New security hole in Intel HW, boot key combo bypasses security

[cdev]

This is not the same one as the other vulnerabilities. It deserves its own thread.

https://press.f-secure.com/2018/01/12/intel-amt-security-issue-lets-attackers-bypass-login-credentials-in-corporate-laptops/

"The essence of the security issue is that setting a BIOS password, which normally prevents an unauthorized user from booting up the device or making low-level changes to it, does not prevent unauthorized access to the AMT BIOS extension. This allows an attacker access to configure AMT and make remote exploitation possible."

See also http://www.theregister.co.uk/2018/01/12/intel_amt_insecure/

[Whales]

Summary: Intel AMT has its own configuration bios called MEBx.  If your machine has AMT (most home ones don't, it costs more money) then you can access it by pressing Ctrl+P at boot.  Many [citation needed?] companies are not changing the default password for MEBx and you can (sometimes¹) use MEBx to take over a computer.

For practical purposes: this is the same as leaving a BIOS unpassworded.  Allows full control of the machine if you have physical access

¹Personal experience: some MEBx environments present you with very few options, depends how they have been setup.

General commentary
This isn't a fault in AMT.  It's a fault in understanding and education about AMT, which Intel is still of course responsible for.  Your product, your responsibility to tell people about it and make sure it's not being abused.

Nonetheless: how many BIOS password protected computers are using the default AMT password? IMHO that's the only stat that matters, because if you are not passwording your BIOS then you probably don't care about passwording MEBx either.  Eg many work desktop computers, servers, anything that doesn't leave the premises.

Topic title a bit sensationalist?
I think saying that a "boot key combo bypasses security" is misleading.  It suggests that anyone can walk up to an AMT computer, hit a key-combo and take control.

Imagine a similar physical access attack: I boot your computer off my USB stick which I then use to steal files off your HDD or install boot-time keyloggers.  To do this I press F12 on your keyboard during boot (to select the boot options).  Does this mean "boot key combo bypasses security"?  No.

In the attack mentioned in this article: you have to hit Ctrl+P, enter the default password, reconfigure AMT, then do stuff from another computer to remotely manage/control the computer.  Whilst it's easy to perform if you practice it, it's still much more effort than "Press Alt+F4 to enter god mode".

[Jeroen3]

There are so many inherited security flaws you can't even begin to comprehend.
The best way to move forward is with ARM, since that ecosystem started developing with a smaller legacy backpack.

A The best one by far I heard of is Thunderstrike. A brand new developed macbook is flawed by the inherited feature of boot ROM code execution from PCI devices, which happened to be made available outside the enclosure by Thunderbolt. Yeah... a feature from the 1980's.

[Whales]

A The best one by far I heard of is Thunderstrike. A brand new developed macbook is flawed by the inherited feature of boot ROM code execution from PCI devices, which happened to be made available outside the enclosure by Thunderbolt. Yeah... a feature from the 1980's.

That's beautiful.  I wonder how hard it would be to interface an old LAN card boot rom to a Thunderbolt connector.

Unfortunately again: physical access.  You're right about there being a very long list of those.  Ooh there's more to what you linked to than just PCI boot roms

[cdev]

Its scary the way people are so dependent on computers now.

There is a good argument for pulling back from the Internet and computer use, especially for children.

[tooki]

There are so many inherited security flaws you can't even begin to comprehend.
The best way to move forward is with ARM, since that ecosystem started developing with a smaller legacy backpack.

A The best one by far I heard of is Thunderstrike. A brand new developed macbook is flawed by the inherited feature of boot ROM code execution from PCI devices, which happened to be made available outside the enclosure by Thunderbolt. Yeah... a feature from the 1980's.

Of course, that paper was over 2 years ago and much has happened since. Most Macs from the past few years have been patched, and High Sierra apparently verifies the firmware weekly, too.

[fourtytwo42]

Its scary the way people are so dependent on computers now.
There is a good argument for pulling back from the Internet and computer use, especially for children.

Is that like the digital equivelent of going off grid for power ?
I remember before the internet bookshelves groaning under the weight of data books and/or laterly cd's all a bygone age now but I agree we have inherited hacker vulnrabilities as a price!
Guess I have sidestepped some of these issues by using older hardware and software (XP) but seriously beginning to consider Linux...........

[TerraHertz]

I remember before the internet bookshelves groaning under the weight of data books and/or laterly cd's all a bygone age now ...

It's precisely because I've known since the Internet began that networks and PC hardware are not and never will be secure and trustworthy, that I kept all my old paper media. Recent revelations of ridiculous holes (and deliberate backdoors) at all system levels do not surprise me at all.

Back in the 2000s a friend of mine & I got our hands on a Pentium 1 hardware emulator. Plugged it into a standard PC and had a look. The damned PC was spending about 20% of it's CPU cycles running SMM code. (System Management Mode, effectively a separate CPU space with total access to everything.) SMM execution is *completely* invisible to all user, OS software and debuggers. We cut the NMI trace on the motherboard that was regularly throwing the CPU into SMM mode. No more SMM execution. The PC worked exactly as normal. Not a thing different that we could find.
All righty... what was all that SMM code doing? We didn't have a SMM disassembler, or time to pursue it further. But it makes one suspicious.

