Intel vPro CPUs have a web server open

https://mastodon.lilysthings.org/@i_lost_my_bagel/112228352384742242

by pixiemaster • 2 years ago

66 22 2 years ago

mastodon.lilysthings.org

ram_rattle• 2 years ago

can someone help understand why this is there and perhaps what threat it introduces.

tyingq• 2 years ago

The vpro cpus include things like AMT (Active Management Technology), which is similar to IPMI. A way to remotely manage the device even if it's not booted yet.

The internal web server shown here lets you configure AMT, disable it if you wish, etc.

aesh2Xa1• 2 years ago

The Intel Management Engine is part of the CPU, and it's there for remote management of a system so you can do things like control power on/off or configure the BIOS from over the network.

https://en.wikipedia.org/wiki/Intel_Active_Management_Techno...

https://www.meshcommander.com/

monocasa• 2 years ago

It's a remote console to the management engine for "lights out management" or remotely being able to to what a hardware tech would generally need physical access for like accessing the preboot environment.

It's bad if you don't know it's on because it lets you remotely access pieces of the computer you normally need physical access for like accessing the preboot environment.

holowoodman3• 2 years ago

Remote management.

The CPU/chipset has an integrated keyboard/video/mouse (via VNC), serial console, power control (on/off) and some settings exposed via this webserver over some kind of XMLRPC.

It is activated either by configuring it locally through the BIOS or some special key combination at boot, or when connecting to a network that has a setup server with a special certificate (not really a security feature, just a money grab) present. Some vendors might also ship it always-on. Network can be either wired or WiFi, not sure about mobile networks.

The threat is extreme, hidden remote access, several known vulnerabilities in the past in e.g. the broken XML parser, activation and takeover via brief physical access at boot (press the magic key, set username and password, boom, it is not your machine anymore) or connecting to a network with a magic setup server and certificate (corporate WiFi might do this accidentially to your machine). No good consistent and easy way to deactivate or prevent, it is different for each generation and vendor unfortunately, if at all possible.

kllrnohj4• 2 years ago

No good way to deactivate or prevent.

Eh? https://software.intel.com/sites/manageability/AMT_Implement...

jstanley• 2 years ago

But if it's on localhost, how does the management engine get a chance to reply?

Are you sure you're not actually talking to some Windows service?

EDIT: From reading further in the Twitter thread, it is indeed a Windows service you're talking to.

holowoodman3• 2 years ago

localhost:16992 is just the windows service redirecting port 16992 from the ethernet/WiFi interfaces. It actually listens on your external interfaces by sniffing DHCP packets and grabbing all connections on port 16992.

dhx• 2 years ago

For Linux, one has to build and enable the "mei" kernel driver[1] and then install the user-mode daemon "Intel Local Manageability Service"[2].

[1] https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/lin...

[2] https://github.com/intel/lms

yencabulator• 2 years ago

To enable it locally.

If it's already enabled, the management engine is a separate computer tapping your network connection, no software install needed.

ta988• 2 years ago

Nitpick, it is not twitter it is Mastodon.

kllrnohj4• 2 years ago

This is literally an above-the-fold advertised feature of vPro:

Remote Manageability
Remotely power up, update, and repair PCs outside of the firewall, even if they’re out-of-band1, to help your users from virtually anywhere.

https://www.intel.com/content/www/us/en/now/itheroes.html

With features like hardware-level remote keyboard, video, and mouse control (KVM)1 3 Intel AMT allows you to discover, repair, and help protect networked computing assets as easily as if working in person.

https://www.intel.com/content/www/us/en/architecture-and-tec...

Morale of the story here seems to be to actually bother to spend 5 seconds figuring out what you bought?

cqqxo4zV46cp• 2 years ago

No. Nerds love to hate any notion of their hardware spying on them, especially if it’s Intel. Computers need to work exactly as they did in 2004. But let’s also ignore the management functionality we had in ‘04 :)

Timshel• 2 years ago

Features are advertised, but I don't see any mention of the server itself.

Instead of aimlessly searching the doc if you know it exists you can just search for it and find some documentation which appear way more interesting: https://software.intel.com/sites/manageability/AMT_Implement...

And the author is quite happy with the feature, appeared he just wanted to advertise it:

yeah... I will say though. I used this laptop as a server for a bit and it was so so useful.

kllrnohj4• 2 years ago

but I don't see any mention of the server itself.

I mean how else does any remote management solution work? This is no different than IPMI?

sebazzz• 2 years ago

I've yet to find a company also using the vPro feature set.

kstenerud• 2 years ago

Yup. I used that feature for many years to remote manage a file server at my folks place. Works great! Just don't expose it directly to the outside world.

Nowadays I'd probably turn it off and use pikvm instead, though.

oefrha• 2 years ago

No shit, AMT is literally the point of vPro. Why present it as some sort of conspiracy? Don’t buy enterprise hardware if you don’t like the enterprise features, I guess.

Intel vPro CPUs have a web server open

Related Stories