Intel(R) Management Engine Vulnerability

[IsaakC]

---

@mdklassen wrote:

Nobody on this forum can officially speak for HP, nor for Intel.

---

For someone claiming to be totally not employed by HP, you're making an impressive lot of effort trying to downplay and deny this issue.

[mdklassen]

> For someone claiming to be totally not employed by HP ...

Thank you for such flattery. 

It truly would be an honour for me to be employed by HP.

Now, can we please avoid ad hominem  comments, and stick to the topic?

[IsaakC]

---

@mdklassen wrote:

Now, can we please avoid ad hominem  comments, and stick to the topic?

---

No, I'd rather want you to stop mudding the waters and drop this topic.

[HD_AU]

Dear HP-Support,

I own a HP 350 G1 Notebook. It seems that I'm affected, too. Will there be any update available?

[mdklassen]

>   I own a HP 350 G1 Notebook. It seems that I'm affected, too. Will there be any update available?

Your model of computer is not listed at: https://ftp.hp.com/pub/softpaq/sp82001-82500/sp82271.html

If you want to "sail into uncharted terrority", run: https://ftp.hp.com/pub/softpaq/sp82001-82500/sp82271.exe

Note that your computer can be attacked only via 3 methods:

1 remotely, if you have a direct Ethernet connection from your computer to a cable-modem, or a DSL-modem, with no "wired/wireless router" between your Internet connection and your computer;

2 locally: if your computer is already infected, then the M.E. vulnerability can be exploited;

3 locally: if you have a "home-network", and one of the other computers on your network is infected.

That is a relatively small "attack surface".

In #1, note that many ISPs are now providing "combination" devices, being both "modem" and "router.

In #2, protect your computer.

In #3, protect other computers inside your network.

[IsaakC]

Just in case you still think this is a nothing burger with nothing behind it, have fun reading this article.

[krzemien]

And yet time's passing and there's no sign of an updated IME driver for my PC.

https://support.hp.com/us-en/document/c05843704 remains static since 30/11.

EDITED TO ADD:

I just chased HP for an update via hp­security­alert@hp.com - I advise you all do the same

(I actually did notify them on 29/11 that my product is missing on their list, and the list got updated on 30/11. Coincidence, I'm sure)

[krzemien]

(Sincere apologies for replying to myself but there is some development - at last!)

Fix for my machine has just been released last night:

https://support.hp.com/gb-en/drivers/selfservice/swdetails/omen-by-hp-870-000-desktop-pc-series/1108...

Direct link:

http://ftp.hp.com/pub/softpaq/sp84001-84500/sp84244.exe

Release notes are here:

http://ftp.hp.com/pub/softpaq/sp84001-84500/sp84244.html

And there's quite a few models included on that list:

PRODUCT TYPE(S):
Desktops;Workstations;Consumer Desktops;Notebooks
HARDWARE PRODUCT MODEL(S):
HP HP ENVY 750-4xx Desktop PC
HP HP ENVY 750-5xxPC Desktop PC
HP ENVY 750-6xx Desktop PC
HP ENVY 13
HP Spectre 13 Notebook
HP Pavilion 14 Notebook PC
HP Spectre x360 13 Convertible
HP ENVY Notebook PC
HP 14 Laptop
HP 240 G6 Notebook PC
HP 246 G6 Notebook PC
HP Notebook PC
HP 250 G5 Notebook PC
HP 256 G5 Notebook PC
OMEN X by HP 17 Laptop PC
HP Pavilion 24-b0XX All-in-One PC
HP Pavilion 24-b1XX All-in-One PC
HP Pavilion 24-b2XX All-in-One PC
HP Pavilion 24-q1XX All-in-One PC
HP Pavilion 27-a0XX All-in-One PC
HP Pavilion 27-a1XX All-in-One PC
HP Pavilion 27-a2XX All-in-One PC
HP Pavilion 27-q2XX All-in-One PC
HP Pavilion 24-a0XX All-in-One PC
HP Pavilion 24-a1xx All-in-One PC
HP Pavilion 24-a2XX All-in-One PC
HP Pavilion x360 Convertible Notebook PC
HP Pavilion x360 m3 Convertible Notebook PC
OMEN by HP
HP Pavilion 560-p0xx Desktop PC
HP Pavilion 560-p1xx Desktop PC
HP Notebook 15g
HP Notebook 15q
HP 250 G4 Notebook PC
HP 256 G4 Notebook PC
HP Pavilion x360 Notebook PC
HP Pavilion Power 580-0xx Desktop
HP Pavilion Power 580-1xx Desktop
OMEN by HP 880-0xx Desktop PC
OMEN by HP 880-1xx Desktop PC
HP Spectre x2
HP 15 Laptop
HP 250 G6 Notebook PC
HP 256 G6 Notebook PC
HP 258 G6 Notebook PC
HP Spectre x360 Convertible
HP ENVY 15 Notebook PC
HP ENVY x360 Convertible
HP ENVY x360 15 Convertible
HP ENVY x360 15m Convertible
OMEN by HP 17 Laptop PC
HP ENVY x360 m6
HP Spectre x2 Detachable Convertible
HP Pavilion 24-r0xx All-in-One PC
HP Pavilion 27-r0xx All-in-One PC
HP Pavilion 24-x0xx All-in-One PC
HP 14s Laptop
HP Notebook 14
HP Notebook 14s
HP Pavilion 14 Laptop
HP Spectre x360 Convertible Convertible
HP Spectre Pro x360 G2 Convertible PC
OMEN by HP 15 Laptop PC
HP 240 G5 Notebook PC
HP 246 G5 Notebook PC
HP All-in-One PC All-in-One
HP ENVY 17
HP ENVY 17m
HP Slimline 260-p0xx Desktop PC
HP Slimline 260-p1xx Desktop PC
HP Slimline 270-p0xx Desktop PC
HP Spectre Pro 13 G1 Notebook PC
HP ENVY m7 Notebook PC
HP 460-p0xx Desktop PC
HP Pavilion 510-p0xx Desktop PC
HP Pavilion 510-p1xx Desktop PC
HP Pavilion 570-p0xx Desktop PC
HP Notebook 14g
HP Notebook 14q
HP Pavilion Power 15 Laptop
HP Pavilion Wave 600-axxx Desktop
HP Pavilion Wave 600-a1xx Desktop
HP Pavilion Wave 600-a2xx Desktop
HP Pavilion 15 Notebook PC
OMEN by HP 870-xxx Desktop PC
OMEN X by HP 900-0xx Desktop PC
OMEN X by HP 900-1xx Desktop PC
OMEN X by HP 900-2xx Desktop PC
HP Pavilion x360 15 Convertible

Last but not least, advisory notes have not been updated just yet (very bad, HP😞

https://support.hp.com/us-en/document/c05843704

I will be installing in the evening and will keep you. guys posted.

EDITED TO ADD: So it looks like I'm sorted.

Needless to add that this update has not been offered via HP Support Assistant (yet?).