Intel finds critical holes in secret Management Engine hidden in tons of desktop, server chipsets

theregister.co.uk/2017/11/20/intel_flags_firmware_flaws/

>Bugs can be exploited to extract info, potentially insert rootkits

>Intel today admitted its Management Engine (ME), Server Platform Services (SPS), and Trusted Execution Engine (TXE) are vulnerable to multiple worrying security flaws, based on the findings of external security experts.

>The firmware-level bugs allow logged-in administrators, and malicious or hijacked high-privilege processes, to run code beneath the operating system to spy on or meddle with the computer completely out of sight of other users and admins. The holes can also be exploited by network administrators, or people masquerading as admins, to remotely infect machines with spyware and invisible rootkits, potentially.

>Meanwhile, logged-in users, or malicious or commandeered applications, can leverage the security weaknesses to extract confidential and protected information from the computer's memory, potentially giving miscreants sensitive data – such as passwords or cryptographic keys – to kick off other attacks. This is especially bad news on servers and other shared machines.

>In short, a huge amount of Intel silicon is secretly running code that is buggy and exploitable by attackers and malware to fully and silently compromise computers. The processor chipsets affected by the flaws are as follows:

>6th, 7th and 8th Generation Intel Core processors
>Intel Xeon E3-1200 v5 and v6 processors
>Intel Xeon Scalable processors
>Intel Xeon W processors
>Intel Atom C3000 processors
>Apollo Lake Intel Atom E3900 series
>Apollo Lake Intel Pentiums
>Celeron N and J series processors

Other urls found in this thread:

intel.com/content/www/us/en/support/articles/000025619/software.html
libreboot.org/docs/hardware/#desktops-amd-intel-x86
libreboot.org/docs/hardware/#serversworkstations-amd-x86
libreboot.org/docs/hardware/#laptops-intel-x86
puri.sm/learn/freedom-roadmap/
coreboot.org/Chromebooks
docs.google.com/presentation/d/1eGPMu03vCxIO0a3oNX8Hmij_Qwwz6R6ViFC_1HlHOYQ/edit#slide=id.p
inforcecomputing.com/products/single-board-computers-sbc/qualcomm-snapdragon-820-inforce-6640-sbc
cavium.com/Table.html
en.wikipedia.org/wiki/Free_and_open-source_graphics_device_driver#ARM
github.com/altreact/archbk/issues/3
raptorcs.com/TALOSII/
nxp.com/products/microcontrollers-and-processors/power-architecture-processors
powerpc-notebook.org/faq/
embeddedplanet.com/product/single-board-computers/
lemote.com/html/product/
embeddedplanet.com/single-board-computers/processor/cavium-oceteon-ii/
sifive.com/products/freedom/
lowrisc.org/
github.com/corna/me_cleaner/commit/ced3b46ba2ccd74602b892f9594763ef34671652
twitter.com/NSFWRedditGif

So you're telling me the best cpu made, the 2500k, is not affected?

>tfw 2500k owner

lmao the best intlel even after six years.

>tfw changed to ryzen a moth ago

I have a Core i3-2350M laptop. Am I affected?

Old news.
Been using SPARC for years already.

4th generation here. Seems I'm not affected.

>using Larry Ellison's processors

As long as none of that is exploitable over port 80 I guess I don't fucking care at all. Boohoo someone standing right beside the machine or someone who is logged in (there is only one account and that is me as root) can do anything he/she wants. I just don't fucking care. Getting my password is easier than exploiting anything cpu-related.

When are they going to recall all these CPUs?

>bugs
>not features for nsa
Nice try

>So our backdoors got found out, now we need to replace them with newer, better ones.

>Intel finds

That's all I needed to read. Are they trying to pass as the good guys that warn people about IME now?

Is there a way to get a modern Intel computer without the problematic IME stuff?

>he doesn't just use a PowerBook G4 as a daily driver

PPC is not supported by Apple or the macOS community anymore; only old software is available for it now.

>what is leopard-webkit

>Stallman was right again
When will newfags ever learn?

>when you actually have to download firmware drivers for your CPU

Where's that permabtfo intel shill at? I wanna laugh.

may I inquire what setup you're using?

Intel released a detection tool: intel.com/content/www/us/en/support/articles/000025619/software.html

Are you vulnerable, Sup Forums?

>write an intentional backdoor to your shit
>whistle-blower tells everyone there's a backdoor in every single new chip
>someone finds the backdoor
>"bug" can be exploited
Seems like a feature to me rather than a bug. It's working as intended.

>he/she
he/she/xir sweetheart

resbond

it*

them

fuck off with your incorrect grammar piece of shit commie

...

it says error ME driver not installed and 'maybe'. Haswell here.

YOU DIDN'T LISTEN

Do MacBooks have this problem? If so, looks like it wouldn't really be a bad idea for Apple to start putting their own CPUs in their laptops.

These Sup Forums roleplayers are getting really good

This was inevitable

>tfw he was spot on

However I think most of us really saw this coming even if we probably wouldn't be this close.

>buying intlel ever

>it has full access to the TCP/IP stack
Can anyone explain what exactly this means? Maybe newer hardware is different, but I'm pretty sure TCP/IP doesn't even exist until the OS says so.

