If you have a computer with an Intel processor that’s newer than about 2007, odds are high that it also contains a mystery software package known as the Intel Management Engine (ME). The ME has complete access to the computer below the operating system and can access a network, the computer’s memory, and many other parts of the computer even when the computer is powered down. If you’re thinking that this seems like an incredible security vulnerability then you’re not alone, and a team at Black Hat Europe 2017 has demonstrated yet another flaw in this black box (PDF), allowing arbitrary code execution and bypassing many of the known ME protections.
[Mark Ermolov] and [Maxim Goryachy] are the two-man team that discovered this exploit, only the second of its kind in the 12 years that the ME has been deployed. Luckily, this exploit can’t be taken advantage of (yet) unless an attacker has physical access to the device. Intel’s firmware upgrades also do not solve the problem because the patches still allow for use of older versions of the ME. [Mark] and [Maxim] speculate in their presentation that this might be fixed on the next version of the ME, but also note that these security vulnerabilities would disappear if Intel would stop shipping processors with the ME.
We won’t hold our breath on Intel doing the right thing by eliminating the ME, though. It’s only a matter of time before someone discovers a zero-day (if they haven’t already, there’s no way to know) which could cripple pretty much every computer built within the last ten years. If you’re OK with using legacy hardware, though, it is possible to eliminate the management engine and have a computer that doesn’t have crippling security vulnerabilities built into it. This post was even written from one. Good luck doing anything more resource-intensive with it, though.
Not to state the obvious– an ‘Intel’ fan myself– But I’m presuming also this applies only to Intel (not x86 generally), so rather than going ‘stone age’, buy AMD (?)
Dosn’t AMD have a similar black box processor?
Well that’s what I am not sure about– I’ve only read about the ME as far as I can remember at least on this site… Why I am asking I guess.
Ah, okay. I guess they do (TrustZone). I stand corrected.
http://www.amd.com/en-us/innovations/software-technologies/security
Not quite. The purpose of the AMD co-processor is for security, sort of like having a TPM built into your CPU (primarily key storage). It is NOT for management (from what I understand), and being made for security means that making it hard-to-hack is really high up on the priority list. Also, I think that this processor is only powered up when the main CPU is.
Given this, probably the largest security hole is having your keys stolen, but this is probably safer than the Microsoft software TPM shipping with Windows.
TrustZone is an ARM thing, not an AMD thing. One of the use cases is to behave in a similar fashion to a HSM [1] so it’s unsurprising AMD use it as a TPM replacement.
Oddly enough you’ll find ARM, a TrustZone TEE[2] vendor, and a HSM[1] manufacturer all in Cambridge UK – two of which are sat on the same street, and until recently next door neighbours.
HSM: https://en.wikipedia.org/wiki/Hardware_security_module
TEE: https://en.wikipedia.org/wiki/Trusted_execution_environment
AMD’s version of this technology is the Platform Security Processor (PSP). It’s pretty much the same thing and has the same problem as being an attack vector, but it’s newer technology and haven’t been explored as much yet.
AMD is rumored to allow users to disable it with upcoming bios revisions. Possibly triggered by the recent Intel compromised equivalent. https://www.phoronix.com/scan.php?page=news_item&px=AMD-PSP-Disable-Option
While for me that’s sensible more than enough, I’m sure there’s a subset of users that won’t be happy unless you can permanently disable it somehow. Most Intel M.E. hacks need ring0 access to work, if you’re getting that, writing to the BIOS and enabling it is just as easy. Or even better, modify the BIOS to not actually disable it.
The Geode LX-800 in my router should be safe. With that, hopefully it should be possible to restrict what the ME might be able to talk to.
The ME processor itself is probably more powerful than your Geode processor.
It’s not about power… it’s about communication.
Why is Intel the sole receiver of this ire? The idea of companion processors that can access the main system is not new to the ME. There are SOCs with similar management processors and I’m not seeing articles railing against them every few months.
The companion processor with system access isn’t even new to the x86 platform, find a server worth the name without a BMC. The majority of these will be a member of the Pilot family of BMCs. They have network access (often on a shared NIC port so they get network when the ma inboard does) and has lots of system access too. For example, there was a company trying to sell my last company was investigating the idea of debugging the host CPU via a BMC.
But I don’t see articles every few months about Pilot BMCs.
Why is this single thing such a flash point issue? There are so many similar systems out there with the same potentalfor total system control.
The best technical reasons I can think of is that there are so many PCs out there, and the ecosystem has become very homogeneous (almost a mono-culture now). But there seems to be this general feeling of loss, like the ME represents how the PC has become a closed ecosystem, that is is becoming just another device.
Research is good, but I’d like demos rather than doomsday scenarios.
If this really is mourning how for nearly the last decade PCs have almost exclusively been the domain of Intel, then I have some thoughts on that as well.
I will say this is one of the better presentations on ME security I have seen with an actual demo and is a well done presentation. I look forward to watching how this one develops.
