09.01.2020

Intel Amt Lms-sol Driver For Mac

Best Video Software for the Mac How To Run MacOS High Sierra or Another OS on Your Mac Best Graphic Design Software the Mac Stay Safe with Best Free Password Managers. Intel amt mei and sol driver for mac I try with another disk loaded with the original software from factory recovery, and all hardware work fine and configured. Port for WS-Management requests.

  1. Canon Printer Driver For Mac
  2. Hp Driver For Mac
  3. Intel Lms Driver

Abstract

There are several key differences one must consider when using Intel Active Management Technology (Intel® AMT) features on a virtualized client. Those differences, along with Intel’s recommendations, are discussed in this article. It is important to understand those differences in order to adjust the IT processes when managing virtualized clients with Intel Active Management Technology.
The discussion in this paper only applies to client virtualization solutions that support Intel AMT.

Fixes: - Provides a Microsoft Windows Hardware Quality Labs (WHQL) Certified driver. - Supports a configuration model that enables the end-user (IT shop) to simply connect the system to their enterprise environment for Intel AMT configuration. Intel® vPro™ Technology Solution Reference Design - Intel® vPro™ Platform Solution Manager Intel® vPro™ Platform Solution Manager (2.0.0.38) allows you to launch plugins on Intel® vPro™-based PCs that perform tasks such as power management, KVM Remote Control, system defense, and others. Free Download Dell Optiplex 755 Intel AMT SOL/LMS Driver (Other Drivers & Tools). You can look into Intel SDK ZTPLocalAgent sample to interact with local Intel AMT driver to get Intel AMT LAN information and use Winsock to get Host OS LAN information and post the information to Event log. Intel Commander allows you to see the event log. AMT will use the mac address called manageability mac which comes to play only in. Intel® Active Management Technology enables IT managers to discover, repair, and help protect networked computing assets. You save time with remote maintenance and wireless manageability, and simplify computer lifecycle transitions with secure drive wiping.

Introduction

Intel® Active Management Technology (Intel® AMT) provides the capability for IT departments to manage client systems even when the PCs are powered down. When the client is virtualized there are differences in the way the client is managed with Intel AMT. It is important to note that virtualization, in this case, is limited to virtualization on a physical system. This does not apply to desktop virtualization which runs on a server. Client virtualization is generally discussed as being either Type 1 or Type 2. This article does not discuss the merits of either solution, or the merits of using virtualization on a client system. The purpose of this article is to provide insight into using Intel AMT on clients that are virtualized. Since Intel AMT is only available on Intel vPro Technology platforms, it should also be noted that this paper only applies to Intel vPro Technology capable platforms.
It is assumed that the decision to virtualize the client PCs has already been made and therfore no attempt is made to discuss the merits of client virtualization. Instead, this article focuses on the expected behavior and Best Known Methods for managing PCs with client virtualization.
Type 1 virtualization-this method includes a hypervisor layer between the operating system of the virtual machine(s) and the hardware. The hypervisor either provides virtual devices to the virtual machines (VMs), or devices are passed through directly to the VMs. There are significant differences in the management capabilities and processes involved with Type 1 virtualization, and therefore this paper will focus primarily on Type1virtualization.
Type 2 virtualization-this method does not utilize a hypervisor. There is a host operating system layer directly on the hardware. VMs are created as files and run on top of the host OS. Since there are few differences in manageability with Type 2 virtualization we will only touch on this briefly.


Figure 1. Comparison of an OS hosted platform (Type 2 on the left) and a Hypervisor (Type 1 shown on the right) which runs directly on the device hardware.
Type 1 Virtualization
The manageability challenges surrounding Type 1 virtualization are much greater than that of Type 2 virtualization. Type 1 hypervisors work on a relatively small set of hardware, as compared to an Operating System. The HCL (Hardware Compatibility List) may or may not include Intel vPro Technology capable systems. If Intel vPro Technology capable clients are not supported, then Intel AMT functionality is not available. In addition, the hypervisor may not have support for Intel AMT built into it which severely limits the Intel AMT functionality available to IT departments.
For the discussion of Type 1 virtualization, we will assume that the client system and the hypervisor both support Intel AMT, and that the Intel AMT hardware devices are passed through to one of the VMs. It is important to note here that Intel AMT cannot be virtualized and can only be associated with one “machine,” either the physical system or a single Virtual Machine. In addition, there will likely be other restrictions from the hypervisor supplier. For example, Citrix* XenClient* restricts which devices can be passed through to a VM when Intel AMT is passed through.
Each Virtual machine has its own IP address, MAC Address, and Host name. When Intel AMT pass-through is selected, for a particular VM, the IP address, the MAC address and host name of the VM and Intel AMT will be aligned. If not, the Intel AMT pass-through is not working correctly and Intel AMT will not function correctly. The Intel AMT drivers and the Intel Management and Security Software (IMSS) can be installed onto the VM once the Intel AMT pass-through option is enabled and the system is rebooted.
Manageability Features:

  • Power States (S3/S4/S5) – Since Intel AMT resides on the physical machine, it is unaware of the power state of the VMs, even when Intel AMT is passed through to a particular VM. This has several side effects.
    • While trying to manage the client system, the management console will only provide visibility into the power state of the physical system. The power state of the VMs is not known.
    • Action taken from the management console applies to the platform, not the VM. Shutting down the system could cause the VMs to be powered off without saving data.
    • If the platform is on, but the VM is powered off, the VM cannot be powered on from the management console. The console will see the platform is already on and VM can only be turned on from the client system.
    • However, if KVM Remote Control is available, it can be used to control the VMs. This applies to any VM, both with and without Intel AMT pass-through.
  • System Reboots – Rebooting the client system can also cause a loss of data in the VMs. In addition, unless automatic boot is enabled for a VM it will remain off when the system powers back on.
  • SOL boot to BIOS – There is no difference in using this feature on a client with virtualization.
  • SOL boot to CD/ISO/HDD – With Type 1 virtualization this Intel AMT capability does not provide IT with any practical benefit. This is because the VMs are not accessible without the hypervisor. Booting to another OS and using a repair utility is not a valid use case with Type 1 virtualization.
  • Fast Call For Help functions normally with Type 1 virtualization.
  • KVM Remote Control – Systems that support KVM Remote Control (a feature of Intel AMT systems with Intel Core vPro Processors and Integrated graphics) can take full advantage of this feature and provides IT with the best option to manage a virtualized client. With KVM Remote Control the following are all accessible by the remote KVM console:
    • The system BIOS and Intel MEBX
    • The boot process
    • The hypervisor GUI
    • Linux terminal window
    • Managed VM
    • Non-managed VMs
  • BIOS Updates – Do not attempt to update the BIOS from within a Virtual Machine. Select an alternative method provided by the OEM.
Warning: Never attempt to upgrade the BIOS or firmware from within a Virtual Machine. Doing so can harm the system.

