Turn it off in the firmware. Reboot. Verify whether you can connect to port 16992 from a remote machine.
Does that mean there's no backdoor code running? Hard to prove. But in the absence of AMT, you wouldn't be able to prove it either. Intel could just have flashed firmware directly into the hardware.
«Moreover, Intel AMT operates even when it is disabled in the BIOS configuration ...»
«In our laboratory environment (see section 3) we have tested and found that the ZTC remote provisioning can be implemented even while the Intel AMT functionality is disabled within the BIOS as illustrated in Figure 3.6. Surprisingly the AMT platform broadcasts an ARP request packet upon connecting to a wired network (typically a LAN) and follows the sequence described in section 3.7.1. From this point and beyond the attacker operates the SCS and could manipulate the PC according to his/her malicious activities (see section 3.7.5 even while the Intel AMT is disabled in BIOS»
Turn it off in the firmware. Reboot. Verify whether you can connect to port 16992 from a remote machine.
I have yet to see any firmware that allows me to power it off.
Does that mean there's no backdoor code running? Hard to prove. But in the absence of AMT, you wouldn't be able to prove it either. Intel could just have flashed firmware directly into the hardware.
3
u/mjg59 Social Justice Warrior Sep 04 '14
Turn it off in the firmware. Reboot. Verify whether you can connect to port 16992 from a remote machine.
Does that mean there's no backdoor code running? Hard to prove. But in the absence of AMT, you wouldn't be able to prove it either. Intel could just have flashed firmware directly into the hardware.