{"id":54851,"date":"2020-01-05T00:00:00","date_gmt":"2020-01-04T21:00:00","guid":{"rendered":"https:\/\/prohoster.info\/blog\/blog_prohoster\/kak-ya-kupil-zablokirovannyj-noutbuk-na-ebay-i-poproboval-sdelat-svoj-antitheft-na-baze-intelamt"},"modified":"2020-02-18T14:02:54","modified_gmt":"2020-02-18T11:02:54","slug":"kak-ya-kupil-zablokirovannyj-noutbuk-na-ebay-i-poproboval-sdelat-svoj-antitheft-na-baze-intelamt","status":"publish","type":"post","link":"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/kak-ya-kupil-zablokirovannyj-noutbuk-na-ebay-i-poproboval-sdelat-svoj-antitheft-na-baze-intelamt","title":{"rendered":"Jak jsem koupil zablokovan\u00fd notebook na eBay a pokusil se vytvo\u0159it sv\u016fj AntiTheft na z\u00e1klad\u011b IntelAMT","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

\"Jak
\n<\/p>\n

TL;DR<\/h3>\n

\nAbsolute Computrace \u2014 technologie, kter\u00e1 umo\u017e\u0148uje zablokovat za\u0159\u00edzen\u00ed (a ne pouze<\/a><\/noindex>), i kdy\u017e na n\u011bm byla p\u0159einstalov\u00e1na opera\u010dn\u00ed syst\u00e9m nebo dokonce vym\u011bn\u011bn pevn\u00fd disk, za 15 $ ro\u010dn\u011b. Koupil jsem notebook na eBay, kter\u00fd byl touto technologi\u00ed uzam\u010den. V \u010dl\u00e1nku popisuji svou zku\u0161enost, jak jsem se s t\u00edmto probl\u00e9mem vypo\u0159\u00e1dal a pokusil se ud\u011blat tot\u00e9\u017e na z\u00e1klad\u011b Intel AMT, ale zdarma.
\n<\/a><\/noindex>
\nPoj\u010fme se rovnou dohodnout: nevnik\u00e1m do otev\u0159en\u00fdch dve\u0159\u00ed a nep\u00ed\u0161u p\u0159edn\u00e1\u0161ku o t\u011bchto vzd\u00e1len\u00fdch z\u00e1le\u017eitostech, ale vypr\u00e1v\u00edm mal\u00fd p\u0159\u00edb\u011bh a jak rychle z\u00edskat vzd\u00e1len\u00fd p\u0159\u00edstup k m\u00e9mu za\u0159\u00edzen\u00ed v jak\u00e9koliv situaci (pokud je p\u0159ipojeno k s\u00edti pomoc\u00ed RJ-45) nebo, pokud je p\u0159ipojeno p\u0159es Wi-Fi, tak pouze v syst\u00e9mu Windows. Tak\u00e9 je mo\u017en\u00e9 zapsat SSID, u\u017eivatelsk\u00e9 jm\u00e9no a heslo konkr\u00e9tn\u00edho bodu p\u0159\u00edmo do Intel AMT a t\u00edm z\u00edskat p\u0159\u00edstup p\u0159es Wi-Fi bez spu\u0161t\u011bn\u00ed syst\u00e9mu. A pokud nainstalujete ovlada\u010de pro Intel ME na GNU\/Linux, m\u011blo by to tak\u00e9 fungovat. Nakonec nebude mo\u017en\u00e9 zablokovat notebook na d\u00e1lku a zobrazit zpr\u00e1vu o t\u00e9to mo\u017enosti (nedok\u00e1zal jsem zjistit, zda je to vlastn\u011b mo\u017en\u00e9 pomoc\u00ed t\u00e9to technologie), ale p\u0159\u00edstup k vzd\u00e1len\u00e9 plo\u0161e a Secure Erase bude, a to je hlavn\u00ed.<\/p>\n

Taxik\u00e1\u0159 odjel s m\u00fdm notebookem a rozhodl jsem se koupit nov\u00fd na eBay. Co se mohlo pokazit?<\/p>\n

Z kupce v zlod\u011bje \u2014 za jeden start<\/h3>\n

\nKdy\u017e jsem p\u0159inesl notebook dom\u016f z po\u0161ty, pustil jsem se do dokon\u010den\u00ed p\u0159edinstalace Windows 10 a dokonce jsem m\u011bl \u010das nainstalovat Firefox, kdy\u017e najednou:<\/p>\n

