Zato Putin pravi ruske procesore za namenske potrebe.
Potpis
Nije bitno koji su zaključci izvučeni, već kako se do njih došlo.
I.. konacno se desilo i to: Remote execution rupetina u Intel ME-u
Zaključano
Zakačeno
Brate, taj Putin... sad i Verilog zna da radi.... Sta ti je covek, gromada!
BTW, ja sam zagledao ovo vec neko vreme:
https://www.raptorengineering.com/TALOS/prerelease.php
malo i pojasnjenja:
http://www.phoronix.com/scan.p...em=talos-workstation&num=1
BTW, ja sam zagledao ovo vec neko vreme:
https://www.raptorengineering.com/TALOS/prerelease.php
malo i pojasnjenja:
http://www.phoronix.com/scan.p...em=talos-workstation&num=1
Potpis
Please do not feed the Trolls!
Blasphemy? How can I blaspheme? I'm a god!'
Blasphemy? How can I blaspheme? I'm a god!'
@Space Beer,
Puno srece sa modernim ARM cipova bez TrustZone-a i proprietary bootloadera koji se inivijalizuju sa nekog malog "radio" procesora.
Puno srece sa modernim ARM cipova bez TrustZone-a i proprietary bootloadera koji se inivijalizuju sa nekog malog "radio" procesora.
Potpis
DigiCortex (ex. SpikeFun) - Cortical Neural Network Simulator:
http://www.digicortex.net/node/1 Videos: http://www.digicortex.net/node/17 Gallery: http://www.digicortex.net/node/25
PowerMonkey - Redyce CPU Power Waste and gain performance! - https://github.com/psyq321/PowerMonkey
http://www.digicortex.net/node/1 Videos: http://www.digicortex.net/node/17 Gallery: http://www.digicortex.net/node/25
PowerMonkey - Redyce CPU Power Waste and gain performance! - https://github.com/psyq321/PowerMonkey
Btw, Lenovo W541 laptop - cak i ako se u BIOS-u uradi "Permanently disable" za AMT, Intel-ova alatka za detekciju bug-a kaze da je sistem je i dalje supalj:
Risk Assessment
Based on the version of the ME, the System is Vulnerable.
If Vulnerable, contact your OEM for support and remediation of this system.
For more information, refer to CVE-2017-5689 at: https://nvd.nist.gov/vuln/detail/CVE-2017-5689 or the Intel security advisory Intel-SA-00075 at: https://security-center.intel....-SA-00075&languageid=en-fr
INTEL-SA-00075 Discovery Tool GUI Version
Dakle, bez Lenovo saradnje ovu rupetinu je nemoguce skroz eliminisati.
https://support.lenovo.com/nl/en/product_security/len-14963
Target za fix: 17. Jun...
Dakle, h4xori imaju vise od mesec dana da naprave haos.
Postavlja se pitanje WTF "permanently disable" opcija u BIOS-u uopste i radi... verovatno setuje neki flag na 0 :(
Citat:
Risk Assessment
Based on the version of the ME, the System is Vulnerable.
If Vulnerable, contact your OEM for support and remediation of this system.
For more information, refer to CVE-2017-5689 at: https://nvd.nist.gov/vuln/detail/CVE-2017-5689 or the Intel security advisory Intel-SA-00075 at: https://security-center.intel....-SA-00075&languageid=en-fr
INTEL-SA-00075 Discovery Tool GUI Version
Dakle, bez Lenovo saradnje ovu rupetinu je nemoguce skroz eliminisati.
https://support.lenovo.com/nl/en/product_security/len-14963
Target za fix: 17. Jun...
Dakle, h4xori imaju vise od mesec dana da naprave haos.
Postavlja se pitanje WTF "permanently disable" opcija u BIOS-u uopste i radi... verovatno setuje neki flag na 0 :(
Potpis
DigiCortex (ex. SpikeFun) - Cortical Neural Network Simulator:
http://www.digicortex.net/node/1 Videos: http://www.digicortex.net/node/17 Gallery: http://www.digicortex.net/node/25
PowerMonkey - Redyce CPU Power Waste and gain performance! - https://github.com/psyq321/PowerMonkey
http://www.digicortex.net/node/1 Videos: http://www.digicortex.net/node/17 Gallery: http://www.digicortex.net/node/25
PowerMonkey - Redyce CPU Power Waste and gain performance! - https://github.com/psyq321/PowerMonkey
https://www.theregister.co.uk/...5/05/intel_amt_remote_exploit/
How to remote hijack computers using Intel's insecure chips: Just use an empty login string
Code dive You can remotely commandeer and control computers that use vulnerable Intel chipsets by sending them empty authentication strings.
You read that right. When you're expected to send a password hash, you send zero bytes. Nothing. Nada. And you'll be rewarded with powerful low-level access to a vulnerable box's hardware from across the network – or across the internet if the management interface faces the public web.
I... sampionski kod:
If you poke around inside Intel's firmware, you'll find this gem that lies at the heart of the matter – machine code that decompiles into C that looks pretty much like this:
Jeza..
