New Intel Chip Set Flaw

Topic

New Reply

[Geo]

Flaw impacts most new Intel chipsets | SC Media    Most not all.

EDITED: Removed tracking info from link!

• This topic was modified 5 years ago by Geo.

3 users thanked author for this post.

Mr. Austin, Fred, AJNorth

Reply | Quote

Replies

I happened to see that on ArsTechnica. At least it seems it would be very difficult to exploit, at least for the average home user. But still, big shame on Intel for yet another flaw. And they seem to be passing the buck, saying no big deal, if you want a fix contact the OEM of your motherboard, BIOS, etc.

These things never end, there is no accountability. I would personally avoid Intel in future purchases, but AMD and others have had issues as well.

It seems to be that manufacturers and engineers of these things don’t have a clue, or perhaps they just don’t care. I’m afraid it is the latter…and that appears to be the case with just about everything.

2 users thanked author for this post.

Mr. Austin, DriftyDonN

Reply | Quote

Geo ( #2177210 ): In plain English, please, does this mean that any computer bought in the last five years with the latest Intel chipsets, if by “chipset”  it means: CPU, GPU, RAM, bus, etc. on the motherboard, are at  risk of being exploited? “I SC Media” does not sound like that to me, more like something included in the motherboard for watching videos.

“A vulnerability was found in most of the Intel chipsets released in the last five years that could allow an attacker to extract the chipset key stored on the PCH microchip and obtain access to data encrypted with the key.“

Ex-Windows user (Win. 98, XP, 7); since mid-2017 using also macOS. Presently on Monterey 12.15 & sometimes running also Linux (Mint).

MacBook Pro circa mid-2015, 15" display, with 16GB 1600 GHz DDR3 RAM, 1 TB SSD, a Haswell architecture Intel CPU with 4 Cores and 8 Threads model i7-4870HQ @ 2.50GHz.
Intel Iris Pro GPU with Built-in Bus, VRAM 1.5 GB, Display 2880 x 1800 Retina, 24-Bit color.
macOS Monterey; browsers: Waterfox "Current", Vivaldi and (now and then) Chrome; security apps. Intego AV

Reply | Quote

I saw mention of this online yesterday, but as yet, Intel’s Security Advisories was last updated Feb 11th!

Reply | Quote

OscarCP wrote:

if by “chipset”  it means: CPU, GPU, RAM, bus, etc. on the motherboard, are at  risk of being exploited? “I SC Media” does not sound like that to me, more like something included in the motherboard for watching videos.

It is a flaw in Converged Security and Manageability Engine (CSME) that takes care of DRM, file encryption, etc.. So if you encrypt your HD,.. it is at risk by hacker obtaining the encryption keys.

https://www.theregister.co.uk/2020/03/05/unfixable_intel_csme_flaw/

2 users thanked author for this post.

Mr. Austin, OscarCP

Reply | Quote

Link to the original article: Positive Technologies.

Here, attackers can obtain the key in many different ways. For example, they can extract it from a lost or stolen laptop in order to decrypt confidential data. Unscrupulous suppliers, contractors, or even employees with physical access to the computer can get hold of the key. In some cases, attackers can intercept the key remotely, provided they have gained local access to a target PC as part of a multistage attack, or if the manufacturer allows remote firmware updates of internal devices, such as Intel Integrated Sensor Hub.

1 user thanked author for this post.

OscarCP

Reply | Quote

[lylejk]

Said this a year ago when the other Intel based flaws started to show up and I’ll say it again.  Thank goodness I use AMD.   That said, I’m looking forward to Ampere processors in the future.  They recently produced the Ampere Altra which has 64 cores and uses hardly any power.  Win/win, but that will be a while.  I still believe ARM is the future and it’s looking better and better every day.  I mean every cell phone pretty much uses such a processor already.   🙂

• This reply was modified 5 years ago by lylejk.

1 user thanked author for this post.

Mr. Austin

Reply | Quote

I’ve been using Team Blue exclusively for decades. For my latest build, however, I switched to AMD for a number of reasons including price, performance, value, features and security.

Now that AMD is becoming a powerhouse, however, I suspect researchers and hackers will be taking a closer look at their CPUs and GPUs. It’s only a matter of time before new flaws will be discovered – it’s the nature of the beast.

AMD Product Security

1 user thanked author for this post.

Mr. Austin

Reply | Quote

Alex5723 wrote:

takes care of DRM, file encryption, etc..

May I politely opine, “***, Intel?” 😉

Human, who sports only naturally-occurring DNA ~ oneironaut ~ broadcaster

Reply | Quote

[Mr. Austin]

Thank you Geo and all. Notes from a power user who doesn’t know nearly as much as youse guys?

I do use Intel’s Driver and Support Assistant on my machine so that if Intel becomes aware of any concerns they’ve the opportunity to solve it without me fiddling around. Their assistant has so far only made updates to the motherboard’s wifi and bluetooth drivers.

After preferring an AMD desktop (from HP) for myself for several years ending in 2018, I ended up crossing over ‘to the dark side’ 😉 and got a new Intel-based desktop. I still have my 2015 Intel-based laptop. My choices were matters of Performance vs. Price. When my latest desktop was new it had fiddly software issues with its Intel “Turbo Boost” control panel staying open after booting. The desktop’s manufacturer has mediocre support, so I had to correspond with Intel to solve the annoyance. It’s possible the Turbo Boost issue was related to my failed experiment in using LapLink’s transfer software (I used a crossover RJ-45 cable) from Windows 7 to 10 which messed Intel’s Bluetooth drivers. Eventually a second-level Microsoft engineer had to wipe the OS and reinstall it and things have been copacetic since then.

Human, who sports only naturally-occurring DNA ~ oneironaut ~ broadcaster

• This reply was modified 5 years ago by Mr. Austin.
• This reply was modified 5 years ago by Mr. Austin.
• This reply was modified 5 years ago by Mr. Austin.
• This reply was modified 5 years ago by Mr. Austin.
• This reply was modified 5 years ago by Mr. Austin.
• This reply was modified 5 years ago by Mr. Austin.

Reply | Quote