[es] - I.. konacno se desilo i to: Remote execution rupetina u Intel ME-u

nkrgovic
Nikola Krgović
Beograd

Član broj: 3534
Poruke: 2807

ICQ: 49345867
Sajt: https://www.twinstarsyste..

+655 Profil

Re: I.. konacno se desilo i to: Remote execution rupetina u Intel ME-u

^{05.05.2017. u 08:51 - pre 84 meseci}

Brate, taj Putin... sad i Verilog zna da radi.... Sta ti je covek, gromada!

BTW, ja sam zagledao ovo vec neko vreme:

https://www.raptorengineering.com/TALOS/prerelease.php

malo i pojasnjenja:

http://www.phoronix.com/scan.p...em=talos-workstation&num=1

Please do not feed the Trolls!

Blasphemy? How can I blaspheme? I'm a god!'

Odgovor na temu

Ivan Dimkovic

Administrator
Član broj: 13
Poruke: 16687
*.web.vodafone.de.

+7173 Profil

Re: I.. konacno se desilo i to: Remote execution rupetina u Intel ME-u

^{05.05.2017. u 09:37 - pre 84 meseci}

@Space Beer,

Puno srece sa modernim ARM cipova bez TrustZone-a i proprietary bootloadera koji se inivijalizuju sa nekog malog "radio" procesora.

DigiCortex (ex. SpikeFun) - Cortical Neural Network Simulator:
http://www.digicortex.net/node/1 Videos: http://www.digicortex.net/node/17 Gallery: http://www.digicortex.net/node/25
PowerMonkey - Redyce CPU Power Waste and gain performance! - https://github.com/psyq321/PowerMonkey

Odgovor na temu

Ivan Dimkovic

Administrator
Član broj: 13
Poruke: 16687
*.ip.telfort.nl.

+7173 Profil

Re: I.. konacno se desilo i to: Remote execution rupetina u Intel ME-u

^{07.05.2017. u 11:35 - pre 84 meseci}

Btw, Lenovo W541 laptop - cak i ako se u BIOS-u uradi "Permanently disable" za AMT, Intel-ova alatka za detekciju bug-a kaze da je sistem je i dalje supalj:

Citat:

Risk Assessment

Based on the version of the ME, the System is Vulnerable.

If Vulnerable, contact your OEM for support and remediation of this system.
For more information, refer to CVE-2017-5689 at: https://nvd.nist.gov/vuln/detail/CVE-2017-5689 or the Intel security advisory Intel-SA-00075 at: https://security-center.intel....-SA-00075&languageid=en-fr
INTEL-SA-00075 Discovery Tool GUI Version

Dakle, bez Lenovo saradnje ovu rupetinu je nemoguce skroz eliminisati.

https://support.lenovo.com/nl/en/product_security/len-14963

Target za fix: 17. Jun...

Dakle, h4xori imaju vise od mesec dana da naprave haos.

Postavlja se pitanje WTF "permanently disable" opcija u BIOS-u uopste i radi... verovatno setuje neki flag na 0 :(

Odgovor na temu

Ivan Dimkovic

Administrator
Član broj: 13
Poruke: 16687
*.ip.telfort.nl.

+7173 Profil

Re: I.. konacno se desilo i to: Remote execution rupetina u Intel ME-u

^{07.05.2017. u 19:58 - pre 84 meseci}

https://www.theregister.co.uk/...5/05/intel_amt_remote_exploit/

Citat:

How to remote hijack computers using Intel's insecure chips: Just use an empty login string

Code dive You can remotely commandeer and control computers that use vulnerable Intel chipsets by sending them empty authentication strings.

You read that right. When you're expected to send a password hash, you send zero bytes. Nothing. Nada. And you'll be rewarded with powerful low-level access to a vulnerable box's hardware from across the network – or across the internet if the management interface faces the public web.

I... sampionski kod:

Citat:

If you poke around inside Intel's firmware, you'll find this gem that lies at the heart of the matter – machine code that decompiles into C that looks pretty much like this:

Code:

if(strncmp(computed_response, user_response, response_length))
deny_access();

Jeza..

Vise detalja:

https://www.embedi.com/files/w...apers/Silent-Bob-is-Silent.pdf

Kapiram da ce Intel uloziti silne resurse da sledeca verzija AMT-a bude potpuno kriptovan binarni blob... da se bar ne vidi blam.

Odgovor na temu

Space Beer
ISS

Član broj: 325788
Poruke: 107
*.cormai.net.

+93 Profil

Re: I.. konacno se desilo i to: Remote execution rupetina u Intel ME-u

^{08.05.2017. u 07:25 - pre 84 meseci}

Genijalno :D Koliko sam shvatio, pogođeni su samo Q čipsetovi, tj. poslovni korisnici? Mi obični nemamo razloga za brigu, bar za sada?

Odgovor na temu

Ivan Dimkovic

Administrator
Član broj: 13
Poruke: 16687
*.ip.telfort.nl.

+7173 Profil

Re: I.. konacno se desilo i to: Remote execution rupetina u Intel ME-u

^{09.05.2017. u 15:05 - pre 84 meseci}

Q i neki C cipseti, koji obicno jesu "poslovni" ali ima masa masina koje zavrse i kod krajnjih korisnika.

