fbpx

Categories

Intel chip flaws leave millions of devices exposed

SECURITY RESEARCHERS HAVE raised the alarm for years about the Intel remote administration feature known as the Management Engine. The platform has a lot of useful features for IT managers, but it requires deep system access that offers a tempting target for attackers; compromising the Management Engine could lead to full control of a given computer. Now, after several research groups have uncovered ME bugs, Intel has confirmed that those worst-case fears may be possible.

On Monday, the chipmaker released a security advisory that lists new vulnerabilities in ME, as well as bugs in the remote server management tool Server Platform Services, and Intel’s hardware authentication tool Trusted Execution Engine. Intel found the vulnerabilities after conducting a security audit spurred by recent research. It has also published a Detection Tool so Windows and Linux administrators can check their systems to see if they're exposed.

Upper Management

The Management Engine is an independent subsystem that lives in a separate microprocessor on Intel chipsets; it exists to allow administrators to control devices remotely for all types of functions, from applying updates to troubleshooting. And since it has extensive access to and control over the main system processors, flaws in the ME give attackers a powerful jumping-off point. Some have even called the ME an unnecessary security hazard.

Intel specifically undertook what spokesperson Agnes Kwan called a “proactive, extensive, rigorous evaluation of the product,” in light of findings that Russian firmware researchers Maxim Goryachy and Mark Ermolov will present at Black Hat Europe next month. Their work shows an exploit that can run unsigned, unverified code on newer Intel chipsets, gaining more and more control using the ME as an unchecked launch point. The researchers also play with a sinister property of the ME: It can run even when a computer is “off” (just so long as the device is plugged in), because it is on a separate microprocessor, and essentially acts as a totally separate computer.

As with previous ME bugs, nearly every recent Intel chip is impacted, affecting servers, PCs, and IoT devices. Compounding the issue: Intel can provide updates to manufacturers, but customers need to wait for hardware companies to actually push the fixes out. Intel's maintaining a running list of available firmware updates, but so far only Lenovo has offered one up.

Intel has confirmed that those worst-case fears may be possible.

"These updates are available now," Intel said in a statement to WIRED. "Businesses, systems administrators, and system owners using computers or devices that incorporate these Intel products should check with their equipment manufacturers or vendors for updates for their systems, and apply any applicable updates as soon as possible." In many cases, it could be a while before that fix becomes available.

The newly disclosed vulnerabilities can cause instability or system crashes. They can be used to impersonate the ME, Server Platform Services, and Trusted Execution Engine to erode security verifications. And Intel says they can even be used to “load and execute arbitrary code outside the visibility of the user and operating system.” This is the crucial danger of the ME. If exploited, it can operate totally separate from the main computer, meaning that many ME attacks wouldn’t raise red flags.

Unclear Fallout

Still, the true impact of current ME vulnerability isn't clear, given the relatively limited amount of information Intel has released.

“This looks bad, but we don’t yet know how easy it will be to exploit these vulnerabilities,” says Filippo Valsorda, a cryptography engineer and researcher. “It’s a really wide range of machines that are impacted, not just servers. Intel seems worried enough to publish detection tools and do a well-orchestrated release.”

The good news is that most of the vulnerabilities require local access to exploit; someone has to have hands on a device or deep in a network. Intel does note, though, that some of the new wave of vulnerabilities can be exploited remotely if an attacker has administrative privileges. And some of the bugs also potentially allow for privilege escalation, which could make it possible to start with a standard user status and work up to higher network access.

“Based on public information, we have no real idea how serious this is yet. It could be fairly harmless, it could be a giant deal,” Matthew Garrett, a Google security researcher, wrote on Twitter when the vulnerabilities were first announced. But he quickly added that, “on reflection I don't see many outcomes where this is fairly harmless.”

It will take time for the full impact of these ME bugs to come into view, but for researchers who have warned about the dangers of ME for years, Intel's fixes now are cold comfort.

