2

Today Slashdot published an article about a new exploit involving the Intel Management Engine (ME) which allows for undetectable exfiltration of data from a system via a Serial-over-LAN tunnel to an outside host. Because this does not involve the host OS it is not detectable there (via packet capture).

As I unterstand the article it is generally not possible to simply disable the ME.

This leads to my question: Which countermeasures can be taken to avoid that such Serial-Over-Lan tunnel can even be established to an outside host.

A comment in the original article on bleepingcomputer.com for example asks about ports that could be blocked in a router. Preliminary search did not reveal any usual ports and I wouldn't be surprised if there is no specific port involved, because it is software-defined by whatever RAT is running on the host.

Pondering this, I had the idea that because the AMT TCP/IP Stack is apparently not integrated into the OS stack, perhaps changing the OS MAC address and enforcing a router-based MAC access control could be effective? For me, the host OS would be windows 8. But I'd welcome answers for any host OS.

|improve this question
  • This is not an exploit. The malware is using legitimate remote management features that have been poorly locked down. – André Borie Jun 9 '17 at 17:05
  • @André Borie I am asking about possibilities to lock it down. You have any more insight to share here? – antipattern Jun 11 '17 at 23:28
  • Physically disabling, removing, or otherwise damaging any unnecessary physical interfaces on a machine not absolutely under your team's administrative control would be an obvious responsibility. Epoxy, stong adhesives, and glitter nail polish are all useful here. Not at all joking. – quadruplebucky Jun 12 '17 at 10:54
2

AFAIK, stuff such as AMT(AMD has the same stuff call PSP), only works with a particular network adapter that supports the instruction.

So besides disable AMT from the BIOS, which is not 100% disable (unless you flash the firmware), another mitigation method is unplugged network cable connect to Intel adapter, and use another network adapter that doesn't talk Intel AMT.

There is a many Network adapter vendor. , since AMT is proprietary to Intel, so it is a safe bet that to use any external network adapter (not the internal one, as some may license technology from Intel to make it AMT ready) that not using Intel Chipset(with a risk of AMT enable).

|improve this answer
  • Nice answer. Does that mean the cheapo china stuff actually has an advantage here? – antipattern Jun 11 '17 at 22:21
  • 1
    @antipattern In this sense, it'd seem so. It's worth noting that other hardware can have backdoors or/and vulnerabilities, too (example). There might be a Windows-has-more-viruses-than-Mac thing going on here, where larger vendors are more researched targets. – Nat Jun 12 '17 at 3:21
0

Disable AMT and this should remove the problem. Follow this guide on how to do this.

Alternatively for the specific vulnerability there are a number of patches available.

Personally I would patch first at a minimum. If you do not require this feature I would also disable it, in addition to patching. This way if you ever enable it again for whatever reason it will be patched.

|improve this answer
0

There is a team that is actively developing solutions to disable the AMT chip at the source:

https://puri.sm/posts/deep-dive-into-intel-me-disablement/

It involves running a custom BIOS called coreboot: https://puri.sm/coreboot/

and removing critical parts of the AMT system: https://puri.sm/learn/intel-me/

|improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.