Skip to main content

Intel AMT firmware suffers security flaw even when machines are off

8th gen intel core launch
Image used with permission by copyright holder
Another security vulnerability has been revealed that poses a significant risk for a number of PCs running Intel chipsets or processors. This one’s a bit different — and potentially more dangerous — than many other vulnerabilities in that it targets business-class systems in particular. It can also affect machines that aren’t even running.

The flaw, which exists in certain Intel chipset firmware versions utilized by some systems with vPro processors, affects the Active Management Technology, or AMT, feature. AMT lets administrators manage machines via remote connections, and the vulnerability allows attackers to bypass authentication and utilize the same capabilities, Ars Technica reports.

AMT is a part of the remote access features of some systems that allow remote access to a machine even when it’s shut down. As long as such a machine has power, it can by design be accessed with all the intended remote capabilities enabled.

Intel designed AMT to demand a password before allowing remote access via web browser. Unfortunately, the flaw allows attackers to bypass the AMT system’s usual authentication requirement. Tenable Network Security, which has created what it characterizes as the first Intel AMT vulnerability detection capability, describes the flaw as follows:

” … we reduced the response hash to one hex digit and authentication still worked. Continuing to dig, we used a NULL/empty response hash (response=”” in the HTTP Authorization header). Authentication still worked. We had discovered a complete bypass of the authentication scheme.”

As Ars Technica points out, the issue is made even worse by the AMT feature’s design, in which network traffic is passed through the Intel Management Engine and to the AMT, bypassing the operating system. That means that there’s no record of unauthorized access.

Intel indicated in a blog post that PC manufacturers should be releasing patches for affected systems within the week. It also posts a tool to locate and diagnose vulnerable systems. Fujitsu, HP, and Lenovo have provided information on their own affected systems. So far, the Shodan security search engine has located more than 8,500 machines that are vulnerable to attack.

Updated on 5-10-2017 by Mark Coppock: Clarified that the flaw exists in certain chipset firmware and not inherent in Intel vPro processors and removed the incorrect reference to any empty text field being able to bypass AMT authentication.

Editors' Recommendations

Mark Coppock
Mark has been a geek since MS-DOS gave way to Windows and the PalmPilot was a thing. He’s translated his love for…
Best OLED monitor deals: Get an OLED screen from just $450
Marvel's Spider-Man running on the Samsung Odyssey OLED G8.

Shopping some of the best monitor deals is a good way to save on some extra screen real estate, but if you’re looking for something that can produce a stunning image you should turn your shopping cart toward the OLED monitors. OLED is one of the best picture technologies currently available, and it can create a lifelike image that makes interacting with games, presentations, and creative work much more immersive. The best OLED monitors can run pretty expensive, but that’s what OLED monitor deals are for. If you’re looking for superior picture quality and some ways to save, read onward for more details on the best OLED monitor deals taking place right now.
ViewSonic 15.6-inch VX1655 4K OLED portable monitor — $450, was $500

Getting into the OLED game can be both affordable and portable with the ViewSonic VX1655. It’s a 4K OLED display that’s made to function as either a laptop extension or something to pair with a tablet. It comes in at a super sharp 4K resolution and a refresh rate of 60Hz. This isn’t something you’d want to pair with a gaming PC, but it’s a great little display to keep with you if you do creative work on the run or want some extra screen real estate while working on a tablet at your desk.

Read more
Best monitor deals: Gaming, office, curved, OLED and more
Dell UltraSharp 27 4K PremierColor Monitor

Whether you prefer to work at one of the best desktop computers, the best laptops, or anything in between, an external monitor can be helpful to add some extra screen real estate. One of the best monitors can even go a long way toward reducing eye strain and creating an immersive digital or gaming experience. While high end monitors can get quite expensive, there are always some impressive monitor deals to shop, and we’ve tracked them all down. Reading onward you’ll find what we feel are the best monitor deals, whether you’re shopping for 4K monitors, gaming monitors, ultrawide monitors, or more general monitors meant for all-purpose users.
Best monitor deals

The following deals represent a best-of of the deals below. They're selected to give a mixture of prices, styles, and levels of discount. If you don't see something you like, don't worry, as the following sections will have plenty more deals for you to choose from. However, this is a highly recommended place to start:

Read more
7 best Chromebooks for 2024: the best for every budget
Close up of the Chrome logo on the top of a Chromebook.

Chromebooks might have a hard time competing with Windows laptops and MacBooks, but that doesn't mean they don't have their place. We've reviewed hundreds of laptops over the years, testing for important qualities like performance, battery life, and display quality — and we've found that Chromebooks consistently excel at performance and reliability.

You can find Chromebooks from Google, HP, Lenovo, Acer, and many others, and we've dug through them to put together this roundup of the best Chromebooks on the market. They're incredibly accessible devices, and for the right person, a Chromebook can be the best laptop in terms of value.

Read more