Intel Releases Linux-Compatible Tool For Confirming ME Vulnerabilities

[kaprikawn]

...it's the motherboard manufacturer...

The motherboard isn't a system, it's a motherboard. System in this context means the whole PC. MSI manufactured my mobo, Intel manufactured my CPU, Corsair manufactured my RAM and PSU, AMD manufactured my graphics card.

When I hear manufacturer in this context, I take it to mean Dell or HP or equivalent. If they mean I should go to my motherboard manufacturer for the update it would be nice if they were more specific and actually put that in their messages.

Despite your snarky tone, thank you for setting me straight.

[Almindor]

If you think intel ME is bad, check out what AMD PSP can do!

[adomas]

~/intel >>> sudo ./intel_sa00086.py 
[sudo] password for adomas:  
Traceback (most recent call last):
 File "./intel_sa00086.py", line 13, in <module>
   from heci import get_fw_state
 File "/home/adomas/intel/heci.py", line 11, in <module>
   from mei.debugfs import fixed_address_soft
 File "/home/adomas/intel/mei/debugfs.py", line 25
   print "%s (relative)" % (msg)
                       ^
SyntaxError: invalid syntax
~/intel >>>

Am I missing some package or what?

[damg]

~/intel >>> sudo ./intel_sa00086.py
[sudo] password for adomas:
Traceback (most recent call last):
File "./intel_sa00086.py", line 13, in <module>
from heci import get_fw_state
File "/home/adomas/intel/heci.py", line 11, in <module>
from mei.debugfs import fixed_address_soft
File "/home/adomas/intel/mei/debugfs.py", line 25
print "%s (relative)" % (msg)
^
SyntaxError: invalid syntax
~/intel >>>

Am I missing some package or what?

The code uses Python 2 specific syntax but calls the vague 'python' interpreter which I assume is pointing to python3 on your system. Ensure you have python2 installed and call this script with it directly:

sudo python2 ./intel_sa00086.py

[adomas]

Thanks, it worked!

[starshipeleven]

The motherboard isn't a system, it's a motherboard.

And you are still not a manufacturer by just connecting some wires and "screwing" some tool-less thumbscrews. Checkmate.

Still, I know their talk. Also for Windows activation the motherboard is the "system", as Windows locks on unique board firmware IDs or uses keys embedded in the board firmware. Do they mention this? No, they stay vague and use "PC" or "system" and I routinely find confused people that ask if changing their CPU or GPU (or hard drive) will break their windows license (answer: no it does not).

When I hear manufacturer in this context, I take it to mean Dell or HP or equivalent.

It's probably the case. This tool is for sysadmins and IT technicians in companies, not for random people.

The bugs detected by this tool are in the remote management component (vPro or AMT), which are a useful feature in Dell/HP/Lenovo/whatever workstations/laptops deployed (and managed) en masse, and even there require specific configuration on the "user" side to be enabled at all.

I doubt consumer motherboards sold (and used) alone have any kind of facility to even enable this stuff (or any real need to). This is a Dell software to configure/control their stuff with vPro, for example http://en.community.dell.com/techcen...ro-out-of-band

Now if you have bought some server-grade board from Supermicro or Asrock Rack... you're probably IT-savyy enough to know what they really meant.

[starshipeleven]

If you think intel ME is bad, check out what AMD PSP can do!

Last time I checked, it could do less and worse.

Intel leads the way on overengineered backfiring crap since the Itanium days.

[rene]

Yeah, don't know what the fuss is about either Brisse

$ ./intel_sa00086.py
INTEL-SA-00086 Detection Tool
Copyright(C) 2017, Intel Corporation, All rights reserved

Application Version: 1.0.0.128
Scan date: 2017-11-23 19:20:00 GMT

*** Host Computer Information ***
Name: khouri
Manufacturer: ASUSTeK COMPUTER INC.
Model: GL702ZC
Processor Name: AMD Ryzen 7 1700 Eight-Core Processor
OS Version: Fedora 27 Twenty Seven (4.14.1+)

*** Risk Assessment ***
Detection Error: This system may be vulnerable, please install the Intel(R) MEI/TXEI driver (available from your system manufacturer).

For more information refer to the SA-00086 Detection Tool Guide or the Intel security advisory Intel-SA-00086 at the following link:
https://security-center.intel.com/advisory.aspx?intelid=INTEL-SA-00086&languageid=en-fr

yeah, well, until AMD PSP (Platform SecureProcess) vulnerabilities are published next year –or 34C3–, ... :-/ Really sad that AMD had to add this kinda crap, too, ..-/

[oooverclocker]

Intel's SA-00086 Detection Tool has Linux support and will confirm whether your system is vulnerable to the recently published Management Engine (ME) security issues.

I think it's actually meant to tell whether it's vulnerable by others than the NSA. It's well known that it contained backdoors before.
Installing more binaries you don't know about what they do doesn't sound really trustworthy.

I hope that Google will succeed deactivating this crap and unchains Libreboot for everyone in the world on every hardware. On the other hand, now it will just be a matter of time that we can buy russian or chinese CPUs with decent power. Because they won't run anything important with x86-CPUs in the future, I'm sure about it.

[johanb]

yeah, well, until AMD PSP (Platform SecureProcess) vulnerabilities are published next year –or 34C3–, ... :-/ Really sad that AMD had to add this kinda crap, too, ..-/

A year more is still a year more until I have to deal with trying to disable the crap, so at least it's better than Intel.