Type 2 Virtualization

Type 2 virtualization utilizes a host OS, therefore, the manageability of the physical client system is not at all different from the non-virtualized PC. Intel AMT will function in the same way on a Type 2 virtualized client as it does on a non-virtualized client.
The Intel AMT driver and IMSS are installed on the host OS. Intel AMT functionality is only directed toward the host. The VMs have no knowledge of the Intel AMT features and Intel AMT features have no knowledge of the VMs.
In managing a Type 2 client, IT departments will need to be aware that they have no in-band or out-of-band control over the VMs. Therefore they are not able to determine the power state of a VM, or power it on or off. Care needs to be taken when powering off the client with Intel AMT since data could be lost if a VM is running and data is not saved.
However, on Intel vPro Technology client systems that support KVM Remote Control, IT personel can access the host OS and use KVM Remote Control to control the VMs. This is a significant advantage when the IT professional needs to remotely start, shutdown, save data, or repair the virtual machine’s OS.
With Serial Over LAN and IDE Redirection (SOL/IDER), the IT processional will have the same capability on the client as a non-virtualized system. Redirection can be used to repair the host Operating System. Unfortunately, SOL/IDER will not provide IT with the capability to repair the VMs.

Conclusion

The use of a Type 1 virtualization solution on client systems will require a different approach when it comes to client management with Intel AMT. To a lesser degree, there are also differences as will when Type 2 virtualization solutions are used.
In the future, IT professionals will need a method to detect the virtualization type used on a PC. Currently management consoles such as Symantec* Altiris* and Microsoft* ConfigMgr are not capable of detecting whether the client being managed is virtualized or not.

For more complete information about compiler optimizations, see our Optimization Notice.
(Redirected from Intel AMT)
A part of the Intel AMT web management interface, accessible even when the computer is sleeping

Intel Active Management Technology (AMT) is hardware and firmware for remote out-of-band management of select business computers,[1][2][3][4][5] running on the Intel Management Engine, a separate microprocessor not exposed to the user, in order to monitor, maintain, update, upgrade, and repair them.[1]Out-of-band (OOB) or hardware-based management is different from software-based (or in-band) management and software management agents.[1][2]

Hardware-based management works at a different level from software applications, and uses a communication channel (through the TCP/IP stack) that is different from software-based communication (which is through the software stack in the operating system). Hardware-based management does not depend on the presence of an OS or locally installed management agent. Hardware-based management has been available on Intel/AMD based computers in the past, but it has largely been limited to auto-configuration using DHCP or BOOTP for dynamic IP address allocation and diskless workstations, as well as wake-on-LAN (WOL) for remotely powering on systems.[6] AMT is not intended to be used by itself; it is intended to be used with a software management application.[1] It gives a management application (and thus, the system administrator who uses it) access to the PC down the wire, in order to remotely do tasks that are difficult or sometimes impossible when working on a PC that does not have remote functionalities built into it.[1][3][7]

AMT is designed into a secondary (service) processor located on the motherboard,[8] and uses TLS-secured communication and strong encryption to provide additional security.[2] AMT is built into PCs with Intel vPro technology and is based on the Intel Management Engine (ME).[2] AMT has moved towards increasing support for DMTFDesktop and mobile Architecture for System Hardware (DASH) standards and AMT Release 5.1 and later releases are an implementation of DASH version 1.0/1.1 standards for out-of-band management.[9] AMT provides similar functionality to IPMI, although AMT is designed for client computing systems as compared with the typically server-based IPMI.

Currently, AMT is available in desktops, servers, ultrabooks, tablets, and laptops with Intel Core vPro processor family, including Intel Core i5, i7, and Intel Xeon processor E3-1200 product family.[1][10][11]

Intel confirmed a Remote Elevation of Privilege bug (CVE-2017-5689, SA-00075) in its Management Technology on May 1, 2017.[12] Every Intel platform with either Intel Standard Manageability, Active Management Technology, or Small Business Technology, from Nehalem in 2008 to Kaby Lake in 2017 has a remotely exploitable security hole in the ME.[13][14] Some manufacturers, like Purism[15] and System76[16] are already selling hardware with Intel Management Engine disabled to prevent the remote exploit. Additional major security flaws in the ME affecting a very large number of computers incorporating Management Engine, Trusted Execution Engine, and Server Platform Services firmware, from Skylake in 2015 to Coffee Lake in 2017, were confirmed by Intel on November 20, 2017 (SA-00086).

  • 7Design
  • 8Security
    • 8.3Known vulnerabilities and exploits

Non-free service access[edit]

Although iAMT may be included for free in devices sold to the public and to small businesses, the full capabilities of iAMT, including encrypted remote access via a public key certificate and automatic remote device provisioning of unconfigured iAMT clients, are not accessible for free to the general public or to the direct owners of iAMT equipped devices. iAMT cannot be fully utilized to its maximum potential without purchasing additional software or management services from Intel or another 3rd partyindependent software vendor (ISV) or value added reseller (VAR).