I imagine the past few years of security fails, and privacy, what’s that, has something to do with the backlash. Problem is all of it’s reactionary, rather than pro-active, we should have done at the start. Basically horse has left barn, and we’re closing the doors on a burning building.
you haven’t been reading the body of the articles just the headlines or don’t understand the difference between an add on management engine chip/module and one embedded in the cpu that is enabled by default.
the add on management engine chips sit outside the cpu and talk to it like a peripheral attached to the pci/pci-e bus. said cpu is still in charge and software running can still detect changes made by external management engine. for instance an anti-virus package could pick up on memory contents being changed
the me inside intel cpus ships enabled, isn’t well understood by the masses, and can affect running code to such an extent that it may be possible that it has already been compromised in roughly 60% off all computers out there and it still may be unnoticed even knowing to look for it.
it’s a big deal
AMD has an equivalently horrible system too. Maybe the best we can hope for is a new PowerPC.
That’s a thing actually, https://www.raptorcs.com/TALOSII/
It is of course extremely expensive. Not that I’m saying Raptor are ripping people off, they have limited volume and have to profit somehow.
Heh. Even the screwdriver is “pre-order acceptance”.
It’s nice to see a company up at the high-end of performance still doing stuff like that, POWERPC CPUs and motherboards that look like they’re competitive with x86 stuff. Didn’t some genius a while back invent a recompiler that could port object code between different instruction sets with near-native performance? That would, theoretically, mean an end to software incompatibility! We could finally prise off the last couple of fingers that x86’s zombie corpse still has clutched round our ankles.
It’d be nice to think the world has room for more than one architecture. There used to be dozens of mainstream CPUs in the 8 and 16-bit days. Actually the 8086 was probably the last one anyone would have picked for a winner.
Actually with FPGA fabric creeping towards CPUs, a future CPU might just be a few banks of registers, a few ALUs, some bits and pieces to set up into vector calculations, and field-programmable routing and main logic. A program could define the CPU it wants to run on as it goes. If it turns out there’s no registers left spare, you could either have that task wait for one, or throw an exception and let the OS emulate it. Same way virtual memory works for RAM, or virtual anything works, within the CPU itself.
So yeah, let’s have that. Someone go invent what I just said.
Perhaps some genius did, but if he tried to patent the implementation, the NSA may have seized the patent for national security reasons, so it never reached market. After the Snowden disclosures, how can people be so trusting of those who have lied to them again and again?
I’d suggest the Cell CPU but Sony smothered that beautiful bit of work behind IBM’s back by turning off OtherOS. It WAS a fantastic PPC based architecture aiming to someday knock x86 off it’s high horse, especially after haven proven itself an excellent multipurpose computational chip in college and military applications, the birthing grounds of reliable technology.
“… mystery software package …”
Not so mystery, as we know a good deal about it, and the problem is the hardware, the software is what someone would replace by exploiting it :-)
“Luckily, this exploit can’t be taken advantage of (yet) unless an attacker has physical access to the device.”
Hmmm, I wonder what other things people could do?
” [Mark] and [Maxim] speculate in their presentation that this might be fixed on the next version of the ME, but also note that these security vulnerabilities would disappear if Intel would stop shipping processors with the ME.”
Quick! Back to IMPI.
“If you’re OK with using legacy hardware, though, it is possible to eliminate the management engine and have a computer that doesn’t have crippling security vulnerabilities built into it.”
I have one machine with Libreboot, but I will probably switch to Coreboot because of this bug as it hadn’t been even answered to in 3 months:
https://notabug.org/libreboot/libreboot/issues/286
What about Pentium IV ? Does it have ME ?
Yes, it has YOU!
Good one. I should have said ‘ IME ‘
Not a fan of IME here, but doesn’t any security concept assumes that the attacker doesn’t have physical access to the attacked machine?
Once you have physical access to a machine, any protection can be defeated.
>Once you have physical access to a machine, any protection can be defeated.
If that were true, there wouldn’t be any closed-source video blobs and the IME wouldn’t be a problem.
It was true back when a computer needed dozens of chips, each one connected over a simple open bus. But that’s not been the case for a long time.
You could have, for example, an encrypted hard drive, on your desk from now til the end of time, if they’ve done their job properly you’re not going to get any data off it.
Yes, and then we have all these hacking conferences where it’s revealed most don’t.
This is quite true. So far the IME hacks require very obvious physical access to the machine. Not something you can get away with in a secure compute facility without attractive armed security response.
Call me when they can hack in remotely. That will be more impressive. Right now they are at the stage of a teenage carjacker armed with a brick and screwdriver.
I know what cheeses me off about the ME, it’s the fact that its hardware and software are not documented and users are not free to disable it that bothers me. Non-integrated systems (or systems that are integrated but can be disabled by strapping or jumper settings) can be opted out of). They have made the ME both sticky and secret to a degree that doesn’t make sense to me unless they have some ulterior motive. Could a back door placed by or on behalf of a three letter agency let them export something that would previously not been allowed? Could they be harvesting data on the instruction sequences being run? If a similar interface to the PEBS performance monitoring capability was available from the management engine side it wouldn’t be hard to skim private keys for example… The part that is hard to swallow is the fact that we don’t have any reasonable way of knowing what this processor is up to. For all the talk of trusted computing, they demand we trust them and explicitly do not allow us end users to set our own rules with regard to what entities we trust or not, nor do they allow the systems we buy to trust us OVER them. The root of the issue is that they are not exhibiting the openness or good faith that can earn the level of trust they are unconditionally reserving for themselves.