\"Jak
\n
\nDob\u0159e jsem si uv\u011bdomoval, \u017ee nikdo by se nem\u011bl pokou\u0161et tak\u00e9 modifikovat distribuci Windows, a pokud by se o to pokusil, v\u0161echno by vypadalo jinak a blokace by se t\u00edm p\u00e1dem stala rychlej\u0161\u00ed. A nakonec by to nem\u011blo smysl blokovat, proto\u017ee v\u0161echno by se dalo opravit p\u0159einstalac\u00ed. Dobr\u00e1, restartujeme.<\/p>\n

Restart do BIOSu a u\u017e je v\u0161echno o n\u011bco jasn\u011bj\u0161\u00ed:<\/p>\n

\"Jak
\n
\nA nakonec je definitivn\u011b jasn\u00e9:<\/p>\n

\"Jak
\n<\/p>\n

Jak to, \u017ee m\u011b \u0161ikanuje vlastn\u00ed notebook? Co je to Computrace?<\/h3>\n

\nStriktn\u011b vzato, Computrace je sada modul\u016f ve va\u0161\u00ed EFI BIOS, kter\u00e9, po spu\u0161t\u011bn\u00ed Windows, do n\u011bj vlo\u017e\u00ed sv\u00e9 trojany, kter\u00e9 komunikuj\u00ed s d\u00e1lkov\u00fdm serverem Absolute software a umo\u017e\u0148uj\u00ed, pokud je to pot\u0159eba, zablokovat syst\u00e9m p\u0159es internet. V\u00edce podrobnost\u00ed si m\u016f\u017eete p\u0159e\u010d\u00edst zde tady<\/a><\/noindex>. S opera\u010dn\u00edmi syst\u00e9my, kter\u00e9 nejsou Windows, Computrace nefunguje. Nav\u00edc, pokud p\u0159ipoj\u00edme za\u0159\u00edzen\u00ed s Windows, kter\u00e9 je za\u0161ifrov\u00e1no pomoc\u00ed BitLocker nebo jin\u00e9ho software, Computrace op\u011bt nebude fungovat \u2014 moduly n\u00e1m prost\u011b nebudou schopny poskytnout sv\u00e9 soubory do syst\u00e9mu.<\/p>\n

Na prvn\u00ed pohled se mohou tyto technologie zd\u00e1t futuristick\u00e9, ale to a\u017e do t\u00e9 doby, ne\u017e zjist\u00edme, \u017ee to v\u0161e prob\u00edh\u00e1 na nativn\u00edm UEFI pomoc\u00ed n\u011bkolika pochybn\u011b funguj\u00edc\u00edch modul\u016f. <\/p>\n

Vypad\u00e1 to, jako by to za\u0159\u00edzen\u00ed bylo studen\u00e9 a v\u0161emocn\u00e9, dokud nezkus\u00edme nap\u0159\u00edklad spustit GNU\/Linux:<\/p>\n

\"Jak
\nNa tomto laptopu je v tuto chv\u00edli aktivov\u00e1na blokace v Computrace<\/i><\/p>\n

Jak se \u0159\u00edk\u00e1,<\/p>\n

\"Jak
\n<\/p>\n

Co d\u011blat?<\/h3>\n

\nExistuj\u00ed \u010dty\u0159i z\u0159ejm\u00e9 zp\u016fsoby, jak vy\u0159e\u0161it dan\u00fd probl\u00e9m:<\/p>\n

    \n
  1. Napsat prodejci na eBay<\/li>\n
  2. Napsat do Absolute Software, tv\u016frci a vlastn\u00edkovi Computrace<\/li>\n
  3. Ud\u011bl\u00e1n\u00ed dumpu z BIOS \u010dipu, posl\u00e1n\u00ed ho podez\u0159el\u00fdm lidem, aby n\u00e1m poslali dump s patchem, kter\u00fd deaktivuje v\u0161echny blokace a zm\u011bn\u00ed ID za\u0159\u00edzen\u00ed<\/li>\n
  4. Zavolat do Lazard<\/li>\n<\/ol>\n

