Stories
Slash Boxes
Comments

SoylentNews is people

posted by Fnord666 on Friday September 01 2017, @09:08AM   Printer-friendly
from the idle-hands-devil's-playthings dept.

Positive Technologies has posted an interesting article about disabling the Intel Management Engine 11 via an undocumented mode.

Our team of Positive Technologies researchers has delved deep into the internal architecture of Intel Management Engine (ME) 11, revealing a mechanism that can disable Intel ME after hardware is initialized and the main processor starts. In this article, we describe how we discovered this undocumented mode and how it is connected with the U.S. government's High Assurance Platform (HAP) program.

[...] Intel Management Engine is a proprietary technology that consists of a microcontroller integrated into the Platform Controller Hub (PCH) chip and a set of built-in peripherals. The PCH carries almost all communication between the processor and external devices; therefore Intel ME has access to almost all data on the computer. The ability to execute third-party code on Intel ME would allow for a complete compromise of the platform.

[...] Unfortunately, analysis of Intel ME 11 was previously impossible because the executable modules are compressed by Huffman codes with unknown tables. Nonetheless, our research team (Dmitry Sklyarov, Mark Ermolov, and Maxim Goryachy) managed to recover these tables and created a utility for unpacking images. The utility is available on our GitHub page.

Hey, the government isn't the only one who wants "high assurance" for their computers. We trolls and average peons would like to think our systems are secure as well.

But it gets better.

Intel allows motherboard manufacturers to set a small number of ME parameters. For this, the company provides hardware manufacturers with special software, including utilities such as Flash Image Tool (FIT) for configuring ME parameters and Flash Programming Tool (FPT) for programming flash memory directly via the built-in SPI controller. These programs are not provided to end users, but they can be easily found on the Internet.

From these utilities, you can extract a large number of XML files (detailed description of the process). These files contain a lot of interesting information: the structure of ME firmware and description of the PCH strap, as well as special configuration bits for various subsystems integrated into the PCH chip. One of the fields, called "reserve_hap", drew our attention because there was a comment next to it: "High Assurance Platform (HAP) enable".

[Ed Note - The fine article contains the following disclaimer:

Disclaimer: The methods described here are risky and may damage or destroy your computer. We take no responsibility for any attempts inspired by our work and do not guarantee the operability of anything. For those who are aware of the risks and decide to experiment anyway, we recommend using an SPI programmer.

You've been warned.]


Original Submission

 
This discussion has been archived. No new comments can be posted.
Display Options Threshold/Breakthrough Mark All as Read Mark All as Unread
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
  • (Score: 4, Interesting) by jmorris on Friday September 01 2017, @04:46PM (2 children)

    by jmorris (4844) on Friday September 01 2017, @04:46PM (#562582)

    Read the article before saying something dumb. Intel confirmed the existence of the feature. They won't remove a feature that is a requirement by a large volume buyer like the U.S. Gov because that would be so dumb there isn't language to express the concept with.

    What we should be pushing for is for motherboard makers to expose that knob in BIOS. We fought the CPUID and they did it, we just have to make sufficient noise that one of them sees an opportunity to move some additional units in a stagnant market. Now is the time, we have the whip hand.

    These things are out of control. Did you read that description? Three (3) 486 class processors inside the chipset that we know almost nothing about and are cryptographically locked out of ever controlling? Shut it down!

    Next we have to make AMD give us an escape mode too.

    Starting Score:    1  point
    Moderation   +2  
       Interesting=2, Total=2
    Extra 'Interesting' Modifier   0  
    Karma-Bonus Modifier   +1  

    Total Score:   4  
  • (Score: 1, Interesting) by Anonymous Coward on Friday September 01 2017, @10:52PM

    by Anonymous Coward on Friday September 01 2017, @10:52PM (#562759)

    The solution to this (sadly not for TMB there with his x86 videogame addiction..) is crowdfunding ACTUAL desktop chips.

    Hell, find out if there are any design copyrights still being enforced on Socket 7/SS7 and use that. Depending on the unused pins (if any) we could even run multiprocessor support off the same socket, while providing single or dual socket boards that were electrically compatible with vintage pentium processors. And socket 7 should be good for at least 266 mhz, maybe more before running into the power/ground plane issues that lead the jump to 423/478/775.

    All the ancillary tech is out of patent if not copyright, SDRAM and DDR chips are both cheap enough for low production run systems at reasonable affordable rates.

    Won't be a shiny modern x86 or arm system in power, price, or performance, but just look at where bitcoin took mining development there. If you built a first generation, even if it isn't that great, you can get people jumping on the bandwagon for future generations if it is something they are willing to continue throwing money at to buy, whether for profit or privacy. Obviously you aren't going to be selling lots of 2k-10k computer systems like they were able to with mining rigs, but if you aim for a 100-500 dollar price, carefuly budget to step down pricing on old models as demand increases and new models can be added, you should have no trouble getting market share in the tens to hundreds of thousands of units. Not much by modern computer sales standards, but numbers that were quite good in years past, even when motherboards/cpus were only in the 150 dollar range each. And thanks to modern electronics sales and design most of the components can be bought/built for far less than those older parts were, especially if you can tape on older processors like 180nm (like the propeller 2 is planning to, and which was used for... the Pentium 3 era processors? Capable of up to 1.5 ghz with a 512k cache onboard. Maybe more given modern process technology or a carefully designed prefetcher.

  • (Score: 2) by Hyperturtle on Saturday September 02 2017, @08:41PM

    by Hyperturtle (2824) on Saturday September 02 2017, @08:41PM (#563010)

    I agree with everything you say, from the context you've stated it. My context was for end users being unable to exploit this in the long term, because the process will change, and the power of control will end up back where it was supposed to be. I never suggested the people that wanted the features were going to somehow be without it because their firmware secrets are now known.

    And why call me dumb? I can't say I've stated the same about you. Lighten up.