Securing Acer Veriton X4610G Intel Management Engine

[Marty1]

Dear people,

My main (desktop) computer is an Acer Veriton X4610G (Intel Q65/Courgarpoint chip-set, see my signature below for specs). I’ve upgraded it to Win10x64pro (2004 build). My OEM and Intel have both dropped support for my hardware (HW) and chip-set, but I find that the HW is still quite viable/usable. I’m in the process of updating firmware (FW) and necessary drivers and stumbled upon various ME vulnerabilities (INTEL-SA-00075 and Intel-SA-00086 at least). @Fernando was kind enough to point me to the SOL driver . Later on I read (and reread) the opening post of this topic and was taken back by the immense complexity of it all and the deep integration of ME into the platform. My OEM and Intel refuse to assist me and just send me to their forums due to indifference and/or system age. I found no solution there. I’m really happy to see the expertise in this forum and would like to ask the following questions regarding ME/AMT.

My goal is to get my system stable and secure and not break nor brick it in the process.

Here’s what I currently have: ME CPT 5M v7.0.4.1197

C:\Apps\Intel-ME_CPT_5M_7.0.4.1197\MEInfo\Windows>MEInfoWin.exe

Intel(R) MEInfo Version: 7.0.4.1197
Copyright(C) 2005 - 2010, Intel Corporation. All rights reserved.

Intel(R) Manageability and Security Application code versions:

BIOS Version: P01-B3
MEBx Version: 7.0.0.53
Gbe Version: 1.3
VendorID: 8086
PCH Version: 600005
FW Version: 7.0.4.1197
UNS Version: Not Available
LMS Version: Not Available
MEI Driver Version: 11.0.0.1157
Wireless Hardware Version: Not Available
Wireless Driver Version: Not Available

FW Capabilities: 19536998

Intel(R) Standard Manageability - PRESENT/ENABLED
Intel(R) Anti-Theft Technology - PRESENT/ENABLED
Intel(R) Capability Licensing Service - PRESENT/ENABLED
Protect Audio Video Path - PRESENT/ENABLED

Intel(R) Standard Manageability State: Enabled
CPU Upgrade State: Upgrade Capable
Cryptography Support: Enabled
Last ME reset reason: Power up
Local FWUpdate: Enabled
BIOS and GbE Config Lock: Disabled
Host Read Access to ME: Disabled
Host Write Access to ME: Disabled
SPI Flash ID #1: EF4017
SPI Flash ID VSCC #1: 20052005
SPI Flash BIOS VSCC: 20052005
BIOS boot State: Post Boot
OEM Id: 00000000-0000-0000-0000-000000000000
Link Status: Link down
System UUID: <censored>
MAC Address: <censored>
IPv4 Address: 0.0.0.0
IPv6 Enablement: Disabled
Privacy Level: Default
Configuration state: Not started
Provisioning Mode: Unknown
Capability Licensing Service: Enabled
Capability Licensing Service Status: Permit info not available
OEM Tag: 0x00000000

C:\Apps\Intel-ME_CPT_5M_7.0.4.1197\MEManuf\Windows>MEManufWin.exe -verbose

Intel(R) MEManuf Version: 7.0.4.1197
Copyright(C) 2005 - 2010, Intel Corporation. All rights reserved.

Platform stepping value is 5

FW Status Register1: 0x1E000245
FW Status Register2: 0x68000006

CurrentState: Normal
ManufacturingMode: Disabled
FlashPartition: Valid
OperationalState: M0 with UMA
InitComplete: Complete
BUPLoadState: Success
ErrorCode: No Error
ModeOfOperation: Normal
ICC: Valid OEM data, ICC programmed

Get FWU info command…done

Get FWU version command…done

Get FWU feature state command…done

Get ME FWU platform type command…done

Get ME FWU feature capability command…done
Feature enablement is 0x12A1C66
gFeatureAvailability value is 0x1
OEM ICC data valid and programmed correctly

Request Intel(R) ME test result command…done
vsccommn.bin was created on 02:10:39 09/22/2010 GMT
SPI Flash ID #1 ME VSCC value is 0x2005
SPI Flash ID #1 (ID: 0xEF4017) ME VSCC value checked
SPI Flash ID #1 BIOS VSCC value is 0x2005
SPI Flash ID #1 (ID: 0xEF4017) BIOS VSCC value checked
FPBA value is 0x0
No Intel Wireless device was found

Get Intel(R) ME test data command…done
Total of 21 Intel(R) ME test result retrieved
Micro Kernel - Blob Manager: Set - Passed
Micro Kernel - Blob Manager: Get - Passed
Micro Kernel - Blob Manager: Remove - Passed
Policy Kernel - SMBus: Read byte - Passed
Policy Kernel - ME Password: Valid MEBx password - Passed
Policy Kernel - Power Package: Package 1 supported - Passed
Policy Kernel - Power Package: Default package supported - Passed
Policy Kernel - ME Configuration: Wlan Power Well - Passed
Policy Kernel - ME Configuration: CPU Missing Logic - Passed
Policy Kernel - ME Configuration: M3 Power Rails Available - Passed
Policy Kernel - Embedded Controller: Get power source - Passed
Common Services - General: Low power idle timeout - Passed
Common Services - Provisioning: Valid MEBX password change policy - Passed
Common Services - Provisioning: Client Config mode is valid - Passed
Common Services - General: Vlan not enabled on mobile - Passed
Common Services - Provisioning: Both PID and PPS are set - Passed
Common Services - Provisioning: MEBX password set when PID and PPS set - Passed
AMT - Privacy Level: Valid Privacy Level settings - Passed
AMT - Power: Power-package 2 supported - Passed
AMT - Hardware Inventory: BIOS tables - Passed
Policy Kernel - Power Package: Live Heap Test - Passed

Clear Intel(R) ME test data command…done

MEManuf Test Passed

╔═══════════════════════════════════════════╗
║ ME Analyzer v1.160.0 r212 ║
╚═══════════════════════════════════════════╝

