3 ms·

is why Intel needed to give an irreversible and verifiable way of completely disabling it. The article said it comes disabled by default. Isn't this a verifiab

is why Intel needed to give an irreversible and verifiable way of completely disabling it. The article said it comes disabled by default. Isn't this a verifiable way, or is the article incorrect?

SXX 9y ago
AMT is disabled by default on most consumer PCs or at least it's not expose itself. Though AMT work on top of ME and ME is opposite: it's always active and required for system to operate. If ME firmware not found CPU will shut down every 30 minutes or something. There also way to neutralize some part of ME firmware while keeping system operational, but it's hard to tell how effective this is actually.
- zkms 9y ago
  A privileged local user can provision AMT to its liking though, which is afaict what this malware did.
  - SXX 9y ago
    I posted it below already, but anyway as far as I personally understand to provision AMT you need it actually enabled in BIOS / EFI and it's in fact usually disabled by default. Am I missing something?
    - an27 9y ago
      Privileged users usually have BIOS access. BIOS's are often designed to be configurable/flashable with vendor-specific tools that your run on top of your OS.
  - microwavecamera 9y ago
    AMT exploits are a side channel attack. AMT has it's own processor, loads from it's own ROM separate from the BIOS and has it's own network stack but has full access to the system at a hardware level. AMT System Management Mode hooks in to the CPU at ring level -2, below the OS and is remotely exploitable.
tremon 9y ago
If it isn't verifiable, how can you check if the article's statement is true for your particular machine? And moreover, the article continues with Microsoft can't say if these state-sponsored hackers found a secret way to enable this feature on infected hosts
tyingq 9y ago
There's a second bug that allows a non-privileged local user to provision it. "An unprivileged local attacker could provision manageability features gaining unprivileged network or local system privileges on Intel manageability SKUs" https://security-center.intel.com/advisory.aspx?intelid=INTEL-SA-00075&languageid=en-fr https://security-center.intel.com/advisory.aspx?intelid=INTE...
- zkms 9y ago
  Also a privileged local user can provision it -- which is also pretty horrific, and that's not even a bug, it's how it's designed! Also "provision manageability features" is such an awkwardly euphemistic phrase here tbh, it's like reading leaked classified documents talking about "implanting" systems.
- SXX 9y ago
  Isn't it supposed to be enabled in BIOS in order to provision it? On most laptops and desktop motherboards such features simply disable by default like VT-d (IOMMU).
  - tyingq 9y ago
    See this question on the Intel forums. Seems difficult to actually disable it. https://software.intel.com/en-us/forums/intel-business-client-software-development/topic/563988 https://software.intel.com/en-us/forums/intel-business-clien...
    - SXX 9y ago
      Oh this isn't looks good at all. Didn't knew that. Thanks.
oneplane 9y ago
The only way to be sure it's off is by severing the link between the LM-suffixed Intel Ethernet chip and the PCH. There are two links, the 'normal' one (often MII type, sometimes PCI(e)), and the OOB-one, via SMBus or a comparable I2C style bus between the PCH and the Ethernet chip. Another way that hasn't been verified since in theory the ARC controller could access other PCI devices anyway, is to install a new ethernet card in a free expansion slot and use that instead. AMT is supposedly only supported with a specific CPU, firmware, PCH and PHY combination. Breaking that chain by swapping one of those components with an unsupported one should work. If you simply don't use any of the AMT-enabled interfaces, it shouldn't be able to communicate at all. Best plug in a chopped off ethernet jack to make sure nobody plugs in a cable by mistake. I believe there was a 802.11 variant as well, but that might have been before AMT and around the Centrino era. Best disconnect that as well...

is why Intel needed to give an irreversible and verifiable way of completely disabling it. The article said it comes disabled by default. Isn't this a verifiable way, or is the article incorrect?

SXX 9y ago

AMT is disabled by default on most consumer PCs or at least it's not expose itself. Though AMT work on top of ME and ME is opposite: it's always active and required for system to operate. If ME firmware not found CPU will shut down every 30 minutes or something. There also way to neutralize some part of ME firmware while keeping system operational, but it's hard to tell how effective this is actually.

zkms 9y ago
A privileged local user can provision AMT to its liking though, which is afaict what this malware did.
- SXX 9y ago
  I posted it below already, but anyway as far as I personally understand to provision AMT you need it actually enabled in BIOS / EFI and it's in fact usually disabled by default. Am I missing something?
  - an27 9y ago
    Privileged users usually have BIOS access. BIOS's are often designed to be configurable/flashable with vendor-specific tools that your run on top of your OS.
- microwavecamera 9y ago
  AMT exploits are a side channel attack. AMT has it's own processor, loads from it's own ROM separate from the BIOS and has it's own network stack but has full access to the system at a hardware level. AMT System Management Mode hooks in to the CPU at ring level -2, below the OS and is remotely exploitable.

tremon 9y ago

If it isn't verifiable, how can you check if the article's statement is true for your particular machine? And moreover, the article continues with Microsoft can't say if these state-sponsored hackers found a secret way to enable this feature on infected hosts

tyingq 9y ago

There's a second bug that allows a non-privileged local user to provision it. "An unprivileged local attacker could provision manageability features gaining unprivileged network or local system privileges on Intel manageability SKUs" https://security-center.intel.com/advisory.aspx?intelid=INTEL-SA-00075&languageid=en-fr https://security-center.intel.com/advisory.aspx?intelid=INTE...

zkms 9y ago
Also a privileged local user can provision it -- which is also pretty horrific, and that's not even a bug, it's how it's designed! Also "provision manageability features" is such an awkwardly euphemistic phrase here tbh, it's like reading leaked classified documents talking about "implanting" systems.
SXX 9y ago
Isn't it supposed to be enabled in BIOS in order to provision it? On most laptops and desktop motherboards such features simply disable by default like VT-d (IOMMU).
- tyingq 9y ago
  See this question on the Intel forums. Seems difficult to actually disable it. https://software.intel.com/en-us/forums/intel-business-client-software-development/topic/563988 https://software.intel.com/en-us/forums/intel-business-clien...
  - SXX 9y ago
    Oh this isn't looks good at all. Didn't knew that. Thanks.

oneplane 9y ago

The only way to be sure it's off is by severing the link between the LM-suffixed Intel Ethernet chip and the PCH. There are two links, the 'normal' one (often MII type, sometimes PCI(e)), and the OOB-one, via SMBus or a comparable I2C style bus between the PCH and the Ethernet chip. Another way that hasn't been verified since in theory the ARC controller could access other PCI devices anyway, is to install a new ethernet card in a free expansion slot and use that instead. AMT is supposedly only supported with a specific CPU, firmware, PCH and PHY combination. Breaking that chain by swapping one of those components with an unsupported one should work. If you simply don't use any of the AMT-enabled interfaces, it shouldn't be able to communicate at all. Best plug in a chopped off ethernet jack to make sure nobody plugs in a cable by mistake. I believe there was a 802.11 variant as well, but that might have been before AMT and around the Centrino era. Best disconnect that as well...