Re:Rediscovering the Intel AMT Vulnerability
by terom on Friday May 05, 2017 @02:06PM
(#14275504)
The article discusses an actual partial prefix match.
> we tested out a case in which only a portion of the correct response hash is sent to the AMT web server. To our surprise, authentication succeeded!
> Next, we reduced the response hash to one hex digit and authentication still worked.
This doesn't imply that "no password" - an empty password would still result in a non-empty HTTP Authorization Digest response hash, which would not allow you to login. An empty/truncated digest response hash is not the same thing as an empty/truncated password.
> we tested out a case in which only a portion of the correct response hash is sent to the AMT web server. To our surprise, authentication succeeded!
> Next, we reduced the response hash to one hex digit and authentication still worked.
This doesn't imply that "no password" - an empty password would still result in a non-empty HTTP Authorization Digest response hash, which would not allow you to login. An empty/truncated digest response hash is not the same thing as an empty/truncated password.