Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Intel AMT Checker for Linux

github.com

Post reply on HN
Print view View original

11–20 of 93 posts

Re: Intel AMT Checker for Linux

#13

Post by knappa »

Artlav wrote: post #2

So, if it says "Error: IOCTL_MEI_CONNECT_CLIENT receive message. err=-1", what does it mean? Tried it on i5-6260U, should be new enough to have the thing.

The issues page has a report of the same error (as does my i5-6600) and the author says:

>Ok, I'm /inclined/ to believe that this indicates that the system doesn't implement AMT at all, but I'll try to do some more research.

Re: Intel AMT Checker for Linux

#15

Post by lclarkmichalek »

d33 wrote: post #8
lclarkmichalek wrote: post #7

Earlier quoted context omitted.

From the readme: In this state, AMT is not vulnerable to CVE-2017-5689.

Thanks! Missed this part. Also, do you think it's a good idea to keep it in this state as opposed to updating in case Intel's new patches lock AMT down even further? This is the pattern I saw with Sony once - groups of users not updating their consoles because via exploiting it they could get more control over it.

You should be able to disable it in the BIOS. If you're not going to use it, I'd suggest disabling it. You could always reenable it later, should you find a need for it.

Re: Intel AMT Checker for Linux

#16

Post by 0x0 »

neves wrote: post #11

It looks like I’m out the news cycle. What is AMT? Why would I need to check for it? Why just in Linux?

It turns out all(?) Intel CPUs in the last decade has a co-CPU that is always running as long as there is electricity available - even when shut down - that is continuously executing a "management engine" bios program, which your main CPU or OS cannot prevent (in fact, if the ME fails to "check in", the main CPU will automatically shutdown in 30 minutes). And, of course, it turns out there is a remote exploit for it. (The co-CPU intercepts network packets on its own, too, apparently)

Re: Intel AMT Checker for Linux

#18

Post by lclarkmichalek »

0x0 wrote: post #16
neves wrote: post #11

It looks like I’m out the news cycle. What is AMT? Why would I need to check for it? Why just in Linux?

It turns out all(?) Intel CPUs in the last decade has a co-CPU that is always running as long as there is electricity available - even when shut down - that is continuously executing a "management engine" bios program, which your main CPU or OS cannot prevent (in fact, if the ME fails to "check in", the main CPU will automatically shutdown in 30 minutes). And, of course, it turns out there is a remote exploit for it.…

Not all Intel CPUs have AMT. Most consumer machines won't have it enabled, it's an enterprise targeted feature.

  > Does this mean every Intel system built since 2008 can be taken over by hackers?
  
  No. Most Intel systems don't ship with AMT. Most Intel systems with AMT don't have it turned on.
From an FAQ by MJG, the author of the tool we are discussing: https://mjg59.dreamwidth.org/48429.html

Re: Intel AMT Checker for Linux

#19

Post by ue_ »

0x0 wrote: post #16
neves wrote: post #11

It looks like I’m out the news cycle. What is AMT? Why would I need to check for it? Why just in Linux?

It turns out all(?) Intel CPUs in the last decade has a co-CPU that is always running as long as there is electricity available - even when shut down - that is continuously executing a "management engine" bios program, which your main CPU or OS cannot prevent (in fact, if the ME fails to "check in", the main CPU will automatically shutdown in 30 minutes). And, of course, it turns out there is a remote exploit for it.…

This sounds horrible, even though I knew about it before. What are the viable options for other manufacturers or architectures which don't come with this sort of thing, either for desktops or for laptops?

Re: Intel AMT Checker for Linux

#20

Post by rst »

knappa wrote: post #13
Artlav wrote: post #2

So, if it says "Error: IOCTL_MEI_CONNECT_CLIENT receive message. err=-1", what does it mean? Tried it on i5-6260U, should be new enough to have the thing.

The issues page has a report of the same error (as does my i5-6600) and the author says: >Ok, I'm /inclined/ to believe that this indicates that the system doesn't implement AMT at all, but I'll try to do some more research.

I got this message on a system which has a Core i7-4510 CPU; this is not on the list of systems with "vPro" technology. I've seen referenced as another name for the vulnerable component --- but given the marketing-spawned confusion around Intel CPU nomenclature, I can easily imagine someone (perhaps me!) getting confused on the point.

Search for "vPro" systems here: https://ark.intel.com/Search/FeatureFilter?productType=proce...

Post reply on HN