Odgovor na temu

stopnarkomaniji

Član broj: 336064
Poruke: 11

+54 Profil

Re: I.. konacno se desilo i to: Remote execution rupetina u Intel ME-u

^{17.05.2017. u 13:22 - pre 84 meseci}

Imam neki laptop Lenovo sa Intelom.
Pokazuje neke simptome sllčne ovde opisanim.
Ne može da se uključi
nego kad odstoji par nedelja bez napajanja
onda proradi na 20 minuta i naprasno se ugasi.
Zato pretpostavljam ako je neki "uljez" da se uvukao u BIOS ili tako negde.

Da li neko ima ideju kako doskočiti?

Odgovor na temu

valjan
Janko Valencik
Software Deployer
Schneider Electric
Novi Sad

Član broj: 158605
Poruke: 3531
*.mediaworksit.net.

+553 Profil

Re: I.. konacno se desilo i to: Remote execution rupetina u Intel ME-u

^{17.05.2017. u 14:15 - pre 84 meseci}

To više zvuči kao neki hladan lem koji kad se laptop zagreje jednostavno izgubi kontakt i laptop prestane da radi, pa kad se dovoljno ohladi kontakt se uspostavi i opet sve radi. Ili što bi rekao Branko Kockica "sunce vrelo širi telo, zima bela skuplja tela" ;-) Dakle, ništa softver, izgleda kao čist hardverski problem...

Odgovor na temu

stopnarkomaniji

Član broj: 336064
Poruke: 11

+54 Profil

Re: I.. konacno se desilo i to: Remote execution rupetina u Intel ME-u

^{17.05.2017. u 17:30 - pre 84 meseci}

A tako?
Stavio sam u friz pa ću da vidim kad postigne 0 stepeni.
Srećom da je ona komora veličine ko da su znali šta ću trpati unutra :)

Odgovor na temu

valjan
Janko Valencik
Software Deployer
Schneider Electric
Novi Sad

Član broj: 158605
Poruke: 3531
*.dynamic.sbb.rs.

+553 Profil

Re: I.. konacno se desilo i to: Remote execution rupetina u Intel ME-u

^{17.05.2017. u 20:24 - pre 84 meseci}

Pazi samo na kondenzovanje vlage kad ga izvadiš odande ;-)

Odgovor na temu

stopnarkomaniji

Član broj: 336064
Poruke: 11

+54 Profil

Re: I.. konacno se desilo i to: Remote execution rupetina u Intel ME-u

^{17.05.2017. u 22:03 - pre 84 meseci}

Ma imam iskustva sa tim :)

Medjutim ovo čudo i nakon "hladnog tuša" ne radi.
Ipak mislim da ima nekih problema sa biosom.
Mada ni hladan lem ne isključujem. Samo što hladan lem teže dolazi do izražaja ako je laptop fiksiran kao što je bio slučaj kod mene.

Ok, da ne ometam temu.

Poz.

Odgovor na temu

Ivan Dimkovic

Administrator
Član broj: 13
Poruke: 16687
*.ip.telfort.nl.

+7173 Profil

Re: I.. konacno se desilo i to: Remote execution rupetina u Intel ME-u

^{21.09.2017. u 13:30 - pre 79 meseci}

Postaje sve bolje i bolje:

Prezentacija u decembru:

https://www.blackhat.com/eu-17...n-intel-management-engine-8668

Citat:

How to Hack a Turned-Off Computer, or Running Unsigned Code in Intel Management Engine

Unfortunately, this changing did not go without errors. In a subsystem change that will be detailed in the talk of Intel ME version 11+, a vulnerability was found. It allows an attacker of the machine to run unsigned code in PCH on any motherboard via Skylake+. The main system can remain functional, so the user may not even suspect that his or her computer now has malware resistant to reinstalling of the OS and updating BIOS. Running your own code on ME gives unlimited possibilities for researchers, because it allows exploring the system in dynamics.

Ako stvarno mogu da nateraju ME podsistem da trci nepotpisan kod bez nekih velikih vratolomija, mislim da ce to napraviti poveci problem kako Intel-u tako i njihovim OEM kupcima i verovatno ce doci do zahteva od strane kupaca da se cela stvar moze iskljuciti, potpuno.

Jedna dobra vest za one koji su propustili, izgleda da ME ima "kill switch" koji se koristi u 'High Assurance' programu (za drzavne sluzbe) i koji su istrazivaci uspeli da pronadju:

http://blog.ptsecurity.com/2017/08/disabling-intel-me.html

Na zalost, ovo nije bas neko siroko primenjivo resenje posto zahteva a) hakovanje opreme, b) moze da dovede do brick-ovanja sistema i c) nije podrzana konfiguracija od strane proizvodjaca.

Odgovor na temu

Ivan Dimkovic

Administrator
Član broj: 13
Poruke: 16687
*.ip.telfort.nl.

+7173 Profil

Re: I.. konacno se desilo i to: Remote execution rupetina u Intel ME-u

^{21.09.2017. u 13:44 - pre 79 meseci}

Btw, evo sta se desava kad se u ME-u ukljuci "HAP" mod:

http://blog.ptsecurity.com/2017/08/disabling-intel-me.html

Citat:

Binary analysis of Intel ME firmware, as described in this paper.

If we remove some critical ME modules and enable HAP mode, Intel ME does not crash. This proves that HAP disables ME at an early stage.

We are quite sure that Intel ME is unable to exit this mode because we have not found code capable of doing so in the RBE, KERNEL, and SYSLIB modules.

Zanimljivo je da MEInfo ovakvu konfiguraciju zove "Alt Disable Mode".

Odgovor na temu