Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Vulnerabilities / Threats

12/6/2017
11:30 AM
Connect Directly
Twitter
RSS
E-Mail
50%
50%

How the Major Intel ME Firmware Flaw Lets Attackers Get 'God Mode' on a Machine

Researchers at Black Hat Europe today revealed how a buffer overflow they discovered in the chip's firmware can be abused to take control of a machine - even when it's turned 'off.'

A recently discovered and now patched vulnerability in Intel microprocessors could be used by an attacker to burrow deep inside a machine and control processes and access data - even when a laptop, workstation, or server is powered down.

Researchers who discovered the flaw went public today at Black Hat Europe in London with details of their finding, a stack buffer overflow bug in the Intel Management Engine (ME) 11 system that's found in most Intel chips shipped since 2015. ME, which contains its own operating system, is a system efficiency feature that runs during startup and while the computer is on or asleep, and handles much of the communications between the processor and external devices.

An attacker would need physical, local access to a victim's machine to pull off the hack, which would give him or her so-called "god mode" control over the system, according to Positive Technologies security researchers Mark Ermolov and Maxim Goryachy, who found the flaw.

And although Intel issued a security advisory and update for the vulnerability on November 20, Ermolov and Goryachy argue that the fix doesn't prevent an attacker from using other vulnerabilities for the attack that Intel also patched in the recent ME update, including buffer overflows in the ME kernel (CVE-2017-5705), the Intel Server Platform Services Firmware kernel (CVE-2017-5706), and the Intel Trusted Execution Engine Firmware kernel (CVE-2017-5707).

All the attacker would have to do is convert the machine to a vulnerable version of ME and exploit one of the older vulns in it, they say. Those flaws "have been patched by Intel through its latest firmware release, but if an attacker has write access to the Management Engine region, they can downgrade to an older, vulnerable version of Management Engine and exploit a vulnerability that way," Goryachy told Dark Reading.

"Unfortunately, it's not possible to completely defend against this [buffer overflow] flaw" in the Intel ME, he says.

Intel OEMs can mitigate such attacks by turning off the manufacturer mode of the chip, he says. That way, they "make sure that a local vector attack … is not possible," notes Goryachy.

How the Attack Works

An attacker would need access to the "write" feature in ME, which is part of the SPI-flash chip that contains the firmware for ME and the BIOS, according to the researchers. He or she would then rewrite the flash and run a buffer overflow exploit, which would give him or her access to the ME.

"An attacker will have almost full control at the target machine, with access to memory, USB devices, and the network," Goryachy  says. "With this, an attacker could decrypt an encrypted hard disk of someone using Microsoft Bitlocker, or access content protected by DRM [Digital Rights Management], or intercept all activity on the PC, such as viewing what's on the screen, intercepting what's typed on the keyboard, and accessing data stored on disks."

It's up to Intel's OEMs to issue firmware updates, and Intel in its security advisory last month urged customers to check with their system OEMs for the updates. Enterprises also can use the open-source CHIPSEC utility to check for BIOS configuration errors, Goryachy says, and update to the latest version of the BIOS.

The Intel processors affected by the flaw are: 6th, 7th & 8th Generation Intel Core; Xeon E3-1200 v5 & v6 Product Family; Xeon Scalable Family; Xeon W Family; Atom C3000 Family; Apollo Lake Intel Atom E3900 series; Apollo Lake Intel Pentium; and CeleronG, N and J series.

This is the second major firmware vulnerability issue for Intel this year. In early May, the company disclosed a critical privilege-escalation bug in its Active Management Technology (AMT) firmware used in many Intel chips that affected AMT firmware versions dating back to 2010.

"Over the past 12 years, only two vulnerabilities allowing the execution of arbitrary code on Management Engine have been found," Goryachy says. "The AMT vulnerability only allows an attacker to bypass authentication. The vulnerability Positive Technologies discovered enables an attacker to insert invisible backdoors on a target machine."

Related Content:

Kelly Jackson Higgins is the Executive Editor of Dark Reading. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise ... View Full Bio
 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
News
US Formally Attributes SolarWinds Attack to Russian Intelligence Agency
Jai Vijayan, Contributing Writer,  4/15/2021
News
Dependency Problems Increase for Open Source Components
Robert Lemos, Contributing Writer,  4/14/2021
News
FBI Operation Remotely Removes Web Shells From Exchange Servers
Kelly Sheridan, Staff Editor, Dark Reading,  4/14/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win an Amazon Gift Card! Click Here
Latest Comment: "Thank goodness that he's only asking about a LOGIC probe..."
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Flash Poll
How Enterprises are Developing Secure Applications
How Enterprises are Developing Secure Applications
Recent breaches of third-party apps are driving many organizations to think harder about the security of their off-the-shelf software as they continue to move left in secure software development practices.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2021-31607
PUBLISHED: 2021-04-23
In SaltStack Salt 2016.9 through 3002.6, a command injection vulnerability exists in the snapper module that allows for local privilege escalation on a minion. The attack requires that a file is created with a pathname that is backed up by snapper, and that the master calls the snapper.diff function...
CVE-2021-31597
PUBLISHED: 2021-04-23
The xmlhttprequest-ssl package before 1.6.1 for Node.js disables SSL certificate validation by default, because rejectUnauthorized (when the property exists but is undefined) is considered to be false within the https.request function of Node.js. In other words, no certificate is ever rejected.
CVE-2021-2296
PUBLISHED: 2021-04-22
Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is Prior to 6.1.20. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromi...
CVE-2021-2297
PUBLISHED: 2021-04-22
Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is Prior to 6.1.20. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromi...
CVE-2021-2298
PUBLISHED: 2021-04-22
Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.23 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attac...