Slashdot Mirror
Google Working To Remove MINIX-Based ME From Intel Platforms (tomshardware.com)
An anonymous reader quotes a report from Tom's Hardware: Intel's Management Engine (ME) technology is built into almost all modern Intel CPUs. At the Embedded Linux Conference, a Google engineer named Ronald Minnich revealed that the ME is actually running its own entire MINIX OS and that Google is working on removing it. Due to MINIX's presence on every Intel system, the barebones Unix-like OS is the most widely deployed operating system in the world. Intel's ME technology is a hardware-level system within Intel CPUs that consists of closed-source firmware running on a dedicated microprocessor. There isn't much public knowledge of the workings of the ME, especially in its current state. It's not even clear where the hardware is physically located anymore.
What's concerning Google is the complexity of the ME. Public interest in the subject piqued earlier this year when a vulnerability was discovered in Intel's Active Management Technology (AMT), but that's just a software that runs on ME--ME is actually an entire OS. Minnich's presentation touched on his team's discovery that the OS in question is a closed version of the open-source MINIX OS. The real focus, though, is what's in it and the consequences. According the Minnich, that list includes web server capabilities, a file system, drivers for disk and USB access, and, possibly, some hardware DRM-related capabilities. It's not known if all this code is explicitly included for current or future ME capabilities, or if it's because Intel simply saw more potential value in keeping rather than removing it.
What's concerning Google is the complexity of the ME. Public interest in the subject piqued earlier this year when a vulnerability was discovered in Intel's Active Management Technology (AMT), but that's just a software that runs on ME--ME is actually an entire OS. Minnich's presentation touched on his team's discovery that the OS in question is a closed version of the open-source MINIX OS. The real focus, though, is what's in it and the consequences. According the Minnich, that list includes web server capabilities, a file system, drivers for disk and USB access, and, possibly, some hardware DRM-related capabilities. It's not known if all this code is explicitly included for current or future ME capabilities, or if it's because Intel simply saw more potential value in keeping rather than removing it.
You are not alone. This is not normal. None of this is normal.
Google Working To Remove MINIX-Based ME From Intel Platforms
... and replacing it with Android. "Just how much juicy monetizable user data could we get that way?"
(I believe I'm joking, but I'm not completely sure...)
I have discovered a truly marvelous proof of killer sig, which this margin is too narrow to contain.
Hrmm, so some of these intel systems would have linux on it, and linux would be on some AMD x86 systems, and intel ME isn't on Qualcomm/ARM chips in mobiles that android (linux) runs on, or any of these IoT devices. I'm willing to wager there are more mobile phones in the world than intel ME enabled PCs at this point.
Guys, can you at least get your facts straight before doing another FUD piece on the Intel ME?
1) The ME is not in the CPU, it's in the chipset, specificly it's loaded in the firmware of the firmware hub, and the "hidding processor" is in the chip we typically call the South Bridge.
2) It's OFF BY DEFAULT.
Go ahead and check it yourself:
INTEL-SA-00075 Detection and Mitigation Tool
https://downloadcenter.intel.com/download/26755
Tanenbaum gets the last laugh over Torvalds.
It's the year of the Minix desktop!
Google might want to talk to Purism, who claim to have completely disabled Intel's ME in their secure Linux based laptops.
If ever notice that when thigns are powered off they are still using 1-10wats? Or that LED's are still lit or blinking?
This is the case with PC's, Microwaves, Dumb TV, VCR's, your name it.
PC's no longer have an on/off button. It's now a button that asks the CPU to shutdown. Power is not cut removed, and some parts stay powered on. Can't ask the CPU to power on, if there's no power for it to reconize the input.
The spirit of resistance to government is so valuable on certain occasions that I wish it to be always kept alive
You should peruse this great website which talked about this three days ago...
https://tech.slashdot.org/stor...
It seems like just a day ago, there was a Slashdot posting about this, and several highy-rated comments amounting to "naw man, there's no way this could be a problem!"
