Embedi Blog
embedi.com · Company blog · on HN since 2017
Embedi, a security research firm, publishes vulnerability write-ups on Intel AMT, Boot Guard, Cisco, D-Link routers and MS Office.
What HN saysHN cites it as the original source on Intel AMT's CVE-2017-5689 and Boot Guard bypasses, with commenters asking for technical detail and noting UEFI quirks.
15HN people shared it
4linked it in comments
11stories submitted
166story points
9 years agolast shared
2017people per year2026
Most-shared posts
- 1Skeleton in the closet. MS Office vulnerability you didn’t know about3 people · 6 points · first shared 2017 · discussion on HN
- 2Bypassing Intel Boot Guard2 people · 76 points · first shared 2017 · 12 comments on HN
- 3Intel AMT vulnerability: Silent Bob is Silent [pdf]2 people · 73 points · first shared 2017 · 30 comments on HN
- 4Enlarge your botnet with: top D-Link routers2 people · 6 points · first shared 2017 · discussion on HN
- 5Cisco Smart Install Remote Code Execution1 people · 2 points · first shared 2018 · discussion on HN
- 6The Adventure of the Final Intel AMT Problem1 people · 1 points · first shared 2017 · discussion on HN
- 7First glance on OS VRP by Huawei1 people · 1 points · first shared 2018 · discussion on HN
- 8Intel AMT some new stealth-vector attacks and good old vulnerabilities1 people · 1 points · first shared 2017 · discussion on HN
- 9Mythbusters cve 2017 56891 people · first shared 2017
- 10BH Las Vegas 2017 Intel AMT Stealth Breakthrough presentation.pdf1 people · first shared 2017
What HN people wrote when they linked it
ComodoHacker · 2017-05-07
That comment id great, but where is the source? I can't find any technical details following links in the article. Moreover, Embedi team who found the vulnerability says[0] on their site: "Intel representatives have asked Embedi to hold off on disclosing any technical details regarding this issue until further notice."
Or is the commenter just guessing?
0. https://www.embedi.com/news/mythbusters-cve-2017-5689
hilmipilmi · 2017-10-11
I used it to look into Gigabytes response to Intel SA 00075
described in https://embedi.com/files/presentations/BH-Las-Vegas-2017-Intel-AMT-Ste…
before: http://download.gigabyte.us/FileList/BIOS/brix_bios_bsi5ha(a)-6300_f3.…
after: http://download.gigabyte.us/FileList/BIOS/brix_bios_bsi5ha(a)-6300_f4.…
You can see that there is an extra function call added that tests for response.length.
Given the easy availability of the assembler dump you can expect progress towards demystifying IME.
I'm not a professional in the security field, but I sense that there is lots of possibilities by just doing a
"strings image/00275000.NFTP/amt.mod". Gigabyte might be special, but they have left their assert prints in the code
and you can get a sense what the thing is doing...
Kwastie · 2017-10-10
interestingly enough some implementations are broken because of buggy UEFI (AMI) https://embedi.com/blog/bypassing-intel-boot-guard
lima · 2017-05-07
As far as I know, Embedi and not SemiAccurate found and reported the issue.
https://www.embedi.com/files/white-papers/Silent-Bob-is-Silent.pdf
> An authentication bypass vulnerability, which will be later known as CVE-2017-5689, was originally
discovered in mid-February of 2017 while doing side-research on the internals of Intel ME firmware.
The first objects of interest were network services and protocols.