Problems? See this thread at archive.org.
@Mr. Fox ...It has the Z370 A Pro Mobo. I went to the support page and tried to do the update they have posted for it but my machine wouldn't take it. It wouldn't even recognize it. Good thing because the guys over on MSI forums said it would bricked my machine had I flashed it with that Bios.
-
-
-
-
Any chance you could upload that for us?
-
-
-
Here we go... Version 4
Intel-SA-00086 Detection Tool Version: 1.0.0.152
(Latest) Date: 12/19/2017
When will the 5 version come?
-
-
-
Lucky you as always my friend...
Papusan likes this.
-
-
Get These Laptops With Intel ME Chip Disabled From Dell, System76, And Purism
December 5, 2017
https://fossbytes.com/laptops-intel-me-chip-disabled/
"The Intel ME chip which recently became popular is giving sleepless nights to the security community and PC users around the world.
Why? Because the vulnerabilities in the Management Engine chip, running a closed source variant of MINIX OS, can allow attackers to take complete control of a system without the users noticing.
What now? Several PC manufacturers have tried to take advantage of the situation and made attempts to build user trust by offering laptops with Intel ME chip disabled. Yes, probably the chips can be disabled through a feature designed to leave the management engine inoperable on machines purchased by government bodies.
Dell Laptops With Intel ME chip disabled
The American PC manufacturer Dell is willing to disable the vulnerable Intel chip on selected machines if the user is willing to pay $20 fee (spotted by a Reddit user).
You can disable the chip on Dell’s New Latitude 14 Rugged Laptop. Visit the product page and choose “Intel vPro – ME Inoperable, custom order” which will increase the bill amount by $20.92.
The other Dell machines include Latitude 15 E5570 laptop and Latitude 12 Rugged Tablet.
Purism Laptops with Intel ME chip disabled
Purism was probably the first company to announce that their Librem series laptops would come with the Management Engine disabled out of the box. For the Laptops released in the recent past, the company is providing the same via software update. It was a little bit difficult for Purism as their laptops run the open source firmware ‘coreboot’.
You can find Librem13 and Librem 15 shipping with ME firmware disabled at this product page.
System76 Laptop with Intel ME chip disabled
Unlike Dell, System76 is offering to turn off the ME chip on all of their new machines. In a blog post, the company provides the list of all affected laptops.
They have released an open source tool which can be used to disable ME chip on all of their laptops. Users can download the tool from this GitHub page."Dr. AMK, Starlight5 and inm8#2 like this. -
Microsoft Releases Patches for 16 Critical Flaws, Including a Zero-Day
![[IMG]](images/storyImages/microsoft-windows-update.png)
If you think that only CPU updates that address this year's major security flaws—Meltdown and Spectre—are the only ones you are advised to grab immediately, there are a handful of major security flaws that you should pay attention to.
Microsoft has issued its first Patch Tuesday for 2018 to address 56 CVE-listed flaws, including a zero-day vulnerability in MS Office related that had been actively exploited by several threat groups in the wild.
Sixteen of the security updates are listed as critical, 38 are rated important, one is rated moderate, and one is rated as low in severity. The updates address security flaws in Windows, Office, Internet Explorer, Edge, ChakraCore, ASP.NET, and the .NET Framework.
The zero-day vulnerability (CVE-2018-0802), described by Microsoft as a memory corruption flaw in Office, is already being targeted in the wild by several threat actor groups in the past few months.
The vulnerability, discovered by several researchers from Chinese companies Tencent and Qihoo 360, ACROS Security's 0Patch Team, and Check Point Software Technologies, can be exploited for remote code execution by tricking a targeted user into opening a specially crafted malicious Word file in MS Office or WordPad.
According to the company, this security flaw is related to CVE-2017-11882—a 17-year-old vulnerability in the Equation Editor functionality (EQNEDT32.EXE), which Microsoft addressed in November.
When researchers at 0Patch were analysing CVE-2017-11882, they discovered a new, related vulnerability (CVE-2018-0802). More details of CVE-2018-0802 can be found in a blog post published by Check Point.
Besides CVE-2018-0802, the company has addressed nine more remote code execution and memory disclosure vulnerabilities in MS Office.
A spoofing vulnerability (CVE-2018-0819) in Microsoft Outlook for MAC, which has been listed as publicly disclosed (Mailsploit attack), has also addressed by the company. The vulnerability does not allow some versions Outlook for Mac to handle the encoding and display of email addresses properly, causing antivirus or anti-spam scanning not to work as intended.
Microsoft also addressed a certificate validation bypass vulnerability (CVE-2018-0786) in .NET Framework (and .NET Core) that could allow malware authors to show their invalid certificates as valid.
"An attacker could present a certificate that is marked invalid for a specific use, but the component uses it for that purpose," describes Microsoft. "This action disregards the Enhanced Key Usage taggings."
The company has also patched a total of 15 vulnerabilities in the scripting engine used by Microsoft Edge and Internet Explorer.
All these flaws could be exploited for remote code execution by tricking a targeted user into opening a specially-crafted webpage that triggers a memory corruption error, though none of these has been exploited in the wild yet.
