Intel chip vulnerability lets hackers easily hijack fleets of PCs by Zack Whittaker.
From the post:
A vulnerability in Intel chips that went undiscovered for almost a decade allows hackers to remotely gain full control over affected Windows PCs without needing a password.
The “critical”-rated bug, disclosed by Intel last week, lies in a feature of Intel’s Active Management Technology (more commonly known as just AMT), which allows IT administrators to remotely carry out maintenance and other tasks on entire fleets of computers as if they were there in person, like software updates and wiping hard drives. AMT also allows the administrator to remotely control the computer’s keyboard and mouse, even if the PC is powered off.
To make life easier, AMT was also made available through the web browser — accessible even when the remote PC is asleep — that’s protected by a password set by the admin.
The problem is that a hacker can enter a blank password and still get into the web console, according to independent technical rundowns of the flaw by two security research labs.
Embedi researchers, credited with finding the bug, explained in a whitepaper posted Friday that a flaw in how the default “admin” account for the web interface processes the user’s passwords effectively lets anyone log in by entering nothing at the log-on prompt.
…
Opportunity to stretch your technical chops as fixes are due to roll out May 8th and thereafter.
Of course, as Verizon posted last week:
81% of hacking-related breaches leveraged either stolen and/or weak passwords. (page 3)
Decade old hardware bugs grab headlines but human fails are the bread and butter of cybersecurity.