Forum - RE: RE:Securing Acer Veriton X4610G Intel Management Engine

Win-Raid Forum (Drivers - Firmware - Modding) � Special Topics � Intel Management Engine � Securing Acer Veriton X4610G Intel Management Engine

Page 2 of 2 � Page 1 2 Page �

Topic settings

Print view

Jump to forum

General & Forum related Topics News / Announcements Forum-related Questions & Suggestions Off Topic Important Drivers (AHCI/RAID, NVMe, USB etc.) General: Storage Drivers (AHCI/RAID, NVMe and USB) Specific: Intel AHCI/RAID Drivers Specific: NVIDIA nForce Chipset Drivers (incl. AHCI/RAID) Specific: NVMe Drivers Other Drivers System Performance RAID Performance AHCI/NVMe Performance Solid State Drives BIOS Modding BIOS Modding Guides and Problems BIOS modules (PCI ROM, EFI and others) BIOS Modding Requests Reports: BIOS Modding Results Offers: Already modded special BIOSes Special Topics Intel Management Engine CPU Microcodes NVMe Support for old Systems Other Tools (not BIOS modding related) Interesting PC Hardware & Software OS related Topics Windows 11 Windows 8-10/Server 2012-2019 Windows 7/Vista/Server 2008 Windows XP/2000/Server 2003 DOS/Windows 3.X/9X/ME - Retro Gaming Other Operating Systems

#16 | RE: RE:Securing Acer Veriton X4610G Intel Management Engine datum

Wed Nov 04, 2020 9:43 pm (Last edited: Wed Nov 04, 2020 11:22 pm)

I upgraded to ME FW Version 7.1.91.3272

Here are the results:

C:\Apps\Intel-ME_CPT_5M_7.0.4.1197\MEInfo\Windows>MEInfoWin.exe

Intel(R) MEInfo Version: 7.0.4.1197
Copyright(C) 2005 - 2010, Intel Corporation. All rights reserved.

Intel(R) Manageability and Security Application code versions:

BIOS Version: P01-B3
MEBx Version: 7.0.0.53
Gbe Version: 1.3
VendorID: 8086
PCH Version: 600005
FW Version: 7.1.91.3272
UNS Version: Not Available
LMS Version: Not Available
MEI Driver Version: 11.0.0.1157
Wireless Hardware Version: Not Available
Wireless Driver Version: Not Available

FW Capabilities: 20585574

Intel(R) Standard Manageability - PRESENT/ENABLED
Intel(R) Anti-Theft Technology - PRESENT/ENABLED
Intel(R) Capability Licensing Service - PRESENT/ENABLED
Protect Audio Video Path - PRESENT/ENABLED

Intel(R) Standard Manageability State: Enabled
CPU Upgrade State: Upgrade Capable
Cryptography Support: Enabled
Last ME reset reason: Power up
Local FWUpdate: Disabled
BIOS and GbE Config Lock: Disabled
Host Read Access to ME: Disabled
Host Write Access to ME: Disabled
SPI Flash ID #1: EF4017
SPI Flash ID VSCC #1: 20052005
SPI Flash BIOS VSCC: 20052005
BIOS boot State: Post Boot
OEM Id: 00000000-0000-0000-0000-000000000000
Link Status: Link down
System UUID: <censored>
MAC Address: <censored>
IPv4 Address: 0.0.0.0
IPv6 Enablement: Disabled
Privacy Level: Default
Configuration state: Not started
Provisioning Mode: Unknown
Capability Licensing Service: Enabled
Capability Licensing Service Status: Permit info not available
OEM Tag: 0x00000000

C:\Apps\Intel-ME_CPT_5M_7.0.4.1197\MEManuf\Windows>MEManufWin.exe -R -verbose

Intel(R) MEManuf Version: 7.0.4.1197
Copyright(C) 2005 - 2010, Intel Corporation. All rights reserved.