Intel itself provides a developer's toolkit software package which allows basic access to iAMT, but is not intended to be normally used to access the technology.[17] Only basic modes of access are supported, without full access to the encrypted communications of the complete purchased management system.[18]

Features[edit]

Intel AMT includes hardware-based remote management, security, power management, and remote configuration features that enable independent remote access to AMT-enabled PCs.[1][7][19] Intel AMT is security and management technology that is built into PCs with Intel vPro technology.[1][6]

Intel AMT uses a hardware-based out-of-band (OOB) communication channel[1] that operates regardless of the presence of a working operating system. The communication channel is independent of the PC's power state, the presence of a management agent, and the state of many hardware components such as hard disk drives and memory.

Most AMT features are available OOB, regardless of PC power state.[1] Other features require the PC to be powered up (such as console redirection via serial over LAN (SOL), agent presence checking, and network traffic filtering).[1] Intel AMT has remote power-up capability.

Usb dfu driver. Hardware-based features can be combined with scripting to automate maintenance and service.[1]

Hardware-based AMT features on laptop and desktop PCs include:

  • Encrypted, remote communication channel for network traffic between the IT console and Intel AMT.[1][2]
  • Ability for a wired PC (physically connected to the network) outside the company's firewall on an open LAN to establish a secure communication tunnel (via AMT) back to the IT console.[1][2] Examples of an open LAN include a wired laptop at home or at an SMB site that does not have a proxy server.
  • Remote power up / power down / power cycle through encrypted WOL.[1][2]
  • Remote boot, via integrated device electronics redirect (IDE-R).[1][2]
  • Console redirection, via serial over LAN (SOL).[1]
  • Keyboard, video, mouse (KVM) over network.
  • Hardware-based filters for monitoring packet headers in inbound and outbound network traffic for known threats (based on programmable timers), and for monitoring known / unknown threats based on time-based heuristics. Laptops and desktop PCs have filters to monitor packet headers. Desktop PCs have packet-header filters and time-based filters.[1][2][20]
  • Isolation circuitry (previously and unofficially called 'circuit breaker' by Intel) to port-block, rate-limit, or fully isolate a PC that might be compromised or infected.[1][2][20]
  • Agent presence checking, via hardware-based, policy-based programmable timers. A 'miss' generates an event; and this can also generate an alert.[1][2][20]
  • OOB alerting.[1][2]
  • Persistent event log, stored in protected memory (not on the hard drive).[1][2]
  • Access (preboot) the PC's universal unique identifier (UUID).[1][2]
  • Access (preboot) hardware asset information, such as a component's manufacturer and model, which is updated every time the system goes through power-on self-test (POST).[1][2]
  • Access (preboot) to third-party data store (TPDS), a protected memory area that software vendors can use, in which to version information, .DAT files, and other information.[1][2]
  • Remote configuration options, including certificate-based zero-touch remote configuration, USB key configuration (light-touch), and manual configuration.[1][2][21]
  • Protected Audio/Video Pathway for playback protection of DRM-protected media.

Laptops with AMT also include wireless technologies:

  • Support for IEEE 802.11a/g/nwireless protocols[1][10][22][23]
  • Cisco-compatible extensions for Voice over WLAN[1][10][22][23]

History[edit]

Software updates provide upgrades to the next minor version of Intel AMT. New major releases of Intel AMT are built into a new chipset, and are updated through new hardware.[2]

Applications[edit]

Almost all AMT features are available even if the PC is in a powered-off state but with its power cord attached, if the operating system has crashed, if the software agent is missing, or if hardware (such as a hard drive or memory) has failed.[1][2] The console-redirection feature (SOL), agent presence checking, and network traffic filters are available after the PC is powered up.[1][2]

Intel AMT supports these management tasks:

  • Remotely power up, power down, power cycle, and power reset the computer.[1]
  • Remote boot the PC by remotely redirecting the PC's boot process, causing it to boot from a different image, such as a network share, bootable CD-ROM or DVD, remediation drive, or other boot device.[1][7] This feature supports remote booting a PC that has a corrupted or missing OS.
  • Remotely redirect the system's I/O via console redirection through serial over LAN (SOL).[1] This feature supports remote troubleshooting, remote repair, software upgrades, and similar processes.
  • Access and change BIOS settings remotely.[1] This feature is available even if PC power is off, the OS is down, or hardware has failed. This feature is designed to allow remote updates and corrections of configuration settings. This feature supports full BIOS updates, not just changes to specific settings.
  • Detect suspicious network traffic.[1][20] In laptop and desktop PCs, this feature allows a sys-admin to define the events that might indicate an inbound or outbound threat in a network packet header. In desktop PCs, this feature also supports detection of known and/or unknown threats (including slow- and fast-moving computer worms) in network traffic via time-based, heuristics-based filters. Network traffic is checked before it reaches the OS, so it is also checked before the OS and software applications load, and after they shut down (a traditionally vulnerable period for PCs[citation needed]).
  • Block or rate-limitnetwork traffic to and from systems suspected of being infected or compromised by computer viruses, computer worms, or other threats.[1][20] This feature uses Intel AMT hardware-based isolation circuitry that can be triggered manually (remotely, by the sys-admin) or automatically, based on IT policy (a specific event).
  • Manage hardware packet filters in the on-board network adapter.[1][20]
  • Automatically send OOB communication to the IT console when a critical software agent misses its assigned check in with the programmable, policy-based hardware-based timer.[1][20] A 'miss' indicates a potential problem. This feature can be combined with OOB alerting so that the IT console is notified only when a potential problem occurs (helps keep the network from being flooded by unnecessary 'positive' event notifications).
  • Receive Platform Event Trap (PET) events out-of-band from the AMT subsystem (for example, events indicating that the OS is hung or crashed, or that a password attack has been attempted).[1] An alert can be issued on an event (such as falling out of compliance, in combination with agent presence checking) or on a threshold (such as reaching a particular fan speed).
  • Access a persistent event log, stored in protected memory.[1] The event log is available OOB, even if the OS is down or the hardware has already failed.
  • Discover an AMT system independently of the PC's power state or OS state.[1] Discovery (preboot access to the UUID) is available if the system is powered down, its OS is compromised or down, hardware (such as a hard drive or memory) has failed, or management agents are missing.
  • Perform a software inventory or access information about software on the PC.[1] This feature allows a third-party software vendor to store software asset or version information for local applications in the Intel AMT protected memory. (This is the protected third party data store, which is different from the protected AMT memory for hardware component information and other system information). The third-party data store can be accessed OOB by the sys-admin. For example, an antivirus program could store version information in the protected memory that is available for third-party data. A computer script could use this feature to identify PCs that need to be updated.
  • Perform a hardware inventory by uploading the remote PC's hardware asset list (platform, baseboard management controller, BIOS, processor, memory, disks, portable batteries, field replaceable units, and other information).[1] Hardware asset information is updated every time the system runs through power-on self-test (POST).

