How to Hack a Turned-Off Computer, or Running Unsigned Code in Intel Management Engine
summary
They disclose a reproducible exploit that achieves arbitrary unsigned code in Intel ME by abusing an emFS file parser to trigger a stack buffer overflow in Bob module, then corrupting a thread‑local storage at bottom of stack to turn iterative 64‑byte reads into an arbitrary write primitive. Exploit uses a flash programmer and GTA/USB debug cable plus Python tooling, chains ROP to bypass NX by loading a module into flash, activates AMT/GTA, dumps platform keys and bypasses Boot Guard; works on 6th–8th‑gen and Xeon systems when SPI write or AMT provisioning + flashserv is allowed. They reported June, Intel patched in November.
AI-written summary · about
chapters (14)
- 0:00Introduction and agenda
- 2:10Intel ME 11 architecture
- 4:20Public vulnerabilities
- 5:31Potential attack vectors
- 8:23Firmware and access control
- 11:13Targeting the BUP module
- 12:52Vulnerability discovery
- 14:47Mitigation bypass techniques
- 18:18Achieving arbitrary writes
- 22:13Bypassing non-executable stack
- 24:15Impact and exploitation
- 27:19Limitations and bad news
- 30:42Demos and achievements
- 36:55Questions and answers
related talks
57mExtreme Privilege Escalation on Windows 8/UEFI Systems
33mAI Accelerated Exploiting: Compromising MTE Enabled Pixel from DSP Coprocessor
51mExploiting Hardware Glitches And Side Channels In Perfect Software
55mHow hacking works
49mBreaking Through Another Side: Bypassing Firmware Security Boundaries from Embedded Controller
54mWhen Good Turns Evil: Using Intel SGX to Stealthily Steal Bitcoins
51mThe Anatomy of an Exploit
57mThe Anatomy of an Exploit