low yields on the wafer). These days production has gotten smaller, better and cheaper so yields are rarely a problem and even if they were, they probably wouldn't produce useful products anymore.
The management engine provides exactly that, management. It's intended for servers and enterprise systems. It's a form of baked-in IPMI and these days runs a version of MINIX. It can connect either directly or over VPN to your corporate environment and then you can remotely manage the machine, it can do security posture assessments (because it's not controlled by the OS, it can peer into hypervisors or compromised hosts), it can even emulate a serial port so you can connect to your host if you're running Linux/Unix-type systems.
Nothing about this is open source besides it being based on MINIX, to actually use it you have to pay Intel for their closed source software to be able to access the devices.
Purism is a computer technology company based in South San Francisco, California and registered as a social purpose corporation in the state of Washington.
Custom electronics and digital signage for your business: www.evcircuits.com
A secure laptop should have verified boot because it addresses an attack model that has become more important after the Snowden revelations. We learned that:
- NSA wants to keep their best exploits secret. For example, it uses more valuable exploits on less technically sophisticated targets who are less likely to discover them.
- NSA goes to great lengths to achieve persistence, for example hard drive firmware attacks that expose the exploited code the first time a sector is read, at boot, but the original code from then on, when the system is scanned for malware or checksum mismatches.
- NSA has many BIOS- and firmware-level attacks because it wants persistence even if the OS is wiped and replaced.
- It's unrealistic to expect we will ever patch all the bugs the NSA knows about.
Verified boot is very powerful in this scenario because, even if you don't know about a bug, it can stop that bug from permitting secret persistence. It drives persistence techniques into the open. For example, to attack ChromeOS and survive a reboot, they may need to install a malware extension, which can be audited from cloud side thus making everyone a technically-sophisticated target.
Intel breaks verified boot with their FSP blob. Verified boot starts with "read only" firmware which contains the verified boot key(*), checks the signature on the read-write firmware and jumps to it. But the processor must be fed the FSP blob before it runs the first instruction, so there's no way to check a signature on the FSP blob. A variety of CPU errata are fixable by updating the FSP blob, so it's prohibitively costly warranty exposure to leave the FSP blob un-updateable by linking it into the read-only firmware.
This undermines the defense ecosystem / attack recovery benefits described above. To get them, all state on the machine needs to fall in one of three categories:
1. not verified but impossible to change without physical access (ex. "remove the developer screw" on Chrome OS, or the trivial solution of replacing the entire CPU with a backdoored one)
2. auto-updateable, but verified by boot signature chain
3. wipeable user data
The first verified-boot key in the chain is in bucket 1, and other keys are in bucket 2. But Intel FSP inserts step 0:
0. CPU and RAM bring-up code: auto-updatable and not verified by boot signature chain.
It undermines the entire purpose of verified boot.
Disabling the ME is not very convincing unless there is some verified-boot way to make sure it stays disabled. The hypothetical persistent attack would simply un-disable the ME, so part of the problem is that it's there at all for an an attack can turn it on: it's a perfect hardware rootkit that can surveil without detection. There is no verified-boot way to disable the ME because of the FSP, so this Purism promise is pretty close to snake oil. They have hand-wavily reduced the attack surface somewhat, so it's not worthless, but it's not enough to fundamentally unbreak Intel's platform security-wise.
AMD has a similar blob called PSP. Many ARM chips also have this problem. FWIH Rockchip does not, so currently I would suggest a Rockchip Chromebook over Purism if security is the goal.
(*) You may have heard verified boot uses TPM. This is to prevent rollback from a current patched version of the OS to an old exploitable version without wiping user data first. The TPM starts in "willing to roll back counter if asked" mode, but before the program running on the CPU exposes its full attack surface, it either wipes userdata or sets the TPM into "only willing to roll forward the counter" mode. The read-only firmware obviously cannot maintain state. The purpose of the TPM is to maintain state with rules, and in this case the "rule" is a fuse that's reset on each reboot.