From major version 6, Intel AMT embeds a proprietary VNC server, for out-of-band access using dedicated VNC-compatible viewer technology, and have full KVM (keyboard, video, mouse) capability throughout the power cycle – including uninterrupted control of the desktop when an operating system loads. Clients such as VNC Viewer Plus from RealVNC also provide additional functionality that might make it easier to perform (and watch) certain Intel AMT operations, such as powering the computer off and on, configuring the BIOS, and mounting a remote image (IDER).

Provisioning and integration[edit]

AMT supports certificate-based or PSK-based remote provisioning (full remote deployment), USBkey-based provisioning ('one-touch' provisioning), manual provisioning[1] and provisioning using an agent on the local host ('Host Based Provisioning'). An OEM can also pre-provision AMT.[21]

The current version of AMT supports remote deployment on both laptop and desktop PCs. (Remote deployment was one of the key features missing from earlier versions of AMT and which delayed acceptance of AMT in the market.)[7] Remote deployment, until recently, was only possible within a corporate network.[24] Remote deployment lets a sys-admin deploy PCs without 'touching' the systems physically.[1] It also allows a sys-admin to delay deployments and put PCs into use for a period of time before making AMT features available to the IT console.[25] As delivery and deployment models evolve, AMT can now be deployed over the Internet, using both 'Zero-Touch' and Host-Based methods.[26]

PCs can be sold with AMT enabled or disabled. The OEM determines whether to ship AMT with the capabilities ready for setup (enabled) or disabled. The setup and configuration process may vary depending on the OEM build.[21]

AMT includes a Privacy Icon application, called IMSS,[27] that notifies the system's user if AMT is enabled. It is up to the OEM to decide whether they want to display the icon or not.

AMT supports different methods for disabling the management and security technology, as well as different methods for reenabling the technology.[1][25][28][29]

AMT can be partially unprovisioned using the Configuration Settings, or fully unprovisioned by erasing all configuration settings, security credentials, and operational and networking settings.[30] A partial unprovisioning leaves the PC in the setup state. In this state, the PC can self-initiate its automated, remote configuration process. A full unprovisioning erases the configuration profile as well as the security credentials and operational / networking settings required to communicate with the Intel Management Engine. A full unprovisioning returns Intel AMT to its factory default state.

Once AMT is disabled, in order to enable AMT again, an authorized sys-admin can reestablish the security credentials required to perform remote configuration by either:

  • Using the remote configuration process (full automated, remote config via certificates and keys).[1]
  • Physically accessing the PC to restore security credentials, either by USB key or by entering the credentials and MEBx parameters manually.[1]

There is a way to totally reset AMT and return in to factory defaults. This can be done in two ways:

  • Setting the appropriate value in the BIOS.
  • Clearing the CMOS memory and / or NVRAM.

Setup and integration of AMT is supported by a setup and configuration service (for automated setup), an AMT Webserver tool (included with Intel AMT), and AMT Commander, an unsupported and free, proprietary application available from the Intel website.

Communication[edit]

All access to the Intel AMT features is through the Intel Management Engine in the PC's hardware and firmware.[1] AMT communication depends on the state of the Management Engine, not the state of the PC's OS.

As part of the Intel Management Engine, the AMT OOB communication channel is based on the TCP/IPfirmware stack designed into system hardware.[1] Because it is based on the TCP/IP stack, remote communication with AMT occurs via the network data path before communication is passed to the OS.

Intel AMT supports wired and wireless networks.[1][10][22][31] For wireless notebooks on battery power, OOB communication is available when the system is awake and connected to the corporate network, even if the OS is down. OOB communication is also available for wireless or wired notebooks connected to the corporate network over a host OS-based virtual private network (VPN) when notebooks are awake and working properly.

AMT version 4.0 and higher can establish a secure communication tunnel between a wired PC and an IT console outside the corporate firewall.[1][32] In this scheme, a management presence server (Intel calls this a 'vPro-enabled gateway') authenticates the PC, opens a secure TLS tunnel between the IT console and the PC, and mediates communication.[1][33] The scheme is intended to help the user or PC itself request maintenance or service when at satellite offices or similar places where there is no on-site proxy server or management appliance.

Technology that secures communications outside a corporate firewall is relatively new. It also requires that an infrastructure be in place, including support from IT consoles and firewalls.

