Today Slashdot published an article about a new exploit involving the Intel Management Engine (ME) which allows for undetectable exfiltration of data from a system via a Serial-over-LAN tunnel to an outside host. Because this does not involve the host OS it is not detectable there (via packet capture).
As I unterstand the article it is generally not possible to simply disable the ME.
This leads to my question: Which countermeasures can be taken to avoid that such Serial-Over-Lan tunnel can even be established to an outside host.
A comment in the original article on bleepingcomputer.com for example asks about ports that could be blocked in a router. Preliminary search did not reveal any usual ports and I wouldn't be surprised if there is no specific port involved, because it is software-defined by whatever RAT is running on the host.
Pondering this, I had the idea that because the AMT TCP/IP Stack is apparently not integrated into the OS stack, perhaps changing the OS MAC address and enforcing a router-based MAC access control could be effective? For me, the host OS would be windows 8. But I'd welcome answers for any host OS.