Is there a nice semi-automated way that I would just paste output of my /proc, lspci, or any other hardware description and get suggestions to what kind of vulnerabilities a given computer may be subject to (and hints how to fix them)?
asked Dec 18, 2017 at 19:58
Add a comment
|
2 Answers
Intel released a detection tool for the INTEL-SA-00086-related vulnerabilities, called Intel-SA-00086 Detection Tool:
SA00086_Linuxtar.gz - For Linux* Users
The version of the tool is a command line executable that will display a risk assessment for the system being tested.
Note: Versions of the INTEL-SA-00086 Detection Tool earlier than 1.0.0.146 did not check for CVE-2017-5711 and CVE-2017-5712. These CVE's only affect systems with Intel Active Management Technology (Intel AMT) version 8.x-10.x. Users of systems with Intel AMT 8.x-10.x are encouraged to install version 1.0.0.146, or later, to help verify the status of their system in regards to the INTEL-SA-00086 Security Advisory.
According to Rapid7, you can also scan for IME/AMT management ports.
-
This looks like it's specific to one set of vulnerabilities. The OP was asking for more general information (from what I can tell).– forestCommented Dec 19, 2017 at 4:40
-
@forest the answer was upvoted and accepted by the OP. "What you can tell" is irrelevant. As is your downvote.– julianCommented Dec 19, 2017 at 4:46
-
The downvote was because this will not be very useful to others who have the same question due to being so specific and limited to the time where this specific INTEL-SA is affecting people. It's good if it solved the OP's problem, but it won't do much more. I certainly don't mean to say that this answer isn't accurate. I just feel it is incomplete.– forestCommented Dec 19, 2017 at 4:51
-
-
1This tool doesn't even find the vulnerability in Intel ME. It only checks for the firmware metadata like specific versions which were affected by the vulnerability. This tool has no idea what code of Intel ME has caused the vulnerability. This tool cannot be used again to detect vulnerabilities in future.– defaltCommented Dec 19, 2017 at 7:49
CHIPSEC is arguably the most comprehensive tool for analyzing firmware security to date.
The first answer provided resources for detecting whether or not INTEL-SA-00086 affects you. There is another, the CHIPSEC framework, which scans your BIOS/UEFI for various security issues and reports it to you. It is frequently updated in response to new information. From their Github page:
CHIPSEC is a framework for analyzing the security of PC platforms including hardware, system firmware (BIOS/UEFI), and platform components. It includes a security test suite, tools for accessing various low level interfaces, and forensic capabilities. It can be run on Windows, Linux, Mac OS X and UEFI shell.
It is capable of providing information on various capabilities of your firmware, and whether or not it is configured to resist modification from software. There are many ways to overwrite firmware with privileged access, and your firmware has to lock itself down properly. Even missing one detail can result in firmware which can be modified at runtime. It can also provide details on specific vulnerabilities, and on more mild issues such as whether or not your keyboard buffer contains keystrokes entered while in the BIOS, which could disclose your BIOS password.
Note that CHIPSEC output can appear rather arcane at times. It is designed to be used as a framework by researchers and firmware vendors, so it does not go into detail about the implications of various issues it has found. The manual gives more details about the purpose of each module, and this page provides information on some of the more common modules and vulnerabilities. You can also expand its functionality by writing custom modules. It is a framework, after all.
Example output from the common.bios_wp module:
[+] imported chipsec.modules.common.bios_wp
[x][ =======================================================================
[x][ Module: BIOS Region Write Protection
[x][ =======================================================================
BIOS Control (BDF 0:31:0 + 0xDC) = 0x2A
[05] SMM_BWP = 1 (SMM BIOS Write Protection)
[04] TSS = 0 (Top Swap Status)
[01] BLE = 1 (BIOS Lock Enable)
[00] BIOSWE = 0 (BIOS Write Enable)
[+] BIOS region write protection is enabled (writes restricted to SMM)
[*] BIOS Region: Base = 0x00500000, Limit = 0x00FFFFFF
SPI Protected Ranges
------------------------------------------------------------
PRx (offset) | Value | Base | Limit | WP? | RP?
------------------------------------------------------------
PR0 (74) | 00000000 | 00000000 | 00000000 | 0 | 0
PR1 (78) | 8FFF0F40 | 00F40000 | 00FFF000 | 1 | 0
PR2 (7C) | 8EDF0EB1 | 00EB1000 | 00EDF000 | 1 | 0
PR3 (80) | 8EB00EB0 | 00EB0000 | 00EB0000 | 1 | 0
PR4 (84) | 8EAF0C00 | 00C00000 | 00EAF000 | 1 | 0
[!] SPI protected ranges write-protect parts of BIOS region (other parts of BIOS can be modified)
[+] PASSED: BIOS is write protected
-
It should not be installed/deployed on production end-user systems.– julianCommented Dec 19, 2017 at 4:05
-
Yes that's true. Your system should not be in production when you run it, because it can (in rare circumstances) crash the system, and because it requires running a kernel module that allows arbitrary access to system memory (albeit only from privileged processes), as the warning link says. That doesn't mean it can't safely be used on soon-to-be production system, or a production system that has been taken offline for planned maintenance.– forestCommented Dec 19, 2017 at 4:10
-
Are end users eligible to use this tool on consumer laptops?– defaltCommented Dec 19, 2017 at 8:00
-
Yes. There is no qualification necessary. For a consumer laptop, you should either use the UEFI shell or the pre-built Fedora version, on a USB stick. It will give you information on potential vulnerabilities. In some cases it will also make it easy to find out how to fix it, but in most cases only the BIOS vendor can fix it (unless you want to go about writing a binary patch to the BIOS yourself...). For the end-user, it's a "how screwed are you" tool. For the BIOS vendor or OEM, it's a framework for finding out what needs to be improved in the next release.– forestCommented Dec 19, 2017 at 8:02