    \nProbereme je postupn\u011b:<\/p>\n

      \n
    1. My, jako\u017eto rozumn\u00ed lid\u00e9, nejprve nap\u00ed\u0161eme prodejci, kter\u00fd n\u00e1m tento produkt prodal, a prodiskutujeme probl\u00e9m s t\u00edm, kdo za n\u011bj odpov\u00edd\u00e1 na prvn\u00edm m\u00edst\u011b.\n

      Hotovo:<\/p>\n

      \"Jak<\/li>\n

    2. Podle rady nalezen\u00e9 v hlubin\u00e1ch internetu,
      \n

      Mus\u00edte kontaktovat Absolute Software. Budou cht\u00edt s\u00e9riov\u00e9 \u010d\u00edslo stroje a s\u00e9riov\u00e9 \u010d\u00edslo z\u00e1kladn\u00ed desky. Tak\u00e9 budete pot\u0159ebovat poskytnout \"d\u016fkaz o koupi\", jako je \u00fa\u010dtenka. Kontaktuj\u00ed majitele, kter\u00e9ho maj\u00ed v z\u00e1znamech, a z\u00edskaj\u00ed souhlas k odstran\u011bn\u00ed. P\u0159edpokl\u00e1d\u00e1me-li, \u017ee nen\u00ed kraden\u00fd, pak jej \"ozna\u010d\u00ed k odstran\u011bn\u00ed\". Pot\u00e9, co se p\u0159\u00ed\u0161t\u011b p\u0159ipoj\u00edte k internetu nebo budete m\u00edt otev\u0159en\u00e9 internetov\u00e9 p\u0159ipojen\u00ed, dojde k z\u00e1zraku a bude to pry\u010d. Po\u0161lete materi\u00e1ly, kter\u00e9 jsem zm\u00ednil, na TechSupport@absolute.com.<\/p><\/blockquote>\n

      \nM\u016f\u017eeme napsat p\u0159\u00edmo do Absolute a komunikovat s nimi ohledn\u011b odblokov\u00e1n\u00ed. Neposp\u00edchal jsem a rozhodl se k tomuto \u0159e\u0161en\u00ed p\u0159istoupit a\u017e na konci.<\/li>\n

    3. Brut\u00e1ln\u00ed \u0159e\u0161en\u00ed probl\u00e9mu, na\u0161t\u011bst\u00ed, u\u017e tak\u00e9 existovalo. Tady jsou ti kluci<\/a><\/noindex> a mnoho dal\u0161\u00edch specialist\u016f na po\u010d\u00edta\u010dovou podporu na eBay a dokonce i lid\u00e9 v Facebooku n\u00e1m slibuj\u00ed, \u017ee n\u00e1m odblokuj\u00ed n\u00e1\u0161 BIOS, pokud jim za\u0161leme dump a po\u010dk\u00e1me p\u00e1r minut.\n

      Proces odblokov\u00e1n\u00ed je pops\u00e1n takto:<\/p>\n

      \u0158e\u0161en\u00ed odem\u010den\u00ed je kone\u010dn\u011b dostupn\u00e9 a vy\u017eaduje SPEG program\u00e1tor, aby bylo mo\u017en\u00e9 p\u0159eflashovat BIOS.<\/p>\n

      Proces je:<\/p>\n

        \n
      1. P\u0159e\u010dten\u00ed BIOSu a vytvo\u0159en\u00ed platn\u00e9ho dumpu. V Thinkpadu je BIOS v\u00e1z\u00e1n na intern\u00ed \u010dip TPM a obsahuje jeho jedine\u010dn\u00fd podpis, tak\u017ee je d\u016fle\u017eit\u00e9, aby byl p\u016fvodn\u00ed BIOS spr\u00e1vn\u011b p\u0159e\u010dten pro \u00fasp\u011b\u0161nost cel\u00e9 operace a n\u00e1slednou obnovu BIOSu.<\/li>\n
      2. \u00daprava BIOSov\u00fdch bin\u00e1rn\u00edch soubor\u016f a injekce mal\u00e9ho allservice.ro UEFI programu. Tento program p\u0159e\u010dte zabezpe\u010den\u00fd EEPROM, resetuje certifik\u00e1t TPM a heslo, nap\u00ed\u0161e zabezpe\u010den\u00fd EEPROM a rekonstruuje v\u0161echna data.<\/li>\n
      3. Napi\u0161te opraven\u00fd BIOS dump (to bude fungovat pouze v tom TP), zapn\u011bte notebook a vygenerujte Hardware ID. Po\u0161leme v\u00e1m jedine\u010dn\u00fd kl\u00ed\u010d, kter\u00fd aktivuje BIOS Allservice, p\u0159i jeho na\u010d\u00edt\u00e1n\u00ed se spust\u00ed odemkac\u00ed rutina a odemkne SVP a TPM.<\/li>\n
      4. Nakonec zapi\u0161te p\u016fvodn\u00ed BIOS dump zp\u011bt pro norm\u00e1ln\u00ed provoz a u\u017e\u00edvejte si notebook.<\/li>\n<\/ol>\n