Read 6842 times

comments

  • Eric Jones
    Eric Jones 2 days ago

    Hi, Eric here with a quick thought about your website raindesigner.com...

    I’m on the internet a lot and I look at a lot of business websites.

    Like yours, many of them have great content.

    But all too often, they come up short when it comes to engaging and connecting with anyone who visits.

    I get it – it’s hard. Studies show 7 out of 10 people who land on a site, abandon it in moments without leaving even a trace. You got the eyeball, but nothing else.

    Here’s a solution for you…

    Talk With Web Visitor is a software widget that’s works on your site, ready to capture any visitor’s Name, Email address and Phone Number. You’ll know immediately they’re interested and you can call them directly to talk with them literally while they’re still on the web looking at your site.

    CLICK HERE https://talkwithwebvisitors.com to try out a Live Demo with Talk With Web Visitor now to see exactly how it works.

    It could be huge for your business – and because you’ve got that phone number, with our new SMS Text With Lead feature, you can automatically start a text (SMS) conversation – immediately… and contacting someone in that 5 minute window is 100 times more powerful than reaching out 30 minutes or more later.

    Plus, with text messaging you can follow up later with new offers, content links, even just follow up notes to keep the conversation going.

    Everything I’ve just described is extremely simple to implement, cost-effective, and profitable.

    CLICK HERE https://talkwithwebvisitors.com to discover what Talk With Web Visitor can do for your business.

    You could be converting up to 100X more eyeballs into leads today!

    Eric
    PS: Talk With Web Visitor offers a FREE 14 days trial – and it even includes International Long Distance Calling.
    You have customers waiting to talk with you right now… don’t keep them waiting.
    CLICK HERE https://talkwithwebvisitors.com to try Talk With Web Visitor now.

    If you'd like to unsubscribe click here http://talkwithwebvisitors.com/unsubscribe.aspx?d=raindesigner.com

  • Eric Jones
    Eric Jones 1 month ago

    Hi, Eric here with a quick thought about your website raindesigner.com...

    I’m on the internet a lot and I look at a lot of business websites.

    Like yours, many of them have great content.

    But all too often, they come up short when it comes to engaging and connecting with anyone who visits.

    I get it – it’s hard. Studies show 7 out of 10 people who land on a site, abandon it in moments without leaving even a trace. You got the eyeball, but nothing else.

    Here’s a solution for you…

    Talk With Web Visitor is a software widget that’s works on your site, ready to capture any visitor’s Name, Email address and Phone Number. You’ll know immediately they’re interested and you can call them directly to talk with them literally while they’re still on the web looking at your site.

    CLICK HERE https://talkwithwebvisitors.com to try out a Live Demo with Talk With Web Visitor now to see exactly how it works.

    It could be huge for your business – and because you’ve got that phone number, with our new SMS Text With Lead feature, you can automatically start a text (SMS) conversation – immediately… and contacting someone in that 5 minute window is 100 times more powerful than reaching out 30 minutes or more later.

    Plus, with text messaging you can follow up later with new offers, content links, even just follow up notes to keep the conversation going.

    Everything I’ve just described is extremely simple to implement, cost-effective, and profitable.

    CLICK HERE https://talkwithwebvisitors.com to discover what Talk With Web Visitor can do for your business.

    You could be converting up to 100X more eyeballs into leads today!

    Eric
    PS: Talk With Web Visitor offers a FREE 14 days trial – and it even includes International Long Distance Calling.
    You have customers waiting to talk with you right now… don’t keep them waiting.
    CLICK HERE https://talkwithwebvisitors.com to try Talk With Web Visitor now.

    If you'd like to unsubscribe click here http://talkwithwebvisitors.com/unsubscribe.aspx?d=raindesigner.com

  • Eric Jones
    Eric Jones 2 months ago

    Hello, my name’s Eric and I just ran across your website at raindesigner.com...

