News for hackers. Stuff that matters.

A comment on Escalation of Privilege Advisory. Parent comment

Re:Escalation of Privilege Advisory by biktor_gj on Monday May 01, 2017 @05:04PM (#14241575)
Yes. This affects the management engine, an independent firmware that runs in your system wether it runs linux, windows BSD. It is still running even if your computer is off (in fact, one of its capabilities is to turn it on remotely).

Edit to add: independent of what Intel might say about this (given it seems it has taken 5 years to disclose this and 5 major firmware versions I won't trust too much what they say about consumer pcs not being affected). Check if your cpu and motherboard support AMT and if it is enabled. All workstations I've worked with have it, but there are a lot of machines that have it disabled by default unless you specifically turn it on. So, you might be affected if you have a "supported" processor and (I guess) an Intel NIC onboard and wired, and remote capabilities enabled.

[ Parent | on HN ]
Re:Escalation of Privilege Advisory by abecedarius on Monday May 01, 2017 @07:50PM (#14242835)
What if I disable AMT in the BIOS setting? Does that make these Windows programs irrelevant?
[ Parent | on HN ]
Re:Escalation of Privilege Advisory by wiredfool on Monday May 01, 2017 @05:28PM (#14241845)
I'm mostly interested in if servers with ipmi (supermicro in particular) are vulnerable, and to what degree. If it's the network with the ipmi ports, that's one thing, but if it's public facing...

Much stuff is going to be hitting fans.

[ Parent | on HN ]
Re:Escalation of Privilege Advisory by amluto on Monday May 01, 2017 @06:33PM (#14242348)
IIUC the SuperMicro BMC is different software on a separate third-party chip. So it's reasonably likely to be vulnerable, but not to this particular vulnerability.
[ Parent | on HN ]
Re:Escalation of Privilege Advisory by ams6110 on Monday May 01, 2017 @07:23PM (#14242682)
Your IPMI should be on a private management network, at least. If you haven't done that, I hope you at least changed the default password.
[ Parent | on HN ]
Re:Escalation of Privilege Advisory by wiredfool on Tuesday May 02, 2017 @03:32AM (#14244605)
Yeah, that's pretty easy on this generation. But there was a previous generation where the IPMI piggybacked on one of the main NICs, where it was a lot easier to accidentally expose that to unfriendly traffic.
[ Parent | on HN ]
Re:Escalation of Privilege Advisory by ryanlol on Monday May 01, 2017 @05:07PM (#14241601)
It's not entirely clear if this'll be exploitable except in the rather rare scenario where someone has actually set up AMT.
[ Parent | on HN ]