So with all the verifiable, proven news of backdoors being built-in to software and hardware over the past decade, and all the news of vulnerabilities in software and hardware that compromise systems, people say "nah, not a problem, see, you can turn it off" about this "computer in my computer." Really? It's off?
I'm not seeing reports saying "The Intel ME is off by default in consumer devices, and this is verified by researchers." In fact, I'm seeing the opposite, which says that the Intel ME is always on. Do we have any proof that the "off switch" in BIOS actually makes this feature unexploitable? Because, really, that's what I want: I want this feature to be unexploitable, and the only way I can be sure of that is for it to be disabled, for real, because I don't need this feature.
So yeah, please forgive us all if we are just a BIT skeptical about Intel ME. Forgive us if we're skeptical of spokespersons at Intel saying "There's no problem with this feature."
This may be worth 0.02 or less but I believe the vulnerabilities can be mitigated somewhat by using disk encryption. I store all of my data on virtual encrypted file system with a hardware decryption key. When I am done with the filesystem, I just unmount it and remove the USB thumb drive that acts as the decryption key. Yes, it's a pain in the ass and yes, it really only works on desktops. It is a little impractical to do this on a server. It would be good for Google to find a way to stop this Intel menace.
Intel's ME being based on MINIX is quite old news. Or at least, based on the summary. Is there anything new in the talk that should have been in the summary / writeup?
09F91102 no, 455FE104 nope, F190A1E8 uh-uh, 7A5F8A09 that's not it, C87294CE no. Ah! 452F6E403CDF10714E41DFAA257D313F.
Due to MINIX's presence on every Intel system, the barebones Unix-like OS is the most widely deployed operating system in the world.
I seriously doubt this claim. Phones have outnumbered PCs for years, for one thing. And Linux is deployed maybe even in more TVs and routers than phones, and numerous other embedded systems, now increasingly including cars. Anybody with decent stats on this?
When all you have is a hammer, every problem starts to look like a thumb.
First, not all Intel systems that are capable of it actually have the management engine software. Second, the Intel PC motherboard probably does not hold the "largest number of systems" title, that might belong to Android phones. And anyway isn't the fact that MINIX with its BSD/MIT style licensing was used for the most user-hostile system in recent time an indictment of that license? You would not see GPL software used for this, for obvious reasons, and people who use GPL should be proud of that.
Bruce Perens.
See subject: Stop it's ability to send info. outward via router port filtering ala ports 16992-16995 that Intel AMT/ME uses so filter those ports in a modem/router external to OS/PC. Intel ME/AMT operates from your mobo but has NO CONTROL OF YOUR MODEM/ROUTER!
(This stops it cold talking in/out permanently OR being able to remotely 'patch' it to use other ports by Intel OR malicious actors/malware makers etc.!)
Additionally, once you disable the AMT engine's software interface (ez via software these articles note)? A malware to 'repatch' this = impossible (bios updaters require it in usermode ware, e.g. ASUS).
(I only allow 80, 8080 & 443 in/out here on a SINGLE stand-alone system (no home LAN but TCP/IP connected online in BOTH my modem or router port filters or software firewalls))
HOWEVER - Be CERTAIN your modem/router's internal ware is "solid" as well (turn off things like UPnP etc. & CHECK router/modem HAS NO KNOWN BACKDOOR EXPLOITS (tons do unfortunately)) - get it patched ASAP if it's KNOWN exploited & TONS of routers, ARE https://it.slashdot.org/comments.pl?sid=9995967&cid=53488785/
* GOOD ROUTERS/MODEMS HAVE PORT FILTERING OPTIONS (crappy ones do not)!
APK
P.S.=> Good luck - it's the BEST EASIEST & CHEAPEST DEFENSE using what you already have (hopefully, again as not ALL modems have port filtering but most do & certainly GOOD ONES DO) vs. this threat by stopping it being able to communicate in/out period, from OUTSIDE of the INTEL chipset external to it via a router/firewall hardware... apk
Seriously, and no joke, chromebooks disable the ME after boot.