    I found it after a quick search, so your SEO’s working out…

    Content looks pretty good…

    One thing’s missing though…

    A QUICK, EASY way to connect with you NOW.

    Because studies show that a web lead like me will only hang out a few seconds – 7 out of 10 disappear almost instantly, Surf Surf Surf… then gone forever.

    I have the solution:

    Talk With Web Visitor is a software widget that’s works on your site, ready to capture any visitor’s Name, Email address and Phone Number. You’ll know immediately they’re interested and you can call them directly to TALK with them - literally while they’re still on the web looking at your site.

    CLICK HERE http://talkwithcustomer.com to try out a Live Demo with Talk With Web Visitor now to see exactly how it works and even give it a try… it could be huge for your business.

    Plus, now that you’ve got that phone number, with our new SMS Text With Lead feature, you can automatically start a text (SMS) conversation pronto… which is so powerful, because connecting with someone within the first 5 minutes is 100 times more effective than waiting 30 minutes or more later.

    The new text messaging feature lets you follow up regularly with new offers, content links, even just follow up notes to build a relationship.

    Everything I’ve just described is extremely simple to implement, cost-effective, and profitable.

    CLICK HERE http://talkwithcustomer.com to discover what Talk With Web Visitor can do for your business, potentially converting up to 100X more eyeballs into leads today!

    Eric
    PS: Talk With Web Visitor offers a FREE 14 days trial – and it even includes International Long Distance Calling.
    You have customers waiting to talk with you right now… don’t keep them waiting.
    CLICK HERE http://talkwithcustomer.com to try Talk With Web Visitor now.

    If you'd like to unsubscribe click here http://talkwithcustomer.com/unsubscribe.aspx?d=raindesigner.com

  • Eric Jones
    Eric Jones 2 months ago

    Hi, Eric here with a quick thought about your website raindesigner.com...

    I’m on the internet a lot and I look at a lot of business websites.

    Like yours, many of them have great content.

    But all too often, they come up short when it comes to engaging and connecting with anyone who visits.

    I get it – it’s hard. Studies show 7 out of 10 people who land on a site, abandon it in moments without leaving even a trace. You got the eyeball, but nothing else.

    Here’s a solution for you…

    Talk With Web Visitor is a software widget that’s works on your site, ready to capture any visitor’s Name, Email address and Phone Number. You’ll know immediately they’re interested and you can call them directly to talk with them literally while they’re still on the web looking at your site.

    CLICK HERE https://talkwithwebvisitors.com to try out a Live Demo with Talk With Web Visitor now to see exactly how it works.

    It could be huge for your business – and because you’ve got that phone number, with our new SMS Text With Lead feature, you can automatically start a text (SMS) conversation – immediately… and contacting someone in that 5 minute window is 100 times more powerful than reaching out 30 minutes or more later.

    Plus, with text messaging you can follow up later with new offers, content links, even just follow up notes to keep the conversation going.

    Everything I’ve just described is extremely simple to implement, cost-effective, and profitable.

    CLICK HERE https://talkwithwebvisitors.com to discover what Talk With Web Visitor can do for your business.

    You could be converting up to 100X more eyeballs into leads today!

    Eric
    PS: Talk With Web Visitor offers a FREE 14 days trial – and it even includes International Long Distance Calling.
    You have customers waiting to talk with you right now… don’t keep them waiting.
    CLICK HERE https://talkwithwebvisitors.com to try Talk With Web Visitor now.

    If you'd like to unsubscribe click here http://talkwithwebvisitors.com/unsubscribe.aspx?d=raindesigner.com

  • Eric Jones
    Eric Jones 2 months ago

    Hi, my name is Eric and I’m betting you’d like your website raindesigner.com to generate more leads.

    Here’s how:
    Talk With Web Visitor is a software widget that’s works on your site, ready to capture any visitor’s Name, Email address and Phone Number. It signals you as soon as they say they’re interested – so that you can talk to that lead while they’re still there at raindesigner.com.

