4 ms·
This is confusing. Does the exploit really entirely hinge on administrators not changing the default password? How the hell is that an exploit? Is F-Secure just
by 013a 9y ago
This is confusing. Does the exploit really entirely hinge on administrators not changing the default password? How the hell is that an exploit? Is F-Secure just trying to ride the hate-Intel Meltdown bandwagon?
- Spivak 9y agoBecuase this is a very real practical exploit. Having such grossly insecire defaults is a security issue. Intel AMT should be disabled by default and enabled from the BIOS after the password is provided.
- thezilch 9y agoSaid every router ever? The feature shouldn't exist; it's not securable, short of a second device.
- cherioo 9y agoThe issue here is there's no way to physically provide a password to user without also handing it to the adversary. AMT could be protected, or AMT disabled and BIOS protected, by unique password printed onto laptop, neither of which will prevent adversary with physical access.
- reacweb 9y agoAll computer should be sold with a small card listing all the unique default passwords and private keys. Maybe a bunch of QR codes may help the type in.
- 013a 9y agoSounds like F-Secure is just trying to say "Yeah we do security research too, remember we exist." Basically they are saying that their "exploit" requires physical access to a device and an incompetent administrator. What's next? Oh no, Windows doesn't require administrators to force their users to not use the password "password". Someone issue a press release slamming Microsoft, horrible security! Point being, this doesn't belong on the front page of HN. Of course admins should know about this, but whoever submitted this is FUD piggy-backing on a legitimate exploit.
- Maakuth 9y agoIf it's something they regularly fail to do, I think it's a fair point.