4 ms·

"While AMT gives an authenticated user a great deal of power, it's also designed with some degree of privacy protection in mind - for instance, when the remote

by rsync 9y ago

"While AMT gives an authenticated user a great deal of power, it's also designed with some degree of privacy protection in mind - for instance, when the remote console is enabled, an animated warning border is drawn on the user's screen to alert them." Can someone point me to a picture, or screenshot, of this ?

Cyphase 9y ago
If the ME is drawing this directly to the GPU, it wouldn't show up on a screenshot. A picture would work of course. Also, I would guess that it only works if you're using the integrated Intel GPU. Non-xkcd reference: http://www.bash.org/?291262 http://www.bash.org/?291262
- rsync 9y ago
  I am looking forward to seeing some ME demos from the art scene ...
tedunangst 9y ago
There's a screenshot somewhere in https://www.youtube.com/watch?v=aiMNbjzYMXo https://www.youtube.com/watch?v=aiMNbjzYMXo
- acidburnNSA 9y ago
  I think I see it at 27:57 https://www.youtube.com/watch?v=aiMNbjzYMXo&t=27m57s https://www.youtube.com/watch?v=aiMNbjzYMXo&t=27m57s
mrsteveman1 9y ago
Rebooted one of my AMT machines so I could take a video of what you see on the physical screen during boot while the remote console is active: https://youtu.be/GDD8os3ZeCI https://youtu.be/GDD8os3ZeCI
- sspiff 9y ago
  rEFInd is the greatest little EFI bootloader!
- vultour 9y ago
  So that’s what it was! I saw this at my previous university one day and no amount of Google fu could point me towards what sort of remote access tool it was.
cm2187 9y ago
But isn’t the concern about Intel ME mostly on servers which pretty much all have it and aren’t behind firewalls? This surely wouldn’t show on a remote desktop session?
- deleted 9y ago
  [deleted]
- dijit 9y ago
  FD: I am an Infrastructure Guy. Honestly I care a lot less about ME on servers because at the end of the day, if I see a server misbehaving (sending packets on the wire where it shouldn't) that's going to be a big red flag. Not to mention, egress traffic is indeed filtered. Could they compromise how my applications run? probably. Is there a need to do that? Maybe. Would I see it? certainly. the concern of ME is for my laptop which many wifi access points have "direct" line access to, it stores all the secrets of my server environment, and even if encrypted a persistent backdoor in ring -1 of my CPU is going to compromise those thousands of servers and in exactly the way I can't defend against.
  - Asiasweatworker 9y ago
    server ME does not connect to ethernet but BMC do. They may enable something like Secure Boot which requires signing to prevent 3party unauthorized backdoors.
  - vog 9y ago
    Maybe you could unite with other infrastructure people to speak up? See also: https://news.ycombinator.com/item?id=15796691 https://news.ycombinator.com/item?id=15796691
  - michaelbuckbee 9y ago
    I worry about egress routes like https://www.christophertruncer.com/exfiltrate-data-via-dns-with-egress-assess/ https://www.christophertruncer.com/exfiltrate-data-via-dns-w... It's hard to keep up with the cleverness of attackers.

by rsync 9y ago

Cyphase 9y ago

If the ME is drawing this directly to the GPU, it wouldn't show up on a screenshot. A picture would work of course. Also, I would guess that it only works if you're using the integrated Intel GPU. Non-xkcd reference: http://www.bash.org/?291262 http://www.bash.org/?291262

rsync 9y ago
I am looking forward to seeing some ME demos from the art scene ...

tedunangst 9y ago

There's a screenshot somewhere in https://www.youtube.com/watch?v=aiMNbjzYMXo https://www.youtube.com/watch?v=aiMNbjzYMXo

acidburnNSA 9y ago
I think I see it at 27:57 https://www.youtube.com/watch?v=aiMNbjzYMXo&t=27m57s https://www.youtube.com/watch?v=aiMNbjzYMXo&t=27m57s

mrsteveman1 9y ago

Rebooted one of my AMT machines so I could take a video of what you see on the physical screen during boot while the remote console is active: https://youtu.be/GDD8os3ZeCI https://youtu.be/GDD8os3ZeCI

sspiff 9y ago
rEFInd is the greatest little EFI bootloader!
vultour 9y ago
So that’s what it was! I saw this at my previous university one day and no amount of Google fu could point me towards what sort of remote access tool it was.

cm2187 9y ago

But isn’t the concern about Intel ME mostly on servers which pretty much all have it and aren’t behind firewalls? This surely wouldn’t show on a remote desktop session?

deleted 9y ago
[deleted]
dijit 9y ago
FD: I am an Infrastructure Guy. Honestly I care a lot less about ME on servers because at the end of the day, if I see a server misbehaving (sending packets on the wire where it shouldn't) that's going to be a big red flag. Not to mention, egress traffic is indeed filtered. Could they compromise how my applications run? probably. Is there a need to do that? Maybe. Would I see it? certainly. the concern of ME is for my laptop which many wifi access points have "direct" line access to, it stores all the secrets of my server environment, and even if encrypted a persistent backdoor in ring -1 of my CPU is going to compromise those thousands of servers and in exactly the way I can't defend against.
- Asiasweatworker 9y ago
  server ME does not connect to ethernet but BMC do. They may enable something like Secure Boot which requires signing to prevent 3party unauthorized backdoors.
- vog 9y ago
  Maybe you could unite with other infrastructure people to speak up? See also: https://news.ycombinator.com/item?id=15796691 https://news.ycombinator.com/item?id=15796691
- michaelbuckbee 9y ago
  I worry about egress routes like https://www.christophertruncer.com/exfiltrate-data-via-dns-with-egress-assess/ https://www.christophertruncer.com/exfiltrate-data-via-dns-w... It's hard to keep up with the cleverness of attackers.