Malware Uses Obscure Intel CPU Feature To Steal Data and Avoid Firewalls
'Microsoft's security team has come across a malware family that uses Intel's Active Management Technology (AMT) Serial-over-LAN (SOL) interface as a file transfer tool. The problem with Intel AMT SOL is that it's part of Intel's ME, a separate chip inside Intel CPUs that runs its own OS and stays on even when the main CPU is off. Inside Intel's ME, AMT SOL opens a virtual network interface which works even when the PC is turned off. Furthermore, because this virtual network interface runs inside ME, firewalls and security products installed on the main OS won't detected malware using AMT SOL to exfiltrate data. The malware was created and used by a nation-state cyber-espionage unit codenamed PLATINUM, active since 2009, and which has targeted countries around the South China Sea. PLATINUM is by far one of the most sophisticated hacking groups ever discovered. Last year [PDF], the OS maker said the group was installing malware by abusing hotpatching — a mechanism that allows Microsoft to issue updates that tap into active processes and upgrade applications or the operating system without having to reboot the computer. Details about PLATINUM's recent targets and attacks are available in a report [PDF] Microsoft released yesterday.' -- source: https://it.slashdot.org/story/17/06/08/1754244 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/
On Fri, 9 Jun 2017 09:15:43 +1200, Peter Reutemann wrote:
'Microsoft's security team has come across a malware family that uses Intel's Active Management Technology (AMT) Serial-over-LAN (SOL) interface as a file transfer tool. The problem with Intel AMT SOL is that it's part of Intel's ME, a separate chip inside Intel CPUs that runs its own OS and stays on even when the main CPU is off.'
This <https://en.wikipedia.org/wiki/Intel_Active_Management_Technology> says “AMT is designed into a secondary (service) processor located on the motherboard”, and this <https://www.fsf.org/blogs/community/active-management-technology> says “AMT is an auxiliary processor built into the high-end Intel Q chipsets with an i5 or i7 CPU”. It seems clear in either case that it is not “inside the CPU”, but a separate chip. Intel itself <https://www.intel.com/content/www/us/en/architecture-and-technology/intel-active-management-technology.html> says this is a “feature of Intel Core processors with Intel vPro technology”. So if your machine doesn’t boast “vPro”, then it doesn’t have this.
Further to this <https://arstechnica.com/security/2017/06/sneaky-hackers-use-intel-management-tools-to-bypass-windows-firewall/>: ...the group's malware requires AMT to be enabled and serial-over-LAN turned on before it can work. This isn't exploiting any flaw in AMT; the malware just uses the AMT as it's designed in order to do something undesirable. The article also mentions a known flaw that has been discovered in AMT; but this seems to be separate to how PLATINUM actually works.
participants (2)
-
Lawrence D'Oliveiro -
Peter Reutemann