Platform stepping value is 5

FW Status Register1: 0x1E000245
FW Status Register2: 0x68000006

CurrentState: Normal
ManufacturingMode: Disabled
FlashPartition: Valid
OperationalState: M0 with UMA
InitComplete: Complete
BUPLoadState: Success
ErrorCode: No Error
ModeOfOperation: Normal
ICC: Valid OEM data, ICC programmed

Get FWU info command...done

Get FWU version command...done

Get FWU feature state command...done

Get ME FWU platform type command...done

Get ME FWU feature capability command...done
Feature enablement is 0x13A1C66
gFeatureAvailability value is 0x1
OEM ICC data valid and programmed correctly

Request Intel(R) ME test result command...done
vsccommn.bin was created on 02:10:39 09/22/2010 GMT
SPI Flash ID #1 ME VSCC value is 0x2005
SPI Flash ID #1 (ID: 0xEF4017) ME VSCC value checked
SPI Flash ID #1 BIOS VSCC value is 0x2005
SPI Flash ID #1 (ID: 0xEF4017) BIOS VSCC value checked
FPBA value is 0x0
No Intel Wireless device was found

Get Intel(R) ME test data command...done
Total of 21 Intel(R) ME test result retrieved
Micro Kernel - Blob Manager: Set - Passed
Micro Kernel - Blob Manager: Get - Passed
Micro Kernel - Blob Manager: Remove - Passed
Policy Kernel - SMBus: Read byte - Passed
Policy Kernel - ME Password: Valid MEBx password - Passed
Policy Kernel - Power Package: Package 1 supported - Passed
Policy Kernel - Power Package: Default package supported - Passed
Policy Kernel - ME Configuration: Wlan Power Well - Passed
Policy Kernel - ME Configuration: CPU Missing Logic - Passed
Policy Kernel - ME Configuration: M3 Power Rails Available - Passed
Policy Kernel - Embedded Controller: Get power source - Passed
Common Services - General: Low power idle timeout - Passed
Common Services - Provisioning: Valid MEBX password change policy - Passed
Common Services - Provisioning: Client Config mode is valid - Passed
Common Services - General: Vlan not enabled on mobile - Passed
Common Services - Provisioning: Both PID and PPS are set - Passed
Common Services - Provisioning: MEBX password set when PID and PPS set - Passed
AMT - Privacy Level: Valid Privacy Level settings - Passed
AMT - Power: Power-package 2 supported - Passed
AMT - Hardware Inventory: BIOS tables - Passed
Policy Kernel - Power Package: Live Heap Test - Passed

Clear Intel(R) ME test data command...done

MEManuf Test Passed

╔═══════════════════════════════════════════╗
║ ME Analyzer v1.160.0 r212 ║
╚═══════════════════════════════════════════╝

╔════════════════════════════════════════════════════╗
║ ME7_5M_UPD_Production.bin (1/1) ║
╟───────────────────────────────┬────────────────────╢
║ Family │ ME ║
╟───────────────────────────────┼────────────────────╢
║ Version │ 7.1.91.3272 ║
╟───────────────────────────────┼────────────────────╢
║ Release │ Production ║
╟───────────────────────────────┼────────────────────╢
║ Type │ Update ║
╟───────────────────────────────┼────────────────────╢
║ SKU │ 5MB ║
╟───────────────────────────────┼────────────────────╢
║ Patsburg PCH Support │ Yes ║
╟───────────────────────────────┼────────────────────╢
║ Date │ 2017-04-07 ║
╟───────────────────────────────┼────────────────────╢
║ Downgrade Blacklist 7.0 │ <= 7.0.10.1203 ║
╟───────────────────────────────┼────────────────────╢
║ Downgrade Blacklist 7.1 │ <= 7.1.13.1088 ║
╟───────────────────────────────┼────────────────────╢
║ Chipset Support │ CPT/PBG ║
╟───────────────────────────────┼────────────────────╢
║ Latest │ No ║
╚═══════════════════════════════╧════════════════════╝

Please have a look at the bold marked passages. They have changed. Why?
Is the system vulnerable to the Intel poinson pill (Intel(R) Anti-Theft Technology - PRESENT/ENABLED)?
Is DRM blocking still enabled (Intel(R) Capability Licensing Service - PRESENT/ENABLED).