Vise detalja:
https://www.embedi.com/files/w...apers/Silent-Bob-is-Silent.pdf
Kapiram da ce Intel uloziti silne resurse da sledeca verzija AMT-a bude potpuno kriptovan binarni blob... da se bar ne vidi blam.
Citat:
How to remote hijack computers using Intel's insecure chips: Just use an empty login string
Code dive You can remotely commandeer and control computers that use vulnerable Intel chipsets by sending them empty authentication strings.
You read that right. When you're expected to send a password hash, you send zero bytes. Nothing. Nada. And you'll be rewarded with powerful low-level access to a vulnerable box's hardware from across the network – or across the internet if the management interface faces the public web.
I... sampionski kod:
Citat:
If you poke around inside Intel's firmware, you'll find this gem that lies at the heart of the matter – machine code that decompiles into C that looks pretty much like this:
Code:
if(strncmp(computed_response, user_response, response_length))
deny_access();
if(strncmp(computed_response, user_response, response_length))
deny_access();
Jeza..
Vise detalja:
https://www.embedi.com/files/w...apers/Silent-Bob-is-Silent.pdf
Kapiram da ce Intel uloziti silne resurse da sledeca verzija AMT-a bude potpuno kriptovan binarni blob... da se bar ne vidi blam.
Potpis
DigiCortex (ex. SpikeFun) - Cortical Neural Network Simulator:
http://www.digicortex.net/node/1 Videos: http://www.digicortex.net/node/17 Gallery: http://www.digicortex.net/node/25
PowerMonkey - Redyce CPU Power Waste and gain performance! - https://github.com/psyq321/PowerMonkey
http://www.digicortex.net/node/1 Videos: http://www.digicortex.net/node/17 Gallery: http://www.digicortex.net/node/25
PowerMonkey - Redyce CPU Power Waste and gain performance! - https://github.com/psyq321/PowerMonkey
Genijalno :D Koliko sam shvatio, pogođeni su samo Q čipsetovi, tj. poslovni korisnici? Mi obični nemamo razloga za brigu, bar za sada?
Q i neki C cipseti, koji obicno jesu "poslovni" ali ima masa masina koje zavrse i kod krajnjih korisnika.
Potpis
DigiCortex (ex. SpikeFun) - Cortical Neural Network Simulator:
http://www.digicortex.net/node/1 Videos: http://www.digicortex.net/node/17 Gallery: http://www.digicortex.net/node/25
PowerMonkey - Redyce CPU Power Waste and gain performance! - https://github.com/psyq321/PowerMonkey
http://www.digicortex.net/node/1 Videos: http://www.digicortex.net/node/17 Gallery: http://www.digicortex.net/node/25
PowerMonkey - Redyce CPU Power Waste and gain performance! - https://github.com/psyq321/PowerMonkey
Imam neki laptop Lenovo sa Intelom.
Pokazuje neke simptome sllčne ovde opisanim.
Ne može da se uključi
nego kad odstoji par nedelja bez napajanja
onda proradi na 20 minuta i naprasno se ugasi.
Zato pretpostavljam ako je neki "uljez" da se uvukao u BIOS ili tako negde.
Da li neko ima ideju kako doskočiti?
Pokazuje neke simptome sllčne ovde opisanim.
Ne može da se uključi
nego kad odstoji par nedelja bez napajanja
onda proradi na 20 minuta i naprasno se ugasi.
Zato pretpostavljam ako je neki "uljez" da se uvukao u BIOS ili tako negde.
Da li neko ima ideju kako doskočiti?
To više zvuči kao neki hladan lem koji kad se laptop zagreje jednostavno izgubi kontakt i laptop prestane da radi, pa kad se dovoljno ohladi kontakt se uspostavi i opet sve radi. Ili što bi rekao Branko Kockica "sunce vrelo širi telo, zima bela skuplja tela" ;-) Dakle, ništa softver, izgleda kao čist hardverski problem...
A tako?
Stavio sam u friz pa ću da vidim kad postigne 0 stepeni.
Srećom da je ona komora veličine ko da su znali šta ću trpati unutra :)
Stavio sam u friz pa ću da vidim kad postigne 0 stepeni.
Srećom da je ona komora veličine ko da su znali šta ću trpati unutra :)
Pazi samo na kondenzovanje vlage kad ga izvadiš odande ;-)
Ma imam iskustva sa tim :)
Medjutim ovo čudo i nakon "hladnog tuša" ne radi.
Ipak mislim da ima nekih problema sa biosom.
Mada ni hladan lem ne isključujem. Samo što hladan lem teže dolazi do izražaja ako je laptop fiksiran kao što je bio slučaj kod mene.
Ok, da ne ometam temu.
Poz.
Medjutim ovo čudo i nakon "hladnog tuša" ne radi.
Ipak mislim da ima nekih problema sa biosom.
Mada ni hladan lem ne isključujem. Samo što hladan lem teže dolazi do izražaja ako je laptop fiksiran kao što je bio slučaj kod mene.
Ok, da ne ometam temu.
Poz.
