Intel AMT Security Issue allows Local Attacker to get Complete Control Over any Laptop
Security researchers identified a significant security flaw with Intel AMT(Active Management Technology) utilized for remote monitoring and maintenance in corporate workplaces and it can be found in Intel vPro-enabled processors.
The flaw allows attackers to gain remote access to your laptops within seconds by simply log in using the default password and then enabling remote access by changing user permission.
BIOS password is to Prevent unauthorized access to the system and the problem here is attacker does not need BIOS password to setup AMT.
Intel busy in providing patches for Meltdown and Spectre which affects Intel, AMD, ARM processors and this unexpected behavior in Intel AMT reported by security F-securesecurity researchers. We hope firmware updates will be available soon.
How an attacker can Exploit – Intel AMT
The attacker needs to have a few seconds of Physical access to exploit and cannot be exploitable over the network.
The attack starts simply by rebooting the system and after an initial screen by pressing ctrl+p to get AMT’s Management. Then by entering default password “admin” attacker can gain access to AMT and configures AMT to allow remote access.
The attacker should reside in the same network to access the compromised machine, they can get full access to the site through VNC and can modify any data, you can find Technical details in F-secure.
Mitigations Suggested – Intel AMT
Researchers recommended to go through all currently deployed devices and configure the AMT password or disable the functionality completely and narrow the list of remotely connected devices.
Never leave your devices unmonitored in an unreliable area, Your screen may display blinking borders during remote management over AMT. Contact your organization’s IT department in case this happens.
Intel said fixes for security issues in its microchips would not slow down computers, rebuffing concerns that the flaws found in microprocessors would significantly reduce performance.
The performance impact of the recent security updates should not be significant and will be mitigated over time, Intel said, adding that Apple, Amazon, Google and Microsoft reported little to no performance impact from
the security updates.
Intel shares fell nearly 2 per cent on Thursday as investors were worried about the potential financial liability and reputational damage from the recently disclosed security issues.
The largest chipmaker confirmed earlier this week that the security issues reported by researchers in the company’s widely used microprocessors could allow hackers to steal sensitive information from computers, phones
and other devices.
Security researchers had disclosed two security flaws exposing vulnerability of nearly every modern computing device containing chips from Intel, Advanced Micro Devices and ARM Holdings.
The first, called Meltdown, affects Intel chips and lets hackers bypass the hardware barrier between applications run by users and the computer’s memory, potentially letting hackers read a computer’s memory and steal passwords. The second, called Spectre, affects chips from Intel, AMD and ARM and lets hackers potentially trick otherwise error-free applications into giving up secret information.
Intel had said the issues were not caused by a design flaw and asked users to download a patch and update their operating system.
Intel may be on the hook for costs stemming from lawsuits claiming that the patches would slow computers and effectively force consumers to buy new hardware, and big customers will likely seek compensation from Intel for any software or hardware fixes they make, security experts said.
Source:- INTEL OFFICIAL
Comments
Post a Comment