Intel Says 'Partitions' in New Chips Will Correct the Design Flaw that Created Spectre and Meltdown (geekwire.com) 68
Intel said on Thursday it is introducing hardware protections against the Spectre CPU flaw that was discovered last year. From a report: Starting with the Cascade Lake version of its Xeon server processors later this year, Intel will incorporate "protective walls" in its hardware that prevent malicious hackers from using speculative execution techniques to steal private information from the secure part of the processor. These fixes will also ship with the PC version of the Cascade Lake chips, but the tech industry has been much more concerned about the effect of these design flaws on server processors running in data centers and cloud vendors.
The new fixes allow Intel to still benefit from the performance advantages of speculative execution -- in which a processor guesses which upcoming instructions it will need to execute in order to speed things up -- without the security risks. The hardware changes address Variants 2 and 3 of the Spectre and Meltdown issues first disclosed in early January, and software fixes should continue to address Variant 1, Intel said.
The new fixes allow Intel to still benefit from the performance advantages of speculative execution -- in which a processor guesses which upcoming instructions it will need to execute in order to speed things up -- without the security risks. The hardware changes address Variants 2 and 3 of the Spectre and Meltdown issues first disclosed in early January, and software fixes should continue to address Variant 1, Intel said.
Obligatory: Intel CPU Backdoor Report (Jan 1 2018) (Score:2, Informative)
Change log:
2018/01/01 - Added 14 Useful Links. Disable Intel ME 11 via undocumented NSA "High Assurance Platform" mode with me_cleaner, Blackhat Dec 2017 Intel ME presentation, Intel ME CVEs (CVSS Scored 7.2-10.0)
Intel CPU Backdoor Report
The goal of this report is to make the existence of Intel CPU backdoors a common knowledge and provide information on backdoor removal.
What we know about Intel CPU backdoors so far:
TL;DR version
Your Intel CPU and Chipset is running a backdoor as we speak.
The backdoor hardware is inside the CPU/Bridge and the backdoor firmware (Intel Management Engine) is in the chipset flash memory.
30C3 Intel ME live hack:
[Video] 30C3: Persistent, Stealthy, Remote-controlled Dedicated Hardware Malware [youtube.com]
@21:43, keystrokes leaked from Intel ME above the OS, wireshark failed to detect packets.
[Quotes] Vortrag [events.ccc.de]:
"the ME provides a perfect environment for undetectable sensitive data leakage on behalf of the attacker".
"We can permanently monitor the keyboard buffer on both operating system targets."
Decoding Intel backdoors:
The situation is out of control and the Libreboot/Coreboot community is looking for BIOS/Firmware experts to help with the Intel ME decoding effort.
If you are skilled in these areas, download Intel ME firmwares from this collection [win-raid.com] and have a go at them, beware Intel is using a lot of counter measures to prevent their backdoors from being decoded (explained below).
Backdoor removal:
The backdoor firmware can be removed by following this guide [github.io] using the me_cleaner [github.com] script.
Removal requires a Raspberry Pi (with GPIO pins) and a SOIC clip.
2017 Dec Update:
Intel ME on recent CPUs may be disabled by enabling the undocumented NSA HAP mode [ptsecurity.com], use me_cleaner [github.com] with -S option to set the HAP bit, see me_cleaner: HAP AltMeDisable bit [github.com].
