Experts published a PoC code for Intel Management Engine JTAG flaw
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2017-5689 | Unauthenticated Privilege Escalation in Intel AMT, ISM, and SBT Manageability Firmware CVE-2017-5689 is a critical (CVSS 9.8) privilege escalation flaw in the manageability features of the Intel Management Engine: Active Management Technology (AMT), Standard Manageability (ISM), and Small Business Technology (SBT), which ship with Intel vPro-class business platforms. An unprivileged remote attacker can exploit it by sending crafted unauthenticated requests to the AMT/ISM network interface (typically TCP ports 16992/16993) on a provisioned system, gaining full system/administrative privileges with no credentials or user interaction. Alternatively, an unprivileged local attacker can provision the manageability features to gain system privileges on AMT, ISM, and SBT. Affected systems include business PCs and workstations with AMT/ISM enabled, plus OEM implementations such as HPE ProLiant ML10 Gen9 servers and a wide range of Siemens SIMATIC industrial PCs, controllers, and panel firmware. The flaw is listed in CISA's Known Exploited Vulnerabilities catalog (added 2022-01-28, ransomware use unknown), has a public PoC (Embedi's 'Silent Bob is Silent'), and carries a 92.2% EPSS probability of exploitation, so it should be treated as actively exploited. Do: Update Intel Management Engine/AMT firmware to the fixed versions released under Intel's May 2017 advisory (SA-00075) via your OEM — apply HPE ProLiant ML10 Gen9 and Siemens SIMATIC firmware updates per vendor instructions, as required by CISA KEV. Until patched, block or restrict ports 16992/16993 at the perimeter, keep AMT confined to trusted management networks, or disable AMT/SBT where not required, and verify provisioned systems with Intel's detection guidance. | 9.8 | 92% | KEV PoC |
| masstens of millions of vPro-enabled endpoints ship with AMT/ISM, of which hundreds of thousands were directly exposed to the internet |
Full article550 words · extracted from securityaffairs.com · click to collapse
A group of security researchers has published a proof-of-concept exploit code for a vulnerability in the Intel Management Engine JTAG.
A team of security researchers has published a proof-of-concept exploit code for a vulnerability in the Intel Management Engine JTAG.
Last year the same group of experts at Positive Technologies discovered an undocumented configuration setting that disabled the Intel Management Engine.
The Intel Management Engine consists of a microcontroller that works with the Platform Controller Hub chip, in conjunction with integrated peripherals, it is a critical component that handles data exchanged between the processor and peripherals.
For this reason, security experts warned in the past of the risks for Intel Management Engine vulnerabilities. An attacker can exploit a flaw in the Intel ME to establish a backdoor on the affected system and gain full control over it.
The flaw was patched, but the team composed of Mark Ermolov, Maxim Goryachy, and Dmitry Sklyarov, has devised a walkthrough for accessing the Joint Test Action Group (JTAG) feature implemented in the Intel’s Management Engine (IME).
JTAG feature provides debugging access to the processor via special USB 3.0 debugging connectors.
“A special USB 3.0 debugging connector is also necessary, though those who enjoy hacking hardware can make their own by isolating the D+, D-, and Vcc contacts on a USB 3.0 Type A Male to Type A Male cable.” reported ElReg.
The PoC incorporates the work of Dmitry Sklyarov, another researcher from the company.
The exploitation of the flaw is not simple, it requests the physical access via USB to the device.
In May 2107, security experts discovered a critical remote code execution (RCE) vulnerability, tracked as CVE-2017-5689, in the remote management features implemented on computers shipped with Intel Chipset in past 9 years.
The vulnerability affected the Intel Management Engine (ME) technologies such as Active Management Technology (AMT), Small Business Technology (SBT), and Intel Standard Manageability (ISM) and could be exploited by hackers to remotely take over the vulnerable systems.
The Electronic Frontier Foundation asked Intel to provide a way to disable the IME.
In August 2017, the experts from Positive Technologies (Dmitry Sklyarov, Mark Ermolov, and Maxim Goryachy) discovered a way to disable the Intel Management Engine 11 via an undocumented mode.
The researchers discovered that it is possible to turn off the Intel ME by setting the undocumented high assurance platform (HAP) bit to 1 in a configuration file.
The experts discovered that the security framework was developed by the US National Security Agency … yes the NSA!
In November Intel issued a security patch for the JTAG vulnerability (INTEL-SA-00086) and in February 2018 it issued a new update for the fix. The vulnerability allowed an attacker to execute arbitrary and unsigned code by using the PoC code to activate JTAG for the IME core.
The PoC was working on a Gigabyte Brix GP-BPCE-3350C, (Intel Celeron-based compact PC), the experts now note that now it should work on other Intel Apollo Lake-based PCs.
The exploitation of the flaw also requires the availability of the TXE firmware version 3.0.1.1107 and a utility called Intel TXE System Tools that is not available only to some of Intel OEM partners.
| [adrotate banner=”9″] | [adrotate banner=”12″] |
(Security Affairs – JTAG, hacking)
[adrotate banner=”5″]
[adrotate banner=”13″]
Text extracted automatically; images, tables and formatting may be missing. Original: https://securityaffairs.com/75733/hacking/intel-management-engine-jtag-flaw.html