Intel's Remote AMT Vulnerability

Re:Intel's Remote AMT Vulnerability by zkms on Monday May 01, 2017 @08:50PM (#14243142)

> If you reboot you should see a brief firmware splash mentioning the ME. Hitting ctrl+p at this point should get you into a menu which should let you disable AMT.

my Lenovo T450s's vPro/AMT setup menu (MEBx) requires a password from me. The default password ("admin") won't work -- which is wonderful, as I have no idea how to reset it. Yaey.

[ Parent | on HN ]

Re:Intel's Remote AMT Vulnerability by mjg59 on Monday May 01, 2017 @09:01PM (#14243192)

Try P@ssw0rd

[ Parent | on HN ]

Re:Intel's Remote AMT Vulnerability by DiabloD3 on Monday May 01, 2017 @09:53PM (#14243406)

I almost downvoted you until I realized you're you. It's seriously that?

[ Parent | on HN ]

Re:Intel's Remote AMT Vulnerability by desdiv on Monday May 01, 2017 @10:56PM (#14243619)

>Intel® Setup and Configuration Software (Intel® SCS) Deployment Guide [0]

>5. Select Unconfigure this system using admin password, enter the admin password (P@ssw0rd) and click the Next button.

I can just imagine the conversation that lead to this:

"Johnson! This password doesn't meet our corporate password policy of having digits and symbols."

"But... but this is the default password. It's publicly available and is not supposed to provide any security."

"I don't care what your excuse is. Change it right now.

[0] http://www.intel.com/content/www/us/en/software/scs-deployme...

[ Parent | on HN ]

Re:Intel's Remote AMT Vulnerability by Clownshoesms on Tuesday May 02, 2017 @05:05AM (#14245008)

Ah geez. Time to create a competent chip manufacturer. Anyone got a spare US sized military budget?

[ Parent | on HN ]

Re:Intel's Remote AMT Vulnerability by ethbro on Tuesday May 02, 2017 @09:11AM (#14246042)

To be fair, this thread wouldn't exist if it were absolutely trivial. ;)

[ Parent | on HN ]

Re:Intel's Remote AMT Vulnerability by vbernat on Tuesday May 02, 2017 @01:48AM (#14244213)

On mine, there is an option to permanently disable AMT in the BIOS. I have enabled it a long time ago. Is it enough?

[ Parent | on HN ]

Re:Intel's Remote AMT Vulnerability by ajdlinux on Tuesday May 02, 2017 @02:04AM (#14244272)

Also, you may need to go into BIOS/UEFI setup and enable an option along the lines of "Enable Intel ME Setup Hotkey" - at least this was needed on my Toshiba Tecra before I could use the Ctrl+P menu.

[ Parent | on HN ]

Re:Intel's Remote AMT Vulnerability by mtgx on Tuesday May 02, 2017 @03:37AM (#14244629)

I don't trust Lenovo anymore. Far too many shenanigans like these from them. It wouldn't surprise me if they do it on purpose for the Chinese government. Also, the last Lenovo I bought, kind of fell apart in 2 years, so there's that, too.

[ Parent | on HN ]

Re:Intel's Remote AMT Vulnerability by imglorp on Tuesday May 02, 2017 @09:29AM (#14246144)

Right, they've been caught several times now. How many didn't get publicized?

http://thehackernews.com/2015/08/lenovo-rootkit-malware.html

https://www.us-cert.gov/ncas/alerts/TA15-051A

etc.

[ Parent | on HN ]

Re:Intel's Remote AMT Vulnerability by posguy on Tuesday May 02, 2017 @05:32AM (#14245117)

What model? I've been buying used Thinkpads as of late (all Lenovo) and while I do see a slow quality down-ramp, even the newest are more robust than a similar Asus.

When it comes to x86-64, everything is back-doored, make no bones about it. If you want something less insecure, go get a T400 and libreboot it, or buy an SBC that can run with no blobs.

[ Parent | on HN ]

Re:Intel's Remote AMT Vulnerability by secretunicorn on Monday May 01, 2017 @09:26PM (#14243290)

You could try removing any batteries on your board and drain the remaining current to ground. It should reset all bios settings.

[ Parent | on HN ]

Re:Intel's Remote AMT Vulnerability by mjg59 on Monday May 01, 2017 @09:28PM (#14243299)

Firmware settings are usually in flash these days, so they'll persist even if there's no charge.

[ Parent | on HN ]