Weak Intel AMT security lets hackers hijack corporate comps - research

Finnish firm detects new Intel security flaw

Finnish firm detects new Intel security flaw

The attacker does need to have physical access to the laptop but there are several scenarios where this could prove to be a trivial issue. This time, it's an issue with Intel's Active Management Technology (AMT), a feature typically reserved for systems that support Intel vPro or workstation platforms with certain Xeon CPUs.

"The attack is nearly deceptively simple to enact, but it has incredible destructive potential, "Harry Sintonen, a senior security consultant at F-Secure, says in a news release".

"In practice, it can give an attacker complete control over an individual's work laptop, despite even the most extensive security measures", he stressed.

Intel AMT is created to enable remote access monitoring and maintenance of corporate-grade personal computers, and is typically used by IT departments or managed service providers to manage devices. "Those best configuration practices include running with the least privileged access, keeping firmware, security software and operating systems up to date". The weakness can be exploited in mere seconds without a single line of code.

Setting a BIOS password, which normally prevents an unauthorised user from booting up the device or making low-level changes to it, does not prevent access to the AMT BIOS extension.

While requiring physical proximity to the target makes the attack more hard to initiate than a remote attack like a phishing email, it's not impossible that skilled attackers looking to compromise a particular target could orchestrate a scenario where they could get the brief time with the device they need.

The setup is simple: an attacker starts by rebooting the target's machine, after which they enter the boot menu. Even if the users do set-up a BIOS password, the attacker can access the Intel Management BIOS Extension (MEBx). The attacker would then be free to change the default password, enable remote access and set AMT's user opt-in to "None".

In certain cases, the assailant could also programme AMT to connect to their own server, which would eliminate the need to be in the same network segment as the victim.

Although the initial attack requires physical access, the speed at which it can be carried out makes it easily exploitable, said Sintonen.

"The attacker can break into your room and configure your laptop in less than a minute, and now he or she can access your desktop when you use your laptop in the hotel WLAN".

Sintonen said even a minute of distracting a target from their laptop at an airport or coffee shop is enough to enable an attacker to gain access to the target machine. The attacker can then access the device remotely, by connecting to the same wireless or wired network as the user.

Sintonen and his colleagues at F-Secure have come across the issue repeatedly since early summer previous year. The vulnerability affected devices back to the first generation of Intel Core, so not all of them were patched.

Last November, meanwhile, Intel issued another security alert, warning that flaws in its Management Engine - used in both consumer and business PCs - and AMT could be exploited by an attacker. The issue highlighted by F-Secure is distinct from that and other recent problems, the company confirmed, and relates to the insecure configuration and deployment of Intel AMT. However, many device manufacturers do not follow this advice.

Notícias recomendadas

  • Justiça dá prazo para Vasco convocar Conselho e declarar Brant vencedor

    Justiça dá prazo para Vasco convocar Conselho e declarar Brant vencedor

    A ação pode ser uma estratégia, já que agora o atual mandatário aposta todas as fichas na anulação da eleição dos sócios. Assim, a vitória passaria a ser novamente da chapa 'Reconstruindo o Vasco' , de Eurico Miranda .
    Huawei WiFi Q2 package spreads a signal over your whole house

    Huawei WiFi Q2 package spreads a signal over your whole house

    Plus, there is an anti-brute force algorithm that helps to prevent any outside or unwanted access to the network. Huawei introduced a hybrid Wi-Fi system yesterday at the CES 2018 .
    Oprah for President: Twitter erupts

    Oprah for President: Twitter erupts

    When Mr Trump discussed a White House run with talk show host Larry King in 1999, he picked Winfrey as his potential running mate. "Yeah, I'll beat Oprah ", Mr Trump told reporters during a meeting to discuss immigration reform with United States senators.
  • First Solar Jumps As Coverage Initiated With Buy Rating

    First Solar Jumps As Coverage Initiated With Buy Rating

    The solar cell manufacturer reported $1.95 EPS for the quarter, topping the Thomson Reuters' consensus estimate of $0.84 by $1.11. According to their observations and findings, the stock could provide a high EPS of $-0.24/share and a low EPS of $-0.41/share.
    AG: Girl can use medical marijuana at school

    AG: Girl can use medical marijuana at school

    Clarity - and fewer seizures - came in December, from medical marijuana patches and cannabis drops. They said the state's current medical marijuana laws do not meet reality.
    Youth should be encouraged to become 'innovators': PM Modi

    Youth should be encouraged to become 'innovators': PM Modi

    In 1984, the government had made a decision to observe the birth anniversary of Swami Vivekanand as the National Youth Day.
  • Hina Khan's Emotional Breakdown On The Last Day

    Hina Khan's Emotional Breakdown On The Last Day

    He asks her to help him win the Rs 3 lakh amount as he feels she is anyways going to be the victor and get the lump sum. Hina dodged this attempt as well because she didn't stand on the pillow, but she didn't quit the task either.
    Reuben Foster arrested for marijuana possession in Alabama

    Reuben Foster arrested for marijuana possession in Alabama

    The charge of second-degree marijuana possession in Alabama comes when an individual possesses for personal use. Alabama officials released the booking photo for San Francisco 49ers linebacker Reuben Foster Friday evening.
    Laurens de Bock: Leeds United sign Club Brugge left-back

    Laurens de Bock: Leeds United sign Club Brugge left-back

    It was quite a big decision I had to make, because I also have my wife and little boy. "I'm already imagining that the stadium is full and I'm on the pitch with the team so I'm really looking forward to it".
  • Protests Hit Several Cities of Tunisia Over Enforced Austerity

    Protests Hit Several Cities of Tunisia Over Enforced Austerity

    The protests draw on anger over price and tax increases included in this year's budget that took effect on January 1. Police carried out raids to " arrest troublemakers and rioters involved in looting and stealing", he said.
    Critics Laud The Post As 2018's Best Movie!

    Critics Laud The Post As 2018's Best Movie!

    And, in doing so, she became a feminist icon for the ages - the hard way (which is always the most remarkable and influential). But this is more about the growth of the Post from an essentially regional newspaper into a national powerhouse.
    James Franco Skips Critics' Choice Awards Amidst Sexual Misconduct Allegations

    James Franco Skips Critics' Choice Awards Amidst Sexual Misconduct Allegations

    A fifth woman accused Franco of pressuring her into performing fellatio while the pair were in a relationship two years ago. Franco maintained that the tweeted accusations were not accurate, but said that he would not try to actively refute them.

We are pleased to provide this opportunity to share information, experiences and observations about what's in the news.
Some of the comments may be reprinted elsewhere in the site or in the newspaper.
Thank you for taking the time to offer your thoughts.