Intel fixed nine years old flaw
Intel fixed nine years old flaw. Yes, after nine years a flaw was detected and patched by Intel. Intel, one of the world’s largest semiconductor chip makers, has come under fire it’s emerged that the company had sold workstation and server chips with a vulnerability that could give a remote attacker absolute control over the machine.
The bug has affected Intel Active Management Technology (AMT), Intel Standard Manageability (ISM), and Intel Small Business Technology firmware versions 6.x to 11.6. If exploited, it could give an attacker near-unfettered access to the targeted machine.
AMT is a tool that allows an authorized user to remotely manage a machine, giving serial access, with the right drivers. It can offer a remotely experienced desktop. In most cases, AMT requires the user authentication with a password but this vulnerability essentially find a way around that process, giving the keys to the kingdom to anyone with a copy of Metasploit.
If the computer is configured incorrectly network, where network port 16992 is accessible to the outside world, it means that anyone can take advantage of these features at any time sitting anywhere in the world. Even, someone could easily attack it from within the network.
The most troubling part of this matter is the bug – which luckily, is not found in consumer Intel chips – remained undetected for almost nine years. Intel has been selling vulnerable silicon for almost a decade. There must be, quite literally, hundreds of millions of computers at risk.
However for almost nine years, this bug remained undetected and for almost a decade the company has been selling vulnerable chips in the market. So, no one has any idea that how many computers are at risk, there must be hundreds of millions of devices.
Charlie Demerjian, wrote on blog SemiAccurate said, “the short version is that every Intel platform with AMT, ISM, and SBT from Nehalem in 2008 to Kaby Lake in 2017 has a remotely exploitable security hole”. He added, “even if your machine doesn’t have SMT, ISM, or SBT provisioned, it is still vulnerable, just not over the network”
Most Popular Training Courses at Indian Cyber Security Solutions
Summer Training for CSE, IT, BCA & MCA Students
Network Penetration Tester Training
Certified Network Penetration Tester
Certified Web Application Penetration Tester
Certified Android Penetration Tester
