mirror of
https://git.sr.ht/~seirdy/seirdy.one
synced 2024-11-10 00:12:09 +00:00
New note: Intel ME rootkits
This commit is contained in:
parent
9d91c5ac21
commit
e0b829a543
1 changed files with 13 additions and 0 deletions
13
content/notes/intel-me-rootkits.md
Normal file
13
content/notes/intel-me-rootkits.md
Normal file
|
@ -0,0 +1,13 @@
|
|||
---
|
||||
title: "Intel ME rootkits"
|
||||
date: 2022-10-19T13:20:19-07:00
|
||||
replyURI: "https://mastodon.social/@byterhymer/109181969125151465"
|
||||
replyTitle: "Don't forget there have already been Intel ME rootkits too"
|
||||
replyType: "SocialMediaPosting"
|
||||
replyAuthor: "@byterhymer@mastodon.social"
|
||||
replyAuthorURI: "https://mastodon.social/@byterhymer/109181969125151465"
|
||||
---
|
||||
I know of two Intel <abbr title="Management Engine">ME</abbr> rootkits that didn't involve Intel <abbr title="Active Management Technology">AMT</abbr>; the latter can be enabled/disabled on "<span translate="no">vPro</span>" chips. One rootkit was from 2009 and seems less relevant now; the more recent of the two was by <span class="h-cite" itemprop="mentions" itemscope="" itemtype="https://schema.org/PresentationDigitalDocument">{{<indieweb-person itemprop="author" first-name="Mark" last-name="Ermolov" url="https://www.blackhat.com/eu-17/speakers/Mark-Ermolov.html">}} and {{<indieweb-person itemprop="author" first-name="Maxim" last-name="Goryachy" url="https://www.blackhat.com/eu-17/speakers/Maxim-Goryachy.html">}} at Black Hat Europe 2017: {{<cited-work url="https://www.blackhat.com/docs/eu-17/materials/eu-17-Goryachy-How-To-Hack-A-Turned-Off-Computer-Or-Running-Unsigned-Code-In-Intel-Management-Engine-wp.pdf" name="How to Hack a Turned-Off Computer, or Running Unsigned Code in Intel Management Engine" extraName="headline">}}</span>.
|
||||
|
||||
Without <abbr>AMT</abbr>, they required physical access. Most PCs are woefully unprepared against the sorts of attacks enabled by physical access, and <abbr>ME</abbr> is only one entry in a long list of issues.
|
||||
|
Loading…
Reference in a new issue