 | This articlecontainspromotional content. Please helpimprove it by removingpromotional language and inappropriateexternal links, and by adding encyclopedic text written from aneutral point of view.See ouradvice if the article is about you and read ourscam warning in case someone asks for money to edit this article.(March 2019) (Learn how and when to remove this message) |
Intel Active Management Technology (AMT) is hardware and firmware for remoteout-of-band management of select business computers,[1][2] running on theIntel Management Engine, a microprocessor subsystem not exposed to the user, intended for monitoring, maintenance, updating, and repairing systems.[1]Out-of-band (OOB) or hardware-based management is different from software-based (or in-band) management and software management agents.[1]
Hardware-based management works at a different level from software applications and uses a communication channel (through theTCP/IP stack) that is different from software-based communication (which is through the software stack in theoperating system). Hardware-based management does not depend on the presence of an OS or a locally installed management agent. Hardware-based management has been available on Intel/AMD-based computers in the past, but it has largely been limited to auto-configuration usingDHCP orBOOTP for dynamic IP address allocation anddiskless workstations, as well aswake-on-LAN (WOL) for remotely powering on systems.[3] AMT is not intended to be used by itself; it is intended to be used alongside a software management application.[1] It gives a management application (and thus, thesystem administrator who uses it) access to the PC down the wire, to remotely do tasks that are difficult or sometimes impossible when working on a PC that does not have remote functionalities built into it.[1][4][5]
AMT is designed into a service processor located on the motherboard and usesTLS-secured communication and strongencryption to provide additional security.[6] AMT is built into PCs withIntel vPro technology and is based on theIntel Management Engine (ME).[6] AMT has moved towards increasing support forDMTFDesktop and mobile Architecture for System Hardware (DASH) standards and AMT Release 5.1 and later releases are an implementation of DASH version 1.0/1.1 standards for out-of-band management.[7] AMT provides similar functionality toIPMI, although AMT is designed for client computing systems as compared with the typically server-based IPMI.
Currently, AMT is available in desktops, servers, ultrabooks, tablets, and laptops with Intel CorevPro processor family, including Intel Core i5, Core i7, Core i9, and Intel Xeon E3-1000, Xeon E, Xeon W-1000 product family.[1][8][9] AMT also requires an Intel networking card and the corporate version of the Intel Management Engine binary.[10]
Intel confirmed a Remote Elevation of Privilege bug (CVE-2017-5689, SA-00075) in its Management Technology on May 1, 2017.[11] Every Intel platform with either Intel Standard Manageability, Active Management Technology, or Small Business Technology, fromNehalem in 2008 toKaby Lake in 2017 has a remotely exploitable security hole in the ME.[12][13] Some manufacturers, likePurism[14] andSystem76[15] are already selling hardware with Intel Management Engine disabled to prevent the remote exploit. Additional major security flaws in the ME affecting a very large number of computers incorporating Management Engine,Trusted Execution Engine, andServer Platform Services firmware, fromSkylake in 2015 toCoffee Lake in 2017, were confirmed by Intel on November 20, 2017 (SA-00086).
Although iAMT may be included for free in devices sold to the public and to small businesses, the full capabilities of iAMT, including encrypted remote access via apublic key certificate and automatic remote device provisioning of unconfigured iAMT clients, are not accessible for free to the general public or to the direct owners of iAMT equipped devices. iAMT cannot be fully utilized to its maximum potential without purchasing additional software or management services from Intel or a3rd partyindependent software vendor (ISV) orvalue added reseller (VAR).
Intel itself provides adeveloper's toolkit software package that allows basic access to iAMT, but is not intended to be normally used to access the technology.[16] Only basic modes of access are supported, without full access to the encrypted communications of the complete purchased management system.[17]
Intel AMT includes hardware-based remote management, security, power management, and remote configuration features that enable independent remote access to AMT-enabled PCs.[5] Intel AMT is security and management technology that is built into PCs withIntel vPro technology.[1]
Intel AMT uses a hardware-basedout-of-band (OOB) communication channel[1] that operates regardless of the presence of a working operating system. The communication channel is independent of the PC's power state, the presence of a management agent, and the state of many hardware components such ashard disk drives andmemory.
Most AMT features are available OOB, regardless of PC power state.[1] Other features require the PC to be powered up (such as console redirection viaserial over LAN (SOL), agent presence checking, and network traffic filtering).[1] Intel AMT has remote power-up capability.
