Intel Amt Vnc Port Update Intel Provides

Kane Commercial Client Product Group, AMD Agenda Overview: Out-of-Band Client Management Standards-Based Client Management DASH: Key.

HP s own IPMI implementation Dell Remote Access Controller, DRAC.

Optional interface card Sun System Service Processor, SSP And more.

DMTF(will speak about it latter) csk (LaCon) Intel AMTME September 21st-22nd, 36.

Additionally we discuss tricks we used for reverse engineering the AMT code, that were needed in order to create meaningful rootkits that can have access to the host memory Vassilios Ververis s thesis - SECT research at Berlin s TU At the Black Hat conference in USA, Alexander Tereshkin and Rafal Wojtczuk presented a ring -3 rootkit10.

They describe ring -3 rootkit as a backdoor that abuses the Intel AMT technology and could potentially bypass the dedicated memory protection of AMT and compromise the AMT code executed on the chipset.

You will be involved in probing for vulnerabilities and possible attacks.

High risk because you might not find any vulnerability worth exploiting; high reward because, if you do a great job, you might end up as coauthor on our paper.

Intel only comformed to default rfc2617 (10y old) Offline bruteforce attack is possible (JtR s HDAA-MD5) csk (LaCon) Intel AMTME September 21st-22nd, 36.

This is a less secure option.

RFB 3.8 4.0) Passively You always can wait for AMT HELLO packets csk (LaCon) Intel AMTME September 21st-22nd, 36.

Not shown: f i l t e r e d p o r t s PORT STATE SERVICE 135 t c p open msrpc 139 tcp open n e t b i o s s s n 443 tcp open h t t p s 445 tcp open m i c r o s o f t ds 623 tcp open oob ws h t t p 902 tcp open i s s r e a l s e c u r e 912 t c p open apex mesh 5357 tcp open wsdapi 16992 tcp open amt soap h t t p 16994 t c p open unknown MAC Address: 0 0: 1 F: 1 6: 0 C: 4 6: 1 C ( Wistron ) csk (LaCon) Intel AMTME September 21st-22nd, 36.

Not shown: f i l t e r e d p o r t s PORT STATE SERVICE 135 t c p open msrpc 139 tcp open n e t b i o s s s n 443 tcp open h t t p s 445 tcp open m i c r o s o f t ds 623 tcp c l o s e d oob ws h t t p 664 tcp open s e c u r e aux bus 902 tcp open i s s r e a l s e c u r e 912 t c p open apex mesh 5357 tcp open wsdapi 16993 tcp open amt soap h t t p s MAC Address: 0 0: 1 F: 1 6: 0 C: 4 6: 1 C ( Wistron ) csk (LaCon) Intel AMTME September 21st-22nd, 36.

DMTF DMTF, Distributed Management Task Force, is a not-for-profit association of industry members dedicated to promoting enterprise and systems management and interoperability.

RMCP as in Remote Management and Control Protocol The Desktop and Mobile Architecture for System Hardware, DASH, implementation requirements (DSP 0232) specifies that a DASH-compliant platform should respond to a Remote Management and Control Protocol (RMCP) ping with an indication that the platform supports DASH.

The ping message format and response are defined in the Alert Standard Format (ASF) Specification.

Starting with Release 4.0, Intel AMT responds to an RMCP ping.

ARC developed synthesisable IP and licensed it to semiconductor companies.

The configurability of the ARC happens at design time (as opposed to run time) using the ARChitect processor configurator.

Intel Amt Vnc Port Update Intel Provides

Intel boards DQ35JO or DQ45CBEK csk (LaCon) Intel AMTME September 21st-22nd, 36 32 Bonus Hardware - POS Thanks again Vassilios csk (LaCon) Intel AMTME September 21st-22nd, 36 33 Something scary from Intel s doc Firmware update Intel provides an interface for updating the Intel Management Engine (ME) firmware.

The Firmware Update interface is used only by OEMs via Intel-supplied tools and is not intended for use in ISV applications.

This feature was removed from Intel AMT starting with Release 7.0.

The Firmware Update realm is deprecated in Release 7.0 and will be removed in a future release.

Document Date: January 17, 2007 Protected by one or more of the following U.S.

Out-of-Band Management with DMTF DASH.

Valerie K. Kane Commercial Client Product Group, AMD.