╔════════════════════════════════════════════════════╗
║ CPT_5M_UPD_Production.BIN (1/1) ║
╟────────────────────────────────┬───────────────────╢
║ Family │ ME ║
╟────────────────────────────────┼───────────────────╢
║ Version │ 7.0.4.1197 ║
╟────────────────────────────────┼───────────────────╢
║ Release │ Production ║
╟────────────────────────────────┼───────────────────╢
║ Type │ Update ║
╟────────────────────────────────┼───────────────────╢
║ SKU │ 5MB ║
╟────────────────────────────────┼───────────────────╢
║ Patsburg PCH Support │ No ║
╟────────────────────────────────┼───────────────────╢
║ Date │ 2011-02-01 ║
╟────────────────────────────────┼───────────────────╢
║ Downgrade Blacklist 7.0 │ <= 7.0.3.1194 ║
╟────────────────────────────────┼───────────────────╢
║ Downgrade Blacklist 7.1 │ <= 7.1.2.1049 ║
╟────────────────────────────────┼───────────────────╢
║ Chipset Support │ CPT ║
╟────────────────────────────────┼───────────────────╢
║ Latest │ No ║
╚════════════════════════════════╧═══════════════════╝

These are my questions:

1. Can I upgrade ME to a secure version that supports my hardware and Win10 OS?
2. Is the ME Firmware part of the normal BIOS/EUFI firmware? Is it physically inside the same BIOS EEPROM? Is it contained in the BIOS image.
3. Is there a risk of bricking my computer by upgrading the ME Firmware?
4. Can ME be upgraded beyond version 7.x on my computer (Acer Support offers a Win8 download for: AMT_Intel_8.1.30.1350_W8x64 it contains "ME8_1.5M_Production.BIN", which ME Analyzer says the following about:

╔═══════════════════════════════════════════╗
║ ME Analyzer v1.160.0 r212 ║
╚═══════════════════════════════════════════╝

╔══════════════════════════════════════════════════╗
║ ME8_1.5M_Production.BIN (1/1) ║
╟──────────────────────────────────┬───────────────╢
║ Family │ ME ║
╟──────────────────────────────────┼───────────────╢
║ Version │ 8.1.30.1350 ║
╟──────────────────────────────────┼───────────────╢
║ Release │ Production ║
╟──────────────────────────────────┼───────────────╢
║ Type │ Stock ║
╟──────────────────────────────────┼───────────────╢
║ SKU │ 1.5MB ║
╟──────────────────────────────────┼───────────────╢
║ TCB Security Version Number │ 1 ║
╟──────────────────────────────────┼───────────────╢
║ Version Control Number │ 2 ║
╟──────────────────────────────────┼───────────────╢
║ Production Ready │ Yes ║
╟──────────────────────────────────┼───────────────╢
║ Date │ 2013-01-17 ║
╟──────────────────────────────────┼───────────────╢
║ Size │ 0x17D000 ║
╟──────────────────────────────────┼───────────────╢
║ Chipset Support │ CPT/PBG/PPT ║
╟──────────────────────────────────┼───────────────╢
║ Latest │ No ║
╚══════════════════════════════════╧═══════════════╝

(It doesn’t seem to be right to me because it’s no Corporate (CPT) 5M firmware image).
5. What does it mean when ME Analyzer reports: "Latest: No"? And can it report to me what the Latest would be?
6. To what version can/should I ultimately update?
7. Would I need to add Vendor Specific Component Capabilities (VCSS) myself?
8. The D1. "Intel MEI Drivers & Software Corporate v11.0.6.1194 (ME 7-8)" corp link points to Lenovo. Is that correct?

@Fernando

Intel MEI Drivers & Software Corporate v11.0.6.1194 (ME 7-8)

9. Does my computer support Intel Anti-Theft Technology? MEInfo reports: "Intel(R) Anti-Theft Technology - PRESENT/ENABLED", but the Q65 chip-set specs state: " Anti-Theft Technology: No".
10. There is a Jumper on my Mother Board (MB) that says: "ME_disable". I can’t find any documentation about it. What does it do? Will disabling it secure me against ME vulnerabilities? Will I loose functionality when I disable it? Or will ME still be silently running and keep on being a vulnerability / security problem?

@plutomaniac

it is essential for it to be operational in order for the platform to be working properly, no matter if the advanced/corporate features are available or not.

11. Can ME communicate over a discrete PCIe-WiFi card?
12. My OEM did provide an ME FW update to protect against: INTEL-SA-00075. ME Analyzer reports some discrepancies about that FW image in comparison to the currently active FW (discrepancies: Patsburg PCH Support No -> Yes, Chipset Support CPT -> CPT/PBG).

╔═══════════════════════════════════════════╗
║ ME Analyzer v1.160.0 r212 ║
╚═══════════════════════════════════════════╝

╔════════════════════════════════════════════════════╗
║ ME7_5M_UPD_Production.bin (1/1) ║
╟───────────────────────────────┬────────────────────╢
║ Family │ ME ║
╟───────────────────────────────┼────────────────────╢
║ Version │ 7.1.91.3272 ║
╟───────────────────────────────┼────────────────────╢
║ Release │ Production ║
╟───────────────────────────────┼────────────────────╢
║ Type │ Update ║
╟───────────────────────────────┼────────────────────╢
║ SKU │ 5MB ║
╟───────────────────────────────┼────────────────────╢
║ Patsburg PCH Support │ Yes ║
╟───────────────────────────────┼────────────────────╢
║ Date │ 2017-04-07 ║
╟───────────────────────────────┼────────────────────╢
║ Downgrade Blacklist 7.0 │ <= 7.0.10.1203 ║
╟───────────────────────────────┼────────────────────╢
║ Downgrade Blacklist 7.1 │ <= 7.1.13.1088 ║
╟───────────────────────────────┼────────────────────╢
║ Chipset Support │ CPT/PBG ║
╟───────────────────────────────┼────────────────────╢
║ Latest │ No ║
╚═══════════════════════════════╧════════════════════╝

Would it be advisable to upgrade? or will it brick my computer for sure?
13. Can I dump/backup the current ME firmware somehow? And will I ever be able to revert to it after an upgrade?