Hardware-based features can be combined with scripting to automate maintenance and service.[1]
Hardware-based AMT features on laptop and desktop PCs include:
Laptops with AMT also include wireless technologies:
Software updates provide upgrades to the next minor version of Intel AMT. New major releases of Intel AMT are built into a newchipset, and are updated through new hardware.[6]
Almost all AMT features are available even if the PC is in a powered-off state but with its power cord attached, if the operating system has crashed, if the software agent is missing, or if hardware (such as a hard drive or memory) has failed.[1][6] The console-redirection feature (SOL), agent presence checking, and network traffic filters are available after the PC is powered up.[1][6]
Intel AMT supports these management tasks:
From major version 6, Intel AMT embeds a proprietaryVNC server, for out-of-band access using dedicated VNC-compatible viewer technology, and have full KVM (keyboard, video, mouse) capability throughout the power cycle – including uninterrupted control of the desktop when an operating system loads. Clients such as VNC Viewer Plus fromRealVNC also provide additional functionality that might make it easier to perform (and watch) certain Intel AMT operations, such as powering the computer off and on, configuring the BIOS, and mounting a remote image (IDER).
AMT supportscertificate-based orPSK-based remote provisioning (full remote deployment),USBkey-based provisioning ("one-touch" provisioning), manual provisioning[1] and provisioning using an agent on the local host ("Host Based Provisioning"). An OEM can also pre-provision AMT.[19]
The current version of AMT supports remote deployment on both laptop and desktop PCs. (Remote deployment was one of the key features missing from earlier versions of AMT and which delayed acceptance of AMT in the market.)[5] Remote deployment, until recently, was only possible within a corporate network.[22] Remote deployment lets a sys-admin deploy PCs without "touching" the systems physically.[1] It also allows a sys-admin to delay deployments and put PCs into use for a period of time before making AMT features available to the IT console.[23] As delivery and deployment models evolve, AMT can now be deployed over the Internet, using both "Zero-Touch" and Host-Based methods.[24]
PCs can be sold with AMT enabled or disabled. TheOEM determines whether to ship AMT with the capabilities ready for setup (enabled) or disabled. The setup and configuration process may vary depending on the OEM build.[19]
AMT includes a Privacy Icon application, called IMSS,[25] that notifies the system's user if AMT is enabled. It is up to the OEM to decide whether they want to display the icon or not.
AMT supports different methods for disabling the management and security technology, as well as different methods for reenabling the technology.[1][23][26][27]
AMT can be partially unprovisioned using the Configuration Settings, or fully unprovisioned by erasing all configuration settings, security credentials, and operational and networking settings.[28] A partial unprovisioning leaves the PC in the setup state. In this state, the PC can self-initiate its automated, remote configuration process. A full unprovisioning erases the configuration profile as well as the security credentials and operational / networking settings required to communicate with the Intel Management Engine. A full unprovisioning returns Intel AMT to its factory default state.
Once AMT is disabled, to enable AMT again, an authorized sys-admin can reestablish the security credentials required to perform remote configuration by either:
There is a way to totally reset AMT and return to factory defaults. This can be done in two ways:
Setup and integration of AMT is supported by a setup and configuration service (for automated setup), an AMT Webserver tool (included with Intel AMT), and AMT Commander, an unsupported and free, proprietary application available from the Intel website.
All access to the Intel AMT features is through the Intel Management Engine in the PC's hardware and firmware.[1] AMT communication depends on the state of the Management Engine, not the state of the PC's OS.
As part of the Intel Management Engine, the AMT OOB communication channel is based on theTCP/IPfirmware stack designed into system hardware.[1] Because it is based on the TCP/IP stack, remote communication with AMT occurs via the network data path before communication is passed to the OS.
Intel AMT supports wired andwireless networks.[1][8][20][29] For wireless notebooks on battery power, OOB communication is available when the system is awake and connected to the corporate network, even if the OS is down. OOB communication is also available for wireless or wired notebooks connected to the corporate network over a host OS-basedvirtual private network (VPN) when notebooks are awake and working properly.
AMT version 4.0 and higher can establish a secure communication tunnel between a wired PC and an IT console outside the corporate firewall.[1][30] In this scheme, a management presence server (Intel calls this a "vPro-enabled gateway") authenticates the PC, opens a secure TLS tunnel between the IT console and the PC, and mediates communication.[1][31] The scheme is intended to help the user or PC itself request maintenance or service when at satellite offices or similar places where there is no on-siteproxy server or management appliance.
Technology that secures communications outside a corporatefirewall is relatively new. It also requires that aninfrastructure be in place, including support from IT consoles and firewalls.
