Sunday, November 5th 2017
Intel CPU On-chip Management Engine Runs on MINIX
With the transition to multi-core processors, and multi-core processors with integrated core-logic (chipset), the need arose for a low-level SoC embedded into the processor with just enough compute power to make sure all the components you pay for start-up and function as advertised. Enter the Intel ME (management engine). This is a full-fledged computer within your Intel processor, which isn't exposed to you. It runs on its very own tiny x86 CPU core that isn't exposed, and its software is driven on an infinitesimally small ROM and RAM. Since you can't have software without some sort of operating-system, Intel chose MINIX for the job.
MINIX is a Unix-like OS with an extremely small memory footprint. The OS was designed by Andrew Tanenbaum, originally as an educational tool to demonstrate that machines can still be built with extremely tiny code. If you're familiar with the "ring-level" system of hardware-access privilege by software, ring 0 would designate the "highest" level of access. A software with ring 0 access can erase your disk, flash your system BIOS, and even make your CPU run at any C-state. The OS kernel needs these privileges, and hence is a ring 0 software. Most user software, like the web-browser you're reading this on, runs at ring 3 (with the browser's own sandbox, the user-level, and API level forming inner levels). Intel ME runs at ring -3 (negative 3), and your OS has no power over it. Most system BIOS updates for Intel motherboards include a ROM update for ME. ME governs the functioning of the rest of the processor, its start-up, and booting. It also governs silicon-level security and management features that can't be compromised by malware.
Source:
NetworkWorld
MINIX is a Unix-like OS with an extremely small memory footprint. The OS was designed by Andrew Tanenbaum, originally as an educational tool to demonstrate that machines can still be built with extremely tiny code. If you're familiar with the "ring-level" system of hardware-access privilege by software, ring 0 would designate the "highest" level of access. A software with ring 0 access can erase your disk, flash your system BIOS, and even make your CPU run at any C-state. The OS kernel needs these privileges, and hence is a ring 0 software. Most user software, like the web-browser you're reading this on, runs at ring 3 (with the browser's own sandbox, the user-level, and API level forming inner levels). Intel ME runs at ring -3 (negative 3), and your OS has no power over it. Most system BIOS updates for Intel motherboards include a ROM update for ME. ME governs the functioning of the rest of the processor, its start-up, and booting. It also governs silicon-level security and management features that can't be compromised by malware.
41 Comments on Intel CPU On-chip Management Engine Runs on MINIX
It is not under a GPL license and I doubt they would have used it if it did have a GPL.
www.cs.vu.nl/~ast/intel/
I mean jesus christ dude.
Neither Windows or Android, the most popular operating system is another and you use it without knowing it
Your Windows, your Mac or your Linux may not be alone. If you have an Intel processor on your computer, whether desktop or laptop or server, chances are you have a hidden operating system. And this system, called MINIX, has even its own secret processor.
Intel launches an artificial intelligence chip that thinks like a human MINIX, the ace up the sleeve of Intel
AMT, where Intel and MINIX come together
This is where the interesting comes from. Intel AMT (Active Management Technology), also known as Intel Management Engine, is a kind of "secret processor" that works independently of the rest of the computer. It has nothing to do with the processor you use to play or to run the computer. It is a completely differentiated chip.
And in this hidden or secret processor is where Intel has decided to use MINIX. Intel AMT is able to access any region of memory, read and write all files, and even make a web server. All without the rest of the system even knowing of its existence. And everything working with MINIX, that system that was born with an educational purpose
Third, I did a proof-of-concept test today. I found a Dell OptiPlex 7010 that had been turned off for a few months. I checked the PC and found that it had BIOS A23, dated August 25, 2016. This predates the AMT vulnerability announcement. I checked in Windows (7 Pro) and saw that the last update occurred on July 27, 2017.
I downloaded and installed the INTEL-SA-00075 Detection and Mitigation Tool. It reported that the system was vulnerable.
Next, I ran Windows Update multiple times, installing all Important and Optional updates, until no more were available. None of them said jack about an update for AMT or Intel Management Engine. I ran the tool again, and the system was still vulnerable.
Next, I downloaded and installed BIOS A25, dated May 22, 2017. This release was specifically intended to fix the AMT problem. It updated the Intel Management Engine firmware from 8.1.65.1586 to 8.1.71.3608. After Windows booted up, I ran the tool one last time. The system was not vulnerable.
So, I don't know if magic fairy dust was sprinkled on your machines, but all I can say is that Windows Update has never offered firmware for any non-Microsoft computer that I've seen in all of the years that I've been doing system support.I mean Jesus Christ, dude, if you're going to include Enterprise-grade update methods that aren't available to the average user, then you need to say so. :slap:
the version of Minix that Intel used to start with in the MeBX used pre 1.0 openssl (OpenSSL before 0.9.8l is vulnerable to nvd.nist.gov/vuln/detail/CVE-2009-3555).
I was told by a friend of mine in security that Intel uses there own custom version of OpenSSL in AMT. Hopefully they have mitigated this vulnerability??
And just since you missed it I can get the same updates he pushed with WSUS from windows update (not enterprise) and had you read that first thread you would have noticed that he was pulling those updates from the ms server which is the same as the one a normal user grabs.
Windows 7 uefi also isn't fully compliant so that isn't a route anyone would take this.
But carry on arguing. I'm just going to stand here with my documents from Microsoft stating what they can and do actually do. You keep trying to prove you are correct. I guess you win other than all of the firmware updates pushed across ms's update server they don't update firmware.
You assumed that everyone is running Windows in UEFI mode; I assumed that they weren't. You know the old saying: When you assume, you make an "ass" out of "u" and "me".
I'm not wasting any more time on this topic.
I also stated everything post 7 which is 8/8.1/10 all of which are typically used in UEFI.
The generic Microsoft pushes firmware updates is 100% true you have made the choice to nitpick based off of a 9 year old OS.