Intel AMT 發現新漏洞，只要 30 秒駭客就可掌控你的電腦
屋漏偏逢連夜雨，2018 年對 Intel 可說流年不利，面對 CPU 的 Meltdown 和 Spectre 漏洞急於推出解決方案，現在又被資安人員發現 AMT 也有嚴重漏洞，攻擊者不用 30 秒就可以得逞，全球數百萬台商務筆記型電腦都有可能淪陷。
來自芬蘭的網路資訊安全公司 F-Secure 報告，Intel 主動管理技術（Active Management Technology，縮寫 AMT）中有不安全和誤導性的預設行為，允許駭客可在本地端繞過正規登入流程，在 30 秒內完全控制目標筆電，之後就可讓駭客在同一有線、無線網路對目標電腦做進行遠端監控甚至操控，縱使你有 BIOS 或 BitLocker 密碼及 TPM pin 碼保護也防不勝防。
AMT 是商用電腦的 Intel 晶片組功能，讓企業 IT 管理者能妥善管理廣大的設備，方便遠端管理、維修組織內的個人電腦、工作站、伺服器。
雖然過去資安研究人員也曾發現一些嚴重的 AMT 漏洞，但最近發現的漏洞破壞力特別大：
- 一行程式碼都不用打就可以用。
- 影響大多數使用 Intel CPU 的筆記型電腦。
- 可使攻擊者遠端控制受影響的系統以供日後使用。
F-Secure 高級安全研究員 Harry Sintonen 表示，其實他們 2017 年 7 月就發現這個問題，他說：「這個攻擊幾乎看似簡單，但有令人難以置信的破壞潛力。實際上，即使最嚴密的安全措施，也可讓攻擊者在本地端完全控制受害者工作用的筆記型電腦。」
邪惡女僕攻擊
以下是如何利用這個 AMT 漏洞攻擊的方法，目標是一台受密碼保護的電腦（系統登入密碼和 BIOS 密碼）：
- 為了觸發這個漏洞，攻擊者需要以物理操作方式對目標電腦開機或重開機。
- 在開機的啟動程序（booting process）中按 CTRL-P，進入 Intel 管理引擎 BIOS 延伸模組（Intel Management Engine BIOS Extension ，縮寫 MEBx）畫面，正如示範影片的動作。
- MEBx 的預設密碼是「admin」，大多數公司筆記型電腦很可能保持不變。
- 登錄後，攻擊者可更改預設密碼，並啟用遠程遙控。
- 關閉 AMT「User opt-in」。
這樣一來，受害者在電腦的任何操作，就永遠翻不出攻擊者的手掌心了。
這話怎麼說呢？因為在步驟四裡，AMT 密碼修改以後，使用者日後將永遠無法再掌控這台筆電 AMT 的行為，而且不可逆；步驟五的 User opt-in 是筆電使用者的一次性密碼，本來的設計是 IT 管理人員要啟動遠端遙控時，需要取得電腦使用者的同意──使用者需要用電話傳達這個一次性密碼，管理人員才能開通遠端遙控。
然而現在這個功能可被關掉（緣由是方便企業 IT 管理人員遠端維護），受害者將毫不知情被遠端監控，這也不是你重灌系統可解決，因為漏洞在比作業系統更底層的主機板晶片裡。
雖然如此，這不過就是另一個本地端漏洞嘛，又不是大家關注的網路資安漏洞，然而 Sintonen 進一步說明這個漏洞的危害嚴重度：「攻擊者辨識、確認好要攻擊的目標後，他們就可在機場、咖啡館、飯店大廳等公開場所進行『邪惡女僕』式攻擊。」
什麼是「邪惡女僕」（evil maid’ scenario）攻擊呢？ 基本上，就是諜報電影常出現的橋段──比如當目標人物下榻特定旅館時，情報員賄賂飯店的女服務生，趁目標人物離開飯店時進入房間，翻找對方的行李甚至破解對方的鎖來找到高價值的情報，然後趕在對方回來前恢復表面原狀，而目標人物渾然不知機密已外洩，抑或破壞就在眼皮底下發生。所謂的「邪惡女僕」，就是靠你不會起疑心的人來做案。
電影《慕尼黑》就上演過這種橋段，以色列情報員喬裝成不起眼的電信局人員，滲透進目標人物、一位阿拉伯學者家中幫忙「更換電話」，而被置換的電話裡藏有遙控炸彈，得以暗殺對方。
在公開場所，只需要兩名攻擊者就可以得逞：由一名攻擊者分散受害者的注意力，把對方帶離開電腦，另一名攻擊者只要短暫接觸受害者的筆記型電腦，不用超過 1 分鐘就可以開通 AMT 遠端遙控，此後你的電腦再也不是你的電腦，而是壞人監控你的利器，甚至是攻擊你公司 IT 設備網路的起點。