An AMT PC stores system configuration information in protected memory. For PCs version 4.0 and higher, this information can include the name(s) of appropriate 'whitelist' management servers for the company. When a user tries to initiate a remote session between the wired PC and a company server from an open LAN, AMT sends the stored information to a management presence server (MPS) in the 'demilitarized zone' ('DMZ') that exists between the corporate firewall and client (the user PC's) firewalls. The MPS uses that information to help authenticate the PC. The MPS then mediates communication between the laptop and the company's management servers.[1]

Because communication is authenticated, a secure communication tunnel can then be opened using TLS encryption. Once secure communications are established between the IT console and Intel AMT on the user's PC, a sys-admin can use the typical AMT features to remotely diagnose, repair, maintain, or update the PC.[1]

Design[edit]

Hardware[edit]

The Management Engine (ME) is an isolated and protected coprocessor, embedded as a non-optional[34] part in all current (as of 2015) Intel chipsets.[35]

Canon Printer Driver For Mac

Starting with ME 11, it is based on the Intel Quark x86-based 32-bit CPU and runs the MINIX 3 operating system. The ME state is stored in a partition of the SPI flash, using the Embedded Flash File System (EFFS).[36] Previous versions were based on an ARC core, with the Management Engine running the ThreadXRTOS from Express Logic. Versions 1.x to 5.x of the ME used the ARCTangent-A4 (32-bit only instructions) whereas versions 6.x to 8.x used the newer ARCompact (mixed 32- and 16-bit instruction set architecture). Starting with ME 7.1, the ARC processor could also execute signed Java applets.

The ME shares the same network interface and IP as the host system. Traffic is routed based on packets to ports 16992-16995. Support exists in various Intel Ethernet controllers, exported and made configurable via Management Component Transport Protocol (MCTP).[37][38] The ME also communicates with the host via PCI interface.[36] Under Linux, communication between the host and the ME is done via /dev/mei.[35]

Until the release of Nehalem processors, the ME was usually embedded into the motherboard's northbridge, following the Memory Controller Hub (MCH) layout.[39] With the newer Intel architectures (Intel 5 Series onwards), ME is included into the Platform Controller Hub (PCH).[40][41]

Firmware[edit]

  • Management Engine (ME) - mainstream chipsets
  • Server Platform Services (SPS) - server
  • Trusted Execution Engine (TXE) - tablet/mobile/low power

Security[edit]

Because AMT allows access to the PC below the OS level, security for the AMT features is a key concern.

Security for communications between Intel AMT and the provisioning service and/or management console can be established in different ways depending on the network environment. Security can be established via certificates and keys (TLS public key infrastructure, or TLS-PKI), pre-shared keys (TLS-PSK), or administrator password.[1][2]

Security technologies that protect access to the AMT features are built into the hardware and firmware. As with other hardware-based features of AMT, the security technologies are active even if the PC is powered off, the OS is crashed, software agents are missing, or hardware (such as a hard drive or memory) has failed.[1][2][42]

Because the software that implements AMT exists outside of the operating system, it is not kept up-to-date by the operating system's normal update mechanism. Security defects in the AMT software can therefore be particularly severe, as they will remain long after they have been discovered and become known to potential attackers.

On May 15, 2017, Intel announced a critical vulnerability in AMT. According to the update 'The vulnerability could enable a network attacker to remotely gain access to business PCs or devices that use these technologies'.[43] Intel announced partial availability of a firmware update to patch the vulnerability for some of the affected devices.

Networking[edit]

While some protocols for in-band remote management use a secured network communication channel (for example Secure Shell), some other protocols are not secured. Thus some businesses have had to choose between having a secure network or allowing IT to use remote management applications without secure communications to maintain and service PCs.[1]

Modern security technologies and hardware designs allow remote management even in more secure environments. For example, Intel AMT supports IEEE 802.1x, Preboot Execution Environment (PXE), CiscoSDN, and MicrosoftNAP.[1]

All AMT features are available in a secure network environment. With Intel AMT in the secure network environment:

  • The network can verify the security posture of an AMT-enabled PC and authenticate the PC before the OS loads and before the PC is allowed access to the network.
  • PXE boot can be used while maintaining network security. In other words, an IT administrator can use an existing PXE infrastructure in an IEEE 802.1x, CiscoSDN, or MicrosoftNAP network.

Intel AMT can embed network security credentials in the hardware, via the Intel AMT Embedded Trust Agent and an AMT posture plug-in.[1][2] The plug-in collects security posture information, such as firmware configuration and security parameters from third-party software (such as antivirus software and antispyware), BIOS, and protected memory. The plug-in and trust agent can store the security profile(s) in AMT's protected, nonvolatile memory, which is not on the hard disk drive.

Because AMT has an out-of-band communication channel, AMT can present the PC's security posture to the network even if the PC's OS or security software is compromised. Since AMT presents the posture out-of-band, the network can also authenticate the PC out-of-band, before the OS or applications load and before they try to access the network. If the security posture is not correct, a system administrator can push an update OOB (via Intel AMT) or reinstall critical security software before letting the PC access the network.

Support for different security postures depends on the AMT release:

  • Support for IEEE 802.1x and CiscoSDN requires AMT version 2.6 or higher for laptops, and AMT version 3.0 or higher for desktop PCs.[1][44][45]
  • Support for MicrosoftNAP requires AMT version 4.0 or higher.[1]
  • Support for PXE boot with full network security requires AMT version 3.2 or higher for desktop PCs.[1]

Technology[edit]

AMT includes several security schemes, technologies, and methodologies to secure access to the AMT features during deployment and during remote management.[1][2][42] AMT security technologies and methodologies include:

  • Transport Layer Security, including pre-shared key TLS (TLS-PSK)
  • HTTP authentication
  • Single sign-on to Intel AMT with Microsoft Windows domain authentication, based on MicrosoftActive Directory and Kerberos
  • Digitally signed firmware
  • Pseudo-random number generator (PRNG) which generates session keys
  • Protected memory (not on the hard disk drive) for critical system data, such as the UUID, hardware asset information, and BIOS configuration settings
  • Access control lists (ACL)

As with other aspects of Intel AMT, the security technologies and methodologies are built into the chipset.

