安全与密码学2017blackhat.com编辑精选
如何入侵一台已关机的电脑：在 Intel ME 中运行未签名代码
How to hack a turned-off computer, or running unsigned code in Intel ME
专业 · 约 40 分钟读完前置知识：x86 固件与 BIOS/UEFI 基础、Intel ME/AMT 架构、漏洞利用基础
导读
这篇 Black Hat 2017 白皮书讨论 Intel Management Engine（ME）的安全问题：如何在 ME 中运行未签名代码，以及攻破处于关机状态的电脑的相关路径。文中分析远程利用 ME 的条件（如 AMT 启用、可绕过 AMT 授权、BIOS 未受保护且可开放 ME 区域写权限），并指出启动 ROM 不校验固件版本，可能被降级到易受攻击版本。
HN 关注点：Intel ME 这种用户不可控的固件/AMT 远程利用条件，以及企业机器和 Linux 服务器上的实际风险与 DRM 争议。
后来怎么样
这篇 Positive Technologies 的研究成为 Intel ME 安全研究的标志性工作：它促使 Intel 加强 ME 固件签名与 AMT 认证；它也促使 me_cleaner 等社区工具以及 NSA 关于禁用 ME 的公开建议出现。
HN 评论精选
这几条评论里：质疑 1 补充 3
补充远程利用条件并不苛刻，AMT 漏洞在企业环境常见且固件可降级。
关键引文（可能略旧，只是已知信息总结）：最常见问题之一涉及远程利用可能性。我们认为远程利用在以下条件成立时可能：1. 目标平台启用 AMT；2. 攻击者知道 AMT 管理员密码或能利用漏洞绕过授权；3. BIOS 未密码保护（或攻击者知道密码）；4. BIOS 可配置开放 ME 区域写权限。若满足所有条件，攻击者没有理由不能远程访问 ME 区域。另注意启动时 ROM 不检查固件版本，留下可能性：针对最新系统的攻击者可恶意将 ME 降级到易受攻击版本。这个条件列表对我来说并不罕见。消费级硬件应禁用 AMT 并安全，但在企业机器上最高门槛是 AMT 漏洞，鉴于 AMT 规模巨大且代码质量显然糟糕，我预计会经常看到其认证绕过。
saulrh查看英文原文
Money quote, though this may be slightly old news and this is just a summary of known information: One of the most common questions regards the possibility of remote exploitation. We think that remote exploitation is possible if the following conditions are true: 1. The target platform has AMT activated. 2. The attacker knows the AMT administrator password or can use a vulnerability to bypass authorization. 3. The BIOS is not password-protected (or the attacker knows the password). 4. The BIOS can be configured to open up write access to the ME region. If all these conditions are met, there is no reason why an attacker would not be able to obtain access to the ME region remotely. Also note that during startup, the ROM does not check the version of firmware, leaving the possibility that an attacker targeting an up-to-date system could maliciously downgrade ME to a vulnerable version. That list of conditions does not seem incredibly unusual to me. Consumer hardware should have AMT disabled and be safe, but on business machines the highest bar is an AMT vuln, and given the huge size and apparently terrible code quality of the AMT I expect to be seeing auth bypasses for it on a regular basis.
补充应把个人计算环境视为敌对，用外部防火墙/NIDS/物理隔离并重新设计安全优先。
与此同时，防御这种设计上敌对的单体个人计算环境需要高技术能力。假设个人计算环境是敌对的；使用外部防火墙并仅白名单策略；使用外部 NIDS；物理禁用所有硬连接的非有线互连。显示器键盘仍会泄漏，但这是好开始，多数人需关注互联网实际攻击。2018 新年决心：审查备份策略包括测试程序；实施个人数字安全措施。我常想当前便利的单体个人计算环境（iPhone、笔记本或 PC）没正确评估威胁。宽带刚普及时，直接把无防火墙 DSL modem 以太网插电脑是 unprotected sex。下一次进化也许从安全优先重新考虑个人计算设计。
gtcode查看英文原文
In the meantime, a high level of technical proficiency is needed to defend against monolithic personal computing environments that are hostile by design. * Assume personal computing environment is hostile * Use an external firewall and have a whitelist-only policy * Use an external NIDS * Physically disable all hard-connected non-wired interconnectivity Monitors and keyboards ("I leave message here on service but you do not call") still leak, of course, but this is a good start, and most people need to be concerned with practical attacks that could be carried out over the internet. New Year's 2018 resolutions: 1) Review backup policy including backup testing procedures 2) Implement personal digital security measures I've often thought that the current mentality of a "convenient" monolithic personal computing environment (whether an iPhone, laptop, or PC) doesn't properly assess threats. When broadband internet first became popular in my area growing up, it was acceptable practice (and recommended by ISP's) to simply plug your non-firewall'ed DSL modem ethernet directly into your computer. It truly was unprotected sex in the worst possible way. Perhaps the next evolution will fundamentally reconsider personal computing design from a security-first perspective.
