Securing Acer Veriton X4610G Intel Management Engine

Special Topics Intel Management Engine
3

@lfb6 Thanks for your reply,

Now that I can’t get is secure by updating it to ME 11, is it worth updating at all?
(BTW I thought ME 11 would denote the firmware being at version 11? What exactly is at version 11?)

Would it have any advantages to go to ME firmware version 8.x?

There are three subsections in the D section. Would it be:


[quote="lfb6, post:2, topic:35871"]
12. bios region not even meant for your system (3.6MB vs. 2MB, IVB in name).
[/quote] That's disturbing, as I was planning on installing that in order to fix "[X_URL=htt ps://us.answers.acer.com/app/answers/detail/a_id/47605]Intel-SA-00075_CVE-2017-5689_ME - Silent Bob is Silent[/URL]". Are you absolutely sure it's wrong for my system?
[quote="lfb6, post:2, topic:35871"]
13. Yes. Complete backup depending on flash descriptor with fpt (ME- tools) or CH341 programmer, restore CH341 programmer. Bios chip soldered, or socketed? [/quote]
The BIOS chip is soldered.
AMIBIOS supports a "recovery flash" mode, which can be used to flash update a BIOS from the boot block. This is used to update a BIOS image without the need to boot to an operating system. The following is the
process that user should follow to flash BIOS ROM.
1. Put the AMIBoot.ROM to a bootable USB flash drive(Disk on Key, DOK).
2. Install the DOK to the system.
3. Press power button to boot the system and then press Ctrl + Home.
4. The BIOS recovery function will be executed.
5. After BIOS is updated completely, the system will auto reboot.
6. Please enter the setup menu to load default after system reboot.

Would that be of any help if things go wrong?
Could the "AMI Firmware Update Utility(APTIO)" (afuwinx64.exe) dump the entire BIOS including ME regions?

To others please feel free to join in the conversation as [X_URL=htt ps://ww w.win-raid.com/t596f39-Intel-Management-Engine-Drivers-Firmware-amp-System-Tools-344.ht ml#msg126158#msg126158]questions[/URL] #9 and #10 are still unanswered.
What is my best course of action to get my system secure?

Your posts contains to many links. A maximum of links is allowed.

New members have to wait 965 before posting external links.

New members need a minimum of 1000 posts before posting external links

Please remove the following links before saving the post:
ht tps://ww w.win-raid.com/t596f39-Intel-Management-Engine-Drivers-Firmware-amp-System-Tools.html]Intel
ht tps://ww w.win-raid.com/t596f39-Intel-Management-Engine-Drivers-Firmware-amp-System-Tools-344.html#msg126158#msg126158]questions

It could be me, but these are NOT external links!
4

@Marty1 ME 8 would patch one or two security flaws more since end of support was a little later. Otherwise would it probably brick your board.

ME driver: What’s the reason for installing the driver? Using ‘standard manageability’ functionality? Just making the exclamation marks in device manager disappear?

Regarding the update mentioned ‘not meant for your system’ is related to this file: “AMT_Intel_8.1.30.1350_W8x64” which contains “ME8_1.5M_Production.BIN”.
The Acer page you linked shows
Model Name Fixed ME FW Target Available Date
Veriton X4610G 7.1.91.3272 5/31/2017

Latest shown her in the ME firmware thread is “Intel ME 7 5MB Firmware v7.1.92.3273”. Acers patch file would work but wouldn’t be latest version.

Bios update tools aren’t 100% predictable, it might depend on version what they back up and write. When updating these tools spare NVRAM to keep settings, serials, MAC address, for backup some can do complete image, some do just bios region… If something ‘goes wrong’ you might be able to restore a working bios but without a backup you might lose some board specific information.

Easiest regarding ME: Use ME tools7 and download Intel ME 7 5MB Firmware v7.1.92.3273 from Intel Management Engine: Drivers, Firmware & System Tools, update as described.

5

@lfb6
I do have a USB programmer with chip: CH340G, it has pins and leads (no chip clip). Would that be usable?
I wasn’t able to locate the BIOS Flash chip on my MB, but everything that is visible is SMT. It must be inaccessible.