Do you have any other advice for me?

I’m looking forward to your answers.

Kind regards,

Marty

[lfb6]

@Marty1
1. No (Oldest ME version supported by Intel is ME 11 now)
2. Yes, yes, no
3. Yes
4. Possibly no. ME 8.x can work with series 6 chipsets, but I’d suppose the bios should be updated, too. (still MEBx 7.x)
5. Not latest version of the branch. See Intel Management Engine: Drivers, Firmware & System Tools MEA doesn’t report latest, but you could look into MEA.dat.
6. See Intel Management Engine: Drivers, Firmware & System Tools
7. No
8. Yes, driver download is from Lenovo site. (If the meaning of the question was if it’s only meant for Lenovo- no, drivers are normally not vendor specific)

11. If card corresponds to firmware included in (later) ME firmware versions yes
12. That’s a complete package normally not meant for end users since it contains bios and gbe regions, bios region not even meant for your system (3.6MB vs. 2MB, IVB in name).
13. Yes. Complete backup depending on flash descriptor with fpt (ME- tools) or CH341 programmer, restore CH341 programmer. Bios chip soldered, or socketed?

[Marty1]

@lfb6 Thanks for your reply,

@lfb6

1. No (Oldest ME version supported by Intel is ME 11 now)

Now that I can’t get is secure by updating it to ME 11, is it worth updating at all?
(BTW I thought ME 11 would denote the firmware being at version 11? What exactly is at version 11?)

@lfb6

4. Possibly no. ME 8.x can work with series 6 chipsets, but I’d suppose the bios should be updated, too. (still MEBx 7.x)

Would it have any advantages to go to ME firmware version 8.x?

@lfb6

6. See [X_URL=htt ps://ww w.win-raid.com/t596f39-Intel-Management-Engine-Drivers-Firmware-amp-System-Tools.ht ml]Intel Management Engine: Drivers, Firmware & System Tools[/URL]

There are three subsections in the D section. Would it be:

@Fernando

D1. Old Intel MEI Drivers & Software
Intel MEI Drivers & Software Corporate v11.0.6.1194 (ME 7-8)

[quote="lfb6, post:2, topic:35871"]
12. bios region not even meant for your system (3.6MB vs. 2MB, IVB in name).
[/quote] That's disturbing, as I was planning on installing that in order to fix "[X_URL=htt ps://us.answers.acer.com/app/answers/detail/a_id/47605]Intel-SA-00075_CVE-2017-5689_ME - Silent Bob is Silent[/URL]". Are you absolutely sure it's wrong for my system?
[quote="lfb6, post:2, topic:35871"]
13. Yes. Complete backup depending on flash descriptor with fpt (ME- tools) or CH341 programmer, restore CH341 programmer. Bios chip soldered, or socketed? [/quote]
The BIOS chip is soldered.

AMIBIOS supports a "recovery flash" mode, which can be used to flash update a BIOS from the boot block. This is used to update a BIOS image without the need to boot to an operating system. The following is the
process that user should follow to flash BIOS ROM.
1. Put the AMIBoot.ROM to a bootable USB flash drive(Disk on Key, DOK).
2. Install the DOK to the system.
3. Press power button to boot the system and then press Ctrl + Home.
4. The BIOS recovery function will be executed.
5. After BIOS is updated completely, the system will auto reboot.
6. Please enter the setup menu to load default after system reboot.

Would that be of any help if things go wrong?
Could the "AMI Firmware Update Utility(APTIO)" (afuwinx64.exe) dump the entire BIOS including ME regions?

To others please feel free to join in the conversation as [X_URL=htt ps://ww w.win-raid.com/t596f39-Intel-Management-Engine-Drivers-Firmware-amp-System-Tools-344.ht ml#msg126158#msg126158]questions[/URL] #9 and #10 are still unanswered.
What is my best course of action to get my system secure?

Your posts contains to many links. A maximum of links is allowed.

New members have to wait 965 before posting external links.

New members need a minimum of 1000 posts before posting external links

Please remove the following links before saving the post:
ht tps://ww w.win-raid.com/t596f39-Intel-Management-Engine-Drivers-Firmware-amp-System-Tools.html]Intel
ht tps://ww w.win-raid.com/t596f39-Intel-Management-Engine-Drivers-Firmware-amp-System-Tools-344.html#msg126158#msg126158]questions

It could be me, but these are NOT external links!

[lfb6]

@Marty1 ME 8 would patch one or two security flaws more since end of support was a little later. Otherwise would it probably brick your board.

ME driver: What’s the reason for installing the driver? Using ‘standard manageability’ functionality? Just making the exclamation marks in device manager disappear?

Regarding the update mentioned ‘not meant for your system’ is related to this file: “AMT_Intel_8.1.30.1350_W8x64” which contains “ME8_1.5M_Production.BIN”.
The Acer page you linked shows
Model Name Fixed ME FW Target Available Date
Veriton X4610G 7.1.91.3272 5/31/2017

Latest shown her in the ME firmware thread is “Intel ME 7 5MB Firmware v7.1.92.3273”. Acers patch file would work but wouldn’t be latest version.

Bios update tools aren’t 100% predictable, it might depend on version what they back up and write. When updating these tools spare NVRAM to keep settings, serials, MAC address, for backup some can do complete image, some do just bios region… If something ‘goes wrong’ you might be able to restore a working bios but without a backup you might lose some board specific information.

Easiest regarding ME: Use ME tools7 and download Intel ME 7 5MB Firmware v7.1.92.3273 from Intel Management Engine: Drivers, Firmware & System Tools, update as described.

[Marty1]

@lfb6
I do have a USB programmer with chip: CH340G, it has pins and leads (no chip clip). Would that be usable?
I wasn’t able to locate the BIOS Flash chip on my MB, but everything that is visible is SMT. It must be inaccessible.