Known vulnerabilities and exploits[edit]

Ring −3 rootkit[edit]

A ring −3 rootkit was demonstrated by Invisible Things Lab for the Q35 chipset; it does not work for the later Q45 chipset, as Intel implemented additional protections.[46] The exploit worked by remapping the normally protected memory region (top 16 MB of RAM) reserved for the ME. The ME rootkit could be installed regardless of whether the AMT is present or enabled on the system, as the chipset always contains the ARC ME coprocessor. (The '−3' designation was chosen because the ME coprocessor works even when the system is in the S3 state, thus it was considered a layer below the System Management Mode rootkits.[39]) For the vulnerable Q35 chipset, a keystroke logger ME-based rootkit was demonstrated by Patrick Stewin.[47][48]

Zero-touch provisioning[edit]

Another security evaluation by Vassilios Ververis showed serious weaknesses in the GM45 chipset implementation. In particular, it criticized AMT for transmitting unencrypted passwords in the SMB provisioning mode when the IDE redirection and Serial over LAN features are used. It also found that the 'zero touch' provisioning mode (ZTC) is still enabled even when the AMT appears to be disabled in BIOS. For about 60 euros, Ververis purchased from Go Daddy a certificate that is accepted by the ME firmware and allows remote 'zero touch' provisioning of (possibly unsuspecting) machines, which broadcast their HELLO packets to would-be configuration servers.[49]

Silent Bob is Silent[edit]

In May 2017, Intel confirmed that many computers with AMT have had an unpatched critical privilege-escalation vulnerability (CVE-2017-5689).[14][50][12][51][52] The vulnerability, which was nicknamed 'Silent Bob is Silent' by the researchers who had reported it to Intel,[53] affects numerous laptops, desktops and servers sold by Dell, Fujitsu, Hewlett-Packard (later Hewlett Packard Enterprise and HP Inc.), Intel, Lenovo, and possibly others.[53][54][55][56][57][58][59] Those researchers claimed that the bug affects systems made in 2010 or later.[60] Other reports claimed that the bug also affects systems made as long ago as 2008.[61][14] The vulnerability was described as giving remote attackers:

full control of affected machines, including the ability to read and modify everything. It can be used to install persistent malware (possibly in firmware), and read and modify any data.

— Tatu Ylönen, ssh.com[53]

The remote user authorization process included a programmer error: it compared the user-given authorization token hash (user_response) to the true value of the hash (computed_response) using this code:

The vulnerability was that response_length was the length of the user-given token and not of the true token.

Since the third argument for strncmp is the length of the two strings to be compared, if it is less than the length of computed_response, only a part of the string will be tested for equality. Specifically, if user_response is the empty string (with length 0), this 'comparison' will always return True, and thus validate the user. This allowed any person to simply log into the admin account on the devices by editing their sent HTTP packet to use the empty string as the response field's value.

PLATINUM[edit]

In June 2017, the PLATINUM cybercrime group became notable for exploiting the serial over LAN (SOL) capabilities of AMT to perform data exfiltration of stolen documents.[62][63][64][65][66][67][68][69]

SA-00086[edit]

Hp Driver For Mac

In November 2017 serious flaws were detected in the Management Engine (ME) firmware by security firm Positive Technologies, who claimed to have developed a working exploit of this system for someone having physical access to a USB port.[70] On November 20, 2017 Intel confirmed that a number of serious flaws had been found in the Management Engine, Trusted Execution Engine, Server Platform Services and released a 'critical firmware update'.[71][72]

Avoidance and mitigation[edit]

PCs with AMT typically provide an option in the BIOS menu to switch off AMT, though OEMs implement BIOS features differently,[73] and therefore the BIOS is not a reliable method to switch off AMT. Intel-based PCs that shipped without AMT are supposed not to be able to have AMT later installed. However, as long as the PC's hardware is potentially capable of running the AMT, it is unclear how effective these protections are.[74][75][76] Presently, there are mitigation guides[77] and tools[78] to disable AMT on Windows, but Linux has only received a tool to check whether AMT is enabled and provisioned on Linux systems.[79] The only way to actually fix this vulnerability is to install a firmware update. Intel has made a list of updates available.[80] Unlike for AMT, there is generally no official, documented way to disable the Management Engine (ME); it is always on, unless it is not enabled at all by the OEM.[81][82]

In 2015, a small number of competing vendors began to offer Intel-based PCs designed or modified specifically to address potential AMT vulnerabilities and related concerns.[83][84][85][86][87][88][89]

See also[edit]

References[edit]