        \n M\u016f\u017eeme tak\u00e9 deaktivovat Computrace nebo zm\u011bnit SN\/UUID a resetovat chybu kontroln\u00edho sou\u010dtu RFID pomoc\u00ed na\u0161eho UEFI programu stejn\u00fdm zp\u016fsobem, pokud je to nutn\u00e9.<\/p>\n

        Cena slu\u017eby odem\u010den\u00ed je za stroj (jako to d\u011bl\u00e1me pro Macbook\/iMac, HP, Acer atd.) Pro cenu slu\u017eby a dostupnost si pros\u00edm p\u0159e\u010dt\u011bte n\u00e1sleduj\u00edc\u00ed p\u0159\u00edsp\u011bvek. M\u016f\u017eete kontaktovat support@allservice.ro pro jak\u00e9koliv dotazy.\n<\/p><\/blockquote>\n

        \n Vypad\u00e1 to legit! Ale to je tak\u00e9, z d\u016fvod\u016f, kter\u00e9 ch\u00e1pete, varianta pro opravdu zoufalou situaci, nav\u00edc v\u0161echno pot\u011b\u0161en\u00ed stoj\u00ed 80 $. Nech\u00e1me to na pozd\u011bji.<\/li>\n

      5. Pokud mi Lazard v\u0161echno rozbil a \u017e\u00e1d\u00e1 o zp\u011btn\u00e9 zavol\u00e1n\u00ed, nem\u011bl bych odm\u00edtat! Jdeme na to.<\/li>\n<\/ol>\n

        <\/p>\n

        Zavol\u00e1me do Lazard aka \u201ep\u0159edn\u00ed sv\u011btov\u00e1 poradensk\u00e1 a spr\u00e1vcovsk\u00e1 firma, kter\u00e1 rad\u00ed v oblasti f\u00faz\u00ed, akvizic, restrukturalizace, kapit\u00e1lov\u00e9 struktury a strategie\u201c<\/h3>\n

        \nZat\u00edmco mi prod\u00e1vaj\u00edc\u00ed z eBay odpov\u00edd\u00e1, nahr\u00e1v\u00e1m p\u00e1r dolar\u016f na zadarma a t\u011b\u0161\u00edm se na rozhovor s, mo\u017en\u00e1, nejm\u00e9n\u011b empatick\u00fdm partnerem na planet\u011b \u2014 podporou obrovsk\u00e9 finan\u010dn\u00ed korporace z New Yorku. D\u00edvka rychle zved\u00e1 telefon, vyslechne m\u00e9 nesm\u011bl\u00e9 vysv\u011btlen\u00ed, jak jsem tento notebook koupil, zapisuje jeho s\u00e9riov\u00e9 \u010d\u00edslo a slibuje, \u017ee to p\u0159ed\u00e1 administr\u00e1tor\u016fm, kte\u0159\u00ed mi zavolaj\u00ed zp\u011bt. Tento proces se p\u0159esn\u011b opakuje dvakr\u00e1t s odstupem jednoho dne. P\u0159i t\u0159et\u00edm pokusu jsem speci\u00e1ln\u011b po\u010dkal na ve\u010der, dokud bude v New Yorku 10 r\u00e1no, a zavolal, rychle jsem od\u0159\u00edkal u\u017e mi zn\u00e1mou \u0159e\u010d o m\u00e9 koupi. O dv\u011b hodiny pozd\u011bji mi op\u011bt zavolala ta sama \u017eena a za\u010dala \u010d\u00edst instrukce:
        \n \u2014 Stiskn\u011bte escape.
        \nStisknu, ale nic se ned\u011bje.
        \n \u2014 N\u011bco nefunguje, nic se nem\u011bn\u00ed.
        \n \u2014 Stiskn\u011bte.
        \n \u2014 Stisknu.
        \n \u2014 Te\u010f zadejte: 72406917
        \nZad\u00e1v\u00e1m. Nic se ned\u011bje.
        \n \u2014 V\u00edte, ob\u00e1v\u00e1m se, \u017ee to nebude pomoh\u2026 Chvilku\u2026
        \nNotebook se n\u00e1hle restartuje, syst\u00e9m se na\u010d\u00edt\u00e1, otravn\u00e1 b\u00edl\u00e1 obrazovka n\u011bkam zmizela. Pro jistotu vstupuji do BIOSu, Computrace nen\u00ed aktivov\u00e1n. Zd\u00e1 se, \u017ee je to v\u0161e. D\u011bkuji za podporu, p\u00ed\u0161u prod\u00e1vaj\u00edc\u00edmu, \u017ee jsem v\u0161echny ot\u00e1zky vy\u0159e\u0161il s\u00e1m a uvol\u0148uji se.<\/p>\n

