Slashdot Mirror

← Back to Stories (view on slashdot.org)

Intel: We've Found Severe Bugs in Secretive Management Engine, Affecting Millions (zdnet.com)

Posted by msmash on from the security-woes dept.

Liam Tung, writing for ZDNet: Thanks to an investigation by third-party researchers into Intel's hidden firmware in certain chips, Intel decided to audit its firmware and on Monday confirmed it had found 11 severe bugs that affect millions of computers and servers. The flaws affect Management Engine (ME), Trusted Execution Engine (TXE), and Server Platform Services (SPS). Intel discovered the bugs after Maxim Goryachy and Mark Ermolov from security firm Positive Technologies found a critical vulnerability in the ME firmware that Intel now says would allow an attacker with local access to execute arbitrary code. The researchers in August published details about a secret avenue that the US government can use to disable ME, which is not available to the public. Intel ME has been a source of concern for security-minded users, in part because only Intel can inspect the firmware, yet many researchers suspected the powerful subsystem had bugs that were ripe for abuse by attackers.

9 of 207 comments (clear)

  1. Further proof by WoodstockJeff · · Score: 5, Insightful

    of how well "security by obscurity" works.

    1. Re:Further proof by zifn4b · · Score: 5, Insightful

      It works just fine until some fucking idiot blabs

      It's your thinking that is "fucking idiocy". It doesn't require someone to "blab", it requires a savvy hacker to discover it and that's precisely why you shouldn't do it because it's not good security practice.

      --
      We'll make great pets
    2. Re: Further proof by DontBeAMoran · · Score: 4, Insightful

      When most people say "Security by obscurity" they mean "there's no door in the fucking doorway", not "there's a lock that can be picked on the door in the fucking doorway".

      --
      #DeleteFacebook
    3. Re:Further proof by Aaden42 · · Score: 4, Insightful

      The only people who think they're idiots for blabbing are the hackers and governments (what's the difference again? I keep forgetting.) who have been exploiting these bugs/back doors to their own gain. Just because you're just hearing about the bugs doesn't mean they haven't been known and used by others for years.

    4. Re: Further proof by gweihir · · Score: 3, Insightful

      Credentials, crypto-keys, etc. are explicitly _not_ "security by obscurity". You just demonstrated extreme incompetence.

      Look up "Kerckhoffs's principle" some time to at least get a minimal clue.

      --
      Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
    5. Re: Further proof by Ashtead · · Score: 3, Insightful

      This ME thing is like a door on the back of the house. It is painted so as to not be easy to tell apart from the wall, but it is not impossible to discover. And it even has a lock, with a key that has a funny and strange shape.

      And this backdoor is present on every house on the street. And although the key is of an obscure and not readily available design, it is the same one for all these houses. So once you find out how to open up one of these doors, opening any of the others on all the neighbors' houses from the same manufacturer iis easy, with the knowledge of the design of this key.

      Some other houses may have been made by a different manufacturer. Some of these have similar doors with a different key that works on all of them, in much the same way. Then there are still a number of houses that are either too old, or made by a manufacturer that doesn't include this back door.

      Point is, once the presence and nature of the back-door and its lock are known, the house is wide open, and security by obscurity has failed.

      --
      SIGBUS @ NO-07.308
    6. Re:Further proof by MangoCats · · Score: 3, Insightful

      But, are you privy to the government deals which have been brokered to leave these flaws in the mass market chips?

      Oftentimes, willfully malign is a signpost for covertly compensated.

  2. Going out on a limb here.... by Luthair · · Score: 3, Insightful

    Going out on a limb here.... while Intel claims the problems affect the 6th, 7th, and 8th gen processors, I bet they probably didn't bother testing or auditing earlier systems. Hasn't ME been around much longer than that?

    Really, this ought to be factory disabled by OEMs and only shipped enabled to large corporate customers.

  3. Let me guess... by jonr · · Score: 3, Insightful

    ...and very difficult to patch?