Flaws found in Intel Management Engine (ME), TXE and SPS

Thanks man! Happy to dodge a bios flash or something since I'm a wuss about this stuff :)

Hi,

Thanks man! Happy to dodge a bios flash or something since I'm a wuss about this stuff :)

You're most welcome. Flashing a bios hardly ever goes wrong nowadays. Of course there's always that errr... user end, right.

Cheers,

Good Day All

it looks like Toshiba is lagging behind these are the latest updates for my laptop thus far well over a year old


Model Name: S55-C5360 Satellite S55-C5360
Part Number: PSPT2U-00V011
UPC: 889661060796
Operating System C1 2
• Windows 10 Home
Processor3 and Graphics4
• Intel® Core™ i7-6500U Processor
o (4M Cache, up to 3.10GHz) with Intel® Turbo Boost Technology 2.0
o Base 2.50GHz
• NVIDIA® GeForce® 930M – dedicated graphics with NVIDIA® Optimus™ technology with 2GB of DDR3 Memory
Memory5
• 8GB DDR3L 1600MHz (not user upgradeable)


USB BIOS version 1.40 for PSCPSU, PSKW2U, PSKWWU, PSKWYU, PSPT2U, PSPT4U, PSPTWU, PSPTYU
Posted Date: 2016-08-24 | Version: 1.40 | Size: 5.21M
Windows BIOS version 1.40 for PSCPSU, PSKW2U, PSKWWU, PSKWYU, PSPT2U, PSPT4U, PSPTWU, PSPTYU
Posted Date: 2016-08-24 | Version: 1.40 | Size: 9.61M
BIOS version 1.30 for Satellite L5xt-C/S5x-C/S5xt-C Models
Posted Date: 2016-08-24 | Version: 1.30 | Size: 28.79M
BIOS version 1.20 for Satellite L5xt-C/S5x-C/S5xt-C (PSKWYx/PSPT2x/PSPT4x/PSPTYx)
Posted Date: 2016-08-24 | Version: 1.20 | Size: 25.49M
BIOS version 1.10 for Satellite L5xt-C/S5x-C/S5xt-C (PSKWYU/PSPT2U/PSPT4U)
Posted Date: 2016-08-24 | Version: 1.10 | Size: 21.53M

kinda not surprised i have herd that Toshiba was getting out of the business any way

Wynona said:

And now, I'm totally confused! From the opening paragraph in the ZDNet article:



From Keith's post above, I'm no longer thinking I understand what HP did! So, this



question is withdrawn.

I am totally confused and bow out of something I thought I partially understood.

Just updated my HP laptop. No updates showing in Assistant so asked the question on HP's forums. Got a direct link to ME firmware update.



Will find the link for it if needed but not keen on posting direct links.

@dmesal,

Have you ran the tool to make sure? https://downloadcenter.intel.com/download/27150?v=t

You may be in the same boat as me, my gateway is vulnerable but it's not listed on the Acer site so I have to contact them, some gateways are but not mine (acer bought out gateway), you on the other hand aren't so bad, yet.

I did find the toshiba site that lists the affected machines but I couldn't match your make/model to its list, maybe you can.
Toshiba Intel Vulnerability

Wynona said:

It would be good if Microsoft could push the fix, but to my knowledge, it can't. I don't think software (Windows 10) can actually touch firmware (Intel's Processors). At least, in my experience, updating BIOS has to happen upon bootup/entering BIOS.

Of course, if someone can prove me wrong, I wouldn't mind a bit! :)

No Microsoft can't fix it. IME (or the equivalent AMD version) runs before (and separately from) any OS. It can even work if your PC is turned off (I don't begin to understand how).

There was great excitement with Ryzen when AMD said they would drop their equivalent technology (or make it open source). I don't know if they did.

This Reddit thread is quite interesting (lots of responses from AMD CEO Lisa SU) and explains it well.

In layman's terms, AMD's PSP (aka, AMD Secure Processor) and Intel's equivalent technology, IME (Intel Management Engine) are essentially small independent Co-Processor's (CPU's) contained within all modern x86 based Desktop and Laptops. Intel's is built into the motherboard, while AMD's is inside the main CPU itself.