ME has its own TCP/IP stack not sure what that poster meant though

Anyone else get "unknown or unsupported hardware platform"? Just installed the new microcode update from the 17th.

Yes, they have had it since shortly after Apple switched from PPC to x86. If you have an i3/5/7 you are fucked. Very old PPC macbooks are good though.

Intel i5 3320M here, seems not affected.. nice

Reposting the list made in the Hardware Removal-of-botnet Threads (/hrt/):

(1/2)
Findings so far
x86:
For desktops, there's lots of C2Ds and atoms listed, but also some very nice opterons and apparently an iMac
libreboot.org/docs/hardware/#desktops-amd-intel-x86
libreboot.org/docs/hardware/#serversworkstations-amd-x86
For Laptops, you have the CD and C2D memepads
libreboot.org/docs/hardware/#laptops-intel-x86
Purism doesn't do libreboot, but their roadmap includes this as a future goal.
puri.sm/learn/freedom-roadmap/
The last AMD chip that came without the PSP is Piledriver.
VIA and Zhaoxin Semiconductor apparently also make x86 processors.

ARM:
Obviously there's a shit ton of SBCs (Olimex, Beagle, etc).
For a laptop option with an open firmware, try ARM Chromebooks.
I'm dead serious. Open it up, remove the write protection, reflash coreboot with different payload (Not seaBIOS or Depthcharge), install loonix of choice.
coreboot.org/Chromebooks
docs.google.com/presentation/d/1eGPMu03vCxIO0a3oNX8Hmij_Qwwz6R6ViFC_1HlHOYQ/edit#slide=id.p
Inforce has an SBC with high-specs and an open GPU
inforcecomputing.com/products/single-board-computers-sbc/qualcomm-snapdragon-820-inforce-6640-sbc
Cavium makes some god-tier processors. Be on the lookout for that.
cavium.com/Table.html
In general, your biggest concern with ARM is the GPU drivers.
Mali is fucked. PowerVR too. Vivante GC and Qualcomm Ardreno are fine. Broadcom VideoCore is partial.
en.wikipedia.org/wiki/Free_and_open-source_graphics_device_driver#ARM
Some anons have reported that lighter environments like XFCE are usable on stuff like Mali without the driver, but it's not ideal.
One user said he couldn't remove the ChromeOS on his libreboot C201. This github issue talks about a solution.
github.com/altreact/archbk/issues/3

(2/2)
OpenPOWER:
Raptor Engineering sells POWER9 workstations, that may soon be getting RYF certification.
They're expensive as fuck, but probably the most powerful non-botnet computers that exist. Comparable to Xeons/Epyc.
raptorcs.com/TALOSII/

PowerPC:
The company that still makes this is NXP
nxp.com/products/microcontrollers-and-processors/power-architecture-processors
Here is a project for a Libre PowerPC laptop using NXP, shooting for RYF certification.
powerpc-notebook.org/faq/
EmbeddedPlanet has several PowerPC SBCs, most using NXP.
embeddedplanet.com/product/single-board-computers/

MIPS:
The /csg/ of desktops. Lemote is a chink company that sells libre MIPS boards, using PMON firmware.
lemote.com/html/product/
A German user on this board says he is going to work with Lemote to resell their stuff.
EmbeddedPlanet also has MIPS boards with processors from Cavium with U-boot firmware.
embeddedplanet.com/single-board-computers/processor/cavium-oceteon-ii/

RISC-V:
Only SBCs here. SiFive has some.
sifive.com/products/freedom/
There's also LowRISC
lowrisc.org/

Reminder to disable this shit, the flag used by US DoD to disable ME from fully initializing was found months ago:
github.com/corna/me_cleaner/commit/ced3b46ba2ccd74602b892f9594763ef34671652

Sadly an equivalent way of disabling AMD's PSP is still unknown.

Actually not intel found them.

>not affected
it might seem that way, but only because jewtel doesn't care about LEGACY products. if that machine of yours ever becomes a target the exploits will work just fine. and if you have a problem with that all you have to do is UPGRADE (read BUY) to a more recent processor were the issue doesnt present, which will probably require new silicon

Is there a list anywhere of all CPUs affected by IME/PSP? I hear people say it affects all modern x86 CPUs, but I haven't seen proof that it's in CPUs other than vPro/Ryzen. What about older Pentiums and the AMD FX?

You are as safe as my virginity

so now that software is fully open, is time for the hardware

That W2 form really convinced me.

Literally never when it's tied to intellectual property. And even open source hardware specs don't guarantee the manufacture simply won't implement malicious or otherwise hidden blackbox features on the assembly line. Nor any other entity doing the same at any point of distribution.

>not 4th gen
sweet

So only safe until the government decides to fuck you in the ass?

>logged-in administrators, and malicious or hijacked high-privilege processes
So what you're saying is... my computer would have to already be compromised in order to be compromised?

Whatever. Maybe with these new findings we can deliberately hack the ME and disable it somehow.

>still on ivy bridge
Feels good

Its called microcode, it is downloaded during every boot, and it is distributed in BIOS updates.

>tool
New backdoor patch tool?

What was the latest model of Thinkpad that could benefit from libreboot?