Then later we got hold of sets of Intel Yellow books, and learned the story behind those. In which NO ONE can design a working Pentium motherboard, without Intel having first vetted their entire design and approved of it. There are critical errors and omissions in the public Intel CPU data books, that make it impossible to design a working system. When your indie design doesn't work you go to Intel for assistance. They analyze your design, and if they like you and what you are doing, you get the yellow books (after your company signs an extremely serious NDA.) Those contain the *real* info.

And there is a deeper-secret-yet set of books, called the Intel Gray Books. Only major manufacturers can get those.

Guess I have sidestepped some of these issues by using older hardware and software (XP) but seriously beginning to consider Linux...........

Switching OS won't make any difference to security at all. The IME (Intel Management Engine) in all recent Intel CPUs is an always-on fully independent system, with it's own entire OS and networking capabilities, and total top-level access to the entire machine. It supposedly runs a version of Minix, of all things. There are also rumors that all Intel CPUs since um... 'Sandy Bridge' from memory, have an entire secret GSM modem built into the silicon. It would not surprise me at all if that's true.

The only way to fix this situation, is to take about 10% of the top management of Intel and Microsoft, and kill them. Give the companies 30 days to open source the entire platform and a year to remove all the spying bullshit, on pain of the next 10% getting the same treatment. And so on.

[IanMacdonald]

Building a remote access system into hardware is just plain stupid. 

However, the main reason for computers being so insecure is the use of the C and C++ programming languages. These have no inherent checks on the length of data input to variables, and the programmer must declare the memory allocation for each. Since everything in a C program (data and instructions) is in a single memory 'heap' that makes for opportunities to overwrite parts of the program with malicious instructions.

Probably the singe greatest blunder the IT industry has ever made was to choose C over Pascal for the IBM PC's system code.

That said, Microsoft come a close second with their million and one ways of making executables launch automatically, and unexpectedly, without requiring any OK from the user.  Latest piece of idiocy in this respect was a feature in Office 365 where clicking a link in an email can encrypt your O365 account data. When will these guys LEARN?

[free_electron]

Its scary the way people are so dependent on computers now.

There is a good argument for pulling back from the Internet and computer use, especially for children.

yeah, it was better when we only had sticks and lived in caves...

[stj]

using public transport and observing around me,

i find it amazing.
probably 60% of the people have a phone out checking email or facescan or twatter etc.

why?
who gives a shit if someone you never met just took a dump or ate a hotdog??
and is that email life & death? - it better not be be, because your stuck on a train! 
and no, your kitten foto is not cute - post a photo of your pussy and i may have other ideas! 

people need to stop this.

btw, i was about 100meters below ground in a metal pipe at the time.
who the hell thought is was a good idea to put a leaky-feeder in the tunnel??

[IanMacdonald]

Yeah. Pedestrians will soon need air horns on their hats to warn the approaching zombie.

[tooki]

Building a remote access system into hardware is just plain stupid. 

Riiiight... ever heard of LOM (lights out management)? This stuff exists for a reason. Just because you don’t need it doesn’t make it stupid.

[fourtytwo42]

I remember before the internet bookshelves groaning under the weight of data books and/or laterly cd's all a bygone age now ...

It's precisely because I've known since the Internet began that networks and PC hardware are not and never will be secure and trustworthy, that I kept all my old paper media. Recent revelations of ridiculous holes (and deliberate backdoors) at all system levels do not surprise me at all.

Back in the 2000s a friend of mine & I got our hands on a Pentium 1 hardware emulator. Plugged it into a standard PC and had a look. The damned PC was spending about 20% of it's CPU cycles running SMM code. (System Management Mode, effectively a separate CPU space with total access to everything.) SMM execution is *completely* invisible to all user, OS software and debuggers. We cut the NMI trace on the motherboard that was regularly throwing the CPU into SMM mode. No more SMM execution. The PC worked exactly as normal. Not a thing different that we could find.
All righty... what was all that SMM code doing? We didn't have a SMM disassembler, or time to pursue it further. But it makes one suspicious.

Then later we got hold of sets of Intel Yellow books, and learned the story behind those. In which NO ONE can design a working Pentium motherboard, without Intel having first vetted their entire design and approved of it. There are critical errors and omissions in the public Intel CPU data books, that make it impossible to design a working system. When your indie design doesn't work you go to Intel for assistance. They analyze your design, and if they like you and what you are doing, you get the yellow books (after your company signs an extremely serious NDA.) Those contain the *real* info.

And there is a deeper-secret-yet set of books, called the Intel Gray Books. Only major manufacturers can get those.

Guess I have sidestepped some of these issues by using older hardware and software (XP) but seriously beginning to consider Linux...........