Useful links (Added 2018 Jan 1):
Disabling Intel ME 11 via undocumented HAP mode (NSA High Assurance Platform mode) [ptsecurity.com]
me_cleaner: Set HAP AltMeDisable bit with -S option [github.com]
Blackhat 2017: How To Hack A Turned Off Computer Or Running Unsigned Code In Intel Management Engine [blackhat.com]
EFF: Intel's Management Engine is a security hazard, and users need a way to disable it [eff.org]
Sakaki's EFI Install Guide/Disabling the Intel Management Engine [gentoo.org]
Intel ME bug storm: Hardware vendors race to identify and provide updates for dangerous Intel flaws. [zdnet.com]
CVE-2017-5689 [cvedetails.com]: An unprivileged network attacker could gain system privileges to provisioned Intel manageability SKUs
CVE-2017-5705 [cvedetails.com]: Multiple buffer overflows in kernel in Intel Manageability Engine Firmware
CVE-2017-5706 [cvedetails.com]: Multiple buffer overflows in kernel in Intel Server Platform Services Firmware
CVE-2017-5707 [cvedetails.com]: Multiple buffer overflows in kernel in Intel Trusted Execution Engine Firmware
CVE-2017-5708 [cvedetails.com]: Multiple privilege escalations in kernel in Intel Manageability Engine Firmware
CVE-2017-5709 [cvedetails.com]: Multiple privilege escalations in kernel in Intel Server Platform Services Firmware
CVE-2017-5710 [cvedetails.com]: Multiple privilege escalations in kernel in Intel Trusted Execution Engine Firmware
CVE-2017-5711 [cvedetails.com]: Multiple buffer overflows in Active Management Technology (AMT)
CVE-2017-5712 [cvedetails.com]: Buffer overflow in Active Management Technology (AMT)
Useful links (Added 2017):
The Intel ME subsystem can take over your machine, can't be audited [ycombinator.com]
REcon 2014 - Intel Management Engine Secrets [youtube.com]
Untrusting the CPU (33c3) [youtube.com]
Towards (reasonably) trustworthy x86 laptops [youtube.com]
30C3 To Protect And Infect - The militarization of the Internet [youtube.com]
30c3: To Protect And Infect Part 2 - Mass Surveillance Tools & Software [youtube.com]
1. Introduction, what is Intel ME
Short version, from Intel staff:
Re: What Intel CPUs lack Intel ME secondary processor? [intel.com]
Amy_Intel Feb 8, 2016 9:27 AM
The Management Engine (ME) is an isolated and protected coprocessor, embedded as a non-optional part in all current Intel chipsets, I even checked with the engineering department and they confirmed it.
Long version:
ME: Management Engine [libreboot.org]
The Intel Management Engine (ME) is a separate computing environment physically located in the MCH chip or PCH chip replacing ICH.
The ME consists of an individual processor core, code and data caches, a timer, and a secure internal bus to which additional devices are connected, including a cryptography engine, internal ROM and RAM, memory controllers, and a direct memory access (DMA) engine to access the host operating system's memory as well as to reserve a region of protected external memory to supplement the ME's limited internal RAM. The ME also has network access with its own MAC address through the Intel Gigabit Ethernet Controller integrated in the southbridge (ICH or PCH).
The Intel Management Engine with its proprietary firmware has complete access to and control over the PC: it can power on or shut down the PC, read all open files, examine all running applications, track all keys pressed and mouse movements, and even capture or display images on the screen. And it has a network interface that is demonstrably insecure, which can allow an attacker on the network to inject rootkits that completely compromise the PC and can report to the attacker all activities performed on the PC. It is a threat to freedom, security, and privacy that can't be ignored.
ME firmware versions 6.0 and later, which are found on all systems with an Intel Core i3/i5/i7 CPU and a PCH, include "ME Ignition" firmware that performs some hardware initialization and power management. If the ME's boot ROM does not find in the SPI flash memory an ME firmware manifest with a valid Intel signature, the whole PC will shut down after 30 minutes.
Quotes on Intel backdoors:
A message from RMS [fsf.org]
by Richard Stallman on Dec 29, 2016 09:45 AM
The current generation of Intel and AMD processor chips are designed with vicious back doors that users cannot shut off. (In Intel processors, it's the "management engine".)
No users should trust those processors.
2. The backdoor is next to impossible to de
In related news ... (Score:5, Funny)
Intel will incorporate "protective walls" in its hardware ...
Big, beautiful walls and Intel will get AMD to pay for them. :-)
Re: (Score:3, Funny)
Intel will incorporate "protective walls" in its hardware ...
Big, beautiful walls and Intel will get AMD to pay for them. :-)
By shorting AMD stock?
Aren't we all supposed to be dead by now? (Score:1, Insightful)
Re: (Score:2)
While I agree, these flaws are in hardware that is staying in use for longer and longer with each cycle (because the performance is still adequate enough that people don't want to buy a new PC). That gives people plenty of time to find ways to exploit the flaw, and still have many vulnerable systems out there.
Software vulnerabilities can be patched up within days. This one will be years before there is "herd immunity".
Re: (Score:2)
What they aren't designed to do, is announce their presence on Slashdot. Doubtlessly, they will be reported here - after things called investigations are completed, by people called researchers, organized into things called agencies.
Meanwhile, we'll have these other people called 'shills' continually trying to downplay this vulnerability until Intel finally has dumped its whole stock of bugged
Intel's stock is worth $0 and should be bankrupt (Score:1)
Failed at that before (Score:5, Insightful)
Intel has already failed at exactly that before :
IntelME was supposed to be exactly that: a separated isolated ARC core in the chipset, that was used to handle administrative tasks even if the main x86 CPU was shutdown (IntelAMT - Intel own NIH syndrom "lights out management" vaguely similar to IPMI). Got further repurposed for some trusted security tasks (TPM), got further repurposed for DRM related task, used also for critical steps to bring the hardware up.