BIOS ROM type: SPI Flash
BIOS ROM size: 8Mb
Support protocol: SMBIOS(DMI)2.4/DMI2.0

I tried to dump my firmware with Flash Programming Tool (fpt -i).

E:\tmp\iAMT_Intel_7.0.0.1144_W7x86x64\CPT_5M_7.0.4.1197\Tools\System Tools\Flash Programming Tool\Windows64>fptw64.exe -I

Intel (R) Flash Programming Tool. Version: 7.0.4.1197
Copyright (c) 2007-2010, Intel Corporation. All rights reserved.

Platform: Intel(R) Q65 Express Chipset Revision: Unknown
Reading HSFSTS register… Flash Descriptor: Valid

— Flash Devices Found —
W25Q64BV ID:0xEF4017 Size: 8192KB (65536Kb)

— Flash Image Information –
Signature: VALID
Number of Flash Components: 1
Component 1 - 8192KB (65536Kb)
Regions:
Descriptor - Base: 0x000000, Limit: 0x000FFF
BIOS - Base: 0x600000, Limit: 0x7FFFFF
ME - Base: 0x003000, Limit: 0x5FFFFF
GbE - Base: 0x001000, Limit: 0x002FFF
PDR - Not present
Master Region Access:
CPU/BIOS - ID: 0x0000, Read: 0x0B, Write: 0x0A
ME - ID: 0x0000, Read: 0x0D, Write: 0x0C
GbE - ID: 0x0118, Read: 0x08, Write: 0x08

Total Accessable SPI Memory: 8192KB, Total Installed SPI Memory : 8192KB

FPT Operation Passed

E:\tmp\iAMT_Intel_7.0.0.1144_W7x86x64\CPT_5M_7.0.4.1197\Tools\System Tools\Flash Programming Tool\Windows64>

E:\tmp\iAMT_Intel_7.0.0.1144_W7x86x64\CPT_5M_7.0.4.1197\Tools\System Tools\Flash Programming Tool\Windows64>fptw64.exe -d "D:\Issues\ME_vulnerabilities\Flash Programming Tool\ME_disble_jumper_on\spi_orig.bin"

Intel (R) Flash Programming Tool. Version: 7.0.4.1197
Copyright (c) 2007-2010, Intel Corporation. All rights reserved.

Platform: Intel(R) Q65 Express Chipset Revision: Unknown
Reading HSFSTS register… Flash Descriptor: Valid

— Flash Devices Found —
W25Q64BV ID:0xEF4017 Size: 8192KB (65536Kb)


- Reading Flash [0x800000] 8192KB of 8192KB - 100% complete.
Writing flash contents to file "D:\Issues\ME_vulnerabilities\Flash Programming Tool\ME_disble_jumper_on\spi_orig.bin"…

Memory Dump Complete
FPT Operation Passed

E:\tmp\iAMT_Intel_7.0.0.1144_W7x86x64\CPT_5M_7.0.4.1197\Tools\System Tools\Flash Programming Tool\Windows64>

E:\tmp\iAMT_Intel_7.0.0.1144_W7x86x64\CPT_5M_7.0.4.1197\Tools\System Tools\Flash Programming Tool\Windows64>fptw64.exe -D "D:\Issues\ME_vulnerabilities\Flash Programming Tool\ME_disble_jumper_on\spi_PDR_orig.bin" -PDR

Intel (R) Flash Programming Tool. Version: 7.0.4.1197
Copyright (c) 2007-2010, Intel Corporation. All rights reserved.

Platform: Intel(R) Q65 Express Chipset Revision: Unknown
Reading HSFSTS register… Flash Descriptor: Valid

— Flash Devices Found —
W25Q64BV ID:0xEF4017 Size: 8192KB (65536Kb)

PDR Region does not exist.

Error 3: Region does not exist.

E:\tmp\iAMT_Intel_7.0.0.1144_W7x86x64\CPT_5M_7.0.4.1197\Tools\System Tools\Flash Programming Tool\Windows64>

In order to do that I had to jump the ME_disable jumper on my MB. Win 10 startup time went down from 9 seconds to 2:05 min.
I compiled and ran ‘intelmetool’ under Linux and it showed:

~/Projects/ME-tool/intelmetool$ sudo ./intelmetool -S
Bad news, you have a Q65 Express Chipset LPC Controller so you have ME hardware on board and it is very difficult to remove, continuing…
RCBA at 0xfed1c000
MEI not hidden on PCI, checking if visible
MEI found: [8086:1c3a] 6 Series/C200 Series Chipset Family MEI Controller #1

ME Status : 0x1e000245
ME Status 2 : 0x69000006

ME: FW Partition Table : OK
ME: Bringup Loader Failure : NO
ME: Firmware Init Complete : YES
ME: Manufacturing Mode : NO
ME: Boot Options Present : NO
ME: Update In Progress : NO
ME: Current Working State : Normal
ME: Current Operation State : M0 with UMA
ME: Current Operation Mode : Normal
ME: Error Code : No Error
ME: Progress Phase : Host Communication
ME: Power Management Event : Non-power cycle reset
ME: Progress Phase State : Host communication established

PCI READ [bc] : 0x000000bc
ME: Extend SHA-256: 24c987fa8c26e9798a4d237df4edabee7222f4fd8e4dfce0cd1981231f0ccc9d

ME seems okay on this board
WRITE [00] : CB: 0x80040007
WRITE [00] : CB: 0x000002ff
READ [08] : CB: 0x80240000
ME: response is missing data
READ [08] : CB: 0x00000084
ME: invalid response, group 255 ?= 132, command 2 ?= 0, is_response 0
ME: not enough room in response buffer: 8 != 6
READ [08] : CB: 0x000002a4
READ [08] : CB: 0x000003ff
READ [08] : CB: 0x00000000
READ [08] : CB: 0x00000000
READ [08] : CB: 0x00000000
READ [08] : CB: 0x00000000
READ [08] : CB: 0x00000000
READ [08] : CB: 0x801c0000
ME: Firmware Version 0.676.1023.0 (code) 0.0.0.0 (recovery) 0.0.0.0 (fitc)
*** stack smashing detected ***: terminated
Aborted

