SuperMicro X11SSi-LN4F + pfSense + Intel ME Bug



  • Hi,

    my pfSense box is based on SuperMicro X11SSi-LN4F which is affected by the Intel ME bug.
    Is this a security problem from WAN side?

    pfSense make only PPPoE connection to the WAN, there should no way from WAN to access the Intel ME, true?



  • Hello, as I was reading it from 4 websites right now two things must be given that your device will be
    able to attack with a bad result for you. First of them is the firmware version shown by that tool shown
    under the download link above and the second point that must be given is the following, the ME unit
    must be enabled and configured or better so called "provisioned"!

    Your SuperMicro X11SSi-LN4F supports supports the following CPUs;
    (fat marks)

    • Intel® Celeron®
    • Intel® Pentium®
    • Intel® 7th/6th Generation Core i3 series
    • Intel® Xeon® Processor E3-1200 v6/v5 series

    Please have a look at the Supermicro website for the following two things;

    • BIOS update or latest BIOS version
      Install the lastest BIOS and have a look into the change log or release notes for ME bug fixes and patches
    • IPMI update or the latest BMC/IPMI firmware version
      Install the lastest BIOS and have a look into the change log or release notes for ME bug fixes and patches

    Connect another HDD/SSD to your Mainboard and boot from there an installed Windows 7,8,8.1 or 10
    and download the Intel tool shown under the link below, and run a test please.
    Intel SA-00075 detection and mitigation tool

    You will be getting out something like this here shown in the code block, it is copied over from the bigger Qotom thread
    because there were also some persons testing their equipment over. Then have to watch out for the following entries;

    Version: 10.0.25.1048
    

    Based on my information it should be updated, because it is under the version number 3000 (<3000).
    The last four numbers are counting to get this information! Let us imnagine the ME version on your
    device will be shown as "11.6.27.3264" the it is counting as 3264 and this is over 3000 and save
    or an updated version that is not able to attack!

    Provisioning Mode: Not Provisioned
    

    But the other point is, that your device is not provisioned and that means;
    Based on the both ME functions variants named "Active Management Technology" (AMT) and "Intel
    Standard Manageability" (ISM) are attackers able to get over or using the network higher access rights,
    if that remote function is activated and configured (provisioned), yours is not provisioned!!!

    Security holes in many Intel systems since 2010 (german language)

    Risk Assessment
    Based on the analysis performed by this tool, this system is not vulnerable; the ME SKU is not affected.
    
    Explanation: 
    
    If Vulnerable, contact your OEM for support and remediation of this system. 
    For more information, refer to CVE-2017-5689 in the following link: CVE-2017-5689
    or the Intel security advisory Intel-SA-00075 in the following link: INTEL-SA-00075
    
    INTEL-SA-00075 Detection Tool
    Application Version: 1.0.3.215
    Scan date: 2017-11-24 15:09:59
    
    Host Computer Information
    Name: DESKTOP-L7VJDFJ
    Manufacturer: To be filled by O.E.M.
    Model: To be filled by O.E.M.
    Processor Name: Intel(R) Core(TM) i5-5250U CPU @ 1.60GHz
    Windows Version: Microsoft Windows 10 Education
    
    ME Information
    Version: 10.0.25.1048
    SKU: Consumer
    Provisioning Mode: Not Provisioned
    Control Mode: None
    Is CCM Disabled: True
    Driver installation found: True
    EHBC Enabled: False
    LMS service state: NotPresent
    microLMS service state: NotPresent
    Is SPS: False
    

    The ME unit is able to be completely deactivated or it is working in one of three available called
    "function modes" called "AMTSKU" from the SCS-Tool;

    • Intel Full AMT Manageability
    • Intel Standard Manageability
    • Intel Small Business Advantage (SBA)

    If you are finding behind your firewall such devices that are effected too, you may block port at the
    firewall to prevent them to be attacked. (16992, 16993, 16994, 16995, 623 and 664), disable
    the ME function in the BIOS and/or update the BIOS and firmware too if you will be sorted right
    from the vendor, it must or should be showing then a number (the last four) over 3000 (>3000)
    this all will be able to help you out. On Windows based systems where nothing else will be nice
    helping out, you could also try out to deactivate the Local Manageability Service (LMS).

    my pfSense box is based on SuperMicro X11SSi-LN4F which is affected by the Intel ME bug.

    How do you find this out? Did you perform this test already?

    Is this a security problem from WAN side?

    The picture (from Intel) below is showing the "way" inside bypassing your overlying OS
    and it will be passing through without to be stopped then as I am informed. (Picture below)

    Sources:
    Intel patches remote hijacking vulnerability that lurked in chips for 7 years
    Remote access bug in Intel AMT worse than we thought, says researcher
    Sicherheitslücke in vielen Intel-Systemen seit 2010
    Tipps zur Intel-ME-Sicherheitslücke SA-00075

    ![ME bug picture around the OS.jpg](/public/imported_attachments/1/ME bug picture around the OS.jpg)
    ![ME bug picture around the OS.jpg_thumb](/public/imported_attachments/1/ME bug picture around the OS.jpg_thumb)


Log in to reply