4 ms·

So if I point another computer on the network to the given ports on a browser, I should see this damn interface? Would be a nice way to indicate whether it is o

So if I point another computer on the network to the given ports on a browser, I should see this damn interface? Would be a nice way to indicate whether it is on or not, maybe?

ppoint 9y ago
I think AMT needs to be provisioned on target computer to be exploitable.
- AnimalMuppet 9y ago
  But to find out if it is, I need to go into the BIOS, right? Isn't it easier just to try going to a port?
  - orblivion 9y ago
    I keep reading that if you "disable AMT" in the BIOS (on my Lenovo, anyway) it just resets the settings. A complete WTF but that's what I've been reading.
  - ppoint 9y ago
    Yea, maybe. going to the port is less conclusive in general case. E.g. you have some firewalls/other networking devices/etc in the middle that would deny access to that port and it would make you think it's disabled but it's actually not.
- tyingq 9y ago
  There is also a local, non root user exploit to provision AMT described in Intel's announcement.
  - ppoint 9y ago
    Yes. To be honest, Intel's announcement was a little dry, lacking details.
turblety 9y ago
The problem is even if the interface says it's not activated, can you believe it's not activated? When you have closed source software running on a separate chip you have no control over you can never be 100% sure of what it does. Even if you trust the company completely you can't be sure there's no bugs in it. Especially if it's got a load of code your "not using" in there.
- orblivion 9y ago
  To that end sure, but then this whole discussion is pointless. Right now we have a known serious problem that has a known (by someone out there) way of identifying.
opless 9y ago
Point your curl at port 16992 of the target machine, you'll get something like: $ curl -v http://server:16992 http://server:16992 > GET / HTTP/1.1 > Host: server:16992 > User-Agent: curl/7.47.0 > Accept: / > < HTTP/1.1 303 See Other < Location: /logon.htm < Content-Length: 0 < Server: Intel(R) Active Management Technology 8.1.10
- orblivion 9y ago
  I went to my BIOS and turned AMT "on". I turned off my modem and connected my Lenovo to Ethernet. I sshed into another machine, and ran the curl command back at the Lenovo. I tried ports 16992 and 16993 per the article. And I got no such response. This shit is never clear, but did I have to actively turn this thing on to be vulnerable to the remote variant of this attack?

So if I point another computer on the network to the given ports on a browser, I should see this damn interface? Would be a nice way to indicate whether it is on or not, maybe?

ppoint 9y ago

I think AMT needs to be provisioned on target computer to be exploitable.

AnimalMuppet 9y ago
But to find out if it is, I need to go into the BIOS, right? Isn't it easier just to try going to a port?
- orblivion 9y ago
  I keep reading that if you "disable AMT" in the BIOS (on my Lenovo, anyway) it just resets the settings. A complete WTF but that's what I've been reading.
- ppoint 9y ago
  Yea, maybe. going to the port is less conclusive in general case. E.g. you have some firewalls/other networking devices/etc in the middle that would deny access to that port and it would make you think it's disabled but it's actually not.
tyingq 9y ago
There is also a local, non root user exploit to provision AMT described in Intel's announcement.
- ppoint 9y ago
  Yes. To be honest, Intel's announcement was a little dry, lacking details.

turblety 9y ago

The problem is even if the interface says it's not activated, can you believe it's not activated? When you have closed source software running on a separate chip you have no control over you can never be 100% sure of what it does. Even if you trust the company completely you can't be sure there's no bugs in it. Especially if it's got a load of code your "not using" in there.

orblivion 9y ago
To that end sure, but then this whole discussion is pointless. Right now we have a known serious problem that has a known (by someone out there) way of identifying.

opless 9y ago

Point your curl at port 16992 of the target machine, you'll get something like: $ curl -v http://server:16992 http://server:16992 > GET / HTTP/1.1 > Host: server:16992 > User-Agent: curl/7.47.0 > Accept: / > < HTTP/1.1 303 See Other < Location: /logon.htm < Content-Length: 0 < Server: Intel(R) Active Management Technology 8.1.10

orblivion 9y ago
I went to my BIOS and turned AMT "on". I turned off my modem and connected my Lenovo to Ethernet. I sshed into another machine, and ran the curl command back at the Lenovo. I tried ports 16992 and 16993 per the article. And I got no such response. This shit is never clear, but did I have to actively turn this thing on to be vulnerable to the remote variant of this attack?