Postaje sve bolje i bolje:
Prezentacija u decembru:
https://www.blackhat.com/eu-17...n-intel-management-engine-8668
How to Hack a Turned-Off Computer, or Running Unsigned Code in Intel Management Engine
Unfortunately, this changing did not go without errors. In a subsystem change that will be detailed in the talk of Intel ME version 11+, a vulnerability was found. It allows an attacker of the machine to run unsigned code in PCH on any motherboard via Skylake+. The main system can remain functional, so the user may not even suspect that his or her computer now has malware resistant to reinstalling of the OS and updating BIOS. Running your own code on ME gives unlimited possibilities for researchers, because it allows exploring the system in dynamics.
Ako stvarno mogu da nateraju ME podsistem da trci nepotpisan kod bez nekih velikih vratolomija, mislim da ce to napraviti poveci problem kako Intel-u tako i njihovim OEM kupcima i verovatno ce doci do zahteva od strane kupaca da se cela stvar moze iskljuciti, potpuno.
Jedna dobra vest za one koji su propustili, izgleda da ME ima "kill switch" koji se koristi u 'High Assurance' programu (za drzavne sluzbe) i koji su istrazivaci uspeli da pronadju:
http://blog.ptsecurity.com/2017/08/disabling-intel-me.html
Na zalost, ovo nije bas neko siroko primenjivo resenje posto zahteva a) hakovanje opreme, b) moze da dovede do brick-ovanja sistema i c) nije podrzana konfiguracija od strane proizvodjaca.
Prezentacija u decembru:
https://www.blackhat.com/eu-17...n-intel-management-engine-8668
Citat:
How to Hack a Turned-Off Computer, or Running Unsigned Code in Intel Management Engine
Unfortunately, this changing did not go without errors. In a subsystem change that will be detailed in the talk of Intel ME version 11+, a vulnerability was found. It allows an attacker of the machine to run unsigned code in PCH on any motherboard via Skylake+. The main system can remain functional, so the user may not even suspect that his or her computer now has malware resistant to reinstalling of the OS and updating BIOS. Running your own code on ME gives unlimited possibilities for researchers, because it allows exploring the system in dynamics.
Ako stvarno mogu da nateraju ME podsistem da trci nepotpisan kod bez nekih velikih vratolomija, mislim da ce to napraviti poveci problem kako Intel-u tako i njihovim OEM kupcima i verovatno ce doci do zahteva od strane kupaca da se cela stvar moze iskljuciti, potpuno.
Jedna dobra vest za one koji su propustili, izgleda da ME ima "kill switch" koji se koristi u 'High Assurance' programu (za drzavne sluzbe) i koji su istrazivaci uspeli da pronadju:
http://blog.ptsecurity.com/2017/08/disabling-intel-me.html
Na zalost, ovo nije bas neko siroko primenjivo resenje posto zahteva a) hakovanje opreme, b) moze da dovede do brick-ovanja sistema i c) nije podrzana konfiguracija od strane proizvodjaca.
Potpis
DigiCortex (ex. SpikeFun) - Cortical Neural Network Simulator:
http://www.digicortex.net/node/1 Videos: http://www.digicortex.net/node/17 Gallery: http://www.digicortex.net/node/25
PowerMonkey - Redyce CPU Power Waste and gain performance! - https://github.com/psyq321/PowerMonkey
http://www.digicortex.net/node/1 Videos: http://www.digicortex.net/node/17 Gallery: http://www.digicortex.net/node/25
PowerMonkey - Redyce CPU Power Waste and gain performance! - https://github.com/psyq321/PowerMonkey
Btw, evo sta se desava kad se u ME-u ukljuci "HAP" mod:
http://blog.ptsecurity.com/2017/08/disabling-intel-me.html
Binary analysis of Intel ME firmware, as described in this paper.
If we remove some critical ME modules and enable HAP mode, Intel ME does not crash. This proves that HAP disables ME at an early stage.
We are quite sure that Intel ME is unable to exit this mode because we have not found code capable of doing so in the RBE, KERNEL, and SYSLIB modules.
Zanimljivo je da MEInfo ovakvu konfiguraciju zove "Alt Disable Mode".
http://blog.ptsecurity.com/2017/08/disabling-intel-me.html
Citat:
Binary analysis of Intel ME firmware, as described in this paper.
If we remove some critical ME modules and enable HAP mode, Intel ME does not crash. This proves that HAP disables ME at an early stage.
We are quite sure that Intel ME is unable to exit this mode because we have not found code capable of doing so in the RBE, KERNEL, and SYSLIB modules.
Zanimljivo je da MEInfo ovakvu konfiguraciju zove "Alt Disable Mode".
Potpis
DigiCortex (ex. SpikeFun) - Cortical Neural Network Simulator:
http://www.digicortex.net/node/1 Videos: http://www.digicortex.net/node/17 Gallery: http://www.digicortex.net/node/25
PowerMonkey - Redyce CPU Power Waste and gain performance! - https://github.com/psyq321/PowerMonkey
http://www.digicortex.net/node/1 Videos: http://www.digicortex.net/node/17 Gallery: http://www.digicortex.net/node/25
PowerMonkey - Redyce CPU Power Waste and gain performance! - https://github.com/psyq321/PowerMonkey