=== second run:
~/Projects/ME-tool/intelmetool$ sudo ./intelmetool --help
Bad news, you have a Q65 Express Chipset LPC Controller so you have ME hardware on board and it is very difficult to remove, continuing…
RCBA at 0xfed1c000
MEI not hidden on PCI, checking if visible
MEI found: [8086:1c3a] 6 Series/C200 Series Chipset Family MEI Controller #1

ME Status : 0x1e000245
ME Status 2 : 0x69000006

ME: FW Partition Table : OK
ME: Bringup Loader Failure : NO
ME: Firmware Init Complete : YES
ME: Manufacturing Mode : NO
ME: Boot Options Present : NO
ME: Update In Progress : NO
ME: Current Working State : Normal
ME: Current Operation State : M0 with UMA
ME: Current Operation Mode : Normal
ME: Error Code : No Error
ME: Progress Phase : Host Communication
ME: Power Management Event : Non-power cycle reset
ME: Progress Phase State : Host communication established

PCI READ [bc] : 0x000000bc
ME: Extend SHA-256: 24c987fa8c26e9798a4d237df4edabee7222f4fd8e4dfce0cd1981231f0ccc9d

ME seems okay on this board
WRITE [00] : CB: 0x80040007
WRITE [00] : CB: 0x000002ff
READ [08] : CB: 0x801c0000
READ [08] : CB: 0xffffffff
ME: invalid response, group 255 ?= 255, command 2 ?= 127, is_response 1
READ [08] : CB: 0xffffffff
READ [08] : CB: 0xffffffff
READ [08] : CB: 0xffffffff
READ [08] : CB: 0xffffffff
READ [08] : CB: 0xffffffff
READ [08] : CB: 0xffffffff
ME: Firmware Version 65535.65535.65535.65535 (code) 65535.65535.65535.65535 (recovery) 65535.65535.65535.65535 (fitc)
WRITE [00] : CB: 0x80080007
WRITE [00] : CB: 0x00000203
WRITE [00] : CB: 0x00000000
READ [08] : CB: 0x80140007
ME: response is missing data
READ [08] : CB: 0x000082ff
ME: invalid response, group 3 ?= 255, command 2 ?= 2, is_response 1
ME: not enough room in response buffer: 4 != 3
READ [08] : CB: 0x00070000
READ [08] : CB: 0x000404ad
READ [08] : CB: 0x00070000
READ [08] : CB: 0x000404ad
ME Capability: Full Network manageability : OFF
ME Capability: Regular Network manageability : OFF
ME Capability: Manageability : ON
ME Capability: Small business technology : OFF
ME Capability: Level III manageability : OFF
ME Capability: IntelR Anti-Theft (AT) : OFF
ME Capability: IntelR Capability Licensing Service (CLS) : OFF
ME Capability: IntelR Power Sharing Technology (MPC) : ON
ME Capability: ICC Over Clocking : OFF
ME Capability: Protected Audio Video Path (PAVP) : OFF
ME Capability: IPV6 : OFF
ME Capability: KVM Remote Control (KVM) : OFF
ME Capability: Outbreak Containment Heuristic (OCH) : OFF
ME Capability: Virtual LAN (VLAN) : OFF
ME Capability: TLS : OFF
ME Capability: Wireless LAN (WLAN) : OFF
exiting
~/Projects/ME-tool/intelmetool$

~/Projects/ME-tool/intelmetool$ sudo ./intelmetool --help
Bad news, you have a Q65 Express Chipset LPC Controller so you have ME hardware on board and it is very difficult to remove, continuing…
RCBA at 0xfed1c000
MEI not hidden on PCI, checking if visible
MEI found: [8086:1c3a] 6 Series/C200 Series Chipset Family MEI Controller #1

ME Status : 0x40185
ME Status 2 : 0x16440006

ME: FW Partition Table : OK
ME: Bringup Loader Failure : NO
ME: Firmware Init Complete : NO
ME: Manufacturing Mode : NO
ME: Boot Options Present : NO
ME: Update In Progress : NO
ME: Current Working State : Normal
ME: Current Operation State : Bring up
ME: Current Operation Mode : Security Override via Jumper
ME: Error Code : No Error
ME: Progress Phase : BUP Phase
ME: Power Management Event : Pseudo-global reset
ME: Progress Phase State : 0x44

PCI READ [bc] : 0x000000bc
ME: Extend SHA-256: 24c987fa8c26e9798a4d237df4edabee7222f4fd8e4dfce0cd1981231f0ccc9d

ME seems okay on this board
ME: failed to become ready
WRITE [00] : CB: 0x80040007
WRITE [00] : CB: 0x000002ff
ME: failed to become ready
ME: GET FW VERSION message failed
ME: failed to become ready
WRITE [00] : CB: 0x80080007
WRITE [00] : CB: 0x00000203
WRITE [00] : CB: 0x00000000
ME: failed to become ready
ME: GET FWCAPS message failed
exiting
~/Projects/ME-tool/intelmetool$

Is my SPI dump good?

@lfb6

When updating these tools spare NVRAM to keep settings, serials, MAC address, for backup some can do complete image, some do just bios region… If something 'goes wrong' you might be able to restore a working bios but without a backup you might lose some board specific information.

NVRAM isn’t that the battery backed CMOS. Are serials, MAC address in there? How can I back that up?

[lfb6]

@Marty1 I’m not familiar with a CH340G, quick view into datasheet seems to indicate it’s an serial interface? CH341 programmer with SOIC clip is usually less than 10$, so it’s normally not woth the time exeperimenting. I addition there’s much more help to find for a tested/ proven solution.

