Secrets of Intel Management Engine – Hidden code in your chipset

http://www.slideshare.net/codeblue_jp/igor-skochinsky-enpub

by mmastrac • 12 years ago

154 61 12 years ago

slideshare.net

jesrui• 12 years ago

Slides can be downloaded without registration at http://recon.cx/2014/slides/Recon%202014%20Skochinsky.pdf

jcr• 12 years ago

The video of Igor's talk at Recon 2014 is here:

https://www.youtube.com/watch?v=Y2_-VXz9E-w

ollybee• 12 years ago

My second thought on reading this was how can a server be PCI compliant with Intel management engine installed? but a quick search shows that Intel have thought of this: http://www.intel.co.uk/content/dam/www/public/us/en/document...

My first thought was that it seems increasingly clear that Stallman has been right all along.

morganvachon8• 12 years ago

My first thought was that it seems increasingly clear that Stallman has been right all along.

The problem is that being philosophically right doesn't always mean being practically right. In order to create the perfect Stallman-esque machine, one would have to design everything from the logic chips up from scratch, because in the end, no third party can be trusted. He says this himself about the Loongson system he uses daily; he considers it a compromise but one heavily weighted in his favor.

In short, Stallman has been right all along, but there's little we can do about it from a practical standpoint.

throwaway2048• 12 years ago

We can certainly do a lot better than this, an attitude of "unless its perfect its futile to even try" is defeatist bullshit, and not what Stallman endorses at all.

pakled_engineer• 12 years ago

rms doesn't have the Loongson netbook anymore, he rolls with a Gluglug X60 now I believe.

gaius• 12 years ago

one would have to design everything from the logic chips up from scratch

You mean like http://www.greenarraychips.com/home/products/index.html ?

Stallman's endorsement of Chinese hardware illustrates tho' that he values software freedom over, y'know, political freedom, which puts him on dodgy ground IMHO.

sedachv3• 12 years ago

The problem is that being philosophically right doesn't always mean being practically right.

"Practical" is a code word people use to mean whatever is convenient for them or is on their agenda. You can use the argument "that's just not practical!" with whatever evidence you can come up with as an objection to almost anything, which makes it a poor argument. That's why we need unambiguous and objective philosophical positions to make decisions in specific circumstances.

What you're really saying is that working against the development of surveillance and control technologies by private capital and government decision makers is hard and so is not "practical."

astrange2• 12 years ago

Why would the newest version of the ME use SPARC ISA? Does someone out there need register windows?

lambda3• 12 years ago

Where did everyone get SPARC from? The slides clearly say ARC, not SPARC.

cm35• 12 years ago

slide 16 and 50

wiml2• 12 years ago

Different versions of this slideshow have different information. The table titled "ME Core Evolution" (slide 15/16), for example, shows two generations in the version on slideshare, but three generations in the PDF on recon.cx. There is also more discussion of the SPARC architecture in the PDF version.

I did wonder if SPARC refers to the Sun architecture, or if it's an evolution of ARC that simply collides with the other name. He doesn't mention having successfully disassembled any of the BayTrail/TXE versions' firmware yet.

userbinator2• 12 years ago

Wow. SPARC and Java, two things you wouldn't ever expect Intel hardware to ship with! The mention of SOAP-based protocols is also rather surprising, since they have rather high overhead, and this means ME is not just a little 8051-class MCU but almost a fully-featured PC itself...

The amount of complexity - and the opportunities to hide things in that - has increased so much compared to earlier PCs that in some ways I think the development of computer systems is headed on a rather treacherous path. When systems are so complex that no single person can understand them entirely, it's easier to make them behave against their owner's will.

walterbell• 12 years ago

Do fewer people know how to write SPARC shellcode than x86?

nine_k• 12 years ago

Fortunately, a number of non-PC systems exist (one is probably in your pocket).

lambda3• 12 years ago

Not SPARC, ARC: https://en.wikipedia.org/wiki/ARC_International

calvin_• 12 years ago

actually, also SPARC

Maakuth2• 12 years ago

What, SPARC and Java in Intel motherboards? Is this some elaborate gag on Sun/Oracle? I hope they'll demo it by running Solaris there for good measure.

lambda3• 12 years ago

ARC, not SPARC. Did the title on HN say "SPARC" originally or something? Because the slides never mentions SPARC, they discuss ARC, an embedded ISA.