RSCN7277.JPG
RSCN7277.JPG1280×960 209 KB


BIOS ROM type: SPI Flash
BIOS ROM size: 8Mb
Support protocol: SMBIOS(DMI)2.4/DMI2.0
I tried to dump my firmware with Flash Programming Tool (fpt -i).

E:\tmp\iAMT_Intel_7.0.0.1144_W7x86x64\CPT_5M_7.0.4.1197\Tools\System Tools\Flash Programming Tool\Windows64>fptw64.exe -I

Intel (R) Flash Programming Tool. Version: 7.0.4.1197
Copyright (c) 2007-2010, Intel Corporation. All rights reserved.

Platform: Intel(R) Q65 Express Chipset Revision: Unknown
Reading HSFSTS register… Flash Descriptor: Valid

— Flash Devices Found —
W25Q64BV ID:0xEF4017 Size: 8192KB (65536Kb)

— Flash Image Information –
Signature: VALID
Number of Flash Components: 1
Component 1 - 8192KB (65536Kb)
Regions:
Descriptor - Base: 0x000000, Limit: 0x000FFF
BIOS - Base: 0x600000, Limit: 0x7FFFFF
ME - Base: 0x003000, Limit: 0x5FFFFF
GbE - Base: 0x001000, Limit: 0x002FFF
PDR - Not present
Master Region Access:
CPU/BIOS - ID: 0x0000, Read: 0x0B, Write: 0x0A
ME - ID: 0x0000, Read: 0x0D, Write: 0x0C
GbE - ID: 0x0118, Read: 0x08, Write: 0x08

Total Accessable SPI Memory: 8192KB, Total Installed SPI Memory : 8192KB

FPT Operation Passed

E:\tmp\iAMT_Intel_7.0.0.1144_W7x86x64\CPT_5M_7.0.4.1197\Tools\System Tools\Flash Programming Tool\Windows64>

E:\tmp\iAMT_Intel_7.0.0.1144_W7x86x64\CPT_5M_7.0.4.1197\Tools\System Tools\Flash Programming Tool\Windows64>fptw64.exe -d "D:\Issues\ME_vulnerabilities\Flash Programming Tool\ME_disble_jumper_on\spi_orig.bin"

Intel (R) Flash Programming Tool. Version: 7.0.4.1197
Copyright (c) 2007-2010, Intel Corporation. All rights reserved.

Platform: Intel(R) Q65 Express Chipset Revision: Unknown
Reading HSFSTS register… Flash Descriptor: Valid

— Flash Devices Found —
W25Q64BV ID:0xEF4017 Size: 8192KB (65536Kb)


- Reading Flash [0x800000] 8192KB of 8192KB - 100% complete.
Writing flash contents to file "D:\Issues\ME_vulnerabilities\Flash Programming Tool\ME_disble_jumper_on\spi_orig.bin"…

Memory Dump Complete
FPT Operation Passed

E:\tmp\iAMT_Intel_7.0.0.1144_W7x86x64\CPT_5M_7.0.4.1197\Tools\System Tools\Flash Programming Tool\Windows64>

E:\tmp\iAMT_Intel_7.0.0.1144_W7x86x64\CPT_5M_7.0.4.1197\Tools\System Tools\Flash Programming Tool\Windows64>fptw64.exe -D "D:\Issues\ME_vulnerabilities\Flash Programming Tool\ME_disble_jumper_on\spi_PDR_orig.bin" -PDR

Intel (R) Flash Programming Tool. Version: 7.0.4.1197
Copyright (c) 2007-2010, Intel Corporation. All rights reserved.

Platform: Intel(R) Q65 Express Chipset Revision: Unknown
Reading HSFSTS register… Flash Descriptor: Valid

— Flash Devices Found —
W25Q64BV ID:0xEF4017 Size: 8192KB (65536Kb)

PDR Region does not exist.

Error 3: Region does not exist.

