4 ms·

It looks like I’m out the news cycle. What is AMT? Why would I need to check for it? Why just in Linux?

by neves 9y ago

rnhmjoj 9y ago
This explains what it is and why everyone is (or should be) upset about it: http://www.intel.com/content/www/us/en/architecture-and-technology/intel-amt-vulnerability-announcement.html#faq http://www.intel.com/content/www/us/en/architecture-and-tech...
0x0 9y ago
It turns out all(?) Intel CPUs in the last decade has a co-CPU that is always running as long as there is electricity available - even when shut down - that is continuously executing a "management engine" bios program, which your main CPU or OS cannot prevent (in fact, if the ME fails to "check in", the main CPU will automatically shutdown in 30 minutes). And, of course, it turns out there is a remote exploit for it. (The co-CPU intercepts network packets on its own, too, apparently)
- lclarkmichalek 9y ago
  Not all Intel CPUs have AMT. Most consumer machines won't have it enabled, it's an enterprise targeted feature. > Does this mean every Intel system built since 2008 can be taken over by hackers? No. Most Intel systems don't ship with AMT. Most Intel systems with AMT don't have it turned on. From an FAQ by MJG, the author of the tool we are discussing: https://mjg59.dreamwidth.org/48429.html https://mjg59.dreamwidth.org/48429.html
  - pritambaral 9y ago
    Your parent is correct. They aren't talking about AMT. They're talking about ME, which IS present in every Intel chip (since 2008-ish)
    - lclarkmichalek 9y ago
      My grandparent was talking about AMT. That's why the question was 'What is AMT?' I'll edit for clarity though.
      - deleted 9y ago
        [deleted]
- ue_ 9y ago
  This sounds horrible, even though I knew about it before. What are the viable options for other manufacturers or architectures which don't come with this sort of thing, either for desktops or for laptops?
  - chx 9y ago
    So the mainstream is Intel and AMD. Both are out. https://libreboot.org/faq.html#intel https://libreboot.org/faq.html#intel https://libreboot.org/faq.html#amd https://libreboot.org/faq.html#amd See https://libreboot.org/faq.html#whatcaniuse https://libreboot.org/faq.html#whatcaniuse -- your best bet is older Intel / AMD. There are some laptops https://www.crowdsupply.com/sutajio-kosagi/novena https://www.crowdsupply.com/sutajio-kosagi/novena which are open.
bo1024 9y ago
1) Intel ME. ALL Intel x86 processors for a long time have shipped with a second, closed-source processor on the same chip. This is called the Management Engine (ME). This processor has in theory complete control over the other one as well as its own ability to communicate over the network as long as the computer is connected to power even if powered down, with no way to check or control it securely. 2) AMT. These Intel processors may have a service enabled called Active Management Technology (AMT). Intel says that AMT usually comes disabled by default on "consumer" hardware (but Intel is not too specific about what this means, e.g. prebuilt only or CPUs you buy at the store?). AMT is like a remote desktop feature for the CPU. It allows someone to log in remotely and control the computer or diagnose problems, no matter what the "main" processor's state (even powered off). 3) The vulnerability. Suprise, AMT turns out to have a serious security vulnerability that allows a hacker to take control of the PC. 4) Uncertainty. It is difficult, due to Intel's vagueness, to figure out whether one's CPU even has AMT capability and whether it is turned on ("provisioned") by default. This is compounded by the fact that it is turned on or off by the motherboard BIOS settings but there are tons of motherboards from tons of manufacturers and it's not clear which ones support AMT, whether AMT might be provisioned on a motherboard that does not have any menu option regarding AMT, etc. The chances of motherboard manufacturers relasing information about this, let alone patches, for all their motherboards from the past 8 years, seems slim. 4.1) Linux. In particular, Intel has released a handy "detection guide"[1] that only applies to Windows. Macs are presumably "consumer hardware" only, so that mainly leaves Linux users out to dry. Please correct me if I missed any details above. [1] https://downloadcenter.intel.com/download/26755 https://downloadcenter.intel.com/download/26755
- qb45 9y ago
  > Uncertainty. It is difficult, due to Intel's vagueness, to figure out whether one's CPU even has AMT capability and whether it is turned on ("provisioned") by default. AMT is software so it's part of the BIOS image, not CPU. AFAIK it only works on "vPro" chipsets (Q series) thanks to Intel's market segmentation.
- dom0 9y ago
  The ME processor is located in the PCH as far as I know. SoC systems have it all on one die, of course.

