Re:The hijacking flaw that lurked in Intel chips is worse th...
by theophrastus on Sunday May 07, 2017 @12:58PM
(#14286306)
"Having AMT on isn't that unusual either. It's not the default"
AMT is on by default in at least a number of the popular thinkpad series[1] (i'm the only owner of a relatively old thinkpad, and only because of this security alert i checked and it was on; never haven't turned it on myself)
[1] https://forums.lenovo.com/t5/Security-Malware/Intel-AMT-back...
I don't think so. There's a second bug that allows local non-privileged users to provision AMT.
And, once it's up and running, you have a full remote KVM where you can boot recovery disks, edit the local files then reboot, etc.
Having AMT on isn't that unusual either. It's not the default, but lots of people use it. I know some digital signage units using NUCS have it on, for example. Also, some large company data centers use it instead of IPMI. The ports aren't exposed to the internet, but if hackers get inside a different way, they are off to the races.