Skip to content

Comment on Introducing Ring -3 Rootkits: BIOS rootkit targeting vPro chipsets (2009) [pdf]parent

Comments

Once you find a bug in certain critical paths, you can write to flash at will, no signatures required. AFAICS some Samsung and Lenovo users ran into one of those when installing Linux.

As for the management engine (the CPU that drives the vPro stuff), it exists in _all_ Intel chipsets since Series 5, vPro is just a certain configuration of its firmware. It also has full access to RAM, some access to USB, network and graphics.

AboutSource Built by g1lg1l

Hackerly is an independent reader for Hacker News, built on the public HN API. Not affiliated with Y Combinator.