Comment by exikyut | Hacker News Reader

Comment by exikyut | Hacker News Reader

> In a subsystem change that will be detailed in the talk of Intel ME version 11+, a vulnerability was found.

Okay, so this effects 11.x, but I wanted to clarify that there seem to always have been circumventions floating around out there.

I stumbled on https://www.reddit.com/r/onions/comments/5i6qa3/can_the_nsaf... (mirror: http://archive.is/T8yVz) some months ago. It reads a little like a skiddie (a well-connected one) strutting a bit, and I think some of this person's views on ME as a viable attack vector are slightly careless and un-thought-through, but whoever this person is, they seem to be very confident about some of the things they said, particularly the following quotes (to be completely clear, I've removed first-person references):

> [This person] know[s] that at least up to firmware version 8 is traded underground, and version 11 (the latest) is available without difficulty to people who know how to find it. [This person has] access to version 8's signing keys [themselves] ...

> It's certainly not common but it is absolutely something that FVEY and related contractors (Raytheon, Leidos, half the people you'll see at ISS, etc) will be able to get their hands on, if they haven't already.

> [This person has] an enterprise ThinkPad that proudly boasts having WiMax support, requiring extensive configuration. It was expensive. If you don't have a BMC card (and you do not), then it is not possible to remotely control your system. Even if you did have a BMC, simply having the signing keys and toolchain for the ME would not be sufficient to get in. An attacker would need either a 0day, or your credentials.

.....Well then. Oops.

> Having the signing key allows nothing more than writing malicious firmware over SPI and allowing it to persist. It's just a little more powerful than the UEFI kits cr4sh can write, and just as easily detectable by reading your flash chip.

That's still bad! (And I have no idea who cr4sh is.)

> But it's not like you're analyzing your microcode (of which there are likely signing keys being traded as well), which can also be installed on a large number of systems, considering the BIOS functions to load the latest microcode it has into the CPU.

The above bit is unrelated, but I couldn't leave it out, because that's worth filing away too (...ouch).

--

Sources/past comments: https://news.ycombinator.com/item?id=15187540

The assertion that you need a BMC card to make use of AMT (you don't, that's kind of the point) makes it pretty hard to assume these claims are credible.

>And I have no idea who cr4sh is

Check out http://blog.cr4.sh/

Please use archive.org instead of archive.is as a mirror next time. Archive.is blocks VPNS and tor while making it impossible to see the target url and use it directly or via another archive. Moreover since it uses cloudflare every connection to it is being MITMed by them.

I just visited archive.is with the Tor Browser Bundle and had not problem accessing it.

With JS disabled as well?

This is quite weird, I was never able to access it with TBB nor with any proxy without the cloudflare captcha page popping in.

Just restarted TBB and turned off JavaScript (High Security) and went there: https://imgur.com/a/CXCw4

This is truly odd, maybe they recently stopped blocking tor users but for some reason they decided to block vpn/proxy users? I honestly have no idea.

(You're actually replying to John Graham-Cumming, CTO of CloudFlare. :P)

In that case this is the best moment to link to https://archive.lainchan.jp/sec/res/4386.html#4391

I'm curious - does archive.is flag the WAF more than the average (if there is such a thing as an "average" for a planet-wide WAF, heh)?

(Also - if I can ask/clarify a couple things I've been curious about for a while: based on released info, I get the idea that the Lua part of the WAF is mostly regexes and "precompiled"/predetermined-ahead-of-time-based-on-past-incidents "possible issue" flagging, and a bunch of Go code (which I theorize runs slightly behind realtime, but not too far) follows up on those flags and makes the actual executive decisions about blocking/tracking/dropping/etc the Lua-generated event. I've also learned (from solving an ISP glitch with the guy who coincidentally manages the WAF!) that your copy of Lua is a bit special (although I don't know specifically how). I just wanted to let you know that there are people out there very interested to learn more about the "boring" (non-proprietary) parts of the CF stack. "Go/no-go within 999 nanoseconds" is amazing, I'd love to learn more about it. It's a cool platform.)

Experimentally mentioning the word cloudflare just in case my previous message (the comment this comment is a reply to) simply wasn't noticed. Now I can have high confidence the comment above this one was at least seen, even if a reply can't work (which is fine).

Yes, if you mention Cloudflare in a comment on Hacker News I see it very quickly: https://github.com/jgrahamc/hncomments

The entire WAF is written in Lua; there is no Go code.

There's nothing special about 'our copy of Lua'; we use LuaJIT and all changes we've made have been contributed back.

Have you seen the talk I have on this? https://www.youtube.com/watch?v=nlt4XKhucS4

It's ironic that you prefer archive.org.

The Wayback Machine requires your browser to support JavaScript, please email info@archive.org if you have any questions about this.

I never had a problem using the wayback machine with js disabled.

They recently updated the UI (a couple months ago). How long ago did you last poke at it?

From what I understand, the date selector (/web/*/...) seems to require JS now, although I haven't tested JS turned off.

The area of SPI flash used by the ME is read-protected from the main CPU. In order to detect a malicious backdoor, you'd have to literally take your computer apart and hook up a hardware SPI flash programmer to the chip.

Reply on news.ycombinator.com