Switching OS won't make any difference to security at all. The IME (Intel Management Engine) in all recent Intel CPUs is an always-on fully independent system, with it's own entire OS and networking capabilities, and total top-level access to the entire machine. It supposedly runs a version of Minix, of all things. There are also rumors that all Intel CPUs since um... 'Sandy Bridge' from memory, have an entire secret GSM modem built into the silicon. It would not surprise me at all if that's true.

The only way to fix this situation, is to take about 10% of the top management of Intel and Microsoft, and kill them. Give the companies 30 days to open source the entire platform and a year to remove all the spying bullshit, on pain of the next 10% getting the same treatment. And so on.

I can remember wayyyy back in the 80's IBM (who was then a serious mainframe hardware manufacturer) being forced to disclose internal information so others could make compatible products under US anti-trust laws, whatever happened to the laws (not IBM) ?

[Kleinstein]

Form the description the flaw is not a HW problem, but just sloppy PC manufacturers who do not set the PW aor at least inform the users properly that they need to set the PW. So this security hole is very easy to fix - an update to the user manual should be enough.

I agree with the feeling that the security of todays PCs is at a poor state. The system got so complicated with so many extra services to ensure compatibility with old crap stuff and add new hidden features, that it is essentially impossible to have a secure PC. The best one can do is having the system up to date to be not so far behind the bad boys - so only the fasted of the bad boys would have easy access.

However requiring essentially weekly  daily updates to the system is already a big security hole - you get used to the behavior of the PC to change and background HD access at some more or less random times. With so many changes / fixes to the system chances are high to add new holes. If this goes one there might be a point when updates add more security holes than they fix - just new ones that need some time to require the next fix.

[fourtytwo42]

The best one can do is having the system up to date to be not so far behind the bad boys - so only the fasted of the bad boys would have easy access.

However requiring essentially weekly  daily updates to the system is already a big security hole - you get used to the behavior of the PC to change and background HD access at some more or less random times. With so many changes / fixes to the system chances are high to add new holes. If this goes one there might be a point when updates add more security holes than they fix - just new ones that need some time to require the next fix.

I seem to have succeded in the opposite tack, having a system so old the hackers no longer bother with it thinking nobody can still be running such old cr*p! Also I disabled auto updates donkey's years ago of everything, I very rarely update anything and certainly not to the latest bug filled version, let others find out whats wrong with it first Having a solid firewall, a good anti-virus package and never opening suspect mails/pages helps Still not perfect, last virus infection requiring a total rebuild was 2015 and that was from a free download the Anti-virus failed to detect.

[Electro Detective]

The best one can do is having the system up to date to be not so far behind the bad boys - so only the fasted of the bad boys would have easy access.

However requiring essentially weekly  daily updates to the system is already a big security hole - you get used to the behavior of the PC to change and background HD access at some more or less random times. With so many changes / fixes to the system chances are high to add new holes. If this goes one there might be a point when updates add more security holes than they fix - just new ones that need some time to require the next fix.

I seem to have succeded in the opposite tack, having a system so old the hackers no longer bother with it thinking nobody can still be running such old cr*p! Also I disabled auto updates donkey's years ago of everything, I very rarely update anything and certainly not to the latest bug filled version, let others find out whats wrong with it first Having a solid firewall, a good anti-virus package and never opening suspect mails/pages helps Still not perfect, last virus infection requiring a total rebuild was 2015 and that was from a free download the Anti-virus failed to detect.

You're not alone nor lucky, it's the only way to go when you sit down and evaluate it all    
I sort of roll this way too after having lost 'faith' in the system years ago, which must be feeding some kind of ludicrous over-servicing industry,
rather than genuine 'computing' and 'paper conservation' marketing BS for the masses and business 

I feel pity for the phone addicts, their souls are trapped 24/7/365 in those childish data mining Ball and Chain styled devices, which they are clueless about,
much less understand the pretentious 'social media' sites that have them well and truly gimped 

 

[TerraHertz]

20171106
https://www.networkworld.com/article/3236064/servers/minix-the-most-popular-os-in-the-world-thanks-to-intel.html
MINIX — The most popular OS in the world, thanks to Intel
You might not know it, but inside your Intel system, you have an operating system running in addition to your main OS, MINIX. And it’s raising eyebrows and concerns.

20171108
http://www.zdnet.com/article/minix-intels-hidden-in-chip-operating-system/
MINIX: ?Intel's hidden in-chip operating system
Buried deep inside your computer's Intel chip is the MINIX operating system and a software stack, which includes networking and a web server. It's slow, hard to get at, and insecure as insecure can be.



Still looking for the original source of the gif below re the IME.
Earliest so far:
twitter.com  Filename: C7my_J_WsAEfZP1.jpg  Found on: hashtag/DarkMatter   Page crawled on Mar 24, 2017

[stj]

it's supposed to have originated in an internal intel forum.

[Electro Detective]

Looks like I'll be sticking to AMD PCs for another 10 years      tried AMD ages ago and they do the business just as well as over marketed !ntel

If the gamers reckon they rock, I'm with them    and I'm no gamer

AMD kicked off x64 in the first place, and most likely in front as far as innovations go,

who are !ntel trying to roll with their techn0 BS on 'inspired' designs ?