P
Positive Technologies Blog
blog.ptsecurity.com · Company blog · on HN since 2013
Security research blog from Positive Technologies, notable for its analysis of Intel Management Engine firmware and modem vulnerabilities.
What HN saysHN links it for the post on disabling Intel ME via an undocumented mode, which commenters say me_cleaner uses, plus its Huffman table work.
43HN people shared it
17linked it in comments
35stories submitted
2.6Kstory points
6 years agolast shared
2013people per year2026
Most-shared posts
- 1Disabling Intel ME 11 via undocumented mode13 people · 734 points · first shared 2017 · 218 comments on HN
- 2Intel ME: The Way of Static Analysis5 people · 88 points · first shared 2017 · 25 comments on HN
- 3Recovering Huffman Tables in Intel ME 11.x3 people · 4 points · first shared 2017 · discussion on HN
- 4Intel ME Manufacturing Mode: obscured dangers and MacBook vulnerability2 people · 345 points · first shared 2018 · 78 comments on HN
- 5Critical Vulnerabilities in 3G/4G Modems or How to Build Big Brother2 people · 4 points · first shared 2015 · 4 comments on HN
- 6What We Have Learned About Intel ME Security in Recent Years: 7 Facts2 people · 4 points · first shared 2018 · discussion on HN
- 7Intel x86 root of trust:loss of trust2 people · 3 points · first shared 2020 · discussion on HN
- 8Intel patches new ME vulnerabilities1 people · 633 points · first shared 2018 · 327 comments on HN
- 9Intel x86 Root of Trust: Loss of Trust1 people · 486 points · first shared 2020 · 232 comments on HN
- 10How to Hack a Turned-Off Computer, or Running Unsigned Code in Intel ME1 people · 177 points · first shared 2018 · 16 comments on HN
- 11PHD VI: How They Stole Our Drone1 people · 93 points · first shared 2016 · 5 comments on HN
- 12Researcher finds vulnerability enabling disclosure of Intel ME encryption keys1 people · 7 points · first shared 2018 · discussion on HN
- 13Theory and Practice of Source Code Parsing with ANTLR and Roslyn1 people · 5 points · first shared 2016 · discussion on HN
- 14DDoS attack over Load Balancer: secure your cookies1 people · 5 points · first shared 2014 · discussion on HN
- 154G Security: Hacking USB Modem and SIM Card via SMS1 people · 4 points · first shared 2014 · discussion on HN
What HN people wrote when they linked it
sounds · 2017-09-20
In case you haven't already used the following, please note that the NSA had an undocumented "backdoor" included which "disables" the ME. (Man, oh man, I wish I was making this stuff up.)
http://blog.ptsecurity.com/2017/08/disabling-intel-me.html
I put quotes around "disables" because the ME is not fully disabled. The blog's analysis does show how it is in a "safe" state, i.e. forced to ignore the outside world very early in its code path. Also, not likely to brick your computer, assuming unscrewing your case and using a SPI flash programmer hasn't already bricked your computer.
Edit: "backdoor" in quotes too.
oneweekwonder · 2017-09-04
> Technically, from what we know ME firmware is flashable and possible to update
And it might be running Minix3[0] which is amazing for me.
But man it sucks to think there is a *nix machine next to my machine I have no control over. Some might mention SSD fw, but does it have a known serial over LAN vulnerability[1].
Wikipedia also cite a elevation of privilege bug[2].
I'm so glad I'm not a IT manager.
[0]: http://blog.ptsecurity.com/2017/04/intel-me-way-of-static-analysis.htm…
[1]: https://www.scmagazineuk.com/platinum-hackers-exploit-intel-amt-sol-fo…
[2]: https://en.wikipedia.org/wiki/Intel_Active_Management_Technology#cite_…
ps. If anybody have some info of the minix in ME. Please drop me a message.
tyingq · 2021-03-12
"ME isn't required at all..."
The document you linked refers to a more technical one that explains they don't disable the ME until after the main OS is booted, because...
"The disappointing fact is that on modern computers, it is impossible to completely disable ME. This is primarily due to the fact that this technology is responsible for initialization, power management, and launch of the main processor."
http://blog.ptsecurity.com/2017/08/disabling-intel-me.html
So, it is serving the same role as the Rpi VideoCore.
