Flaw in Intel's Active Management Technology (AMT), (Sat, Jan 13th)

It has been a rough week for Intel. F-Secure has discovered a flaw in Intel’s Active Management Technology (AMT) which is in most business laptops. AMT is the technology which is used by corporations to remotely manage their  deployed laptops.

The gist of the flaw is that if the AMT password has not been reset from default, then an attacker with physical access to the laptop could reboot the laptop, interrupt the boot process, and access the Intel Management Engine BIOS Extension (MEBx) using the default password. The attacker could then reconfigure the laptop for remote access.  Once enabled the attacker, if on the same wifi or physical network, could remotely access the laptop. Because the access is through AMT it would bypass all security features deployed on the laptop effectively granting unimpeded access to all aspects of the laptop.

This is not really a flaw or vulnerability as much as a feature which can be abused if corporations do not follow best practices for configuring AMT

There are some more details at the The Hacker News.

 

— Rick Wanner MSISE – rwanner at isc dot sans dot edu – http://namedeplume.blogspot.com/ – Twitter:namedeplume (Protected)

(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.