Hacker News Reader

Comment by zkms | Hacker News Reader

Aaaand I think this is the first public disclosure of malware using the Intel Management Engine / AMT's network connection (that uses SMBus, i talked about it here https://news.ycombinator.com/item?id=14309557 and gave links to appropriate datasheets). Welp.

AMT/ME being used by malware created by well-resourced adversaries is no surprise, and is why Intel needed to give an irreversible and verifiable way of completely disabling it.

View on HN

is why Intel needed to give an irreversible and verifiable way of completely disabling it.

The article said it comes disabled by default. Isn't this a verifiable way, or is the article incorrect?

AMT is disabled by default on most consumer PCs or at least it's not expose itself. Though AMT work on top of ME and ME is opposite: it's always active and required for system to operate.

If ME firmware not found CPU will shut down every 30 minutes or something. There also way to neutralize some part of ME firmware while keeping system operational, but it's hard to tell how effective this is actually.

A privileged local user can provision AMT to its liking though, which is afaict what this malware did.

I posted it below already, but anyway as far as I personally understand to provision AMT you need it actually enabled in BIOS / EFI and it's in fact usually disabled by default.

Am I missing something?

Privileged users usually have BIOS access. BIOS's are often designed to be configurable/flashable with vendor-specific tools that your run on top of your OS.

AMT exploits are a side channel attack. AMT has it's own processor, loads from it's own ROM separate from the BIOS and has it's own network stack but has full access to the system at a hardware level. AMT System Management Mode hooks in to the CPU at ring level -2, below the OS and is remotely exploitable.

If it isn't verifiable, how can you check if the article's statement is true for your particular machine?

And moreover, the article continues with Microsoft can't say if these state-sponsored hackers found a secret way to enable this feature on infected hosts

There's a second bug that allows a non-privileged local user to provision it.

"An unprivileged local attacker could provision manageability features gaining unprivileged network or local system privileges on Intel manageability SKUs"

https://security-center.intel.com/advisory.aspx?intelid=INTE...

Also a privileged local user can provision it -- which is also pretty horrific, and that's not even a bug, it's how it's designed! Also "provision manageability features" is such an awkwardly euphemistic phrase here tbh, it's like reading leaked classified documents talking about "implanting" systems.

Isn't it supposed to be enabled in BIOS in order to provision it? On most laptops and desktop motherboards such features simply disable by default like VT-d (IOMMU).

See this question on the Intel forums. Seems difficult to actually disable it. https://software.intel.com/en-us/forums/intel-business-clien...

Oh this isn't looks good at all. Didn't knew that. Thanks.

The only way to be sure it's off is by severing the link between the LM-suffixed Intel Ethernet chip and the PCH. There are two links, the 'normal' one (often MII type, sometimes PCI(e)), and the OOB-one, via SMBus or a comparable I2C style bus between the PCH and the Ethernet chip.

Another way that hasn't been verified since in theory the ARC controller could access other PCI devices anyway, is to install a new ethernet card in a free expansion slot and use that instead. AMT is supposedly only supported with a specific CPU, firmware, PCH and PHY combination. Breaking that chain by swapping one of those components with an unsupported one should work. If you simply don't use any of the AMT-enabled interfaces, it shouldn't be able to communicate at all. Best plug in a chopped off ethernet jack to make sure nobody plugs in a cable by mistake.

I believe there was a 802.11 variant as well, but that might have been before AMT and around the Centrino era. Best disconnect that as well...

Reply on news.ycombinator.com