Story image

Corporate users warned Intel AMT flaw has 'destructive' potential

17 Jan 18

Intel technology has been thrown in the spotlight again after security researchers found a potentially ‘destructive’ vulnerability in its AMT solution, commonly deployed in corporate devices.

Australian cybersecurity watchdog Stay Smart Online issued an alert yesterday that details a new flaw in Intel’s Active Management Technology, also known as AMT.

The vulnerability allows attackers who gain physical access to a device to bypass BIOS and Bitlocker passwords. The attacker could then gain remote access to the compromised machine.

AMT is software that provides IT teams maintenance and remote access monitoring in order to control device fleets.

The vulnerability was discovered by security firm F-Secure. The company says that anyone who gains physical access to a machine could create a backdoor in less than 30 seconds.

According to F-Secure security consultant Harry Sintonen, the backdoor is simple to exploit and wields destructive potential.

“In practice, it can give an attacker complete control over an individual’s work laptop, despite even the most extensive security measures.”

F-Secure explains that an attacker just need to reboot or turn on the machine and press CTRL-P during the boot up process.

“The attacker then may log into Intel Management Engine BIOS Extension (MEBx) using the default password, “admin,” as this default is most likely unchanged on most corporate laptops.”

“The attacker then may change the default password, enable remote access and set AMT’s user opt-in to 'None.' The attacker can now gain remote access to the system from both wireless and wired networks, as long as they’re able to insert themselves onto the same network segment with the victim. Access to the device may also be possible from outside the local network via an attacker-operated CIRA server.”

Stay Smart Online says that if users do not need AMT, they should disable it in their device’s BIOS immediately.
 
“If you do need it, change the default ‘admin’ password to something that is hard to guess.”

F-Secure adds that organisations should analyse all deployed devices and configure the AMT password. If the password is unknown, the device may be compromised.

“We also recommend corporate laptops are never left out of a user's sight, especially in public places such as airports.”

Sintonen further explains how a potential attack could work:

“You leave your laptop in your hotel room while you go out for a drink. The attacker breaks into your room and configures your laptop in less than a minute, and now he or she can access your desktop when you use your laptop in the hotel WLAN. And since the computer connects to your company VPN, the attacker can access company resources.”

Earlier this month vulnerabilities dubbed ‘Meltdown’ and ‘Spectre’ put AMD, ARM and Intel processors in digital devices including computers, mobile phones, TVs, tablets and routers at risk. The vulnerabilities are not related to the AMT vulnerability.

CERT NZ warned that all devices must be updated to mitigate the vulnerabilities and protect against attacks, which could steal personal information and passwords.

At a CES keynote, Intel CEO Brian Kraznich said that the level of collaboration between industry to address the vulnerabilities has been ‘remarkable’.  

“The best thing users can do to make sure your data remains safe is to apply any updates from your operating system vendor and system manufacturer as soon as they become available,” he said.

AlgoSec delivers native security management for Azure Firewall
AlgoSec’s new solution will allow a central management capability for Azure Firewall, Microsoft's new cloud-native firewall-as-a-service.
How to configure your firewall for maximum effectiveness
ManageEngine offers some firewall best practices that can help security admins handle the conundrum of speed vs security.
Exclusive: Why botnets will swarm IoT devices
“What if these nodes were able to make autonomous decisions with minimal supervision, use their collective intelligence to solve problems?”
Why you should leverage a next-gen firewall platform
Through full lifecycle-based threat detection and prevention, organisations are able to manage the entire threat lifecycle without adding additional solutions.
The quid pro quo in the IoT age
Consumer consciousness around data privacy, security and stewardship has increased tenfold in recent years, forcing businesses to make customer privacy a business imperative.
ForeScout acquires OT security company SecurityMatters for US$113mil
Recent cyberattacks, such as WannaCry, NotPetya and Triton, demonstrated how vulnerable OT networks can result in significant business disruption and financial loss.
Exclusive: Fileless malware driving uptake of behavioural analytics
Fileless malware often finds its way into organisations via web browsers (or in combination with other vectors such as infected USB drives).
'DerpTrolling’ faces jail time for Sony DoS attacks
A United States federal court has charged a 23-year-old man for the hacks on Sony Online Entertainment and other major companies back in 2014.