Are separate Intel gigabit NIC cards a solution to AMT vulnerability?

Hello paramountain,

Thank you for contacting Intel Communities.

I recommend running the INTEL-SA-00075 Detection Guide to check whether your system is affected or not. For more information please refer to the Intel's newsroom which refers to this document: INTEL-SA-00075 Mitigation Guide.

Please also keep checking the thread you shared: Intel® Security Advisory regarding escalation of privilege vulnerability in Intel® Active Management Technology (AMT)

Best Regards,
JC
 

Well, presuming that I understand the issue fully, using an add-in NIC will prevent an external entity breaking into a provisioned AMT stack. This add-in NIC can be from any manufacturer; only the NIC built into the chipset (the PHY built into the PCH, in combination with a MAC IC on the baseboard) communicates with the ME and AMT. Going this route, however, will not prevent rogue software that somehow gets executed on your PC from taking over and provisioning your unprovisioned AMT stack. If you have AMT provisioned but use a separate NIC (effectively neutering AMT), you should, in theory (hedging my bets ), be able to avoid both vulnerabilities. Obviously, getting corrected ME firmware is the better way to go and I hope Intel comes through with updated firmware (BIOS) package for these boards.

...S

It doesn't put the kabash on AMT; it just disconnects AMT from seeing any incoming packets on the LAN; that's what I mean by neutering.

...S