E:\tmp\iAMT_Intel_7.0.0.1144_W7x86x64\CPT_5M_7.0.4.1197\Tools\System Tools\Flash Programming Tool\Windows64>
In order to do that I had to jump the ME_disable jumper on my MB. Win 10 startup time went down from 9 seconds to 2:05 min.
I compiled and ran ‘intelmetool’ under Linux and it showed:

~/Projects/ME-tool/intelmetool$ sudo ./intelmetool -S
Bad news, you have a Q65 Express Chipset LPC Controller so you have ME hardware on board and it is very difficult to remove, continuing…
RCBA at 0xfed1c000
MEI not hidden on PCI, checking if visible
MEI found: [8086:1c3a] 6 Series/C200 Series Chipset Family MEI Controller #1

ME Status : 0x1e000245
ME Status 2 : 0x69000006

ME: FW Partition Table : OK
ME: Bringup Loader Failure : NO
ME: Firmware Init Complete : YES
ME: Manufacturing Mode : NO
ME: Boot Options Present : NO
ME: Update In Progress : NO
ME: Current Working State : Normal
ME: Current Operation State : M0 with UMA
ME: Current Operation Mode : Normal
ME: Error Code : No Error
ME: Progress Phase : Host Communication
ME: Power Management Event : Non-power cycle reset
ME: Progress Phase State : Host communication established

PCI READ [bc] : 0x000000bc
ME: Extend SHA-256: 24c987fa8c26e9798a4d237df4edabee7222f4fd8e4dfce0cd1981231f0ccc9d

ME seems okay on this board
WRITE [00] : CB: 0x80040007
WRITE [00] : CB: 0x000002ff
READ [08] : CB: 0x80240000
ME: response is missing data
READ [08] : CB: 0x00000084
ME: invalid response, group 255 ?= 132, command 2 ?= 0, is_response 0
ME: not enough room in response buffer: 8 != 6
READ [08] : CB: 0x000002a4
READ [08] : CB: 0x000003ff
READ [08] : CB: 0x00000000
READ [08] : CB: 0x00000000
READ [08] : CB: 0x00000000
READ [08] : CB: 0x00000000
READ [08] : CB: 0x00000000
READ [08] : CB: 0x801c0000
ME: Firmware Version 0.676.1023.0 (code) 0.0.0.0 (recovery) 0.0.0.0 (fitc)
*** stack smashing detected ***: terminated
Aborted

=== second run:
~/Projects/ME-tool/intelmetool$ sudo ./intelmetool --help
Bad news, you have a Q65 Express Chipset LPC Controller so you have ME hardware on board and it is very difficult to remove, continuing…
RCBA at 0xfed1c000
MEI not hidden on PCI, checking if visible
MEI found: [8086:1c3a] 6 Series/C200 Series Chipset Family MEI Controller #1

ME Status : 0x1e000245
ME Status 2 : 0x69000006

ME: FW Partition Table : OK
ME: Bringup Loader Failure : NO
ME: Firmware Init Complete : YES
ME: Manufacturing Mode : NO
ME: Boot Options Present : NO
ME: Update In Progress : NO
ME: Current Working State : Normal
ME: Current Operation State : M0 with UMA
ME: Current Operation Mode : Normal
ME: Error Code : No Error
ME: Progress Phase : Host Communication
ME: Power Management Event : Non-power cycle reset
ME: Progress Phase State : Host communication established

PCI READ [bc] : 0x000000bc
ME: Extend SHA-256: 24c987fa8c26e9798a4d237df4edabee7222f4fd8e4dfce0cd1981231f0ccc9d

