"Red Alert" hardware God-backdoor (Intel ME) door hackers gekraakt

[sntjj]

Ik vond zojuist het volgende security-gerelateerde nieuwsbericht wat ik op dit forum wilde delen voor meer inzichten. Op Tweakers.net worden dit soort berichten resoluut verwijderd, het gaat echter om een wenzenlijk beveiligingsrisico dat al in computers aanwezig is sinds 2006 en op termijn met terugwerkende kracht veel schade kan veroorzaken bij miljoenen computers.

Over de risico's (en spionage doeleinden) van Intel ME is veel gespeculeerd. Intel heeft echter een security patch uitgebracht dat 'z.s.m.' op alle PC's sinds 2010 moet worden geinstalleerd waarmee duidelijk is geworden wat de risico's daadwerkelijk zijn. Hackers kunnen de backdoor inmiddels uitbuiten en totaal ongezien "God-mode" toegang verkrijgen tot in theorie vrijwel elke PC in de wereld.

Red alert! Intel patches remote execution hole that's been hidden in chips since 2010

According to Chipzilla, the security hole allows "an unprivileged attacker to gain total control of a PC using the manageability features provided by Intel's CPU."

That means it is possible for hackers to log into a vulnerable computer's hardware – right under the nose of the operating system – and silently tamper with the machine, install virtually undetectable malware, and so on, using AMT's features. This is potentially possible across the network because AMT has direct access to the computer's network hardware and is also present in modern routers and firewalls, creating a potential for a hidden internet that can move data unseen.

The security hole has been present in Intel chipsets for nearly a decade, starting with 2010's Intel Q57 family, all the way up to this year's Kaby Lake Core parts. Crucially, the vulnerability lies at the very heart of a machine's silicon, out of sight of the operating system, its applications and any antivirus.

The programming blunder can only be fully addressed with a firmware-level update, and it is present in millions of chips. It is effectively a backdoor into computers all over the world.

Red alert! Intel patches remote execution hole that's been hidden in chips since 2010

De hardware backdoor is hiermee bevestigd en met de nieuwe sleepnet wet verkrijgt de overheid nagenoeg onbegrensde toegang tot elke PC. De mogelijkheden zijn verregaand. Doordat dezelfde backdoor ook in routers en firewalls aanwezig is is het in theorie mogelijk om een compleet verborgen internet te maken waarmee data ongezien - zelfs voor specialisten onzichtbaar - kan worden verplaatst.

Enkele bronnen:

Libreboot – Frequently Asked Questions

Intel x86s hide another CPU that can take over your machine (you can't audit it)

Is the Intel Management Engine a backdoor?

 

[sntjj]

Voor diegene die interesse heeft, de Intel ME backdoor wordt in detail besproken tijdens de Blackhat Europe conferentie in Londen (4 t/m 7 december 2017)

De sprekers zijn de ontdekkers van de mogelijkheid om Intel ME te hacken.

How to Hack a Turned-Off Computer, or Running Unsigned Code in Intel Management Engine

Intel Management Engine is a proprietary technology that consists of a microcontroller integrated into the Platform Controller Hub (PCH) microchip with a set of built-in peripherals. The PCH carries almost all communication between the processor and external devices; therefore Intel ME has access to almost all data on the computer, and the ability to execute third-party code allows compromising the platform completely. Researchers have been long interested in such "God mode" capabilities, but recently we have seen a surge of interest in Intel ME. One of the reasons is the transition of this subsystem to a new hardware (x86) and software (modified MINIX as an operating system) architecture. The x86 platform allows hackers to bring to bear all the power of binary code analysis tools.

Unfortunately, this changing did not go without errors. In a subsystem change that will be detailed in the talk of Intel ME version 11+, a vulnerability was found. It allows an attacker of the machine to run unsigned code in PCH on any motherboard via Skylake+. The main system can remain functional, so the user may not even suspect that his or her computer now has malware resistant to reinstalling of the OS and updating BIOS. Running your own code on ME gives unlimited possibilities for hackers, because it allows exploring the system in dynamics.

In our presentation, we will tell how we detected and exploited the vulnerability, and bypassed built-in protection mechanisms.

Black Hat Europe 2017 | Briefings Schedule