Some drink at the fountain of knowledge. Others just gargle.
Irony.
Brought to you by Carl's Junior.
Google is just as or more evil than... Wait. You know what? Fuck attempting to say something clever. I've always been on board with Open Source, yet I have always had my limits on the philosophy. It always seemed to me that the hard line Open Source philosophy wanted hold things back. I get it now. Not just because of this. Hold up and hold back. We are irresponsible with technology and ultimately we are holding back and damaging our species. If a hard line stance on Open Source means holding technology back, hold it back.
Brought to you by Carl's Junior.
Intel is running their software on your CPU, using electricity
which you pay for. If they do not compensate for that, they are essentially
stealing money from you, which is an offense for which they can be held liable in court.
I propose everbody with such a CPU starts sending Intel invoices.
If they do not compensate, a class action law-suit should be started.
UPDATE: Ports 623-625 also filter them - JUST picked that up today (new information apparently, maybe for versions past 5-11.6 Intel AMT/ME have).
APK
P.S.=> An unidentifiable ac (probably a troll harassing me as usual) noted it uses port 80 in his reply to my original post (maybe in the usermode software interface, that's easily removed, but I have not seen news of it being in the MINIX on motherboard chip portion)... apk
https://www.eff.org/deeplinks/...
As the ME is a black box, we still have no idea what ports it uses... We know for sure that it does use those ports listed, but can you prove it doesn't use any others?
Lack of evidence does not prove innocence.
http://spamdecoy.net - free throwaway anonymous email - avoid spam!
hardware built into every PC? Are they going to somehow overwrite the Minix OS? Any side effects?
It's a UNIX system, I know this!
There's no contradiction, we know for sure it uses *some* ports but do not know what other ports it *might* use. Your notion of blocking the known ports is flawed as it may well communicate via other as yet unknown ports.
See subject: Point me to a valid reputable security community source that shows more ports being used than what I listed.
I don't need to prove that more ports are being used, you need to prove that other ports are *NOT* being used in order to validate your claim that filtering at the network layer is effective.
Monitoring in/out communique from router logs external to the PC would tell fact of what ports it used easily beyond Intel's docs.
Monitoring the network traffic only shows the communication that actually takes place, not the communication that *could* take place. We don't know if any circumstances exist in which it could attempt other forms of communication. Sure the network router could log this traffic were it to take place, but we cannot be sure of all the triggers which would make it do so. That also assumes that the device only has wired connectivity, which is connected directly to your networking equipment. If the device has any form of wireless connectivity it could attempt communication with anything that's within range.
Unless we are 100% sure of all the possible network communication the device could perform, and what could potentially trigger it, a blacklist approach at the network gateway can never be truly effective.
We don't know, and a lack of knowledge is dangerous.
http://spamdecoy.net - free throwaway anonymous email - avoid spam!
Which is enabled/disabled in the stage0 bootloader usually, with signing/hashing just like the Intel ME firmware.
The only difference is that the TrustZone stuff runs on ARM cores and may run either on the primary cores, or a dedicated coprocessor depending on the design chosen by the downstream chip designer.
Earlier versions of TrustZone as well as the ARM Java/JVM stuff (I forget what those extensions were called, but they were basically the predecessor to TrustZone) were completely proprietary, required even stricter license to develop or use, and were never enabled for end-user applications. In theory you can install a custom TrustZone kernel on the later implementations, but I am not clear on if that documentation is available outside academia/nda'd commercial settings, and even then 99 percent of ARM devices that support TrustZone will not allow you to install an unsigned or user signed TrustZone kernel, and even on those devices that will, you will lose support for a large variety of applications (gapps and likely widevine support on android) that rely on the vendor key baked into a locked device's image, which your unlocked device will not have available to avoid the risk of you reusing the key to commit piracy or avoid digital rights management restrictions on the code, data, or device.
