top | item 8813029

Secrets of Intel Management Engine – Hidden code in your chipset

154 points| mmastrac | 11 years ago |slideshare.net | reply

61 comments

order
[+] ollybee|11 years ago|reply
My second thought on reading this was how can a server be PCI compliant with Intel management engine installed? but a quick search shows that Intel have thought of this: http://www.intel.co.uk/content/dam/www/public/us/en/document...

My first thought was that it seems increasingly clear that Stallman has been right all along.

[+] morganvachon|11 years ago|reply
> My first thought was that it seems increasingly clear that Stallman has been right all along.

The problem is that being philosophically right doesn't always mean being practically right. In order to create the perfect Stallman-esque machine, one would have to design everything from the logic chips up from scratch, because in the end, no third party can be trusted. He says this himself about the Loongson system he uses daily; he considers it a compromise but one heavily weighted in his favor.

In short, Stallman has been right all along, but there's little we can do about it from a practical standpoint.

[+] WhitneyLand|11 years ago|reply
tldr: Intel's remote management capabilities are obscurely baked into every chipset. The ME has out of band access to the network card and main memory. Since ME also has its own flashable memory in principle a machine could be compromised in a nearly undetectable way. The presentation shows that a lot of interesting details of ME have been brought to light but it has also withstood a first round of attacks. No rootkit has yet been shown to be practical.
[+] bhouston|11 years ago|reply
It just has to be a matter of time until it is cracked. I am surprised Intel did this.
[+] venomsnake|11 years ago|reply
Lets just hope that intel security teams are better than Sony Pictures' ones.

After the sony hack ... lets say that I feel less secure about anything.

[+] logicallee|11 years ago|reply
what an unlikely coincidence. amazing what nature can come up with without any sort of plan or guidance. :)
[+] userbinator|11 years ago|reply
Wow. SPARC and Java, two things you wouldn't ever expect Intel hardware to ship with! The mention of SOAP-based protocols is also rather surprising, since they have rather high overhead, and this means ME is not just a little 8051-class MCU but almost a fully-featured PC itself...

The amount of complexity - and the opportunities to hide things in that - has increased so much compared to earlier PCs that in some ways I think the development of computer systems is headed on a rather treacherous path. When systems are so complex that no single person can understand them entirely, it's easier to make them behave against their owner's will.

[+] nine_k|11 years ago|reply
Fortunately, a number of non-PC systems exist (one is probably in your pocket).
[+] walterbell|11 years ago|reply
Do fewer people know how to write SPARC shellcode than x86?
[+] icarusmad|11 years ago|reply
ARC[1], not SPARC. It evolved from the SuperFX chip used in some SNES games.

[1]: http://en.wikipedia.org/wiki/ARC_International

[+] userbinator|11 years ago|reply
The earlier ME versions used an ARC. The later ones use a SPARC.

Look at slide 50.

[+] wiml|11 years ago|reply
Take a look at the PDF version on recon.cx linked by jesrui— it's substantially different from the slideshare version in a few places, notably that it talks about a third generation (Bay Trail TXE) which uses SPARC and drops the pesky Huffman coder entirely in favor of LZMA.
[+] cm3|11 years ago|reply
Is it part of vPro or available in every cpu? Can it be disabled like TSX?
[+] sounds|11 years ago|reply
The real question is, what happens if you flash a custom BIOS that just ignores the ME?

Intel chips up to (I think) 2006 would happily boot without the ME enabled ("ME optional").

Intel's newer chipsets have a watchdog in the ME hardware which will reset the main CPU if the ME is not initialized by the BIOS ("ME mandatory").

Combined with the as-of-yet unbroken RSA signature on any ME firmware, this has some pretty astounding implications.

[+] pgeorgi|11 years ago|reply
The ME is on _every_ CPU, and you can't easily disable it (there are ways, but it's unclear how much really shuts down, and you might lose power management features).

vPro is merely the larger ME firmware: The small one is 1.5-2MB, the vPro one is 5-7. A non-vPro mainboard probably comes without a SOAP-capable webserver (although I wonder what they need 1.5MB of code for), but the chip to run it is all there.

[+] astrange|11 years ago|reply
Why would the newest version of the ME use SPARC ISA? Does someone out there need register windows?
[+] lambda|11 years ago|reply
Where did everyone get SPARC from? The slides clearly say ARC, not SPARC.
[+] gweinberg|11 years ago|reply
My last few computers have used AMD chips. I think I will stick with those.
[+] cm3|11 years ago|reply
As noted in another comment AMD has something similar.
[+] Maakuth|11 years ago|reply
What, SPARC and Java in Intel motherboards? Is this some elaborate gag on Sun/Oracle? I hope they'll demo it by running Solaris there for good measure.
[+] lambda|11 years ago|reply
ARC, not SPARC. Did the title on HN say "SPARC" originally or something? Because the slides never mentions SPARC, they discuss ARC, an embedded ISA.
[+] pdkl95|11 years ago|reply
"Can be active even when the system is hibernating or turned off (but connected to mains)"

On top of the security issues, it seems Intel owes a lot of people some reimbursements for their share of the power bill. Unfortunately, I suspect this theft of electricity will be quietly swept under the rug and forgotten about.