It has been a rough week for Intel. Several media outlets are are reporting that researchers at F-Secure hav discovered a flaw in Intel's Active Management Technology (AMT) which is in most business laptops. AMT is the technology which is used by corporations to remotely manage their  deployed laptops.

The gist of the flaw is that if the AMT password has not been reset from default, then an attacker with physical access to the laptop could reboot the laptop, interrupt the boot process, and access the Intel Management Engine BIOS Extension (MEBx) using the default password. The attacker could then reconfigure the laptop for remote access.  Once enabled the attacker, if on the same wifi or physical network, could remotely access the laptop. Because the access is through AMT it would bypass all security features deployed on the laptop effectively granting unimpeded access to all aspects of the laptop.

This is not a flaw or vulnerability, but rather a provided feature which can be abused if corporations do not follow best practices for configuring AMT.   This "flaw" is not a concern for any company which has followed the best practices. I suggest that companies double check that they have reset their AMT password from default and review the best practices for configuring AMT, but other than that this is much ado about nothing.

There are some more details at the The Hacker News.

-- Rick Wanner MSISE - rwanner at isc dot sans dot edu - http://namedeplume.blogspot.com/ - Twitter:namedeplume (Protected)