ME seems okay on this board
WRITE [00] : CB: 0x80040007
WRITE [00] : CB: 0x000002ff
READ [08] : CB: 0x801c0000
READ [08] : CB: 0xffffffff
ME: invalid response, group 255 ?= 255, command 2 ?= 127, is_response 1
READ [08] : CB: 0xffffffff
READ [08] : CB: 0xffffffff
READ [08] : CB: 0xffffffff
READ [08] : CB: 0xffffffff
READ [08] : CB: 0xffffffff
READ [08] : CB: 0xffffffff
ME: Firmware Version 65535.65535.65535.65535 (code) 65535.65535.65535.65535 (recovery) 65535.65535.65535.65535 (fitc)
WRITE [00] : CB: 0x80080007
WRITE [00] : CB: 0x00000203
WRITE [00] : CB: 0x00000000
READ [08] : CB: 0x80140007
ME: response is missing data
READ [08] : CB: 0x000082ff
ME: invalid response, group 3 ?= 255, command 2 ?= 2, is_response 1
ME: not enough room in response buffer: 4 != 3
READ [08] : CB: 0x00070000
READ [08] : CB: 0x000404ad
READ [08] : CB: 0x00070000
READ [08] : CB: 0x000404ad
ME Capability: Full Network manageability : OFF
ME Capability: Regular Network manageability : OFF
ME Capability: Manageability : ON
ME Capability: Small business technology : OFF
ME Capability: Level III manageability : OFF
ME Capability: IntelR Anti-Theft (AT) : OFF
ME Capability: IntelR Capability Licensing Service (CLS) : OFF
ME Capability: IntelR Power Sharing Technology (MPC) : ON
ME Capability: ICC Over Clocking : OFF
ME Capability: Protected Audio Video Path (PAVP) : OFF
ME Capability: IPV6 : OFF
ME Capability: KVM Remote Control (KVM) : OFF
ME Capability: Outbreak Containment Heuristic (OCH) : OFF
ME Capability: Virtual LAN (VLAN) : OFF
ME Capability: TLS : OFF
ME Capability: Wireless LAN (WLAN) : OFF
exiting
~/Projects/ME-tool/intelmetool$

~/Projects/ME-tool/intelmetool$ sudo ./intelmetool --help
Bad news, you have a Q65 Express Chipset LPC Controller so you have ME hardware on board and it is very difficult to remove, continuing…
RCBA at 0xfed1c000
MEI not hidden on PCI, checking if visible
MEI found: [8086:1c3a] 6 Series/C200 Series Chipset Family MEI Controller #1

ME Status : 0x40185
ME Status 2 : 0x16440006

ME: FW Partition Table : OK
ME: Bringup Loader Failure : NO
ME: Firmware Init Complete : NO
ME: Manufacturing Mode : NO
ME: Boot Options Present : NO
ME: Update In Progress : NO
ME: Current Working State : Normal
ME: Current Operation State : Bring up
ME: Current Operation Mode : Security Override via Jumper
ME: Error Code : No Error
ME: Progress Phase : BUP Phase
ME: Power Management Event : Pseudo-global reset
ME: Progress Phase State : 0x44

PCI READ [bc] : 0x000000bc
ME: Extend SHA-256: 24c987fa8c26e9798a4d237df4edabee7222f4fd8e4dfce0cd1981231f0ccc9d

ME seems okay on this board
ME: failed to become ready
WRITE [00] : CB: 0x80040007
WRITE [00] : CB: 0x000002ff
ME: failed to become ready
ME: GET FW VERSION message failed
ME: failed to become ready
WRITE [00] : CB: 0x80080007
WRITE [00] : CB: 0x00000203
WRITE [00] : CB: 0x00000000
ME: failed to become ready
ME: GET FWCAPS message failed
exiting
~/Projects/ME-tool/intelmetool$


Is my SPI dump good?

NVRAM isn’t that the battery backed CMOS. Are serials, MAC address in there? How can I back that up?

6

@Marty1 I’m not familiar with a CH340G, quick view into datasheet seems to indicate it’s an serial interface? CH341 programmer with SOIC clip is usually less than 10$, so it’s normally not woth the time exeperimenting. I addition there’s much more help to find for a tested/ proven solution.

Otherwise fptw tells you what to lock for. Chip may be hidden under plastics or on the underside of the board.
" — Flash Devices Found —
W25Q64BV ID:0xEF4017 Size: 8192KB (65536Kb)…"

Should’ve given you a complete ‘good’ bios dump in spi_orig.bin. But it’s impossible to know without having looked into the file. Open the file with UEFItool_NE, see if there are warnings in parser and if the structure looks OK.

Why did you try to dump the PDR region? fptw- i states that it’s doesn’t exist.

I’m not familiar with the tool you compiled.

