Rediscovering the Intel AMT Vulnerability
<i>Next, we reduced the response hash to one hex digit and authentication still worked. Continuing to dig, we used a NULL&#x2F;empty response hash (response=&quot;&quot; in the HTTP Authorization header).<p>Authentication still worked. We had discovered a complete bypass of the authentication scheme.</i><p>What. the. fuck.<p>This is not the kind of bug you should ship in <i>anything</i> if you have the barest bit of testing in place, much less a large company like Intel, in an enterprise feature which has a lot of security ramifications, and which has apparently existed for a long time (years?).<p>Edit: Also, this is really good evidence for short and hard disclosure deadlines.  What&#x27;s the chance something as simple as this wasn&#x27;t known by someone else?  All they had to do was decide to look and they found something within minutes.  It&#x27;s not like this is obscure or doesn&#x27;t get your much, it&#x27;s about as juicy as they come.