INTEL-SA-00075 – AMT Linux Detection and Mitigation Tools
downloadcenter.intel.com
INTEL-SA-00075 – AMT Linux Detection and Mitigation Tools
1–10 of 14 posts
Re: INTEL-SA-00075 – AMT Linux Detection and Mitigation Tools
#2Looks like it does roughly the same thing as this [1]. I guess it's a tossup between a proprietary program from Intel or a free program on github from the person who found the bug.
Re: INTEL-SA-00075 – AMT Linux Detection and Mitigation Tools
#3Looks like it does roughly the same thing as this [1]. I guess it's a tossup between a proprietary program from Intel or a free program on github from the person who found the bug. [1] https://news.ycombinator.com/item?id=14335159
I figure Intel already owns my machine. I may as well go with them.
Re: INTEL-SA-00075 – AMT Linux Detection and Mitigation Tools
#4Looks like it does roughly the same thing as this [1]. I guess it's a tossup between a proprietary program from Intel or a free program on github from the person who found the bug. [1] https://news.ycombinator.com/item?id=14335159
For what it is worth I think Maksim Malyutin from Embedi was the person that found the bug. MJG is the author of the check.
Re: INTEL-SA-00075 – AMT Linux Detection and Mitigation Tools
#5This is weird: this tool says my laptop is vulnerable, although AMT is disabled. I also tried mjg59's mei-amt-check and it indicated that because my system is unprovisioned it was not vulnerable.
Re: INTEL-SA-00075 – AMT Linux Detection and Mitigation Tools
#6Looks like it does roughly the same thing as this [1]. I guess it's a tossup between a proprietary program from Intel or a free program on github from the person who found the bug. [1] https://news.ycombinator.com/item?id=14335159
The Intel program pops a weird license when you download it, but the files themselves, to my surprise, are not proprietary: they are dual-licensed under the BSD license and GPLv2 license.
Re: INTEL-SA-00075 – AMT Linux Detection and Mitigation Tools
#7This is weird: this tool says my laptop is vulnerable, although AMT is disabled. I also tried mjg59's mei-amt-check and it indicated that because my system is unprovisioned it was not vulnerable.
It's probably vulnerable.
Re: INTEL-SA-00075 – AMT Linux Detection and Mitigation Tools
#8Looks like it does roughly the same thing as this [1]. I guess it's a tossup between a proprietary program from Intel or a free program on github from the person who found the bug. [1] https://news.ycombinator.com/item?id=14335159
For what it is worth I think Maksim Malyutin from Embedi was the person that found the bug. MJG is the author of the check.
My mistake. I mistook his blog post discussing it [1] for an initial announcement of it, even though it links to an Intel announcement.
Re: INTEL-SA-00075 – AMT Linux Detection and Mitigation Tools
#9This is weird: this tool says my laptop is vulnerable, although AMT is disabled. I also tried mjg59's mei-amt-check and it indicated that because my system is unprovisioned it was not vulnerable.
There's a second bug that allows a local, non privileged user to provision AMT.
Re: INTEL-SA-00075 – AMT Linux Detection and Mitigation Tools
#10Something security-related to keep in mind (TL;DR at end):
Directory state after initial unpack (becomes important in a minute):
-rwxr-xr-x 1 i336 users 19K May 13 10:43 INTEL-SA-00075-Discovery-Tool
-rw-r--r-- 1 i336 users 27K May 13 10:57 INTEL-SA-00075-Discovery-Tool.c
-rwxr-xr-x 1 i336 users 15K May 13 10:44 INTEL-SA-00075-Unprovisioning-Tool
-rw-r--r-- 1 i336 users 16K May 13 10:42 INTEL-SA-00075-Unprovisioning-Tool.c
-rw-r--r-- 1 i336 users 187 May 13 10:42 Makefile
$ cd INTEL-SA-00075-Discovery-Unprovisioning-Tool-Engineering-Release
$ make
gcc -I../../usr/include INTEL-SA-00075-Discovery-Tool.c -o INTEL-SA-00075-Discovery-Tool
strip INTEL-SA-00075-Discovery-Tool INTEL-SA-00075-Unprovisioning-Tool
$
$ rm INTEL-SA-00075-Discovery-Tool INTEL-SA-00075-Unprovisioning-Tool
$ make
gcc -I../../usr/include INTEL-SA-00075-Discovery-Tool.c -o INTEL-SA-00075-Discovery-Tool
gcc -I../../usr/include INTEL-SA-00075-Unprovisioning-Tool.c -o INTEL-SA-00075-Unprovisioning-Tool
strip INTEL-SA-00075-Discovery-Tool INTEL-SA-00075-Unprovisioning-Tool
$
Because the binary for the unprovisioning tool is two minutes NEWER than the source code, as shown in the directory listing.
The binary for the discovery tool is older than the source (as normal).
Objectively it's 50/50 as to whether this is meaningless noise or something hidden. Of course everything points toward the former, but I thought I'd leave this here just in case.
It's worth noting that an independent security company rapidly found (and announced) the vulnerability after the initial undisclosed CVE. So if it was that easy, this vulnerability has clearly been known about in various circles for a while.
It's also worth noting that the build process strips the binary, which is arguably unnecessary, but is a nice way to explain why there are no debug symbols in the provided binaries.
Again, I trust Intel and can easily talk this away as the inanites of bureaucracy and management and deadlines, but my "hmmm" sense is tingling nonetheless.