Surface Studio Vulnerable to INTEL-SA-00086 Critical Security Vulnerability - Requires Microsoft to Issue a Firmware Update - How Long?

Anonymous
2017-11-21T00:42:36+00:00

Intel released a disclosure today on a series of vulnerabilities in their management engine and trusted execution engine, affecting Surface Studio (and presumably other Surface devices). 

https://security-center.intel.com/advisory.aspx?intelid=INTEL-SA-00086&languageid=en-fr

They included a tool to check to see if your system is vulnerable:

http://www.intel.com/sa-00086-support

I've run the tool on a Surface Studio and confirmed that is vulnerable and requires Microsoft to issue a firmware update with the patch Intel provided. As they have presumably already given the patch to you, I'm wondering how long you're going to leave us all vulnerable to this before you release the required firmware update to patch this?

We need this fixed ASAP!

Surface | Surface Studio | Safety and security

Locked Question. This question was migrated from the Microsoft Support Community. You can vote on whether it's helpful, but you can't add comments or replies or follow the question.

0 comments

20 answers

Sort by: Newest
Most helpful Newest Oldest
  1. Anonymous
    2017-12-08T18:46:01+00:00

    Hi everyone, 

    Microsoft is aware of the Intel Management Engine vulnerability (Intel-SA-00086). The Intel vulnerability detection tool currently lists Microsoft Surface devices as vulnerable to this security advisory.

    Microsoft has investigated the issue and found the following:

    1. Remote exploit of this vulnerability requires Intel Active Management Technology (AMT). Current Surface devices do not allow remote connectivity to the ME because our devices do not run AMT.
    2. Local exploit of this vulnerability requires Direct Connect Interface (DCI) access via USB, which is not provided on Surface devices.

    Because of this, we believe exploits using this vulnerability are significantly reduced on Surface devices. We care deeply about ensuring our devices are reliable and secure and are working with Intel to generate fixes for current devices, which we expect to release in the near future.

    Thanks,

    Greg

    Was this answer helpful?

    20+ people found this answer helpful.
    0 comments
  2. Anonymous
    2017-11-29T08:08:56+00:00

    Was this answer helpful?

    0 comments
  3. Anonymous
    2017-11-29T00:36:05+00:00

    So a company as big as microsoft cant stand to their under 20 products and fix this issue quickly, but Asus and Lenovo can release patches for many more systems? Hard to recommend the Surface Laptop if not even the Security aspect is true.

    Was this answer helpful?

    0 comments
  4. Anonymous
    2017-11-28T20:53:06+00:00

    Surface Book 2 is also affected

    Was this answer helpful?

    0 comments
  5. Anonymous
    2017-11-28T15:07:56+00:00

    I can confirm that the first gen Surface Book is also affected.

    Was this answer helpful?

    0 comments