There isn’t a major Silicon Valley company that isn’t connected to the NSA/FBI. Google, Facebook and Apple are all part of the surveillance state apparatus in some manner and have back doors in their products.
I find it amusing that some geeks get worried about Intel’s ME, yet have no qualms about carrying and using cell phones which can track them and driving late model cars with built in tracking devices. Video games with voice activation. Echo and Alexa which are connected to the net and designed to listen in on people talking. Folks this is Orwell’s nightmare come true and you folks love it.
For some handwavey “you” perhaps.
QVC-Amazon tv stick comes with Alexa microphone built into the remote.
The remote has some odd looking pieces hidden behind a set of holes in 2 of the slots for the battery cover tabs.
Seems a really strange place to put heat sinks…IF that’s what they are??
I can’t imagine a remote that’s powered by a pair of “AAA” cells needing a set of hidden heat sinks.
The “I fixed it” web site didn’t have a teardown of that particular version of the remote.
It will be at least a week before I can get back here with any (exterior only, no teardown option) photos of it.
The old POCSAG pager is safe and one way.
Include this functionality on a phone and include software to instantly call back a paged number in additon to receiving text pages and you have nearly the connectivity of a normal cell phone but with the opt out on activating power to the cellular telephone modem.
We can have this, easily and cheaply, but we have to design ourselves it into a descent phone before it will leverage competition.
How long before we see these things integrated into ATTinys?
At least on the older chipsets, the DisplayPort lanes were managed by the PCH (Protected video path?… if not signed then blank screen?) amongst other display technologies.
That would mean it would be SUPER COOL to implement a demo where there is no CPU in the socket on the Motherboard and yet still display awesome visuals or a complete GUI+OS stack!
Assuming all that can fit into the limited local RAM inside the IME environment as the main RAM cannot be accessed due to physical isolation via the main CPU module not being in the socket.
I’m thinking of the ATMEL demo-sceners, think 1KB challenge and the other loads with so little type MCU challenges.
Maybe, with the file overflow exploit as the code entry point, Hackaday could offer some huge prize for someone whom achieves such a “CPU-less” demo using only the management engine (8D)
… I’m somewhat aroused by this idea
No gifs please.
Great idea there sir!
This should be made an official challenge.
Awesome, Hackaday, Make this challenge a reality!
This will cause a bit of a riot in Chipzilla, some job cuts and someone with an ear full.
Intels i-series, AMDs Ryzen, Nintendos Wii, Sonys PS4, Microsofts Xbox One & even the Raspberry Pi..
All of them have an “extra” core running closed source blobs, that can control all the other cores.
Intel: ARC or Quark, Raspberry Pi: Videocore4 and the rest of them a variant of ARM.
To get any of these extra cores to display anything on the screen without closedsource blobs, would be a challenge!
Intel could decide in a future processor to use IME as a product line diversification point. In this scenario business models would have the IME enabled, as they actually want the thing, and consumer models could have it fused off, probably paired with features like multiplier unlocking. The fact they didn’t find a way to make business people pay for a purely large-corporate-install feature is kinda stupid on their part.
Pardon my dumb, but is this OS dependent? As in, I’m running a Linux distro, no version of Windows in it at all.
It’s there even before your BIOS/UEFI is active. Even if you installed MS-DOS you’d still have this little Unix-based kernel running in the background.
I wouldn’t mind having it hacked wide open and start writing and installing apps into it. Why bother installing Linux or Windows if your CPU already has a perfectly reasonable operating system in firmware. ;-)
Thank you for the straight answer, I was afraid I’d get three hundred and eighty two smart@ss answers.
It’s not a hack that’s needed but a completely self protected (as per) rewrite. Using the same tricks as the original firmware. From comments by those who de-compiled it, it is poorly written 32 bit code that needs to go open source.
There’s a back door key to kill/control machines via the internet for war time use. Israel has Intel. Doesn’t take a genius to figure out the name.
Military, government… and secure work places all have their bios’ reflashed. This is already public knowledge.
War is a profit making venture for the few. Accomplished by taxpayers, labour and the lives of our children.
Here we spend a small fortune on a mother board and with our money they take advantage of us.
“There’s a back door key to kill/control machines via the internet for war time use.”
Wait what? so in the event of war, murica will force intel to mine eth on all our cpu’s to fund the war? :P
Newer AMD chips have ARM co-processors that do pretty much the same thing. They borrow TEE OS design from Android even..
How does this work “even if the computer is powered down”?
Normally a computer is not completely powered down but has 5V standby power from the PSU if this is not switched off by hard power switch or externally. This can deliver normally 2A for wake up by USB keyboards/mice or wake on LAN, etc 5V/2A runs a whole Raspberry Pi, etc., a typical smartphone needs less power.