I rescanned with:

Intel(R) CSME Detection Tool For Legacy Systems
Application Version: 1.0.16.0
Scan date: 03/11/2020 23:49:23

Risk Assessment
Based on the analysis performed by this tool: This system is vulnerable.

Explanation:
The detected version of the Intel(R) Management Engine firmware is considered vulnerable for INTEL-SA-00086. Contact your system manufacturer for support and remediation of this system.
For more information refer to the Intel(R) CSME Detection Tool For Legacy Systems Guide or the Intel Security Advisory Intel-SA-00086 at the following link: https://www.intel.com/sa-00086-support

Host Computer Information
Name: <censored>
Manufacturer: Acer
Model: Veriton X4610G
Processor Name: Intel(R) Core(TM) i5-2320 CPU @ 3.00GHz
OS Version: Microsoft Windows 10 Pro

Intel(R) ME Information
Engine: Intel(R) Management Engine
Version: 7.1.91.3272

Copyright(C) 2017-2019, Intel Corporation, All rights reserved.

Both ME Analyzer and Intel(R) CSME Detection Tool are unsatisfied.
What vulnerabilities remain and how can I mitigate them?

System: Acer Veriton X4610G: Intel Q65: a 6 Series/C200 Chip-set Family (CougarPoint) with 2nd gen. Intel i5-2320 processor (SandyBridge), HD Graphics 2000 dual booting Windows 10x64 v2004 from NVMe SSD in 8 and XUbuntu 64bit 20.04LTS in 5 sec.

reply

#17 | RE: RE:Securing Acer Veriton X4610G Intel Management Engine datum

Thu Nov 05, 2020 12:16 am

Your markings aren't correct, changes to fw- capabilities are security related (local update).

To run an ME- update file in MEA isn't meaningful regarding configuration details. As explained several times it doesn't contain configuration data.

SA-00086 was never fixed for ME 7.

Other vulnerabilities:
https://www.intel.com/content/www/us/en/...er/default.html
(Don't forget to expand the list. If ME 7 isn't listed, don't feel safe: It's never been examined/ tested for newer flaws since it's EOL/ EOS )

Your update worked well and you're now on the almost latest version of ME7.

reply

#18 | RE: RE:Securing Acer Veriton X4610G Intel Management Engine datum

Thu Nov 05, 2020 12:38 am

I ran MEA on the dumped image of the actively running firmware image.

When was the EOL/ EOS of ME 7?

Are there workarounds to secure against SA-00086, without compromising the system, in order to mitigate the risk of ME 7 vulnerabilities?

reply

#19 | RE: RE:Securing Acer Veriton X4610G Intel Management Engine datum

Thu Nov 05, 2020 10:36 am

Zitat von Marty1 im Beitrag #18
I ran MEA on the dumped image of the actively running firmware image......

Zitat von Marty1 im Beitrag #16
╔════════════════════════════════════════════════════╗
║ ME7_5M_UPD_Production.bin (1/1) ║
╟───────────────────────────────┬────────────────────╢
........
║ Type │ Update ║
╟───────────────────────────────┼────────────────────╢
.....

Dump wouldn't have type 'update' and you'd possibly given another name.

Afaik there are no mitigations. Since there are so many other possible security flaws that never were examined for ME7 there is no point in examining one single old vulnerability.

Never connect this machine directly to the internet!

Last vulnerability fixed for ME7 is SA-00075 (05/17), first not fixed SA-00086 (11/17).

reply

#20 | RE: RE:Securing Acer Veriton X4610G Intel Management Engine datum

Thu Nov 05, 2020 4:01 pm

Zitat von lfb6 im Beitrag #19
Dump wouldn\'t have type \'update\' and you\'d possibly given another name.