Otherwise fptw tells you what to lock for. Chip may be hidden under plastics or on the underside of the board.
" — Flash Devices Found —
W25Q64BV ID:0xEF4017 Size: 8192KB (65536Kb)…"

@Marty1

fptw64.exe -d "D:\Issues\ME_vulnerabilities\Flash Programming Tool\ME_disble_jumper_on\spi_orig.bin"… Memory Dump Complete … FPT Operation Passed…

Should’ve given you a complete ‘good’ bios dump in spi_orig.bin. But it’s impossible to know without having looked into the file. Open the file with UEFItool_NE, see if there are warnings in parser and if the structure looks OK.

Why did you try to dump the PDR region? fptw- i states that it’s doesn’t exist.

I’m not familiar with the tool you compiled.

NVRAM is an area in the SPI- chip/ in the bios where a lot of variables are written/ changed/ deleted continously. Even OSes have the possibility to write into that area. UEFI bios is no longer a static thing that you program once and still find unchanged after years like an old legacy bios.

[Marty1]

Thanks for your reply,

@lfb6

Chip may be hidden under plastics or on the underside of the board.

It’s not in sight beyond that I’ll have to take the whole thing thoroughly apart. It’s a small form factor PC. Space is really cramped. Wouldn’t there be some test points on the PCB (see picture)? Is it really necessary?

@lfb6

NVRAM is an area in the SPI- chip/ in the bios where a lot of variables are written/ changed/ deleted continously. Even OSes have the possibility to write into that area. UEFI bios is no longer a static thing that you program once and still find unchanged after years like an old legacy bios.

Where in memory is it located and how can I back that area up?

[lfb6]

@Marty1 You have with very high probability a comlete backup via fpt according to the posted output. So until you brick your system you won’t need a programmer and access to the bios chip. NVRAM is located in the bios chip, in the bios structure, you did possibly backup it already via fpt. See picture, Haswell AMI- bios, first NVRAM volume expanded (second picture) is a little more than 11 screens of variables.

What is it actually you’re planning to do?

[Marty1]

@lfb6

What is it actually you’re planning to do?

I want to get it secure and keep it fast and take as little risk as possible. What would you recommend.

[Marty1]

@lfb6

Open the file with UEFItool_NE, see if there are warnings in parser and if the structure looks OK.

I checked spi_orig.bin with UEFItool_NE and found the following:

Descriptor:

Fixed: Yes
Base: 0h
Address: FF800000h
Offset: 0h
ReservedVector:
FF FF FF FF FF FF FF FF
FF FF FF FF FF FF FF FF
Full size: 1000h (4096)
GbE region offset: 1000h
ME region offset: 3000h
BIOS region offset: 600000h
Region access settings:
BIOS: 0Bh 0Ah ME: 0Dh 0Ch
GbE: 08h 08h
BIOS access table:
Read Write
Desc Yes No
BIOS Yes Yes
ME No No
GbE Yes Yes
PDR No No
Flash chips in VSCC table:
1F4700 (Atmel AT25DF321)
EF4017 (Winbond W25Q64)
1C3017 (EON EN25Q64)

Does this mean I have 3 discrete SPI flash chips on my MB?

Does this mean that the image is bad, or that my current firmware is bad? Could intelmetool have messed it up?
Is this a red light to continue flashing the ME firmware, or could that restore things?
I’m planning to flash

@Marty1

12. My OEM did provide an ME FW update

.

[lfb6]

Your ME firmware has 3 types of SPI chips supported.

The invalid entries refer to non existing partitions, the valid entries refer to existing partitions.

Checksum errors are not uncommon, especially for the FPT partition table header.

[Marty1]

The latest 6 series Management Engine firmware version on this site is:

@plutomaniac

Intel ME 7 5MB Firmware v7.1.92.3273
For 6/X79/C600-series systems which run ME 5MB v7

But it will miss vendor specific (Acer) modifications.

Intel state about ME FW updates:

Q: Why do I need to contact my system or motherboard manufacturer? Why can’t Intel provide the necessary (ME FW) update for my system?
A: Intel is unable to provide a generic update due to management engine firmware customizations performed by system and motherboard manufacturers.

Won’t I miss the Acer customizations to the ME FW?
How can I find ou what Acer customized to the ME FW and how can I re-apply those customizations to the latest Firmware v7.1.92.3273 ?
Where can I find release notes about ME Firmware v7.1.92.3273, so I can read what has been fixed/changed in that version?

[lfb6]

Intel Management Engine: Drivers, Firmware & System Tools => B. About Intel (CS)ME, PMC, PHY & PCHC Firmware Updates
Intel Management Engine: Drivers, Firmware & System Tools

Settings transfer: Guide-How To: Clean Dumped Intel Engine (CS)ME/(CS)TXE Regions with Data Initialization
[Guide] Clean Dumped Intel Engine (CS)ME/(CS)TXE Regions with Data Initialization

[Marty1]

@lfb6

Settings transfer: Guide-How To: Clean Dumped Intel Engine (CS)ME/(CS)TXE Regions with Data Initialization
[Guide] Clean Dumped Intel Engine (CS)ME/(CS)TXE Regions with Data Initialization

The guide says it is for purpose of:

@plutomaniac

In order for that dump to be usable on another system of the same OEM

Because the ME FW image is of unknown origin and likely not from the same OEM (Acer) it is most likely not to be usable on another system.

How is this guide useful for me?
My questions remain the same:

@Marty1

Won’t I miss the Acer customizations to the ME FW?
How can I find out what Acer customized to the ME FW and how can I re-apply those customizations to the latest Firmware v7.1.92.3273 ?
Where can I find release notes about ME Firmware v7.1.92.3273, so I can read what has been fixed/changed in that version?

[lfb6]

@Marty1

…How can I find ou what Acer customized to the ME FW …

That’s described quite detailed in [Guide] Clean Dumped Intel Engine (CS)ME/(CS)TXE Regions with Data Initialization

But you don’t need to transfer/ reapply any settnigs for an ME update, and that’s described in the guide for updating ME firmware.

Why don’t you just apply the ME-update Acer provides?

[Marty1]

I upgraded to ME FW Version 7.1.91.3272

Here are the results:

C:\Apps\Intel-ME_CPT_5M_7.0.4.1197\MEInfo\Windows>MEInfoWin.exe

Intel(R) MEInfo Version: 7.0.4.1197
Copyright(C) 2005 - 2010, Intel Corporation. All rights reserved.