    Talk With Web Visitor – CLICK HERE https://talkwithwebvisitors.com for a live demo now.

    And now that you’ve got their phone number, our new SMS Text With Lead feature enables you to start a text (SMS) conversation – answer questions, provide more info, and close a deal that way.

    If they don’t take you up on your offer then, just follow up with text messages for new offers, content links, even just “how you doing?” notes to build a relationship.

    CLICK HERE https://talkwithwebvisitors.com to discover what Talk With Web Visitor can do for your business.

    The difference between contacting someone within 5 minutes versus a half-hour means you could be converting up to 100X more leads today!

    Try Talk With Web Visitor and get more leads now.

    Eric
    PS: The studies show 7 out of 10 visitors don’t hang around – you can’t afford to lose them!
    Talk With Web Visitor offers a FREE 14 days trial – and it even includes International Long Distance Calling.
    You have customers waiting to talk with you right now… don’t keep them waiting.
    CLICK HERE https://talkwithwebvisitors.com to try Talk With Web Visitor now.

    If you'd like to unsubscribe click here http://talkwithwebvisitors.com/unsubscribe.aspx?d=raindesigner.com

  • Sex Kahani
    Sex Kahani 3 months ago

    Hi there i am kavin, its my first occasion to commenting anywhere, when i read
    this piece of writing i thought i could also make comment due to
    this good article.

  • Eric Jones
    Eric Jones 4 months ago

    Hello, my name’s Eric and I just ran across your website at raindesigner.com...

    I found it after a quick search, so your SEO’s working out…

    Content looks pretty good…

    One thing’s missing though…

    A QUICK, EASY way to connect with you NOW.

    Because studies show that a web lead like me will only hang out a few seconds – 7 out of 10 disappear almost instantly, Surf Surf Surf… then gone forever.

    I have the solution:

    Talk With Web Visitor is a software widget that’s works on your site, ready to capture any visitor’s Name, Email address and Phone Number. You’ll know immediately they’re interested and you can call them directly to TALK with them - literally while they’re still on the web looking at your site.

    CLICK HERE http://talkwithcustomer.com to try out a Live Demo with Talk With Web Visitor now to see exactly how it works and even give it a try… it could be huge for your business.

    Plus, now that you’ve got that phone number, with our new SMS Text With Lead feature, you can automatically start a text (SMS) conversation pronto… which is so powerful, because connecting with someone within the first 5 minutes is 100 times more effective than waiting 30 minutes or more later.

    The new text messaging feature lets you follow up regularly with new offers, content links, even just follow up notes to build a relationship.

    Everything I’ve just described is extremely simple to implement, cost-effective, and profitable.

    CLICK HERE http://talkwithcustomer.com to discover what Talk With Web Visitor can do for your business, potentially converting up to 100X more eyeballs into leads today!

    Eric
    PS: Talk With Web Visitor offers a FREE 14 days trial – and it even includes International Long Distance Calling.
    You have customers waiting to talk with you right now… don’t keep them waiting.
    CLICK HERE http://talkwithcustomer.com to try Talk With Web Visitor now.

    If you'd like to unsubscribe click here http://talkwithcustomer.com/unsubscribe.aspx?d=raindesigner.com

  • Eric Jones
    Eric Jones 4 months ago

    Good day,

    My name is Eric and unlike a lot of emails you might get, I wanted to instead provide you with a word of encouragement – Congratulations

    What for?

    Part of my job is to check out websites and the work you’ve done with raindesigner.com definitely stands out.

    It’s clear you took building a website seriously and made a real investment of time and resources into making it top quality.

    There is, however, a catch… more accurately, a question…

    So when someone like me happens to find your site – maybe at the top of the search results (nice job BTW) or just through a random link, how do you know?

    More importantly, how do you make a connection with that person?

    Studies show that 7 out of 10 visitors don’t stick around – they’re there one second and then gone with the wind.