Sorry, you're right. I posted the wrong output, but I did compare them before posting and they were identical. Here's the ME Analyzer output of the ME FW that's actively running on my machine:

╔═══════════════════════════════════════════╗
║ ME Analyzer v1.160.0 r212 ║
╚═══════════════════════════════════════════╝

╔══════════════════════════════════════════════════════╗
║ ME_FW_Backup_7.1.91.3272.BIN (1/1) ║
╟────────────────────────────────┬─────────────────────╢
║ Family │ ME ║
╟────────────────────────────────┼─────────────────────╢
║ Version │ 7.1.91.3272 ║
╟────────────────────────────────┼─────────────────────╢
║ Release │ Production ║
╟────────────────────────────────┼─────────────────────╢
║ Type │ Update ║
╟────────────────────────────────┼─────────────────────╢
║ SKU │ 5MB ║
╟────────────────────────────────┼─────────────────────╢
║ Patsburg PCH Support │ Yes ║
╟────────────────────────────────┼─────────────────────╢
║ Date │ 2017-04-07 ║
╟────────────────────────────────┼─────────────────────╢
║ Downgrade Blacklist 7.0 │ <= 7.0.10.1203 ║
╟────────────────────────────────┼─────────────────────╢
║ Downgrade Blacklist 7.1 │ <= 7.1.13.1088 ║
╟────────────────────────────────┼─────────────────────╢
║ Chipset Support │ CPT/PBG ║
╟────────────────────────────────┼─────────────────────╢
║ Latest │ No ║
╚════════════════════════════════╧═════════════════════╝

Zitat von lfb6 im Beitrag #19
Never connect this machine directly to the internet!

The machine needs to be connected to the internet otherwise it's useless.
So there must be IP ports that the ME FW is listening on. Do you know what ports they are?
A firewall on the Win 10 / Linux host (running on the i5 processor) won't work I suppose, because ME runs on its own separate embedded host (with (Minix) OS) with its own network connectivity. Did Intel implement a firewall on it, which I could configure maybe (or is that also proprietary information)?
How would I block access to the ME FW ports from the internet (and how would I do that for attackers from withing the LAN)?
Could I force the ME FW to listen through a proxy, maybe?
Could I maybe shut down or unconfigure the ME FW TCP-IP network stack?

[sarcasm on]
Did those bright minds at Intel foresee this and implemented a fail-safe or is the assumption that Intel engineers not ever make mistakes?
It's best of course to bake their flawless code into obscure and proprietary embedded silicon on all their chip-sets to be, don't they?
And if you don't make mistakes, you don't need to support it either of course.
What a brilliant people over at Intel!
I've got to run out and buy me another one of those, oh shoot, I did and it's flawed too... and not patched either...
Hey I've got a business laptop which I scanned and surprise surprise, it's vulnerable too!
Maybe they should call those unpatched and out of support bugs features over at Intel?
Features to buy yet another machine, oops flawed too and another, and another...
[/sarcasm off]

reply

#21 | RE: RE:Securing Acer Veriton X4610G Intel Management Engine datum

Thu Nov 05, 2020 5:04 pm

AMT/ vpro is pre boot, pre-OS. The ports are documented, but when running a system in a non safe environment one would possibly want to unblock the needed ports and instead og blocking selectively non used ports? But that's stuff I don't know too much of.

AMT documentation:
https://software.intel.com/sites/managea...bilityports.htm

Otherwise it's not just Intel ME with a lot of not known vulnerabilities, it's about processor µcode and possibly some bios vulnerabilities, too.

Good luck!

reply

#22 | RE: RE:Securing Acer Veriton X4610G Intel Management Engine datum

Thu Nov 05, 2020 6:39 pm

If ME FW runs pre-boot, but it's doing TCP-IP, then it needs a MAC address and an IP address.
Does the ME FW have its own unique MAC address (distinct from Win/Linux host)?
Does the ME FW have its own IP address (distinct from Win/Linux host)?

And if the mac address is shared, maybe the Win/Linux host can claim the same IP address and snatch the ports away from ME FW:
664
623
5900
16995
16994
16993
16992

Then the Win/Linux host might be able to obstruct communication to the ME FW by claiming those port with a dummy service. But that is post boot. Hmmm pre- boot needs to be blocked otherwise.

So does the ME FW share its MAC address with the host?

(Alt solution, only run WiFi.)

reply

macbook air Me region corruption bar freezed help � � HP Z200 Workstation (786H3) continuously powers down at 30 minutes.

Page 2 of 2 � Page 1 2 Page �

Please enter a reason for warning.