Intel(R) Manageability and Security Application code versions:

BIOS Version: P01-B3
MEBx Version: 7.0.0.53
Gbe Version: 1.3
VendorID: 8086
PCH Version: 600005
FW Version: 7.1.91.3272
UNS Version: Not Available
LMS Version: Not Available
MEI Driver Version: 11.0.0.1157
Wireless Hardware Version: Not Available
Wireless Driver Version: Not Available

FW Capabilities: 20585574

Intel(R) Standard Manageability - PRESENT/ENABLED
Intel(R) Anti-Theft Technology - PRESENT/ENABLED
Intel(R) Capability Licensing Service - PRESENT/ENABLED
Protect Audio Video Path - PRESENT/ENABLED

Intel(R) Standard Manageability State: Enabled
CPU Upgrade State: Upgrade Capable
Cryptography Support: Enabled
Last ME reset reason: Power up
Local FWUpdate: Disabled
BIOS and GbE Config Lock: Disabled
Host Read Access to ME: Disabled
Host Write Access to ME: Disabled
SPI Flash ID #1: EF4017
SPI Flash ID VSCC #1: 20052005
SPI Flash BIOS VSCC: 20052005
BIOS boot State: Post Boot
OEM Id: 00000000-0000-0000-0000-000000000000
Link Status: Link down
System UUID: <censored>
MAC Address: <censored>
IPv4 Address: 0.0.0.0
IPv6 Enablement: Disabled
Privacy Level: Default
Configuration state: Not started
Provisioning Mode: Unknown
Capability Licensing Service: Enabled
Capability Licensing Service Status: Permit info not available
OEM Tag: 0x00000000

C:\Apps\Intel-ME_CPT_5M_7.0.4.1197\MEManuf\Windows>MEManufWin.exe -R -verbose

Intel(R) MEManuf Version: 7.0.4.1197
Copyright(C) 2005 - 2010, Intel Corporation. All rights reserved.

Platform stepping value is 5

FW Status Register1: 0x1E000245
FW Status Register2: 0x68000006

CurrentState: Normal
ManufacturingMode: Disabled
FlashPartition: Valid
OperationalState: M0 with UMA
InitComplete: Complete
BUPLoadState: Success
ErrorCode: No Error
ModeOfOperation: Normal
ICC: Valid OEM data, ICC programmed

Get FWU info command…done

Get FWU version command…done

Get FWU feature state command…done

Get ME FWU platform type command…done

Get ME FWU feature capability command…done
Feature enablement is 0x13A1C66
gFeatureAvailability value is 0x1
OEM ICC data valid and programmed correctly

Request Intel(R) ME test result command…done
vsccommn.bin was created on 02:10:39 09/22/2010 GMT
SPI Flash ID #1 ME VSCC value is 0x2005
SPI Flash ID #1 (ID: 0xEF4017) ME VSCC value checked
SPI Flash ID #1 BIOS VSCC value is 0x2005
SPI Flash ID #1 (ID: 0xEF4017) BIOS VSCC value checked
FPBA value is 0x0
No Intel Wireless device was found

Get Intel(R) ME test data command…done
Total of 21 Intel(R) ME test result retrieved
Micro Kernel - Blob Manager: Set - Passed
Micro Kernel - Blob Manager: Get - Passed
Micro Kernel - Blob Manager: Remove - Passed
Policy Kernel - SMBus: Read byte - Passed
Policy Kernel - ME Password: Valid MEBx password - Passed
Policy Kernel - Power Package: Package 1 supported - Passed
Policy Kernel - Power Package: Default package supported - Passed
Policy Kernel - ME Configuration: Wlan Power Well - Passed
Policy Kernel - ME Configuration: CPU Missing Logic - Passed
Policy Kernel - ME Configuration: M3 Power Rails Available - Passed
Policy Kernel - Embedded Controller: Get power source - Passed
Common Services - General: Low power idle timeout - Passed
Common Services - Provisioning: Valid MEBX password change policy - Passed
Common Services - Provisioning: Client Config mode is valid - Passed
Common Services - General: Vlan not enabled on mobile - Passed
Common Services - Provisioning: Both PID and PPS are set - Passed
Common Services - Provisioning: MEBX password set when PID and PPS set - Passed
AMT - Privacy Level: Valid Privacy Level settings - Passed
AMT - Power: Power-package 2 supported - Passed
AMT - Hardware Inventory: BIOS tables - Passed
Policy Kernel - Power Package: Live Heap Test - Passed

Clear Intel(R) ME test data command…done

MEManuf Test Passed

╔═══════════════════════════════════════════╗
║ ME Analyzer v1.160.0 r212 ║
╚═══════════════════════════════════════════╝

╔════════════════════════════════════════════════════╗
║ ME7_5M_UPD_Production.bin (1/1) ║
╟───────────────────────────────┬────────────────────╢
║ Family │ ME ║
╟───────────────────────────────┼────────────────────╢
║ Version │ 7.1.91.3272 ║
╟───────────────────────────────┼────────────────────╢
║ Release │ Production ║
╟───────────────────────────────┼────────────────────╢
║ Type │ Update ║
╟───────────────────────────────┼────────────────────╢
║ SKU │ 5MB ║
╟───────────────────────────────┼────────────────────╢
║ Patsburg PCH Support │ Yes ║
╟───────────────────────────────┼────────────────────╢
║ Date │ 2017-04-07 ║
╟───────────────────────────────┼────────────────────╢
║ Downgrade Blacklist 7.0 │ <= 7.0.10.1203 ║
╟───────────────────────────────┼────────────────────╢
║ Downgrade Blacklist 7.1 │ <= 7.1.13.1088 ║
╟───────────────────────────────┼────────────────────╢
║ Chipset Support │ CPT/PBG ║
╟───────────────────────────────┼────────────────────╢
║ Latest │ No ║
╚═══════════════════════════════╧════════════════════╝

Please have a look at the bold marked passages. They have changed. Why?
Is the system vulnerable to the Intel poinson pill (Intel(R) Anti-Theft Technology - PRESENT/ENABLED)?
Is DRM blocking still enabled (Intel(R) Capability Licensing Service - PRESENT/ENABLED).

