How to Hack a Turned-Off Computer, or Running Unsigned Code in Intel ME | Hacker News Reader

How to Hack a Turned-Off Computer, or Running Unsigned Code in Intel ME

blog.ptsecurity.com

177 pointsalexlash16 comments

This PDF might be news to many; click 'past' to see previous submissions -- last month's got traction:

[dupe] https://news.ycombinator.com/item?id=16015539 (543 points, 107 comments)

HN user saulrh mentioned that the list of requirements "does not seem incredibly unusual" for enterprise setups with AMT on.

Pre-Meltdown/Spectre this was 2017's "big deal" re:Intel; nearly all of the varying degrees of paranoia in the previous discusson seem a lot more reasonable with the benefit of hindsight. (If any more AMT info has become available thanks to Meltdown/Spectre-enhanced reverse engineering I would appreciate a heads-up; example vs SGX: https://github.com/lsds/spectre-attack-sgx)

I thought it's not possible to paste the same link twice in HN, yet this appears for the 3rd time, as far as my memory permits.

OK, so the computer and network switch are connected to a UPS power supply. Kill the power for both. System is now down...

Intel needs get their act together or remove this features entirely. Clean it up.

I didnt see mention of this in the article but I thought accessing a powered-off machine required usage of the 3G wireless support built in to the vPro line of intel chips.

No. This is a feature of the Intel vPro Ethernet network adaptors.

> the 3G wireless support built in to the vPro line of intel chips

Yikes. That’s the first I’ve heard of this. It’s terrifying that even exists as an option, given how much of a strategic military benefit it provides to whoever can pull Intel’s strings.

scary stuff ben_w look it up 3g support has been in the vPro line for the better part of a decade.

call me a conspiracy theorist if you like but i'll bet you dollars to donuts wireless powerless remote management exploits exist in the wild for these intel chips.

and by wild i include state-owned in there

edit: if you have one of these chips you can disable the feature in bios

I just did. I agree. And I cannot because I have a mac.

Does AMD's PSP have the same security vulnerability?

Likely not the same, due to independent implementation, but it'd be foolish to think it didn't have security flaws equally as severe.

Can you elaborate?

From what I understand (I'm not well-informed though), those security flaws stem mainly from carelessness by Intel. So this would assume AMD acts equally careless, which may or may not be true.

I think the argument is that AMD's implementation is similar in complexity and any sufficiently complex implementation will likely have vulnerabilities, sloppy or not.

The assumption that the flaws arise from the complexity of contemporary CPU's rather than incompetence within the engineering teams at the world's leading CPU company is probably more useful. When problems come to light, those problems are latent bugs. The engineering was equally competent before and after the latent bugs became known bugs. Bugs with decades long latency are most likely to be non-obvious.

In engineering terms, the bugs are "errors and omissions" not carelessness or negligence. Errors and omissions arise because humans are fallible and engineering is a human process.

One of the features of Intel (and AMD) products is that their primary customers are data centers and that's where the core CPU design parameters come from (not consumers or developers). The consumer/developer SKU's are little more than repackaging and feature tweaking of the chips that Intel/AMD sells datacenters in high volume on 1-3 year cycles. That's what drives the roadmap five+ years out.

Last I heard about PSP is that it's a supplier of things like TPM but does not have network functionality akin to AMT/vPro. If true then it really limits the attack surface.

This is incorrect. PSP is explicitly a match to vPro in terms of features, including offline network asset management.

You're going to have to back that up. I have never found a shred of evidence to support that it has a network stack.

I don't believe it's been explicitly denied either, but I also don't find software that leverages deployments using PSP (or, Secure Processor, as it's now known) unlike what I find for Intels ME/AMT.

All indicators point to them focusing on it as a Trusted Execution Environment, similar to secure enclave.

Reply on news.ycombinator.com