Hello, welcome to the Monday, May 8, 2017 edition of the Sansanet Storm Center's Stormcast. My name is Johannes Ulrich,

and today I'm recording from Jacksonville, Florida. Tenable released a blog post with details regarding

Intel's AMT vulnerability that caused a lot of press and a lot of concerns last week.

And well, what Tenable did discover actually is pretty severe.

Turns out that AMT uses Digest Authication to authenticate clients.

Now, Digest authentication has problems, but in itself,

it's reasonably solid. But Intel implemented the algorithm badly. When a user submits a password hash,

then Intel does only compare as many digits of the hash as the user submitted.

So if the user submits a null-size hash or no hash at all, then nothing is compared and the user is automatically logged in.

So all the user has to do is submit a username without a password and the user is automatically

logged in.

So a regular browser will not really allow you to exploit this, but it would be trivial to set

up a little proxy that deletes the hash or to set up a custom little Python script that will log you in and then execute whatever command you need to execute within the AMT user interface.

Another important point that's made here in Tenables block is the test system. They used as standard Dell computer. It did come with AMT, but it had to be

enabled first. And that's quite typical. You first have to enable the feature to be vulnerable.

It's typically not a vulnerable out of the box. But again, this may depend on the vendor and on the specific system that you're

looking at. So given that there is now a working exploit out there, definitely get patching,

and it will take you some while to really find all this system and patch them all, in particular

if it requires BIOS updates, disable the feature if you can,

and at the very least disable incoming traffic on your firewall. And researchers at the

Technical University of Braunschweig in Germany did some interesting work looking at actual

implementations of ultrasonic side channels.

...