I rescanned with:

Intel(R) CSME Detection Tool For Legacy Systems
Application Version: 1.0.16.0
Scan date: 03/11/2020 23:49:23

Risk Assessment
Based on the analysis performed by this tool: This system is vulnerable.

Explanation:
The detected version of the Intel(R) Management Engine firmware is considered vulnerable for INTEL-SA-00086. Contact your system manufacturer for support and remediation of this system.
For more information refer to the Intel(R) CSME Detection Tool For Legacy Systems Guide or the Intel Security Advisory Intel-SA-00086 at the following link: https://www.intel.com/sa-00086-support

Host Computer Information
Name: <censored>
Manufacturer: Acer
Model: Veriton X4610G
Processor Name: Intel(R) Core™ i5-2320 CPU @ 3.00GHz
OS Version: Microsoft Windows 10 Pro

Intel(R) ME Information
Engine: Intel(R) Management Engine
Version: 7.1.91.3272

Copyright(C) 2017-2019, Intel Corporation, All rights reserved.

Both ME Analyzer and Intel(R) CSME Detection Tool are unsatisfied.
What vulnerabilities remain and how can I mitigate them?

[lfb6]

Your markings aren’t correct, changes to fw- capabilities are security related (local update).

To run an ME- update file in MEA isn’t meaningful regarding configuration details. As explained several times it doesn’t contain configuration data.

SA-00086 was never fixed for ME 7.

Other vulnerabilities:
https://www.intel.com/content/www/us/en/…er/default.html
(Don’t forget to expand the list. If ME 7 isn’t listed, don’t feel safe: It’s never been examined/ tested for newer flaws since it’s EOL/ EOS )

Your update worked well and you’re now on the almost latest version of ME7.

[Marty1]

I ran MEA on the dumped image of the actively running firmware image.

When was the EOL/ EOS of ME 7?

Are there workarounds to secure against SA-00086, without compromising the system, in order to mitigate the risk of ME 7 vulnerabilities?

[lfb6]

@Marty1

I ran MEA on the dumped image of the actively running firmware image…

@Marty1

╔════════════════════════════════════════════════════╗
║ ME7_5M_UPD_Production.bin (1/1) ║
╟───────────────────────────────┬────────────────────╢
…
║ Type │ Update ║
╟───────────────────────────────┼────────────────────╢
…

Dump wouldn’t have type ‘update’ and you’d possibly given another name.

Afaik there are no mitigations. Since there are so many other possible security flaws that never were examined for ME7 there is no point in examining one single old vulnerability.

Never connect this machine directly to the internet!

Last vulnerability fixed for ME7 is SA-00075 (05/17), first not fixed SA-00086 (11/17).

[Marty1]

@lfb6

Dump wouldn't have type 'update' and you'd possibly given another name.

Sorry, you’re right. I posted the wrong output, but I did compare them before posting and they were identical. Here’s the ME Analyzer output of the ME FW that’s actively running on my machine:

╔═══════════════════════════════════════════╗
║ ME Analyzer v1.160.0 r212 ║
╚═══════════════════════════════════════════╝

╔══════════════════════════════════════════════════════╗
║ ME_FW_Backup_7.1.91.3272.BIN (1/1) ║
╟────────────────────────────────┬─────────────────────╢
║ Family │ ME ║
╟────────────────────────────────┼─────────────────────╢
║ Version │ 7.1.91.3272 ║
╟────────────────────────────────┼─────────────────────╢
║ Release │ Production ║
╟────────────────────────────────┼─────────────────────╢
║ Type │ Update ║
╟────────────────────────────────┼─────────────────────╢
║ SKU │ 5MB ║
╟────────────────────────────────┼─────────────────────╢
║ Patsburg PCH Support │ Yes ║
╟────────────────────────────────┼─────────────────────╢
║ Date │ 2017-04-07 ║
╟────────────────────────────────┼─────────────────────╢
║ Downgrade Blacklist 7.0 │ <= 7.0.10.1203 ║
╟────────────────────────────────┼─────────────────────╢
║ Downgrade Blacklist 7.1 │ <= 7.1.13.1088 ║
╟────────────────────────────────┼─────────────────────╢
║ Chipset Support │ CPT/PBG ║
╟────────────────────────────────┼─────────────────────╢
║ Latest │ No ║
╚════════════════════════════════╧═════════════════════╝

@lfb6

Never connect this machine directly to the internet!

The machine needs to be connected to the internet otherwise it’s useless.
So there must be IP ports that the ME FW is listening on. Do you know what ports they are?
A firewall on the Win 10 / Linux host (running on the i5 processor) won’t work I suppose, because ME runs on its own separate embedded host (with (Minix) OS) with its own network connectivity. Did Intel implement a firewall on it, which I could configure maybe (or is that also proprietary information)?
How would I block access to the ME FW ports from the internet (and how would I do that for attackers from withing the LAN)?
Could I force the ME FW to listen through a proxy, maybe?
Could I maybe shut down or unconfigure the ME FW TCP-IP network stack?

[sarcasm on]
Did those bright minds at Intel foresee this and implemented a fail-safe or is the assumption that Intel engineers not ever make mistakes?
It’s best of course to bake their flawless code into obscure and proprietary embedded silicon on all their chip-sets to be, don’t they?
And if you don’t make mistakes, you don’t need to support it either of course.
What a brilliant people over at Intel!
I’ve got to run out and buy me another one of those, oh shoot, I did and it’s flawed too… and not patched either…
Hey I’ve got a business laptop which I scanned and surprise surprise, it’s vulnerable too!
Maybe they should call those unpatched and out of support bugs features over at Intel?
Features to buy yet another machine, oops flawed too and another, and another…
[/sarcasm off]