F-Secure 已透過美國電腦網路危機處理中心 CERT ，通知 Intel 和所有相關設備製造商這個安全問題，並迫切要求他們緊急處理。同時，F-Secure 也呼籲任何企業團體或組織使用者和 IT 管理員，應該把電腦 AMT 預設密碼更改為強密碼，或乾脆禁用 AMT，且不要讓自己的筆記型電腦或桌上電腦處於無人看管的情況。
當然如果你曾有如此印象：「只不過離開電腦一下，回來時電腦畫面跟離開前有點不一樣（可能被重開機了）」，那你應該要檢查一下 BIOS AMT 相關設定，也許你本來根本不知道自己電腦有 AMT 功能，也根本沒使用過，然而前述 AMT 預設密碼輸入卻無效，無法調整設定，那麼你該心裡有數快做必要處置了。
Intel® Management Engine Critical Firmware Update (Intel-SA-00086)
Intel® Management Engine (Intel® ME 6.x/7.x/8.x/9.x/10.x/11.x), Intel® Trusted Execution Engine (Intel® TXE 3.0), and Intel® Server Platform Services (Intel® SPS 4.0) vulnerability (Intel-SA-00086)
In response to issues identified by external researchers, Intel has performed an in-depth comprehensive security review of the following with the objective of enhancing firmware resilience:
- Intel® Management Engine (Intel® ME)
- Intel® Trusted Execution Engine (Intel® TXE)
- Intel® Server Platform Services (SPS)
Intel has identified security vulnerabilities that could potentially impact certain PCs, servers, and IoT platforms.
Systems using Intel ME Firmware versions 6.x-11.x, servers using SPS Firmware version 4.0, and systems using TXE version 3.0 are impacted. You may find these firmware versions on certain processors from the:
- 1st, 2nd, 3rd, 4th, 5th, 6th, 7th, and 8th generation Intel® Core™ Processor Families
- Intel® Xeon® Processor E3-1200 v5 and v6 Product Family
- Intel® Xeon® Processor Scalable Family
- Intel® Xeon® Processor W Family
- Intel Atom® C3000 Processor Family
- Apollo Lake Intel Atom® Processor E3900 series
- Apollo Lake Intel® Pentium® Processors
- Intel® Pentium® Processor G Series
- Intel® Celeron® G, N, and J series Processors
To determine if the identified vulnerabilities impact your system, download and run the Intel-SA-00086 Detection tool using the links below.