Kliment · 2018-07-18
Yes, even for latest gen chips. See http://blog.ptsecurity.com/2017/08/disabling-intel-me.html for details. me_cleaner supports this method.
zkms · 2017-12-28
> versus the 2 from AMT
Until very recently, independent researchers had no access at all to the instructions that the ME processor runs; maybe normalise against that? http://blog.ptsecurity.com/2017/12/huffman-tables-intel-me.html
filereaper · 2017-11-30
If anyone's interested, here's the full article from Positive Technologies on how they went about discovering reserve_hap and disabling it.
http://blog.ptsecurity.com/2017/08/disabling-intel-me.html
mschuster91 · 2017-11-18
GP is referring to Intel's High Assurance Program (http://blog.ptsecurity.com/2017/08/disabling-intel-me.html) which offered the possibility to disable ME.
pedro84 · 2017-11-09
blog post with more details from the tweet's author: http://blog.ptsecurity.com/2017/10/how-to-obtaining-full-system-access…
batat · 2017-11-06
English version in Positive Technologies blog [1]
And this has already been added to me_cleaner [2] as --soft-disable option 2 months ago.
[1] http://blog.ptsecurity.com/2017/08/disabling-intel-me.html
[2] https://github.com/corna/me_cleaner/commit/ced3b46ba2ccd74602b892f9594…
GranPC · 2017-10-29
corkraider · 2017-10-29
Parts of Intel ME are probably derived from Minix 3.
http://blog.ptsecurity.com/2017/04/intel-me-way-of-static-analysis.htm…
uytuijhgj · 2017-10-21
That article's crap. You want http://blog.ptsecurity.com/2017/08/disabling-intel-me.html
platinumrad · 2017-10-10
It's entirely possible that there exists something analogous to the HAP bit[1] or that something like me_cleaner could be developed for the PSP but AMD is not the market leader (and is frankly negligible when it comes to laptops) so much less research has been done on the AMD PSP. I remember that when excitement was building for the release of Ryzen there were petitions for AMD to open source the PSP and some talk that it might actually happen but they eventually shut the idea down during a Q&A.[2] It's a shame because it would have given AMD something to really distinguish itself from Intel and would have been viewed very positively by a lot of different communities/market segments. Really makes you think about why they didn't do it...
[1] http://blog.ptsecurity.com/2017/08/disabling-intel-me.html
[2] https://news.ycombinator.com/item?id=14803373
edaemon · 2017-09-20
Intel ME has the MINIX license copyright message in it: https://twitter.com/qrs/status/857342798420422657
Positive Technologies, the people doing the presentation in the OP, have this blog entry about earlier findings surrounding Intel ME (some of the language from this entry is used in OP): http://blog.ptsecurity.com/2017/08/disabling-intel-me.html
hcs · 2017-09-06
I'm reminded of the work that was done to reverse engineer the Intel ME 11 [1], it was compressed with an unknown Huffman code which the team was nevertheless able to recover somehow. And that was with variable-length words!
[1] http://blog.ptsecurity.com/2017/08/disabling-intel-me.html
agumonkey · 2017-06-04
fun anecdote, it seems that minix3 is the ancestor of the OS running in Intel Management Engine http://blog.ptsecurity.com/2017/04/intel-me-way-of-static-analysis.htm…
openasocket · 2017-10-10
First off, I completely agree. This really should be something you can disable, because often times it isn't used and it increases attack surface.
You can control that bit, as shown here: http://blog.ptsecurity.com/2017/08/disabling-intel-me.html . Of course, that method isn't documented or officially supported by Intel, and you could brick your machine if you mess up, so that's not exactly what you meant. I think Intel definitely should document it and provide official support. As to why they don't currently, I have some guesses. The first is general lack of interest: it costs money for them to support this new feature for everyone and make sure it plays nicely with everyone's setup, and maybe there isn't enough customer demand for the feature. The second is money: I wouldn't be surprised if they sell their chips to the government with the bit already set in firmware at a markup. Making that easily available to everyone means less money.