NVRAM is an area in the SPI- chip/ in the bios where a lot of variables are written/ changed/ deleted continously. Even OSes have the possibility to write into that area. UEFI bios is no longer a static thing that you program once and still find unchanged after years like an old legacy bios.

7

Thanks for your reply,


It’s not in sight beyond that I’ll have to take the whole thing thoroughly apart. It’s a small form factor PC. Space is really cramped. Wouldn’t there be some test points on the PCB (see picture)? Is it really necessary?


Where in memory is it located and how can I back that area up?

8

@Marty1 You have with very high probability a comlete backup via fpt according to the posted output. So until you brick your system you won’t need a programmer and access to the bios chip. NVRAM is located in the bios chip, in the bios structure, you did possibly backup it already via fpt. See picture, Haswell AMI- bios, first NVRAM volume expanded (second picture) is a little more than 11 screens of variables.

nv1.jpg

nv2.jpg



What is it actually you’re planning to do?

9


I want to get it secure and keep it fast and take as little risk as possible. What would you recommend.

10


I checked spi_orig.bin with UEFItool_NE and found the following:


Descriptor:

Fixed: Yes
Base: 0h
Address: FF800000h
Offset: 0h
ReservedVector:
FF FF FF FF FF FF FF FF
FF FF FF FF FF FF FF FF
Full size: 1000h (4096)
GbE region offset: 1000h
ME region offset: 3000h
BIOS region offset: 600000h
Region access settings:
BIOS: 0Bh 0Ah ME: 0Dh 0Ch
GbE: 08h 08h
BIOS access table:
Read Write
Desc Yes No
BIOS Yes Yes
ME No No
GbE Yes Yes
PDR No No
Flash chips in VSCC table:
1F4700 (Atmel AT25DF321)
EF4017 (Winbond W25Q64)
1C3017 (EON EN25Q64)
Does this mean I have 3 discrete SPI flash chips on my MB?


Does this mean that the image is bad, or that my current firmware is bad? Could intelmetool have messed it up?
Is this a red light to continue flashing the ME firmware, or could that restore things?
I’m planning to flash

.

11

Your ME firmware has 3 types of SPI chips supported.

The invalid entries refer to non existing partitions, the valid entries refer to existing partitions.

Checksum errors are not uncommon, especially for the FPT partition table header.

12

The latest 6 series Management Engine firmware version on this site is:



But it will miss vendor specific (Acer) modifications.

Intel state about ME FW updates:



Won’t I miss the Acer customizations to the ME FW?
How can I find ou what Acer customized to the ME FW and how can I re-apply those customizations to the latest Firmware v7.1.92.3273 ?
Where can I find release notes about ME Firmware v7.1.92.3273, so I can read what has been fixed/changed in that version?

13

Intel Management Engine: Drivers, Firmware & System Tools => B. About Intel (CS)ME, PMC, PHY & PCHC Firmware Updates
Intel Management Engine: Drivers, Firmware & System Tools

Settings transfer: Guide-How To: Clean Dumped Intel Engine (CS)ME/(CS)TXE Regions with Data Initialization
[Guide] Clean Dumped Intel Engine (CS)ME/(CS)TXE Regions with Data Initialization

14

The guide says it is for purpose of:

Because the ME FW image is of unknown origin and likely not from the same OEM (Acer) it is most likely not to be usable on another system.

How is this guide useful for me?
My questions remain the same:

15

That’s described quite detailed in [Guide] Clean Dumped Intel Engine (CS)ME/(CS)TXE Regions with Data Initialization

But you don’t need to transfer/ reapply any settnigs for an ME update, and that’s described in the guide for updating ME firmware.

Why don’t you just apply the ME-update Acer provides?

16

I upgraded to ME FW Version 7.1.91.3272

Here are the results:

C:\Apps\Intel-ME_CPT_5M_7.0.4.1197\MEInfo\Windows>MEInfoWin.exe

Intel(R) MEInfo Version: 7.0.4.1197
Copyright(C) 2005 - 2010, Intel Corporation. All rights reserved.

