http://www.phoronix.com/scan.php?page=news_item&px=Thunderbolt-Security-Levels
Tag Archives: Intel
Reversing Intel ME’s ROMP module
Reverse-engineering the Intel Management Engine’s ROMP module
Youness Alaoui, Hardware enablement developer
Last month, while I was waiting for hardware to arrive and undergo troubleshooting, I had some spare time to begin some Intel ME reverse engineering work. First, I need to give some shout out to Igor Skochinsky, a Hex-Rays developer, who had been working on reverse engineering the Intel ME for a while, and who has been very generous in sharing his notes and research on the ME with us, which is going to be a huge help and cut down months of reverse engineering and guesswork. Igor was very helpful in getting me to understand the bits that didn’t make sense to me. The first thing I wanted to try and reverse was the ROMP module. It is one of the two modules that me_cleaner doesn’t remove, and given how small it is (less than 1KB of code+data), I thought it would be a good starting point. Turns out my hunch was right, as I finished reverse engineering that module after only a couple of days.[…]
https://puri.sm/posts/reverse-engineering-the-intel-management-engine-romp-module/
Intel AMT story, continued
A little bit more (warning: a few of these are related to Intel ME hardware, not Intel AMT firmware):
Rumor has it that OpenAMT can also be used for AMT detection:
https://sourceforge.net/p/openamt/wiki/Home/
AMT advisory from ASUS:
https://www.asus.com/News/uztEkib4zFMHCn5r
http://blog.trendmicro.com/tippingpoint-threat-intelligence-zero-day-coverage-week-may-8-2017/
http://www.govinfosecurity.com/intels-amt-flaw-worse-than-feared-a-9901
Is Intel’s Management Engine Broken?
Linux kernel EGP_PGT_DUMP build option
Sai Praneeth Prakhya of Intel submitted V2 of an Intel UEFI diagnostic patch for the Linux kernel, the new version adds x86 support.
[PATCH V2] x86/efi: Add EFI_PGT_DUMP support for x86_32, kexec
EFI_PGT_DUMP, as the name suggests dumps efi page tables to dmesg during kernel boot. This feature is very useful while debugging page faults/null pointer dereferences to efi related addresses. Presently, this feature is limited only to x86_64, so let’s extend it to other efi configurations like kexec kernel, efi=old_map and to x86_32 as well. This doesn’t effect normal boot path because this config option should be used only for debug purposes.
Changes since v1:
1. Call efi_dump_pagetable() only once from efi_enter_virtual_mode() – as suggested by Boris
For more info, see the patch on the linux-(kernel,efi) lists.
Intel AMT and WiFi
Intel AMT story, continued
https://www.us-cert.gov/ncas/current-activity/2017/05/07/Intel-Firmware-Vulnerability
https://github.com/CerberusSecurity/CVE-2017-5689
https://github.com/chipsec/chipsec/issues/212
https://support.lenovo.com/us/en/product_security/len-14963
http://en.community.dell.com/support-forums/laptop/f/3518/p/20011922/20995860
http://en.community.dell.com/techcenter/extras/m/white_papers/20443914
http://en.community.dell.com/techcenter/extras/m/white_papers/20443937
https://support.hp.com/us-en/document/c05507350
https://community.qualys.com/thread/17263-qids-or-scanning-advice-for-intel-amt-sa-00075
https://www.tenable.com/sc-dashboards/intel-sa-00075-detection
https://www.tenable.com/blog/intel-amt-vulnerability-detection-with-nessus-and-pvs-intel-sa-00075
Intel AMT chip bug suspected backdoor, but likely coding error
[…]Some researchers accused the vulnerability of being a backdoor. Tatu Ylonen, the inventor of the Secure Shell protocol told SC Media Charlie Demerjan, the researcher who spotted the flaw, claims to have been in discussions over bug with Intel for years urging them t to fix it. “If his claim is true (I have no reason to doubt it but have no independent evidence), then it begins to sound very much like a backdoor,” Demerjan said. “I mean, if someone knows their product has a vulnerability that undermines the security of pretty much every enterprise server in the world and most security tools, wouldn’t they want to disclose it to the government, one of their biggest customers?”[…]
https://www.scmagazine.com/intel-amt-flaw-likely-just-coding-error/article/655449/
[…]What is clear, however, is that this flaw (which has existed for more than 9 years) truly is somewhere between nightmarish and apocalyptic. Taking no action is not an option.