Frequently Asked Questions Section
Available resources
- Intel official security advisory: Technical details on the vulnerability
Resources for Microsoft and Linux* users
- Intel-SA-00086 Detection Tool
| Note | Versions of the INTEL-SA-00086 Detection Tool earlier than 1.0.0.146 did not check for CVE-2017-5711 and CVE-2017-5712. These CVEs only affect systems with Intel® Active Management Technology (Intel® AMT) version 8.x-10.x. Users of systems with Intel AMT 8.x-10.x are encouraged to install version 1.0.0.146, or later. Installing this version helps to verify the status of their system with regard to the INTEL-SA-00086 Security Advisory. You can check the version of the INTEL-SA-00086 Detection Tool by running the tool and looking for the version information in the output window. |
Resources from system/motherboard manufacturers
| Note | Links for other system/motherboard manufacturers will be provided when available. If your manufacturer is not listed, contact them for information on the availability of the necessary software update. |
- Acer: Support Information
- ASRock: Support Information
- ASUS: Support Information
- Compulab: Support Information
- Dell Client: Support Information
- Dell Server: Support Information
- Fujitsu: Support Information
- Getac: Support Information
- GIGABYTE: Support Information
- HP Inc.: Support Information
- HPE Servers: Support Information
- Intel® NUC, Intel® Compute Stick, and Intel® Compute Card: Support Information
- Intel® Servers: Support Information
- Lenovo: Support Information
- Microsoft Surface*: Support Information
- MSI: Support Information
- NEC: Support Information
- Oracle: Support Information
- Panasonic: Support Information
- Quanta/QCT: Support Information
- Supermicro: Support Information
- Toshiba: Support Information
- Vaio: Support Information
- Wiwynn: Support Information
Frequently asked questions:
Q: The Intel-SA-00086 Detection Tool reports that my system is vulnerable. What do I do?
A: Intel has provided system and motherboard manufacturers with the necessary firmware and software updates to resolve the vulnerabilities identified in Security Advisory Intel-SA-00086.
Contact your system or motherboard manufacturer regarding their plans for making the updates available to end users.
Some manufacturers have provided Intel with a direct link for their customers to obtain additional information and available software updates (Refer to the list below).
Q: Why do I need to contact my system or motherboard manufacturer? Why can’t Intel provide the necessary update for my system?
A: Intel is unable to provide a generic update due to management engine firmware customizations performed by system and motherboard manufacturers.
Q: My system is reported as may be Vulnerable by the Intel-SA-00086 Detection Tool. What do I do?
A: A status of may be Vulnerable is usually seen when either of the following drivers aren't installed:
- Intel® Management Engine Interface (Intel® MEI) driver
- Intel® Trusted Execution Engine Interface (Intel® TXEI) driver
Contact your system or motherboard manufacturer to obtain the correct drivers for your system.
Q: My system or motherboard manufacturer is not shown in your list. What do I do?
A: The list below shows links from system or motherboard manufacturers who have provided Intel with information. If your manufacturer is not shown, contact them using their standard support mechanisms (website, phone, email, and so on) for assistance.
Q: What types of access would an attacker need to exploit the identified vulnerabilities?
A: If the equipment manufacturer enables Intel-recommended Flash Descriptor write protections, an attacker needs physical access to platform’s firmware flash to exploit vulnerabilities identified in:
- CVE-2017-5705
- CVE-2017-5706
- CVE-2017-5707
- CVE-2017-5708
- CVE-2017-5709
- CVE-2017-5710
- CVE-2017-5711
The attacker gains physical access by manually updating the platform with a malicious firmware image through flash programmer physically connected to the platform’s flash memory. Flash Descriptor write-protection is a platform setting usually set at the end of manufacturing. Flash Descriptor write-protection protects settings on the Flash from being maliciously or unintentionally changed after manufacturing is completed.
If the equipment manufacturer doesn't enable Intel-recommended Flash Descriptor write protections, an attacker needs Operating kernel access (logical access, Operating System Ring 0). The attacker needs this access to exploit the identified vulnerabilities by applying a malicious firmware image to the platform through a malicious platform driver.
The vulnerability identified in CVE-2017-5712 is exploitable remotely over the network in conjunction with a valid administrative Intel® Management Engine credential. The vulnerability is not exploitable if a valid administrative credential is unavailable.
If you need further assistance, contact Intel Customer Support to submit an online service request.