Intel(R) Manageability and Security Application code versions:

BIOS Version: P01-B3
MEBx Version: 7.0.0.53
Gbe Version: 1.3
VendorID: 8086
PCH Version: 600005
FW Version: 7.1.91.3272
UNS Version: Not Available
LMS Version: Not Available
MEI Driver Version: 11.0.0.1157
Wireless Hardware Version: Not Available
Wireless Driver Version: Not Available

FW Capabilities: 20585574

Intel(R) Standard Manageability - PRESENT/ENABLED
Intel(R) Anti-Theft Technology - PRESENT/ENABLED
Intel(R) Capability Licensing Service - PRESENT/ENABLED
Protect Audio Video Path - PRESENT/ENABLED

Intel(R) Standard Manageability State: Enabled
CPU Upgrade State: Upgrade Capable
Cryptography Support: Enabled
Last ME reset reason: Power up
Local FWUpdate: Disabled
BIOS and GbE Config Lock: Disabled
Host Read Access to ME: Disabled
Host Write Access to ME: Disabled
SPI Flash ID #1: EF4017
SPI Flash ID VSCC #1: 20052005
SPI Flash BIOS VSCC: 20052005
BIOS boot State: Post Boot
OEM Id: 00000000-0000-0000-0000-000000000000
Link Status: Link down
System UUID: <censored>
MAC Address: <censored>
IPv4 Address: 0.0.0.0
IPv6 Enablement: Disabled
Privacy Level: Default
Configuration state: Not started
Provisioning Mode: Unknown
Capability Licensing Service: Enabled
Capability Licensing Service Status: Permit info not available
OEM Tag: 0x00000000
C:\Apps\Intel-ME_CPT_5M_7.0.4.1197\MEManuf\Windows>MEManufWin.exe -R -verbose

Intel(R) MEManuf Version: 7.0.4.1197
Copyright(C) 2005 - 2010, Intel Corporation. All rights reserved.

Platform stepping value is 5

FW Status Register1: 0x1E000245
FW Status Register2: 0x68000006

CurrentState: Normal
ManufacturingMode: Disabled
FlashPartition: Valid
OperationalState: M0 with UMA
InitComplete: Complete
BUPLoadState: Success
ErrorCode: No Error
ModeOfOperation: Normal
ICC: Valid OEM data, ICC programmed

Get FWU info command…done

Get FWU version command…done

Get FWU feature state command…done

Get ME FWU platform type command…done

Get ME FWU feature capability command…done
Feature enablement is 0x13A1C66
gFeatureAvailability value is 0x1
OEM ICC data valid and programmed correctly

Request Intel(R) ME test result command…done
vsccommn.bin was created on 02:10:39 09/22/2010 GMT
SPI Flash ID #1 ME VSCC value is 0x2005
SPI Flash ID #1 (ID: 0xEF4017) ME VSCC value checked
SPI Flash ID #1 BIOS VSCC value is 0x2005
SPI Flash ID #1 (ID: 0xEF4017) BIOS VSCC value checked
FPBA value is 0x0
No Intel Wireless device was found

Get Intel(R) ME test data command…done
Total of 21 Intel(R) ME test result retrieved
Micro Kernel - Blob Manager: Set - Passed
Micro Kernel - Blob Manager: Get - Passed
Micro Kernel - Blob Manager: Remove - Passed
Policy Kernel - SMBus: Read byte - Passed
Policy Kernel - ME Password: Valid MEBx password - Passed
Policy Kernel - Power Package: Package 1 supported - Passed
Policy Kernel - Power Package: Default package supported - Passed
Policy Kernel - ME Configuration: Wlan Power Well - Passed
Policy Kernel - ME Configuration: CPU Missing Logic - Passed
Policy Kernel - ME Configuration: M3 Power Rails Available - Passed
Policy Kernel - Embedded Controller: Get power source - Passed
Common Services - General: Low power idle timeout - Passed
Common Services - Provisioning: Valid MEBX password change policy - Passed
Common Services - Provisioning: Client Config mode is valid - Passed
Common Services - General: Vlan not enabled on mobile - Passed
Common Services - Provisioning: Both PID and PPS are set - Passed
Common Services - Provisioning: MEBX password set when PID and PPS set - Passed
AMT - Privacy Level: Valid Privacy Level settings - Passed
AMT - Power: Power-package 2 supported - Passed
AMT - Hardware Inventory: BIOS tables - Passed
Policy Kernel - Power Package: Live Heap Test - Passed

