<Note: We’re going to try and post a blog entry for major firmware vulnerabilities that impact enterprises, and the recent Intel AMT vulnerability seems like a good place to start.>

Technology Overview:

Quoting Wikipedia, “Intel Active Management Technology (AMT) is hardware and firmware technology for remote out-of-band management of personal computers, in order to monitor, maintain, update, upgrade, and repair them.<1> Out-of-band (OOB) or hardware-based management is different from software-based (or in-band) management and software management agents.”

Intel AMT is a firmware technology that runs on the Intel ME processor. AMT is normally enabled on servers, but some ‘business-class’ desktops/laptops – such as Thinkpads – also use AMT.

AMT is active even when the operating system is powered off, and the power switch is off, if there is power supply AMT can be running.

AMT can be remotely administrated. If there is a network connection, AMT may be sending network traffic. Normally AMT is considered an ethernet-centric technology, but it appears there are scenerios that AMT also uses WiFi.

Intel ME processor cannot be disabled with tools from Intel. Intel AMT may be disabled in the boot menu.

Vulnerability Background:

Maksim Malyutin of Embedi located the vulnerability.

Tenable also ‘rediscovered’ the vulnerability, both Embedi and Tenable have good technical descriptions of the vulnerability.

The AMT code has a string copy function to check the remote user’s password, and they don’t check the return code, so ANY password will work for ANY user.

Mitigations:

• Read list of mitigations from Intel and US-CERT.
• Get latest AMT software update from Intel/vendor.
• Check Intel announcement for tools to detect and disable.
• Disable AMT.
• If using AMT, question the need to use it.
• Disable AMT in network environments where you cannot fully control the network traffic (eg, mobile AMT-enabled laptop at external wifi hotspot)
• Consider some non-Intel community tools to check AMT and ME status.
• Isolate any AMT network traffic from public Internet (possible with Ethernet, perhaps not possible with WiFi-enabled business-laptops when roaming (eg, coffee shop).
• Set corporate policy regarding AMT use (update policy, disable/enable status).

Beyond the Intel tool, some untested community tools that might be helpful. Beyond detecting current status/informatoin, some of these community tools have features to attempt to disable AMT and/or ME, which may or may not work. Ask your vendor and local hardware expert before touching any of the non-readonly features, they may brick your system if you are not very careful.

Intel AMT aside, if your enterprise uses IPMI, or DMTF SMASH, DMTF DASH, DMTF Redfish, HP iLO, Dell DRAC, IBM Remote Supervisor Adapter, AMI MegaRac, or similar network-enabled OOB pre-OS technologies, you should also check for latest software, and ensure that their network traffic is isolated from attackers.

More Information:

technology background:

• http://www.intel.com/content/www/us/en/architecture-and-technology/intel-active-management-technology.html

• https://en.wikipedia.org/wiki/Intel_Active_Management_Technology

Information from the security researcher who discovered the vulnerability:

• https://www.embedi.com/news/mythbusters-cve-2017-5689

• https://www.embedi.com/files/white-papers/Silent-Bob-is-Silent.pdf

Information from Intel, including tools:

• https://newsroom.intel.com/news/important-security-information-intel-manageability-firmware/

• https://security-center.intel.com/advisory.aspx?intelid=INTEL-SA-00075&languageid=en-fr

• https://downloadcenter.intel.com/download/26754

• https://downloadcenter.intel.com/download/26755

Subset of community tools:

• https://github.com/mjg59/mei-amt-check

• https://sourceforge.net/p/openamt/wiki/Home/

• https://svn.nmap.org/nmap/scripts/http-vuln-cve2017-5689.nse

• https://github.com/bartblaze/Disable-Intel-AMT

• https://github.com/CerberusSecurity/CVE-2017-5689

• https://github.com/travisbgreen/intel_amt_honeypot

• https://github.com/platomav/MEAnalyzer

• https://github.com/skochinsky/me-tools

• https://github.com/corna/me_cleaner

Selected subset of other sources of information:

• https://semiaccurate.com/2017/05/01/remote-security-exploit-2008-intel-platforms/

• http://www.tenable.com/blog/rediscovering-the-intel-amt-vulnerability

• http://mjg59.dreamwidth.org/48837.html

• https://www.ssh.com/vulnerability/intel-amt/

• https://www.kb.cert.org/vuls/id/491375

• https://www.us-cert.gov/ncas/current-activity/2017/05/07/Intel-Firmware-Vulnerability

• https://vuldb.com/?id.100794

• https://isc.sans.edu/forums/diary/Do+you+have+Intel+AMT+Then+you+have+a+problem+today+Intel+Active+Management+Technology+INTELSA00075/22364/