Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Intel AMT Checker for Linux

github.com

Post reply on HN
Print view View original

21–30 of 93 posts

Re: Intel AMT Checker for Linux

#21

Post by bo1024 »

neves wrote: post #11

It looks like I’m out the news cycle. What is AMT? Why would I need to check for it? Why just in Linux?

1) Intel ME. ALL Intel x86 processors for a long time have shipped with a second, closed-source processor on the same chip. This is called the Management Engine (ME). This processor has in theory complete control over the other one as well as its own ability to communicate over the network as long as the computer is connected to power even if powered down, with no way to check or control it securely.

2) AMT. These Intel processors may have a service enabled called Active Management Technology (AMT). Intel says that AMT usually comes disabled by default on "consumer" hardware (but Intel is not too specific about what this means, e.g. prebuilt only or CPUs you buy at the store?). AMT is like a remote desktop feature for the CPU. It allows someone to log in remotely and control the computer or diagnose problems, no matter what the "main" processor's state (even powered off).

3) The vulnerability. Suprise, AMT turns out to have a serious security vulnerability that allows a hacker to take control of the PC.

4) Uncertainty. It is difficult, due to Intel's vagueness, to figure out whether one's CPU even has AMT capability and whether it is turned on ("provisioned") by default. This is compounded by the fact that it is turned on or off by the motherboard BIOS settings but there are tons of motherboards from tons of manufacturers and it's not clear which ones support AMT, whether AMT might be provisioned on a motherboard that does not have any menu option regarding AMT, etc. The chances of motherboard manufacturers relasing information about this, let alone patches, for all their motherboards from the past 8 years, seems slim.

4.1) Linux. In particular, Intel has released a handy "detection guide"[1] that only applies to Windows. Macs are presumably "consumer hardware" only, so that mainly leaves Linux users out to dry.

Please correct me if I missed any details above.

[1] https://downloadcenter.intel.com/download/26755

Re: Intel AMT Checker for Linux

#23

Post by pritambaral »

lclarkmichalek wrote: post #18
0x0 wrote: post #16

Earlier quoted context omitted.

It turns out all(?) Intel CPUs in the last decade has a co-CPU that is always running as long as there is electricity available - even when shut down - that is continuously executing a "management engine" bios program, which your main CPU or OS cannot prevent (in fact, if the ME fails to "check in", the main CPU will automatically shutdown in 30 minutes). And, of course, it turns out there is a remote exploit for it.…

Not all Intel CPUs have AMT. Most consumer machines won't have it enabled, it's an enterprise targeted feature. > Does this mean every Intel system built since 2008 can be taken over by hackers? No. Most Intel systems don't ship with AMT. Most Intel systems with AMT don't have it turned on. From an FAQ by MJG, the author of the tool we are discussing: https://mjg59.dreamwidth.org/48429.html

Your parent is correct. They aren't talking about AMT. They're talking about ME, which IS present in every Intel chip (since 2008-ish)

Re: Intel AMT Checker for Linux

#24

Post by lclarkmichalek »

pritambaral wrote: post #23
lclarkmichalek wrote: post #18

Earlier quoted context omitted.

Not all Intel CPUs have AMT. Most consumer machines won't have it enabled, it's an enterprise targeted feature. > Does this mean every Intel system built since 2008 can be taken over by hackers? No. Most Intel systems don't ship with AMT. Most Intel systems with AMT don't have it turned on. From an FAQ by MJG, the author of the tool we are discussing: https://mjg59.dreamwidth.org/48429.html

Your parent is correct. They aren't talking about AMT. They're talking about ME, which IS present in every Intel chip (since 2008-ish)

My grandparent was talking about AMT. That's why the question was 'What is AMT?' I'll edit for clarity though.

Re: Intel AMT Checker for Linux

#25

Post by virtualwhys »

> Intel AMT: ENABLED > AMT is unprovisioned

Think I'd be alright even if it were provisioned as the ethernet port on this Dell Precision laptop got fried during a lightning storm last year (i.e. from reports I've read a wired connection is needed for the exploit to work). Then again, better to know AMT isn't provisioned than to rely on third party reporting.

Re: Intel AMT Checker for Linux

#26

Post by jaimex2 »

God #$%@ing damn it, this is why we can't have nice things. You can do only so much to not get pwned software wise, now you need to be paranoid about the hardware too?!

Going through all Xeon servers is going to be fun tomorrow.

Re: Intel AMT Checker for Linux

#27

Post by qb45 »

bo1024 wrote: post #21
neves wrote: post #11

It looks like I’m out the news cycle. What is AMT? Why would I need to check for it? Why just in Linux?

1) Intel ME. ALL Intel x86 processors for a long time have shipped with a second, closed-source processor on the same chip. This is called the Management Engine (ME). This processor has in theory complete control over the other one as well as its own ability to communicate over the network as long as the computer is connected to power even if powered down, with no way to check or control it securely. 2) AMT. These In…

> Uncertainty. It is difficult, due to Intel's vagueness, to figure out whether one's CPU even has AMT capability and whether it is turned on ("provisioned") by default.

AMT is software so it's part of the BIOS image, not CPU. AFAIK it only works on "vPro" chipsets (Q series) thanks to Intel's market segmentation.

Re: Intel AMT Checker for Linux

#28

Post by mkl »

tumdum_ wrote: post #22

Did anyone read that code before using it? :)

I looked through it first. Not thoroughly enough to spot anything really underhanded, but it seems to be well written code that does stuff like what it claims.

Re: Intel AMT Checker for Linux

#29

Post by kuschku »

lclarkmichalek wrote: post #15
d33 wrote: post #8

Earlier quoted context omitted.

Thanks! Missed this part. Also, do you think it's a good idea to keep it in this state as opposed to updating in case Intel's new patches lock AMT down even further? This is the pattern I saw with Sony once - groups of users not updating their consoles because via exploiting it they could get more control over it.

You should be able to disable it in the BIOS. If you're not going to use it, I'd suggest disabling it. You could always reenable it later, should you find a need for it.

I have no BIOS option at all for this, yet it’s enabled and provisioned. What do I do?

Re: Intel AMT Checker for Linux

#30

Post by hsivonen »

lclarkmichalek wrote: post #15
d33 wrote: post #8

Earlier quoted context omitted.

Thanks! Missed this part. Also, do you think it's a good idea to keep it in this state as opposed to updating in case Intel's new patches lock AMT down even further? This is the pattern I saw with Sony once - groups of users not updating their consoles because via exploiting it they could get more control over it.

You should be able to disable it in the BIOS. If you're not going to use it, I'd suggest disabling it. You could always reenable it later, should you find a need for it.

Is disabling always possible? I don’t find UI to disable in recent Lenovo ThinkStation BIOS even though I’ve seen such option previously in ThinkPad BIOS.
Post reply on HN