An AMT PC stores system configuration information in protected memory. For PCs version 4.0 and higher, this information can include the name(s) of appropriate "whitelist" management servers for the company. When a user tries to initiate a remote session between the wired PC and a company server from an openLAN, AMT sends the stored information to a management presence server (MPS) in the "demilitarized zone" ("DMZ") that exists between the corporate firewall and client (the user PC's) firewalls. The MPS uses that information to helpauthenticate the PC. The MPS then mediates communication between the laptop and the company's management servers.[1]
Because communication is authenticated, a secure communication tunnel can then be opened usingTLS encryption. Once secure communications are established between the IT console and Intel AMT on the user's PC, a sys-admin can use the typical AMT features to remotely diagnose, repair, maintain, or update the PC.[1]
The Management Engine (ME) is an isolated and protected coprocessor, embedded as a non-optional[32] part in all current (as of 2015[update]) Intel chipsets.[33]
Starting with ME 11, it is based on an Intel 486 32-bit processor,[34] presumablyIntel Quark, and runs a derivative of theMINIX 3 operating system. The ME state is stored in a partition of theSPI flash, using a proprietary file system that is named MFS in the ME FPT (Firmware Partition Table).[35] Previous versions were based on anARC core, with the Management Engine running theThreadXRTOS fromExpress Logic, storing state in another proprietary file system named EFFS in the FPT, but also having the magic MFS in it. Versions 1.x to 5.x of the ME used the ARCTangent-A4 (32-bit only instructions) whereas versions 6.x to 8.x used the newer ARCompact (mixed 32- and 16-bitinstruction set architecture). Starting with ME 7.1, the ARC processor could also execute signedJava applets.
The ME shares the same network interface and IP as the host system. Traffic is routed based on packets to ports 16992–16995. Support exists in various Intel Ethernet controllers, exported and made configurable viaManagement Component Transport Protocol (MCTP).[36][37] The ME also communicates with the host via PCI interface.[35] Under Linux, communication between the host and the ME is done via/dev/mei[33] or more recently[38]/dev/mei0.[39]
Until the release ofNehalem processors, the ME was usually embedded into the motherboard'snorthbridge, following theMemory Controller Hub (MCH) layout.[40] With the newer Intel architectures (Intel 5 Series onwards), ME is included into thePlatform Controller Hub (PCH).[41][42]
Because AMT allows access to the PC below the OS level, security for the AMT features is a key concern.
Security for communications between Intel AMT and the provisioning service and/or management console can be established in different ways depending on the network environment. Security can be established via certificates and keys (TLS public key infrastructure, or TLS-PKI), pre-shared keys (TLS-PSK), or administrator password.[1][6]
Security technologies that protect access to the AMT features are built into the hardware and firmware. As with other hardware-based features of AMT, the security technologies are active even if the PC is powered off, the OS is crashed, software agents are missing, or hardware (such as a hard drive or memory) has failed.[1][6][43]
Because the software that implements AMT exists outside of the operating system, it is not kept up-to-date by the operating system's normal update mechanism. Security defects in the AMT software can therefore be particularly severe, as they will remain long after they have been discovered and become known to potential attackers.
On May 15, 2017, Intel announced a critical vulnerability in AMT. According to the update "The vulnerability could enable a network attacker to remotely gain access to business PCs or devices that use these technologies".[44] Intel announced partial availability of a firmware update to patch the vulnerability for some of the affected devices.
While some protocols for in-band remote management use a secured network communication channel (for exampleSecure Shell), some other protocols are not secured. Thus some businesses have had to choose between having asecure network or allowing IT to useremote management applications without secure communications to maintain and service PCs.[1]
Modern security technologies and hardware designs allow remote management even in more secure environments. For example, Intel AMT supportsIEEE 802.1x,Preboot Execution Environment (PXE),Cisco Self-Defending Network, andMicrosoftNAP.[1]
All AMT features are available in a secure network environment. With Intel AMT in the secure network environment:
Intel AMT can embed network security credentials in the hardware, via the Intel AMT EmbeddedTrust Agent and an AMT postureplug-in.[1][6] The plug-in collects security posture information, such asfirmware configuration and security parameters from third-party software (such asantivirus software andantispyware),BIOS, and protectedmemory. The plug-in and trust agent can store the security profile(s) in AMT's protected, nonvolatile memory, which is not on thehard disk drive.
Because AMT has an out-of-band communication channel, AMT can present the PC's security posture to the network even if the PC's OS or security software is compromised. Since AMT presents the posture out-of-band, the network can alsoauthenticate the PC out-of-band, before the OS or applications load and before they try to access the network. If the security posture is not correct, a system administrator can push an update OOB (via Intel AMT) or reinstall critical security software before letting the PC access the network.
Support for different security postures depends on theAMT release:
AMT includes several security schemes, technologies, and methodologies to secure access to the AMT features duringdeployment and during remote management.[1][6][43] AMT security technologies and methodologies include:
As with other aspects of Intel AMT, the security technologies and methodologies are built into the chipset.
