Re:“We have obtained fully functional JTAG for Intel CSME vi...
by ricw on Friday November 10, 2017 @10:10AM
(#15670326)
Am curious how and what exactly you blocked?! What precautions can be taken to make systems more secure?!
Re:“We have obtained fully functional JTAG for Intel CSME vi...
by _jal on Friday November 10, 2017 @10:38AM
(#15670517)
As usual, it depends on what exactly you have. Not all chips have the AMT enabled, for instance.
This is a useful document for understanding what exactly you're dealing with and what to do about it:
https://www.blackhat.com/docs/us-17/thursday/us-17-Evdokimov...
Re:“We have obtained fully functional JTAG for Intel CSME vi...
by scurvy on Friday November 10, 2017 @11:01AM
(#15670725)
The BMC is listening on that IP, not the ME.
Re:“We have obtained fully functional JTAG for Intel CSME vi...
by seanp2k2 on Friday November 10, 2017 @01:50PM
(#15671986)
https://www.supermicro.com/products/nfo/IPMI.cfm IPMI / BMC != ME. Intel’s is basically the version of this that you can’t disable, that works through the same PHY (most BMCs have their own), that you’re not allowed to use. https://en.m.wikipedia.org/wiki/Intel_Management_Engine
Re:“We have obtained fully functional JTAG for Intel CSME vi...
by scurvy on Friday November 10, 2017 @04:32PM
(#15673236)
I know that the BMC isn't the same as the ME, but in his case that's the BMC getting an IP and default web login for admin/admin. It's not the ME.
BMC doesn't always use a dedicated physical port, and it's commonly bridged in sideband to the other NICs on a server.
Yep, this is the big deal. After I "discovered" the ME, my first stop on my home network was the switch, to block all that crap. (And I found my storage server, equipped with a Supermicro all-in-one motherboard, helpfully grabbed an IP for the ME to listen on with an 'admin/admin' password.)
I just wish the empire builders at the NSA would care about something other than their own little power center. They knew this would happen - it always does. The NSA is probably the biggest security threat to the U.S. people[1] at this point, because they keep building concentrated, high-value targets and then lose control of them.
[1] Not to be confused with 'U.S. government interests'.