Malware uses Intel AMT feature to steal data, avoid firewalls
Microsoft's security team has come across a malware family that uses Intel's Active Management Technology (AMT) Serial-over-LAN (SOL) interface as a file transfer tool.
Because of the way the Intel AMT SOL technology works, SOL traffic bypasses the local computer's networking stack, so local firewalls or security products won't be able to detect or block the malware while it's exfiltrating data from infected hosts.
and . . .
Intel AMT SOL exposes hidden networking interface
This is because Intel AMT SOL is part of the Intel ME (Management Engine), a separate processor embedded with Intel CPUs, which runs its own operating system.
Intel ME runs even when the main processor is powered off, and while this feature looks pretty shady, Intel built ME to provide remote administration capabilities to companies that manage large networks of thousands of computers.
I always believed the Intel Management Engine was a bad idea and a huge target for sophisticated hackers. Your hardware. Pre-compromised from the factory. A processor baked into your microprocessor with full access to the hardware. It runs a secret binary blob -- and the primary microprocessor won't run without it.
This probably isn't the last time that this will be exploited. Probably not even be the first, given the difficulty to detect it. The wonderful thing is that your OS isn't aware of the compromise and is unable to interfere with it.
(Score: 2) by tangomargarine on Friday June 09 2017, @07:16PM (2 children)
Where is that power coming from, the cell battery? Or there's some backup battery wired into the AMT chip?
"Is that really true?" "I just spent the last hour telling you to think for yourself! Didn't you hear anything I said?"
(Score: 2) by tangomargarine on Friday June 09 2017, @07:20PM
Oh, you weren't replying to me. Whoops.
"Is that really true?" "I just spent the last hour telling you to think for yourself! Didn't you hear anything I said?"
(Score: 2) by kaszz on Friday June 09 2017, @08:29PM
Here's the answer anyway:
The power supply (ATX) have a main power conversion part that is switched on or off depending on the visible power button and LED. Then there's a separate power conversion with 5 watt capacity that is always on until it's physically unplugged. Some have a real switch on the back of the supply itself that does the same.