Meanwhile, Adobe has patched a single, out of bounds read flaw (CVE-2018-4871) this month that could allow for information disclosure, though no active exploits have been seen in the wild.
Users are strongly advised to apply October security patches as soon as possible to keep hackers and cybercriminals away from taking control of their computers.
For installing security updates, simply head on to Settings → Update & security → Windows Update → Check for updates, or you can install the updates manually.
-
-
New Intel AMT Security Issue Lets Hackers Gain Full Control of Laptops in 30 Seconds
![[IMG]](images/storyImages/intel-amt-vulnerability.gif)
It's been a terrible new-year-starting for Intel.
Researchers warn of a new attack which can be carried out in less than 30 seconds and potentially affects millions of laptops globally.
As Intel was rushing to roll out patches for Meltdown and Spectre vulnerabilities, security researchers have discovered a new critical security flaw in Intel hardware that could allow hackers to access corporate laptops remotely.
Finnish cyber security firm F-Secure reported unsafe and misleading default behaviour within Intel Active Management Technology (AMT) that could allow an attacker to bypass login processes and take complete control over a user's device in less than 30 seconds.
AMT is a feature that comes with Intel-based chipsets to enhance the ability of IT administrators and managed service providers for better controlling their device fleets, allowing them to remotely manage and repair PCs, workstations, and servers in their organisation.
The bug allows anyone with physical access to the affected laptop to bypass the need to enter login credentials—including user, BIOS and BitLocker passwords and TPM pin codes—enabling remote administration for post-exploitation.
In general, setting a BIOS password prevents an unauthorised user from booting up the device or making changes to the boot-up process. But this is not the case here.
The password doesn't prevent unauthorised access to the AMT BIOS extension, thus allowing attackers access to configure AMT and making remote exploitation possible.
Although researchers have discovered some severe AMT vulnerabilities in the past, the recently discovered issue is of particular concern because it is:
- easy to exploit without a single line of code,
- affects most Intel corporate laptops, and
- could enable attackers to gain remote access to the affected system for later exploitation.
Here's How to Exploit this AMT Issue
To exploit this issue, all an attacker with physical access to a password (login and BIOS) protected machine needs to do is reboot or power-up the targeted PC and press CTRL-P during boot-up, as demonstrated by researchers at F-Secure in the above video.
The attacker then can log into Intel Management Engine BIOS Extension (MEBx) with a default password.
Here, the default password for MEBx is "admin," which most likely remains unchanged on most corporate laptops.
Once logged in, the attacker can then change the default password and enable remote access, and even set AMT's user opt-in to "None."
Now, since the attacker has backdoored the machine efficiently, he/she can access the system remotely by connecting to the same wireless or wired network as the victim.
Although exploiting the issue requires physical access, Sintonen explained that the speed and time at which it can be carried out makes it easily exploitable, adding that even one minute of a distraction of a target from its laptop is enough to do the damage.
"Attackers have identified and located a target they wish to exploit. They approach the target in a public place—an airport, a café or a hotel lobby—and engage in an 'evil maid' scenario," Sintonen says."Essentially, one attacker distracts the mark, while the other briefly gains access to his or her laptop. The attack doesn't require a lot of time—the whole operation can take well under a minute to complete."Along with CERT-Coordination Center in the United States, F-Secure has notified Intel and all relevant device manufacturers about the security issue and urged them to address it urgently.
Meanwhile, users and IT administrators in an organisation are recommended to change the default AMT password of their device to a strong one or disable AMT if this option is available, and never leave their laptop or PC unattended in a public place.Last edited: Jan 12, 2018Vasudev likes this. -
This has been known for years by corporations, and it is usually set just like the administrator BIOS lockout password. This isn't new.
Most laptops aren't set up with this, it's limited to laptops destined for corporations, and they know about this - or should - if they don't it's an exceptional lapse, but then that corporation is likely missing other things too.
It would look new to people that don't administer corporate laptops that need this remote access / control of their assets, but it has been this way for many years.
The current security frenzy is such that things like this will make the news where normally someone would catch it and say "hey man, this isn't new"
jclausius, Robbo99999, Vasudev and 1 other person like this. -
-
-
No news here on one of NBR's hot threads?
Oh'well, here we go Skyfall and Solace Could be the First Attacks Based on Meltdown and Spectre?
"Out of the blue, a website popped up titled "Skyfall and Solace," which describes itself as two of the first attacks that exploit the Spectre and Meltdown vulnerabilities (it doesn't detail which attack exploits what vulnerability)."
Critical Flaws in Computers Leave Millions of PCs Vulnerable
Discussion in 'Hardware Components and Aftermarket Upgrades' started by Dr. AMK, Nov 21, 2017.
![[IMG]](https://2.bp.blogspot.com/-beOJSQDFs8E/WlWzGhDEy1I/AAAAAAAAvao/HtLyZwdkdO0s6swi2W8MGUFOiL97VBjtACLcBGAs/s1600/microsoft-windows-update.png)