Clear Intel(R) ME test data command…done

MEManuf Test Passed
╔═══════════════════════════════════════════╗
║ ME Analyzer v1.160.0 r212 ║
╚═══════════════════════════════════════════╝

╔════════════════════════════════════════════════════╗
║ ME7_5M_UPD_Production.bin (1/1) ║
╟───────────────────────────────┬────────────────────╢
║ Family │ ME ║
╟───────────────────────────────┼────────────────────╢
║ Version │ 7.1.91.3272 ║
╟───────────────────────────────┼────────────────────╢
║ Release │ Production ║
╟───────────────────────────────┼────────────────────╢
║ Type │ Update ║
╟───────────────────────────────┼────────────────────╢
║ SKU │ 5MB ║
╟───────────────────────────────┼────────────────────╢
║ Patsburg PCH Support │ Yes ║
╟───────────────────────────────┼────────────────────╢
║ Date │ 2017-04-07 ║
╟───────────────────────────────┼────────────────────╢
║ Downgrade Blacklist 7.0 │ <= 7.0.10.1203 ║
╟───────────────────────────────┼────────────────────╢
║ Downgrade Blacklist 7.1 │ <= 7.1.13.1088 ║
╟───────────────────────────────┼────────────────────╢
║ Chipset Support │ CPT/PBG ║
╟───────────────────────────────┼────────────────────╢
║ Latest │ No ║
╚═══════════════════════════════╧════════════════════╝
Please have a look at the bold marked passages. They have changed. Why?
Is the system vulnerable to the Intel poinson pill (Intel(R) Anti-Theft Technology - PRESENT/ENABLED)?
Is DRM blocking still enabled (Intel(R) Capability Licensing Service - PRESENT/ENABLED).

I rescanned with:
Intel(R) CSME Detection Tool For Legacy Systems
Application Version: 1.0.16.0
Scan date: 03/11/2020 23:49:23

Risk Assessment
Based on the analysis performed by this tool: This system is vulnerable.

Explanation:
The detected version of the Intel(R) Management Engine firmware is considered vulnerable for INTEL-SA-00086. Contact your system manufacturer for support and remediation of this system.
For more information refer to the Intel(R) CSME Detection Tool For Legacy Systems Guide or the Intel Security Advisory Intel-SA-00086 at the following link: https://www.intel.com/sa-00086-support

Host Computer Information
Name: <censored>
Manufacturer: Acer
Model: Veriton X4610G
Processor Name: Intel(R) Core™ i5-2320 CPU @ 3.00GHz
OS Version: Microsoft Windows 10 Pro

Intel(R) ME Information
Engine: Intel(R) Management Engine
Version: 7.1.91.3272

Copyright(C) 2017-2019, Intel Corporation, All rights reserved.

Both ME Analyzer and Intel(R) CSME Detection Tool are unsatisfied.
What vulnerabilities remain and how can I mitigate them?

17

Your markings aren’t correct, changes to fw- capabilities are security related (local update).

To run an ME- update file in MEA isn’t meaningful regarding configuration details. As explained several times it doesn’t contain configuration data.

SA-00086 was never fixed for ME 7.

Other vulnerabilities:
https://www.intel.com/content/www/us/en/…er/default.html
(Don’t forget to expand the list. If ME 7 isn’t listed, don’t feel safe: It’s never been examined/ tested for newer flaws since it’s EOL/ EOS )

Your update worked well and you’re now on the almost latest version of ME7.

18

I ran MEA on the dumped image of the actively running firmware image.

When was the EOL/ EOS of ME 7?

Are there workarounds to secure against SA-00086, without compromising the system, in order to mitigate the risk of ME 7 vulnerabilities?

19

Dump wouldn’t have type ‘update’ and you’d possibly given another name.

Afaik there are no mitigations. Since there are so many other possible security flaws that never were examined for ME7 there is no point in examining one single old vulnerability.

Never connect this machine directly to the internet!

