5 ms·
I use this simply because I need to have power on/off and remoting capabilities on machines running environments where I cannot configure such capabilities (mea
by close04 8y ago
I use this simply because I need to have power on/off and remoting capabilities on machines running environments where I cannot configure such capabilities (meaning I have 0 recourse, no RDP, no TeamViewer, no VNC,, etc.).
The reason they don't show up on Shodan is that the search engine doesn't scan private networks and you have to explicitly configure it to be internet accessible. You have to configure AMT/ME in BIOS, you have to allow the connection through your router. Very few people will actually do that.
- nine_k 8y agoDoes this mean that if you configure ME in your BIOS in a certain way, it is not exposed to the network? It sounds almost too good to be true: the attack surface is removed by a BIOS switch?
- close04 8y agoNo, it means that AMT is not exposed to the internet. The ME itself is not exposed, but the AMT running on top of it is designed to be accessed over the network. Unless you explicitly expose AMT to the internet you are relatively safe as long as your local network isn't compromised. So it can be exploited only by an attacker with physical access or at least in the same network. Shodan wouldn't show you any of these machines that have ME configured and AMT blocked from crossing your router into the internet.
- praseodym 8y agoIn a typical home network “any device on the same network” is a very large attack vector. You just need some unsecured webcam, router or other cheap IoT device; the Mirai botnet proves that those are widely deployed.