    Here’s a way to create INSTANT engagement that you may not have known about…

    Talk With Web Visitor is a software widget that’s works on your site, ready to capture any visitor’s Name, Email address and Phone Number. It lets you know INSTANTLY that they’re interested – so that you can talk to that lead while they’re literally checking out raindesigner.com.

    CLICK HERE https://talkwithwebvisitors.com to try out a Live Demo with Talk With Web Visitor now to see exactly how it works.

    It could be a game-changer for your business – and it gets even better… once you’ve captured their phone number, with our new SMS Text With Lead feature, you can automatically start a text (SMS) conversation – immediately (and there’s literally a 100X difference between contacting someone within 5 minutes versus 30 minutes.)

    Plus then, even if you don’t close a deal right away, you can connect later on with text messages for new offers, content links, even just follow up notes to build a relationship.

    Everything I’ve just described is simple, easy, and effective.

    CLICK HERE https://talkwithwebvisitors.com to discover what Talk With Web Visitor can do for your business.

    You could be converting up to 100X more leads today!

    Eric
    PS: Talk With Web Visitor offers a FREE 14 days trial – and it even includes International Long Distance Calling.
    You have customers waiting to talk with you right now… don’t keep them waiting.
    CLICK HERE https://talkwithwebvisitors.com to try Talk With Web Visitor now.

    If you'd like to unsubscribe click here http://talkwithwebvisitors.com/unsubscribe.aspx?d=raindesigner.com

  • Eric Jones
    Eric Jones 6 months ago

    Hello, my name’s Eric and I just ran across your website at raindesigner.com...

    I found it after a quick search, so your SEO’s working out…

    Content looks pretty good…

    One thing’s missing though…

    A QUICK, EASY way to connect with you NOW.

    Because studies show that a web lead like me will only hang out a few seconds – 7 out of 10 disappear almost instantly, Surf Surf Surf… then gone forever.

    I have the solution:

    Talk With Web Visitor is a software widget that’s works on your site, ready to capture any visitor’s Name, Email address and Phone Number. You’ll know immediately they’re interested and you can call them directly to TALK with them - literally while they’re still on the web looking at your site.

    CLICK HERE http://talkwithcustomer.com to try out a Live Demo with Talk With Web Visitor now to see exactly how it works and even give it a try… it could be huge for your business.

    Plus, now that you’ve got that phone number, with our new SMS Text With Lead feature, you can automatically start a text (SMS) conversation pronto… which is so powerful, because connecting with someone within the first 5 minutes is 100 times more effective than waiting 30 minutes or more later.

    The new text messaging feature lets you follow up regularly with new offers, content links, even just follow up notes to build a relationship.

    Everything I’ve just described is extremely simple to implement, cost-effective, and profitable.

    CLICK HERE http://talkwithcustomer.com to discover what Talk With Web Visitor can do for your business, potentially converting up to 100X more eyeballs into leads today!

    Eric
    PS: Talk With Web Visitor offers a FREE 14 days trial – and it even includes International Long Distance Calling.
    You have customers waiting to talk with you right now… don’t keep them waiting.
    CLICK HERE http://talkwithcustomer.com to try Talk With Web Visitor now.

    If you'd like to unsubscribe click here http://talkwithcustomer.com/unsubscribe.aspx?d=raindesigner.com

  • write me an essay
    write me an essay 9 months ago

    Howdy! This article could not be written any better!

    Looking at this article remind mee of my previous roommate!
    He continually kept preaching about this. I most certainly will send this information tto him.

    Fairly certain he's going to havfe a very good read.
    Thanks for sharing!
    https://works.bepress.com/researchpapertopicsforcognitivepsychology/67/
    wwrite me an essay
    write me an essay http://5fcda9759a4dc.site123.me/blog/how-to-write-a-college-essay-with-examples

Top Flag Counter
We use cookies to improve our website. By continuing to use this website, you are giving consent to cookies being used. More details…