Looking for someone here smarter than me on AMI Uefi's

[M3038]

Hello,

So, first off thanks for having me. I've been a ways off in the distance observer for quite some time now and figured i'd give this a shot.

So, sparing everyone the gory details i'm in a situation where.. the best way to put it is, my machines are not managed by me. Not a corporation, or place of business either. Think bad guys.

These bad guys have either completely imaged and overwritten a bad guy image to my device(s) and over the course of the past few days and weeks i'm inching closer to smoking these chuckleheads out. Just today i finally gained the initiative with the discovery of "manufacturer mode".

Recently i've been sequestered into using just ISO and DVD's to get an OS running, as USB drives tended to be fraile and easily manipulatable in this context. And with that have founded OpenSUSE as being rock solid and essentially fits my bill for the environment. And OpenSUSE reports that my TPM is nonexistent, my firmware is incorrect, and my manufacturing mode is unlocked (amongst many other things).

Now looking into manufacturing mode it's generally accepted that Alt + (choose whatever F key here) are the open sesame to either locking or unlocking manufacturing bios. Now, to give a little bit more context when i say my devices are managed by some one other than me what i really mean is someone has access to and regularly exercises root privelages over me. They have this privilege across all levels of a machine. From the second i start any of them can even see them configuring them if you have the right equipment. This extends to all operating systems and all scenarios. I'll cut the details here and get down to my question.

I need to find the open sesame or an alternative way into the AMI bios. This is with the serial ports (all of them) seemingly disabled and also with any attempt at flashing the bios nothing but kabuki theater. The only thing that seems to have any effect is just pure tempo, i.e wearing it out.

These jokers like to live in
memory and subvolumes of my installed operating systems and essentially let themselves in at any time. But anything to do with virtual machines or memory fundamentally is that it is effected by entropy. The problem is the next day they literally just reflash the system back to their likint and i'm back at square one.

As i said today i did get s little momentum though. Finding that obnoxiously pressing Alt + F1 and F2 threw off the boot sequence, and then subsequently had me booting to their instance (albeit encrypted, with a one shot chance). I was able to cause some havoc with their config files and delete some modules but that was it; but it was enough to at least bloody a nose as now i can see literally all their little rat tunnels. But, i have no way of capitalizing.

I have tried:

• The entire suite of AMI flash utilities and debuggers
  Flashing via the bios
  Via the OS using a slew of different tools and utilities including flashrom and have even gone as far as building a cool little fleet of arduino's. Nothing has worked.

So, how do i regain soverienty back over my own machines? I'm mainly looking for an administrator login secret back door so to speak. Anyone have any insight??

Thanks in advance!

[diif]

Re: Looking for someone here smarter than me on AMI Uefi's

What makes you think it's compromised?

[M3038]

Re: Looking for someone here smarter than me on AMI Uefi's

What makes you think it's compromised?

Six months of torment up to and including my phone number repeatedly disappearing from my tmobile account, the chuckleheads showing up, flashing new firmware on my router (almost a daily occurrence) and then running multiple virtual LAN and bridge connections. Or maybe it could be the fact that every. Single. Device. I've owned over the past six months ends up inoperable, sometimes within hours. Mainly by what is described above.

This has been my nightmare dude. And there's always someone who wants to argue the merits of my own experience instead of answer the question at hand. I'll preemptively tell you what i tell everyone else who barks up that tree: come fine out. Either via Zoom, or another virtual way or you can feel free to remote in and stop by. Every day's more interesting than the last so there's plenty to see.

[diif]

Re: Looking for someone here smarter than me on AMI Uefi's

What device is it ? What's your network set up ?

[M3038]

Re: Looking for someone here smarter than me on AMI Uefi's

What device is it ? What's your network set up ?

The one i'm writing about specifically is an MSI Z690 Unify. I have an additional two other MSI boards. So one rock three birds.

As per the network *currently* it's simplified down to a Netgear CM500 modem, R6900 router, and a TP Link ER605. We've already burned out two modems and dumped two other routers trying to dump whoever/whatever this is. Isp is Comcast with DHCP. I have noIP enabled on both routers as well as VPN's and the TPLink actually has a pretty cool suite of attack countermeasures as well. Pretty neat to watch over wireshark.

Thank you for taking my sharp response last night on the chin, it has been a long few days/nights. I appreciate you letting it glance off.

Edit: since you brought it up; the router is the 50 yard line or the DMZ. We're constantly going back and forth over it. I finally, after three months of trying was able to pull the debug logs and oh boy. Let's just say i'm getting a further crash course in UDP, bridges, vlan, and tor.