Jump to content

Free Rootkit with Every New Intel Machine


Recommended Posts

Free Rootkit with Every New Intel Machine

Peter Gutmann

Sat, 09 Jun 2007 07:25:46 -0700

(Forwarded with permission from a NZ security mailing list, some portions


-- Snip --

[...] a register article saying Intel released its new platform Centrino Pro

which includes Intel Active Management 2.5. An article with some more info is



It got me interested, so I started taking a look around. Intel has some good

info here:


And for all of you in the Web 2.0 generation with short attention spans for

reading the doc, here is video that explains it all, I found myself getting

more and more concerned the further it went:


Essentially, all new Intel machines (and a number of current Intel servers)

come with free hardware rootkit functionality, which is operational and

accessible when the machine is powered off, and in the case of laptops, even

when they are unplugged and powered off.

There is the mention of code signing, TLS and PKI magic to allay your security

concerns however...

There are a few new things with this that go beyond generic remote IP KVM:

- NIC based TCP/IP filters configurable remotely

- Handy magic bypass for TCP/IP filters [1]

- Remote BIOS updates over the network

- Remote IDE redirection, as in boot off CDROM over the network

- Persistent storage even if you change hard disks

- It doesn't appear to have a method for disabling it (well, I can't find

  anything about it, seems crazy if there isn't)

- Built-in, on chip. I can understand a decent size company wanting IP-KVM.

  But I don't want my personal laptop with IP-KVM.

- Authentication can be done on Kerberos. We're talking AD.

- Built in web interface on every machine (port 16994)

- handy well documented SDK for building whatever you need to interact with


- ...

This is clearly an awesome management tool. Being able to update your

antivirus while your machine is disconnected from the network is helpful.

Being able to id all your assets even though they are powered off is great. My

concerns are around doomsday scenarios like the below:

Worm is released that gets a domain admin account, worm sets up floppy booting

across the network, floppy is boot-and-nuke [2]. Worm reboots every server in

the company and securely wipes them with single pass. Worm then updates bios

on every machine to broken state, enables TCP/IP filters to prevent the NIC

from being used to talk to the OS ever again, then disables the AMT.

Note, this is OS agnostic, will take out your OSX, Windows and Linux boxen.

The hardware would probably be rendered useless, barring opening up the box

and flipping some jumpers or replacing something. A smart user noticing the

reboot and noticing the disk was being wiped (assuming you didn't change dban

to say "now making your computer faster by optimizing the cache flux

capacitor") would have to unplug power and network to stop it, which is harder

if you're a laptop user with wireless.

</end is nigh rant>

While parts of this are possible now, its just not nearly as powerful or


[1] TCP-over-Serial-over-LAN


[2] http://dban.sourceforge.net/

-- Snip --

Link to comment
Share on other sites

Not sure if only I had to do this, but the correct video didn't pop up when I clicked that link.

I had to click on the "Managability tab below the video, and from there select the "Active Management Technology Allows for Remote Management of Mobile Systems" video.

But yeah, no way I'm letting that reside on my systems.

Link to comment
Share on other sites

I'd call that a shoddy workaround at best.

An actual solution would be a jumper on the MoBo that allows you to turn this (bull)shit off in the hardware.

Link to comment
Share on other sites

It sounds like you're referring to an implementation of DMTFs DASH standard.  The DASH framework is designed to assist admins with managing desktops and mobile pcs.  Supported by Microsoft, Novell, Symantec, IBM, Nvidia, AMD and the usually big names, including Intel, the new standard has two management layers.  The MAP (Manageability Access Protocol) and CIM (Common Information Model).  CIMOM will provide authorization and authentication for the model. It will allow management of computers as well as data gathering while the pcs are turned off. 

--  Lifted from Network Computing Magazine.  Found the online article here


Link to comment
Share on other sites

  • 1 year later...

and i though phoenix technologies was bad for putting failsafe in its bios.


Link to comment
Share on other sites

I'm sorry, but doesn't anyone else have a problem with the fact that the described attack vector is dependent on a boot'n'nuke floppy being in the probably non-existent floppy drive? Or am I missing something?

Its quite interesting and all, but it looses a little credibility when the doomsday scenario includes floppy disks.

Link to comment
Share on other sites

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.

Reply to this topic...

×   Pasted as rich text.   Paste as plain text instead

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.

  • Recently Browsing   0 members

    • No registered users viewing this page.
  • Create New...