Their official purpose is for enterprise businesses to remotely manage and configure their computers.

Effectively, PSP is an isolated, low-level, proprietary co-processor that cross-checks your BIOS firmware with its own. If the BIOS firmware doesn't contain AMD-PSP firmware, then your computer will not boot.
They are cryptographically locked away from the operating system, meaning no user could possibly gain access to it to see exactly what it's doing or how it works without the correct key/password, which is only handed out to a very few select people by AMD & Intel.

However, these Co-Processors are a tremendous threat to privacy (hence why Edward Snowden is talking about it). Once activated, it would be able to control your entire PC without your knowledge, as it has:

• Full access to memory (without the parent CPU having any knowledge)
• Full access to the TCP/IP stack; with a dedicated connection to the network interface
• Can send and receive network packets, even if the OS is protected by a firewall
• Can be active when the computer is hibernating or even completely turned off, allowing the Co-Processor to turn on and take control of your computer remotely via the internet.

This effectively makes them a hardware backdoor built into every modern PC. And considering that the creator of Linux was approached by the NSA to create a backdoor, as well as Microsoft attempting to sue the U.S. Government for gag orders, it's quite likely that certain agencies have the keys to both PSP and IME, and may have been a big reason for why they were implemented in the first place.

If you have a Intel CPU older than 2010 you don't need to worry (which covers me, hooray!).

Called and got off the phone awhile ago with Acer support and the gist of my conversation with them is; If my machine is out of warranty I have to pay for support. Pay for support?? I guess the poor bstrds that own an acer are in the same boat.

The rep asked for my last name and told me what phone number I was calling from, I said oh! you must have caller ID do you know how many children I have? There was no sequence of asking for credit card numbers but if I receive a bill from acer for their "support" I am going to be very upset!

I told the guy all I need is information on if and when acer might be placing the file on their website so I can D/L the patch and fix it myself because my model (DX4831 (see near bottom)) is not listed, and he replied "you will have to pay for support", I said what?
Acer already has patches to D/L for free except my model and that's why I'm calling, do you know if my DX will be included? All the other manufacturers are placing the patch on their websites for free like yours and the user fixes their machines themselves why do I have to pay to talk to you, I guess to be fair I can see how information and support can be construed as one and the same, but in my thinking this is BullS.

No matter how I tried to explain my predicament to the rep his only response was; I have to pay for support.

Stay tuned, If I do get a bill from acer it will be a Merry Freaking Christmas!

Anak said:

Called and got off the phone awhile ago with Acer support and the gist of my conversation with them is; If my machine is out of warranty I have to pay for support. Pay for support?? I guess the poor bstrds that own an acer are in the same boat.

The rep asked for my last name and told me what phone number I was calling from, I said oh! you must have caller ID do you know how many children I have? There was no sequence of asking for credit card numbers but if I receive a bill from acer for their "support" I am going to be very upset!

I told the guy all I need is information on if and when acer might be placing the file on their website so I can D/L the patch and fix it myself because my model (DX4831 (see near bottom)) is not listed, and he replied "you will have to pay for support", I said what?
Acer already has patches to D/L for free except my model and that's why I'm calling, do you know if my DX will be included? All the other manufacturers are placing the patch on their websites for free like yours and the user fixes their machines themselves why do I have to pay to talk to you, I guess to be fair I can see how information and support can be construed as one and the same, but in my thinking this is BullS.

No matter how I tried to explain my predicament to the rep his only response was; I have to pay for support.

Stay tuned, If I do get a bill from acer it will be a Merry Freaking Christmas!

I checked their website and forums to find a solution. Neither one was any help. Even their software that came preinstalled is no help.I need updates from Acer, HP and PowerSpec and none of them has the fix available for my computers.

I have a bad taste in my mouth about acer and I don't know about powerspec but I have a new-found respect for HP, check back a few posts to #118, Kado's HP's already been updated. Follow his conversation with Wynona through to Kado's #125 post.