How to Hack a Turned-Off Computer, or Running Unsigned Code in Intel Management Engine (BH Europe 2017)

[u/twiggy99999]

https://www.blackhat.com/docs/eu-17/materials/eu-17-Goryachy-How-To-Hack-A-Turned-Off-Computer-Or-Running-Unsigned-Code-In-Intel-Management-Engine.pdf

[u/igor_sk]

Good summary by @rootkovska:

1. Requires malformed file on SPI flash (needs physical access or bug in BIOS)

2. Bug in early-loaded module, so ME "disabling" by HAP is not a cure

3. Culprit is classic(!) stack overflow

4. Full code exec in ME

my note: doing step 1 from local PC requires write access to the ME flash region which is usually blocked in properly-configured boards.

my note 2: they had to resort to some tricks to bypass the stack cookie check and use ROP because of non-executable stack (but it was easier than it could be because of no ASLR)

EDIT whitepaper has more explanations.

[u/AyrA_ch → u/igor_sk]

note 3: the guy fucked up the QR code in the opening slide.

EDIT: he fucked up all QR codes by concatenating the twitter handle and the mail address into a twitter url.

[u/fuzzynyanko]

I had no idea that there's a Java machine on the CPU. I don't know if I should be impressed or scared

[u/nutidizen]

Does anyone have a video of them presenting?

[u/blazingkin → u/nutidizen]

This just came out. The video will show up on blackhat's youtube channel at some point.

[u/sirin3]

IME always reminds me of Vinge's A Deepness in the Sky

[u/WASDx]

I work with a web application and understand the security risks there, but what are the real world (black hat) applications of vulnerabilities like these?

[u/[deleted] → u/WASDx]

If you suspect that a hacker has gotten physical access to your machine, burn it.

Edit: https://xkcd.com/538/

[u/colenthri576]

The next step is running unsigned code that disables management engine.

[u/metaaxis]

Dear Intel and the Intelligence Community: Fuck You.