Last vulnerability fixed for ME7 is SA-00075 (05/17), first not fixed SA-00086 (11/17).

20


Sorry, you’re right. I posted the wrong output, but I did compare them before posting and they were identical. Here’s the ME Analyzer output of the ME FW that’s actively running on my machine:


╔═══════════════════════════════════════════╗
║ ME Analyzer v1.160.0 r212 ║
╚═══════════════════════════════════════════╝

╔══════════════════════════════════════════════════════╗
║ ME_FW_Backup_7.1.91.3272.BIN (1/1) ║
╟────────────────────────────────┬─────────────────────╢
║ Family │ ME ║
╟────────────────────────────────┼─────────────────────╢
║ Version │ 7.1.91.3272 ║
╟────────────────────────────────┼─────────────────────╢
║ Release │ Production ║
╟────────────────────────────────┼─────────────────────╢
║ Type │ Update ║
╟────────────────────────────────┼─────────────────────╢
║ SKU │ 5MB ║
╟────────────────────────────────┼─────────────────────╢
║ Patsburg PCH Support │ Yes ║
╟────────────────────────────────┼─────────────────────╢
║ Date │ 2017-04-07 ║
╟────────────────────────────────┼─────────────────────╢
║ Downgrade Blacklist 7.0 │ <= 7.0.10.1203 ║
╟────────────────────────────────┼─────────────────────╢
║ Downgrade Blacklist 7.1 │ <= 7.1.13.1088 ║
╟────────────────────────────────┼─────────────────────╢
║ Chipset Support │ CPT/PBG ║
╟────────────────────────────────┼─────────────────────╢
║ Latest │ No ║
╚════════════════════════════════╧═════════════════════╝


The machine needs to be connected to the internet otherwise it’s useless.
So there must be IP ports that the ME FW is listening on. Do you know what ports they are?
A firewall on the Win 10 / Linux host (running on the i5 processor) won’t work I suppose, because ME runs on its own separate embedded host (with (Minix) OS) with its own network connectivity. Did Intel implement a firewall on it, which I could configure maybe (or is that also proprietary information)?
How would I block access to the ME FW ports from the internet (and how would I do that for attackers from withing the LAN)?
Could I force the ME FW to listen through a proxy, maybe?
Could I maybe shut down or unconfigure the ME FW TCP-IP network stack?

[sarcasm on]
Did those bright minds at Intel foresee this and implemented a fail-safe or is the assumption that Intel engineers not ever make mistakes?
It’s best of course to bake their flawless code into obscure and proprietary embedded silicon on all their chip-sets to be, don’t they?
And if you don’t make mistakes, you don’t need to support it either of course.
What a brilliant people over at Intel!
I’ve got to run out and buy me another one of those, oh shoot, I did and it’s flawed too… and not patched either…
Hey I’ve got a business laptop which I scanned and surprise surprise, it’s vulnerable too!
Maybe they should call those unpatched and out of support bugs features over at Intel?
Features to buy yet another machine, oops flawed too and another, and another…
[/sarcasm off]

21

AMT/ vpro is pre boot, pre-OS. The ports are documented, but when running a system in a non safe environment one would possibly want to unblock the needed ports and instead og blocking selectively non used ports? But that’s stuff I don’t know too much of.

AMT documentation:
https://software.intel.com/sites/managea…bilityports.htm

Otherwise it’s not just Intel ME with a lot of not known vulnerabilities, it’s about processor µcode and possibly some bios vulnerabilities, too.

Good luck!

22

If ME FW runs pre-boot, but it’s doing TCP-IP, then it needs a MAC address and an IP address.
Does the ME FW have its own unique MAC address (distinct from Win/Linux host)?
Does the ME FW have its own IP address (distinct from Win/Linux host)?

And if the mac address is shared, maybe the Win/Linux host can claim the same IP address and snatch the ports away from ME FW:
664
623
5900
16995
16994
16993
16992

Then the Win/Linux host might be able to obstruct communication to the ME FW by claiming those port with a dummy service. But that is post boot. Hmmm pre- boot needs to be blocked otherwise.

So does the ME FW share its MAC address with the host?

(Alt solution, only run WiFi.)