  1. ^ abcdefghijklmnopqrstuvwxyzaaabacadaeafagahaiajakalamanaoapaqarasatauavawaxayazbabbbcbdbebfbgbhbibjbkbl'Intel Centrino 2 with vPro Technology and Intel Core2 Processor with vPro Technology'(PDF). Intel. 2008. Archived from the original(PDF) on December 6, 2008. Retrieved August 7, 2008.
  2. ^ abcdefghijklmnopqrstuvwx'Architecture Guide: Intel Active Management Technology'. Intel. June 26, 2008. Archived from the original on October 19, 2008. Retrieved August 12, 2008.
  3. ^ ab'Remote Pc Management with Intel's vPro'. Tom's Hardware Guide. Retrieved November 21, 2007.
  4. ^'Intel vPro Chipset Lures MSPs, System Builders'. ChannelWeb. Retrieved August 1, 2007.
  5. ^'Intel Mostly Launches Centrino 2 Notebook Platform'. ChannelWeb. Retrieved July 1, 2008.
  6. ^ ab'A new dawn for remote management? A first glimpse at Intel's vPro platform'. ars technica. Retrieved November 7, 2007.
  7. ^ abcd'Revisiting vPro for Corporate Purchases'. Gartner. Retrieved August 7, 2008.
  8. ^'Answers to Frequently Asked Questions about libreboot'. libreboot.org. Retrieved September 25, 2015.
  9. ^'Archived copy'. Archived from the original on April 14, 2012. Retrieved April 30, 2012.CS1 maint: archived copy as title (link)
  10. ^ abcd'Intel Centrino 2 with vPro Technology'(PDF). Intel. Archived from the original(PDF) on March 15, 2008. Retrieved July 15, 2008.
  11. ^'Intel MSP'. Msp.intel.com. Retrieved May 25, 2016.
  12. ^ ab'Intel® Product Security Center'. Security-center.intel.com. Retrieved May 7, 2017.
  13. ^Charlie Demerjian (May 1, 2017). 'Remote security exploit in all 2008+ Intel platforms'. SemiAccurate. Retrieved May 7, 2017.
  14. ^ abc'Red alert! Intel patches remote execution hole that's been hidden in chips since 2010'. Theregister.co.uk. Retrieved May 7, 2017.
  15. ^HardOCP: Purism Is Offering Laptops with Intel's Management Engine Disabled
  16. ^System76 to disable Intel Management Engine on its notebooks
  17. ^Garrison, Justin (March 28, 2011). 'How to Remotely Control Your PC (Even When it Crashes)'. Howtogeek.com. Retrieved May 7, 2017.
  18. ^'Open Manageability Developer Tool Kit Intel® Software'. Software.intel.com. Retrieved May 7, 2017.
  19. ^'Intel vPro Technology'. Intel. Retrieved July 14, 2008.
  20. ^ abcdefg'Intel Active Management Technology System Defense and Agent Presence Overview'(PDF). Intel. February 2007. Retrieved August 16, 2008.
  21. ^ abc'Intel Centrino 2 with vPro Technology'. Intel. Archived from the original on March 15, 2008. Retrieved June 30, 2008.
  22. ^ abc'New Intel-Based Laptops Advance All Facets of Notebook PCs'. Intel. Archived from the original on July 17, 2008. Retrieved July 15, 2008.
  23. ^ ab'Understanding Intel AMT over wired vs. wireless (video)'. Intel. Archived from the original on March 26, 2008. Retrieved August 14, 2008.
  24. ^'Intel® vPro™ Technology'. Intel.
  25. ^ ab'Part 3: Post Deployment of Intel vPro in an Altiris Environment: Enabling and Configuring Delayed Provisioning'. Intel (forum). Retrieved September 12, 2008.
  26. ^'Archived copy'(PDF). Archived from the original(PDF) on January 3, 2014. Retrieved July 20, 2013.CS1 maint: archived copy as title (link)
  27. ^'Archived copy'. Archived from the original on February 20, 2011. Retrieved December 26, 2010.CS1 maint: archived copy as title (link)
  28. ^'Intel vPro Provisioning'(PDF). HP (Hewlett Packard). Retrieved June 2, 2008.
  29. ^'vPro Setup and Configuration for the dc7700 Business PC with Intel vPro Technology'(PDF). HP (Hewlett Packard). Retrieved June 2, 2008.[permanent dead link]
  30. ^'Part 4: Post Deployment of Intel vPro in an Altiris Environment Intel: Partial UnProvDefault'. Intel (forum). Retrieved September 12, 2008.
  31. ^'Technical Considerations for Intel AMT in a Wireless Environment'. Intel. September 27, 2007. Retrieved August 16, 2008.
  32. ^'Intel Active Management Technology Setup and Configuration Service, Version 5.0'(PDF). Intel. Retrieved October 13, 2018.
  33. ^'Intel AMT - Fast Call for Help'. Intel. August 15, 2008. Archived from the original on February 11, 2009. Retrieved August 17, 2008.(Intel developer's blog)
  34. ^'Archived copy'. Archived from the original on January 3, 2016. Retrieved January 16, 2016.CS1 maint: archived copy as title (link)
  35. ^ ab'Archived copy'. Archived from the original on November 1, 2014. Retrieved February 25, 2014.CS1 maint: archived copy as title (link)
  36. ^ abIgor Skochinsky (Hex-Rays) Rootkit in your laptop, Ruxcon Breakpoint 2012
  37. ^'Intel Ethernet Controller I210 Datasheet'(PDF). Intel. 2013. pp. 1, 15, 52, 621–776. Retrieved November 9, 2013.
  38. ^'Intel Ethernet Controller X540 Product Brief'(PDF). Intel. 2012. Retrieved February 26, 2014.
  39. ^ abJoanna Rutkowska. 'A Quest to the Core'(PDF). Invisiblethingslab.com. Retrieved May 25, 2016.
  40. ^'Archived copy'(PDF). Archived from the original(PDF) on February 11, 2014. Retrieved February 26, 2014.CS1 maint: archived copy as title (link)
  41. ^'Platforms II'(PDF). Users.nik.uni-obuda.hu. Retrieved May 25, 2016.
  42. ^ ab'New Intel vPro Processor Technology Fortifies Security for Business PCs (news release)'. Intel. August 27, 2007. Archived from the original on September 12, 2007. Retrieved August 7, 2007.
  43. ^'Intel® AMT Critical Firmware Vulnerability'. Intel. Retrieved June 10, 2017.
  44. ^'Intel Software Network, engineer / developers forum'. Intel. Archived from the original on August 13, 2011. Retrieved August 9, 2008.
  45. ^'Cisco Security Solutions with Intel Centrino Pro and Intel vPro Processor Technology'(PDF). Intel. 2007.