Are AMD CPUs clear of it?
Has someone got it onto RISC chips?
Has the NSA or other criminals got their hooks into it?
Can it be "zapped" with some xrays like cancer patients?
I'll see your Constitution and raise you a Queen.
For chromebooks where google can't use their own openbios-based stack,
they use heavily modified firmware, where the ME part running on the micro-controller embed in the chipset is reduced to the base minimum necessary to get the chipset running.
Among other, all the juicy bits that are targeted by ME-exploits (half-broken webserver serving as the user-interface, capability to reflash the UEFI/BIOS while the main Intel CPU isn't even powered, VNC-like server with USB-over-network extensions, etc.) are all removed.
(Common, these are *chromebooks*, why to they need tools for Admins doing "lights-out" maintenance ?!?)
In a similar way, the parts of UEFI that run at "negative rings" on the main Intel CPU have also been reduced or removed.
"Sufficiently advanced satire is indistinguishable from reality." - [Tips: 1DrYakQDKCQ6y52z6QbnkxHXAocMZJE61o ]
intel ME isn't on Qualcomm/ARM chips in mobiles that android (linux) runs on, or any of these IoT devices. I'm willing to wager there are more mobile phones in the world than intel ME enabled PCs at this point.
The correct mention would be :
MINIX is the most widely deployed OS on desktops in the world.
But indeed, the desktop themselves are completely dwarfed by the embed world, were Linux seems to be the king.
and linux would be on some AMD x86 systems
BTW, IPMI is the industry standard for "lights-out management" (and Intel ME/AMT is the Intel proprietary "lights-out management").
According to several presentation at conferences :
- lots of IPMI implementation run actually Linux on their embed micro-controller.
(Meaning that even in the server room/cluster/data center, Minix isn't the king it claims to be on the dekstop)
- expect as many GPL-violations and tivoizations as you could imagine
(so no, you can't install Debian on your micro-controller)
- IPMI is just as buggy, broken and exploitable as Intel ME.
(Running a IPMI-enabled server with an Opteron on a Super-micro motherboard, won't save you from exploit. It will just switch you to a different collection of exploits).
"Sufficiently advanced satire is indistinguishable from reality." - [Tips: 1DrYakQDKCQ6y52z6QbnkxHXAocMZJE61o ]
Google has done a great job however Google also has done a good thing on pixel phones and that is their camera clarity.
MINIX is a transparent and nice OS, well suited for this kind of tasks.
Use a power strip. Problem solved.
Not only do we know what ports it could use, it could easily piggyback it's communications on a known port while it's being used. It's code may include anti-circumvention code that in the case it can't communicate with it's home base that it starts trying all available ports including port 80. It's ability to edit packets at transmission.
BB10, not BBOS.
See subject: you routinely fail to understand the point the other person makes, freaks out and attacks them with nonsensical bullshit. Brockmire P.S=> learn to fucking write a comprehensible post. Brockmire
Your program is so fucking simple, if someone actually gave a fuck, they'd just write their own and make it look the same. But I imagine, they'd use one of the many other hosts file aggregator than your shit if they just want the functionality.
Then you better google your program and check the top 10 hits. I know your shit was on a website without malware bytes in the server name just yesterday.
Supposedly we all may have this pretty cool feature built into our processors, that if we can figure out how to get access to it and control it, we can then do lots of cool shit with our computers without even having to turn them on fully. We should set up some kind of public 'bounty' or such, to incentivize and reward the first people to get us a reliable open source toolkit, for taking control of this feature on our processors and putting it to use - and further bounties, for discoveries of externally accessible exploits within this feature (and a super-sized bounty for discovery of deliberate malicious exploits/backdoors built in). There's not just a security-based incentive for giving huge financial rewards here, there's the incentive based on this being an actual really cool feature.
Regardless, intel processors, whether they're purchased individually or on a machine manufactured by the likes of dell, has Intel ME activated from the start. That's the point. Your nitpick is insignificant.