Aring −3 rootkit was demonstrated by Invisible Things Lab for the Q35 chipset; it does not work for the later Q45 chipset, as Intel implemented additional protections.[47] The exploit worked by remapping the normally protected memory region (top 16 MB of RAM) reserved for the ME. The ME rootkit could be installed regardless of whether the AMT is present or enabled on the system, as the chipset always contains the ARC ME coprocessor. (The "−3" designation was chosen because the ME coprocessor works even when the system is in theS3 state, thus it was considered a layer below theSystem Management Mode rootkits.[40]) For the vulnerable Q35 chipset, akeystroke logger ME-based rootkit was demonstrated by Patrick Stewin.[48][49]
Another security evaluation by Vassilios Ververis showed serious weaknesses in the GM45 chipset implementation. In particular, it criticized AMT for transmitting unencrypted passwords in the SMB provisioning mode when the IDE redirection and Serial over LAN features are used. It also found that the "zero touch" provisioning mode (ZTC) is still enabled even when the AMT appears to be disabled in BIOS. For about 60 euros, Ververis purchased fromGo Daddy a certificate that is accepted by the ME firmware and allows remote"zero touch" provisioning of (possibly unsuspecting) machines, which broadcast their HELLO packets to would-be configuration servers.[50]
In May 2017, Intel confirmed that many computers with AMT have had an unpatched critical privilege-escalation vulnerability (CVE-2017-5689).[13][51][11][52][53] The vulnerability, which was nicknamed "Silent Bob is Silent" by the researchers who had reported it to Intel,[54] affects numerous laptops, desktops and servers sold byDell,Fujitsu,Hewlett-Packard (laterHewlett Packard Enterprise andHP Inc.), Intel,Lenovo, and possibly others.[54][55][56][57][58][59][60] Those researchers claimed that the bug affects systems made in 2010 or later.[61] Other reports claimed that the bug also affects systems made as long ago as 2008.[12][13] The vulnerability was described as giving remote attackers:
full control of affected machines, including the ability to read and modify everything. It can be used to install persistent malware (possibly in firmware), and read and modify any data.
— Tatu Ylönen,ssh.com[54]
The remote user authorization process included a programmer error: it compared the user-given authorization token hash (user_response) to the true value of the hash (computed_response) using this code:
strncmp(computed_response,user_response,response_length)
The vulnerability was thatresponse_length was the length of the user-given token and not of the true token.
Since the third argument forstrncmp is the length of the two strings to be compared, if it is less than the length ofcomputed_response, only a part of the string will be tested for equality. Specifically, ifuser_response is the empty string (with length 0), this "comparison" will always return true, and thus validate the user. This allowed any person to simply log into theadmin account on the devices by editing their sent HTTP packet to use the empty string as theresponse field's value.
In June 2017, thePLATINUM cybercrime group became notable for exploiting theserial over LAN (SOL) capabilities of AMT to perform data exfiltration of stolen documents.[62][63][64][65][66][67][68][69]
In November 2017 serious flaws were detected in the Management Engine (ME) firmware by security firm Positive Technologies, who claimed to have developed a workingexploit of this system for someone having physical access to a USB port.[70] On November 20, 2017, Intel confirmed that a number of serious flaws had been found in the Management Engine, Trusted Execution Engine, Server Platform Services and released a "critical firmware update".[71][72]
PCs with AMT typically provide an option in the BIOS menu to switch off AMT, though OEMs implement BIOS features differently,[73] and therefore the BIOS is not a reliable method to switch off AMT. Intel-based PCs that shipped without AMT are not supposed to be able to have AMT installed later. However, as long as the PC's hardware is potentially capable of running the AMT, it is unclear how effective these protections are.[74][75][76] Presently, there are mitigation guides[77] and tools[78] to disable AMT on Windows, but Linux has only received a tool to check whether AMT is enabled and provisioned on Linux systems.[79] The only way to actually fix this vulnerability is to install a firmware update. Intel has made a list of updates available.[80] Unlike AMT, there is no official, documented way to disable theIntel Management Engine (ME); it is always on, unless it is not enabled at all by the OEM.[81][82]
In 2015, a small number of competing vendors began to offer Intel-based PCs designed or modified specifically to address potential AMT vulnerabilities and related concerns.[83][84][85][86][10][87][88]
{{cite web}}: CS1 maint: archived copy as title (link){{cite web}}: CS1 maint: archived copy as title (link){{cite web}}:|archive-url= is malformed: timestamp (help)CS1 maint: url-status (link)(Intel developer's blog){{cite web}}: CS1 maint: archived copy as title (link){{cite web}}: CS1 maint: archived copy as title (link){{cite web}}:|archive-url= is malformed: timestamp (help)CS1 maint: url-status (link)