  46. ^'Invisible Things Lab to present two new technical presentations disclosing system-level vulnerabilities affecting modern PC hardware at its core'(PDF). Invisiblethingslab.com. Archived from the original(PDF) on April 12, 2016. Retrieved May 25, 2016.
  47. ^'Berlin Institute of Technology : FG Security in telecommunications : Evaluating 'Ring-3' Rootkits'(PDF). Stewin.org. Archived from the original(PDF) on March 4, 2016. Retrieved May 25, 2016.
  48. ^'Persistent, Stealthy Remote-controlled Dedicated Hardware Malware'(PDF). Stewin.org. Archived from the original(PDF) on March 3, 2016. Retrieved May 25, 2016.
  49. ^'Security Evaluation of Intel's Active Management Technology'(PDF). Web.it.kth.se. Retrieved May 25, 2016.
  50. ^'CVE - CVE-2017-5689'. Cve.mitre.org. Archived from the original on May 5, 2017. Retrieved May 7, 2017.
  51. ^'Intel Hidden Management Engine - x86 Security Risk?'. Darknet. June 16, 2016. Retrieved May 7, 2017.
  52. ^Garrett, Matthew (May 1, 2017). 'Intel's remote AMT vulnerablity'. mjg59.dreamwidth.org. Retrieved May 7, 2017.
  53. ^ abc'2017-05-05 ALERT! Intel AMT EXPLOIT OUT! IT'S BAD! DISABLE AMT NOW!'. Ssh.comAccessdate=2017-05-07.
  54. ^Dan Goodin (May 6, 2017). 'The hijacking flaw that lurked in Intel chips is worse than anyone thought'. Ars Technica. Retrieved May 8, 2017.
  55. ^'General: BIOS updates due to Intel AMT IME vulnerability - General Hardware - Laptop - Dell Community'. En.community.dell.com. Retrieved May 7, 2017.
  56. ^'Advisory note: Intel Firmware vulnerability – Fujitsu Technical Support pages from Fujitsu Fujitsu Continental Europe, Middle East, Africa & India'. Support.ts.fujitsu.com. May 1, 2017. Retrieved May 8, 2017.
  57. ^'HPE HPE CS700 2.0 for VMware'. H22208.www2.hpe.com. May 1, 2017. Retrieved May 7, 2017.
  58. ^'Intel® Security Advisory regarding escalation o.. Intel Communities'. Communities.intel.com. Retrieved May 7, 2017.
  59. ^'Intel Active Management Technology, Intel Small Business Technology, and Intel Standard Manageability Remote Privilege Escalation'. Support.lenovo.com. Retrieved May 7, 2017.
  60. ^'MythBusters: CVE-2017-5689'. Embedi.com. Retrieved May 7, 2017.
  61. ^Charlie Demerjian (May 1, 2017). 'Remote security exploit in all 2008+ Intel platforms'. SemiAccurate.com. Retrieved May 7, 2017.
  62. ^'Sneaky hackers use Intel management tools to bypass Windows firewall'. Retrieved June 10, 2017.
  63. ^Tung, Liam. 'Windows firewall dodged by 'hot-patching' spies using Intel AMT, says Microsoft - ZDNet'. Retrieved June 10, 2017.
  64. ^'PLATINUM continues to evolve, find ways to maintain invisibility'. Retrieved June 10, 2017.
  65. ^'Malware Uses Obscure Intel CPU Feature to Steal Data and Avoid Firewalls'. Retrieved June 10, 2017.
  66. ^'Hackers abuse low-level management feature for invisible backdoor'. iTnews. Retrieved June 10, 2017.
  67. ^'Vxers exploit Intel's Active Management for malware-over-LAN • The Register'. www.theregister.co.uk. Retrieved June 10, 2017.
  68. ^Security, heise. 'Intel-Fernwartung AMT bei Angriffen auf PCs genutzt'. Security. Retrieved June 10, 2017.
  69. ^'PLATINUM activity group file-transfer method using Intel AMT SOL'. Channel 9. Retrieved June 10, 2017.
  70. ^Researchers find almost EVERY computer with an Intel Skylake and above CPU can be owned via USB.
  71. ^'Intel® Management Engine Critical Firmware Update (Intel SA-00086)'. Intel.
  72. ^'Intel Chip Flaws Leave Millions of Devices Exposed'. Wired.
  73. ^'Disabling AMT in BIOS'. software.intel.com. Retrieved May 17, 2017.
  74. ^'Are consumer PCs safe from the Intel ME/AMT exploit? - SemiAccurate'. semiaccurate.com.
  75. ^'Intel x86s hide another CPU that can take over your machine (you can't audit it)'. Boing Boing. June 15, 2016. Retrieved May 11, 2017.
  76. ^'[coreboot] : AMT bug'. Mail.coreboot.org. May 11, 2017. Retrieved June 13, 2017.
  77. ^'Disabling Intel AMT on Windows (and a simpler CVE-2017-5689 Mitigation Guide)'. Social Media Marketing Digital Marketing Electronic Commerce. May 3, 2017. Retrieved May 17, 2017.
  78. ^'bartblaze/Disable-Intel-AMT'. GitHub. Retrieved May 17, 2017.
  79. ^'mjg59/mei-amt-check'. GitHub. Retrieved May 17, 2017.
  80. ^'Intel® AMT Critical Firmware Vulnerability'. Intel. Retrieved May 17, 2017.
  81. ^'Positive Technologies Blog: Disabling Intel ME 11 via undocumented mode'. Retrieved August 30, 2017.
  82. ^'Intel Patches Major Flaws in the Intel Management Engine'. Extreme Tech.
  83. ^Vaughan-Nichols, Steven J. 'Taurinus X200: Now the most 'Free Software' laptop on the planet - ZDNet'.
  84. ^Kißling, Kristian. 'Libreboot: Thinkpad X220 ohne Management Engine » Linux-Magazin'. Linux-Magazin.
  85. ^online, heise. 'Libiquity Taurinus X200: Linux-Notebook ohne Intels Management Engine'. heise online.
  86. ^'Intel AMT Vulnerability Shows Intel's Management Engine Can Be Dangerous'. May 2, 2017.
  87. ^'Purism Explains Why It Avoids Intel's AMT And Networking Cards For Its Privacy-Focused 'Librem' Notebooks'. Tom's Hardware. August 29, 2016. Retrieved May 10, 2017.
  88. ^'The Free Software Foundation loves this laptop, but you won't'.
  89. ^'FSF Endorses Yet Another (Outdated) Laptop - Phoronix'. phoronix.com.

External links[edit]

  • Intel ME Secrets: Hidden code in your chipset and how to discover what exactly it does by Igor Skochinsky, talk at Code Blue 2014


Intel Lms Driver

Retrieved from 'https://en.wikipedia.org/w/index.php?title=Intel_Active_Management_Technology&oldid=912886439'