补充远程利用需 AMT 激活，家庭用户风险低；漏洞危及 PAVP，评论者反感 DRM。
注意文档日期是 2017-12-05，对看过 HN 上 ME 旧帖的人不新。第 12 页说，远程利用条件之一是 AMT 必须激活，家庭非企业网络 PC 大概不满足。此类漏洞可能危及多项技术，包括 Intel Protected Audio Video Path (PAVP)。好，去他的 DRM。
userbinator查看英文原文
Note that this document is dated 2017-12-05, so it's not anything new to those who have seen the previous items about ME on HN. According to page 12, one of the conditions for remotely exploiting this is that AMT has to be activated, something which probably isn't going to be true for PCs used at home and not part of a corporate network. Such a vulnerability has the potential to jeopardize a number of technologies, including Intel Protected Audio Video Path (PAVP), Good. Fuck DRM.
质疑质疑企业为何不要求禁用 ME，Linux 环境难修复。
为什么公司不施压 Intel 移除或禁用 ME？对整个组织似乎是巨大安全风险。Linux 上尤其难修复，许多组织/服务器用 Linux。
JoshMnem查看英文原文
Why aren't companies pressuring Intel to remove or disable the ME? It seems like a huge security risk for entire organizations. It's especially difficult to fix when running Linux, and many organizations/servers use Linux.
相关资源
从这篇论文所有 HN 讨论帖的全部评论里整理出来的链接。
历次讨论
- 2017Hacker News 讨论帖543 分 · 107 评
同领域还值得读
比特币：一种点对点的电子现金系统（2008）
Bitcoin: A Peer-to-Peer Electronic Cash System (2008)
中本聪 2008 年发表的比特币白皮书，提出了无需可信第三方的点对点电子现金系统。
安全与密码学2017 · 536 分 · 394 评入门 · 约 45 分钟编辑精选GPRS 加密算法 GEA-1 的密码分析表明存在故意弱点
Cryptanalysis of GPRS Encryption Algorithms GEA-1 suggest intentional weakness
首次公开了对 GPRS 加密算法 GEA-1 和 GEA-2 的密码分析攻击。
安全与密码学2021 · 487 分 · 107 评专业 · 约 90 分钟编辑精选Signal 消息协议的形式化安全分析
A Formal Security Analysis of the Signal Messaging Protocol
用形式化方法分析 Signal 消息协议（TextSecure）的安全性：作者在多阶段密钥交换模型下，借助自动化证明工具对协议的密钥协商与 Double Ratchet 密钥更新…
安全与密码学2016 · 353 分 · 230 评专业 · 约 120 分钟编辑精选A2：模拟恶意硬件
A2: Analog Malicious Hardware
论文研究如何在芯片设计阶段植入模拟电路形式的恶意硬件后门，使其难以被常规检测发现。
安全与密码学2016 · 315 分 · 94 评专业 · 约 75 分钟编辑精选Air-FI：从气隙隔离计算机生成隐蔽 Wi-Fi 信号
Air-FI: Generating Covert Wi-Fi Signals from Air-Gapped Computers
研究如何从物理隔离（air-gapped）的计算机中隐蔽地外泄数据：利用内存总线产生的电磁泄漏，在 2.4 GHz Wi-Fi 频段内编码信息，使附近的普通 Wi-Fi 网卡（如…
安全与密码学2020 · 294 分 · 105 评 · 引用 3进阶 · 约 45 分钟编辑精选