Maakuth2• 12 years ago

Somewhat different set of slides[1] was linked in the comments here, it appears the latest chipsets uses SPARC indeed. 1: http://recon.cx/2014/slides/Recon%202014%20Skochinsky.pdf

icarusmad• 12 years ago

ARC[1], not SPARC. It evolved from the SuperFX chip used in some SNES games.

[1] http://en.wikipedia.org/wiki/ARC_International

userbinator2• 12 years ago

The earlier ME versions used an ARC. The later ones use a SPARC.

Look at slide 50.

tedunangst• 12 years ago

Slide 50 just says "Questions?"

edmccard• 12 years ago

Slide 16 says that ME v1.x used an ARCTangent-A4 and that ME v2.x uses an ARC 600.

wiml2• 12 years ago

Take a look at the PDF version on recon.cx linked by jesrui— it's substantially different from the slideshare version in a few places, notably that it talks about a third generation (Bay Trail TXE) which uses SPARC and drops the pesky Huffman coder entirely in favor of LZMA.

WhitneyLand• 12 years ago

tldr: Intel's remote management capabilities are obscurely baked into every chipset. The ME has out of band access to the network card and main memory. Since ME also has its own flashable memory in principle a machine could be compromised in a nearly undetectable way. The presentation shows that a lot of interesting details of ME have been brought to light but it has also withstood a first round of attacks. No rootkit has yet been shown to be practical.

logicallee• 12 years ago

what an unlikely coincidence. amazing what nature can come up with without any sort of plan or guidance. :)

bhouston• 12 years ago

It just has to be a matter of time until it is cracked. I am surprised Intel did this.

razster• 12 years ago

My guess is that this was requested and passed by without fully understanding the consequences.

cfrantz2• 12 years ago

I believe it has already been cracked. See "Persistent, Stealthy, Remote-controlled Dedicated Hardware Malware" from 30c3: https://www.youtube.com/watch?v=Ck8bIjAUJgE

venomsnake2• 12 years ago

Lets just hope that intel security teams are better than Sony Pictures' ones.

After the sony hack ... lets say that I feel less secure about anything.

pekk• 12 years ago

What was exceptional about the Sony hack? Lots of companies have been owned due to various oversights.

pdkl95• 12 years ago

"Can be active even when the system is hibernating or turned off (but connected to mains)"

On top of the security issues, it seems Intel owes a lot of people some reimbursements for their share of the power bill. Unfortunately, I suspect this theft of electricity will be quietly swept under the rug and forgotten about.

cm35• 12 years ago

Is it part of vPro or available in every cpu? Can it be disabled like TSX?

pgeorgi5• 12 years ago

The ME is on _every_ CPU, and you can't easily disable it (there are ways, but it's unclear how much really shuts down, and you might lose power management features).

vPro is merely the larger ME firmware: The small one is 1.5-2MB, the vPro one is 5-7. A non-vPro mainboard probably comes without a SOAP-capable webserver (although I wonder what they need 1.5MB of code for), but the chip to run it is all there.

cm35• 12 years ago

Oh no. I thought I could select the right chip like you can do to dodge TSX and HT.

What if I get an AMD CPU? Do those also have an IPMI in disguise inside the CPU package wired to a network interface?

sounds• 12 years ago

The real question is, what happens if you flash a custom BIOS that just ignores the ME?

Intel chips up to (I think) 2006 would happily boot without the ME enabled ("ME optional").

Intel's newer chipsets have a watchdog in the ME hardware which will reset the main CPU if the ME is not initialized by the BIOS ("ME mandatory").

Combined with the as-of-yet unbroken RSA signature on any ME firmware, this has some pretty astounding implications.

wyager• 12 years ago

Wikipedia article: http://en.wikipedia.org/wiki/Intel_Active_Management_Technol...

It's absolutely horrifying. There's no way this is secure.

gweinberg• 12 years ago

My last few computers have used AMD chips. I think I will stick with those.

cm35• 12 years ago

As noted in another comment AMD has something similar.

Secrets of Intel Management Engine – Hidden code in your chipset

Related Stories