And was the target of attacks and exploits last summer. Attacks that thus work EVEN when the main x86 CPU is turned off (remembre, before the overarching list of roles, it began as an IPMI-like solution). To the point that vendors like DELL started offering new BIOS/UEFI firmware, in which the Intel ME code was stripped to the bare strict minimum for just the "bring hardware up" part.
But I'm sure *this time around* the walled secure CPU core that Intel promise will be flawless and never exploited~~
Re: (Score:3, Informative)
No, these are rather small modifications to existing designs: moving protection checks earlier (for meltdown) to prevent speculative execution past a guaranteed exception is not a complete redesign.
The protection bits are in the TLB entry, that you need to look up for address translation anyway, and then they may be checked in parallel with the cache access. Compared to looking up the tags for an 8-way (or 4, can't remember) cache access, checking the protection is simple.
Recent chips have 57 virtual addres
Intel Management Engine (Score:2)
Please, please please Intel, provide a mechanism to COMPLETELY disable the IME BackDoor in your CPUs ( https://en.wikipedia.org/wiki/Intel_Management_Engine/ [wikipedia.org] )
Re: (Score:2)
AMD has the exact same thing so don't hold your hopes up.
Re:Intel Management Engine (Score:5, Funny)
You work for Oracle?
Re: (Score:2)
Spot fucking on.
How about more than protective walls? (Score:5, Interesting)
AMD has its bugs, but one new feature that they have implemented is RAM encryption. This way, one VM has no way of obtaining content from another VM's RAM space, should a leak be possible. Why not be proactive in dealing with virtualization and keeping stuff separate, perhaps adding some pipeline randomization to foil side channel attacks?
Intel knows what they are doing. Might as well be ahead of the curve and add some useful security features.
Re: (Score:2)
call me crazy (Score:1)
what's wrong with "check for permissions in the pipeline before doing a speculative memory access"
Re: (Score:2)
that's not how these vulnerabilities work. each process is only allowed to access its allowed memory. the bugs are from detectable side effects in caches and timings of operations
Re: (Score:2)
Isn't that exactly how it works? The processor starts working on a code path which may or may not end up being taken. While doing so, that code is not subject to the usual checks The checks only come into force once the path is taken.
Re: (Score:2)
no. even the path that isn't eventually taken has the proper restrictions on memory access. The issue are "clues" left behind that other processes might snoop with certain weird and extraordinary measures.
Re: (Score:2)
But... that's exactly how it works.
http://www.i-programmer.info/n... [i-programmer.info]
Speculatively, a byte (for example) is fetched from restricted memory. Under normal execution, this would fail with an exception. But under speculative execution, this byte is returned, and then it's used as index to access unrestricted memory - which caches that position in unrestricted memory.
If the speculatively executed section had proper restrictions, it wouldn't have been able to access that restricted memory at all, much less use the
Oh great (Score:5, Funny)
Partitions inside Intel CPUs? How often will we have to re-format the damn things?
Re: (Score:1)
What the heck, it's more billable hours!
I want storage and virtualization benchsmarks (Score:1)
Not between Intel before and after the patches but Intel after against Ryzen and ThreadRipper now/after.
Sure I know Intel perform worse with an SSD now and possibly even worse with virtualization but can I please get to see how Ryzen perform with it too?
Won't fix your 'AMD' problem (Score:5, Interesting)
While you went about paying a company to diss AMD, I checked CTS' report, found out one of my intel systems uses one of the mentioned vulnerable chipsets, the ASM1142, for its USB 3.1 controller.
I bet that the PoC exploit would work on the intel platform right out of the box, if the CTS code isn't full of shit.
Gimme a copy so I can test it out.
We did this in the mainframe days (Score:5, Interesting)
Re: (Score:2)
An expensive new chip security to look after every CPU.
The new generations of OS won't install on any product that does not have the new "security" chips.
Want to run that app, game, business software? Upgrade all the hardware too. It's for security.
12 months later its time to buy a brand new motherboard with the next gen security CPU.
No new OS update unless the new supported chip is found.
Intel FUD working (Score:3)
This is what we call a 'workaround'. (Score:1)
If somebody beats you up every time you go to the supermarket, the fix would be to get this slugger arrested. Now you can go to the supermarket without a hassle.
The alternative would be to walk around the block and avoid that battler. This is what Intel has chosen as their 'solution'.
I'm not judging, I'm merely pointing out the difference.