It looks like I’m out the news cycle. What is AMT? Why would I need to check for it? Why just in Linux?

by neves 9y ago

It looks like I’m out the news cycle. What is AMT? Why would I need to check for it? Why just in Linux?

This explains what it is and why everyone is (or should be) upset about it: http://www.intel.com/content/www/us/en/architecture-and-technology/intel-amt-vulnerability-announcement.html#faq http://www.intel.com/content/www/us/en/architecture-and-tech...

0x0 9y ago

It turns out all(?) Intel CPUs in the last decade has a co-CPU that is always running as long as there is electricity available - even when shut down - that is continuously executing a "management engine" bios program, which your main CPU or OS cannot prevent (in fact, if the ME fails to "check in", the main CPU will automatically shutdown in 30 minutes). And, of course, it turns out there is a remote exploit for it. (The co-CPU intercepts network packets on its own, too, apparently)

lclarkmichalek 9y ago
Not all Intel CPUs have AMT. Most consumer machines won't have it enabled, it's an enterprise targeted feature. > Does this mean every Intel system built since 2008 can be taken over by hackers? No. Most Intel systems don't ship with AMT. Most Intel systems with AMT don't have it turned on. From an FAQ by MJG, the author of the tool we are discussing: https://mjg59.dreamwidth.org/48429.html https://mjg59.dreamwidth.org/48429.html
- pritambaral 9y ago
  Your parent is correct. They aren't talking about AMT. They're talking about ME, which IS present in every Intel chip (since 2008-ish)
  - lclarkmichalek 9y ago
    My grandparent was talking about AMT. That's why the question was 'What is AMT?' I'll edit for clarity though.
    - deleted 9y ago
      [deleted]
ue_ 9y ago
This sounds horrible, even though I knew about it before. What are the viable options for other manufacturers or architectures which don't come with this sort of thing, either for desktops or for laptops?
- chx 9y ago
  So the mainstream is Intel and AMD. Both are out. https://libreboot.org/faq.html#intel https://libreboot.org/faq.html#intel https://libreboot.org/faq.html#amd https://libreboot.org/faq.html#amd See https://libreboot.org/faq.html#whatcaniuse https://libreboot.org/faq.html#whatcaniuse -- your best bet is older Intel / AMD. There are some laptops https://www.crowdsupply.com/sutajio-kosagi/novena https://www.crowdsupply.com/sutajio-kosagi/novena which are open.

bo1024 9y ago

1) Intel ME. ALL Intel x86 processors for a long time have shipped with a second, closed-source processor on the same chip. This is called the Management Engine (ME). This processor has in theory complete control over the other one as well as its own ability to communicate over the network as long as the computer is connected to power even if powered down, with no way to check or control it securely. 2) AMT. These Intel processors may have a service enabled called Active Management Technology (AMT). Intel says that AMT usually comes disabled by default on "consumer" hardware (but Intel is not too specific about what this means, e.g. prebuilt only or CPUs you buy at the store?). AMT is like a remote desktop feature for the CPU. It allows someone to log in remotely and control the computer or diagnose problems, no matter what the "main" processor's state (even powered off). 3) The vulnerability. Suprise, AMT turns out to have a serious security vulnerability that allows a hacker to take control of the PC. 4) Uncertainty. It is difficult, due to Intel's vagueness, to figure out whether one's CPU even has AMT capability and whether it is turned on ("provisioned") by default. This is compounded by the fact that it is turned on or off by the motherboard BIOS settings but there are tons of motherboards from tons of manufacturers and it's not clear which ones support AMT, whether AMT might be provisioned on a motherboard that does not have any menu option regarding AMT, etc. The chances of motherboard manufacturers relasing information about this, let alone patches, for all their motherboards from the past 8 years, seems slim. 4.1) Linux. In particular, Intel has released a handy "detection guide"[1] that only applies to Windows. Macs are presumably "consumer hardware" only, so that mainly leaves Linux users out to dry. Please correct me if I missed any details above. [1] https://downloadcenter.intel.com/download/26755 https://downloadcenter.intel.com/download/26755

qb45 9y ago
> Uncertainty. It is difficult, due to Intel's vagueness, to figure out whether one's CPU even has AMT capability and whether it is turned on ("provisioned") by default. AMT is software so it's part of the BIOS image, not CPU. AFAIK it only works on "vPro" chipsets (Q series) thanks to Intel's market segmentation.
dom0 9y ago
The ME processor is located in the PCH as far as I know. SoC systems have it all on one die, of course.