# Security

## Plain HTTP (16992) versus TLS (16993)

Out of the box, AMT talks WS-Management on **16992 over plain HTTP**. HTTP Digest (MD5)
keeps the password off the wire. Everything else travels in the clear, including the
machine's inventory and every power command, and nothing stops a man in the middle from
replaying or changing them. TLS on 16993 needs a certificate and key provisioned into AMT
(`AMT_PublicKeyManagementService`, `AMT_TLSSettingData`); MEBx alone cannot set it up.

`get_management_protocols` reports `http` enabled while AMT accepts plain connections from
the network. Like IPMI over LAN for a server BMC, that is worth a finding in netOrk.

The driver verifies AMT's certificate on 16993 by default (`verify_ssl=True`). A
self-signed certificate needs `verify_ssl` set to its CA file, or `False`.

## Accounts

MEBx setup leaves one account, `admin`, with every right. AMT can hold more Digest
accounts, each limited to *realms* (`AMT_AuthorizationService`). Reading needs the
hardware asset, general info and event log realms; power control needs remote control.
A separate account for netOrk keeps `admin` out of it, but is not required.

AMT locks an account out for a while after repeated failed logins and writes the failures
to its event log ("Authentication failed N times"). The driver reports that entry as
Critical.

## KVM, SOL and IDE-R

- The **KVM console** goes over the redirection port (16994, or 16995 with TLS), behind
  the AMT login. With **port 5900** enabled, AMT additionally speaks plain VNC, protected
  only by an eight-character RFB password. Worth a finding when on.
- **User consent** (opt-in) asks the person at the machine for a code before KVM starts.
  It is mandatory in Client Control Mode and optional in Admin Control Mode, which MEBx
  setup gives.
- **IDE-R/USB-R** (virtual media) lets whoever holds the login boot the machine from a
  remote image.

## Known vulnerabilities

AMT's firmware has a long CVE history. Most important is **CVE-2017-5689**
(INTEL-SA-00075): AMT 6 to 11.6 accepted an empty Digest response, so anyone on the
network got in without a password. Fixed firmware came through the PC vendors (Lenovo:
ME firmware updates). Many later advisories cover ME/AMT 11.x (SA-00086, SA-00112,
SA-00213, SA-00241, SA-00295 and others).

`get_firmware_inventory` reports AMT's version with its build (`11.8.50.3399`), and AMT
sends the same version without a login in its `Server` header. That version is what netOrk
needs to match advisories, and what a finding for outdated AMT firmware would rest on.

## Power control

`set_power_state` switches the machine itself, like a power button. It checks the action
against the power state and AMT's list of accepted states first, and refuses `On` for a
running machine. `ForceOff`, `ForceRestart` and `PowerCycle` do not ask the operating
system. The graceful actions need the operating system's cooperation, and AMT lists them
only where the host supports them.