        OpenMakeshift Computrace Intel AMT based<\/h3>\n

        \nTo, co se stalo, m\u011b zasko\u010dilo, ale my\u0161lenka se mi zal\u00edbila. Moje fantomov\u00e1 bolest po bezohledn\u011b ztracen\u00e9m hledala n\u011bjak\u00e9 v\u00fdchodisko, cht\u011bl jsem ochr\u00e1nit sv\u016fj nov\u00fd notebook, jako kdyby mi to vr\u00e1tilo ten star\u00fd. Kdy\u017e n\u011bkdo pou\u017e\u00edv\u00e1 Computrace, mohu ho pou\u017e\u00edvat i j\u00e1, \u017ee? V\u017edy\u0165 byl Intel Anti-Theft, podle popisu \u2014 skv\u011bl\u00e1 technologie, funguj\u00edc\u00ed tak, jak m\u00e1, ale trh ji zabil svoj\u00ed inertnost\u00ed, p\u0159esto by m\u011bla existovat alternativa. Uk\u00e1zalo se, \u017ee tato alternativa za\u010d\u00ednala tam, kde kon\u010dila \u2014 na tomto poli se mohla etablovat pouze Absolute software.<\/p>\n

        Nejprve si p\u0159ipome\u0148me, co to je Intel AMT: je to sada knihoven, kter\u00e1 je sou\u010d\u00e1st\u00ed Intel ME, vestav\u011bn\u00e1 do EFI BIOS, aby administr\u00e1tor v n\u011bjak\u00e9 kancel\u00e1\u0159i mohl, ani\u017e by vstal ze \u017eidle, ovl\u00e1dat stroje v s\u00edti, dokonce i kdy\u017e nenab\u00edhaj\u00ed, p\u0159ipojuj\u00edce vzd\u00e1len\u011b ISO soubory, ovl\u00e1daj\u00edc\u00ed p\u0159es vzd\u00e1lenou plochu atd.<\/p>\n

        V\u0161e toto b\u011b\u017e\u00ed na Minix a p\u0159ibli\u017en\u011b na takov\u00e9 \u00farovni:<\/p>\n

        Invisible Things Lab navrhla naz\u00fdvat funk\u010dnost technologie Intel vPro \/ Intel AMT ochrann\u00fdm kruhem -3. V r\u00e1mci t\u00e9to technologie chipsety, kter\u00e9 podporuj\u00ed technologii vPro, obsahuj\u00ed nez\u00e1visl\u00fd mikroprocesor (architektura ARC4), maj\u00ed samostatn\u00e9 rozhran\u00ed k s\u00ed\u0165ov\u00e9 kart\u011b, exkluzivn\u00ed p\u0159\u00edstup k vyhrazen\u00e9 oblasti RAM (16 MB), DMA p\u0159\u00edstup k hlavn\u00ed RAM. Programy na n\u011bm se vykon\u00e1vaj\u00ed nez\u00e1visle na centr\u00e1ln\u00edm procesoru, firmware je ulo\u017een spole\u010dn\u011b s k\u00f3dy BIOS nebo na podobn\u00e9 flash pam\u011bti SPI (k\u00f3d m\u00e1 kryptografick\u00fd podpis). Sou\u010d\u00e1st\u00ed firmwaru je integrovan\u00fd webov\u00fd server. Ve v\u00fdchoz\u00edm nastaven\u00ed je AMT vypnuto, ale \u010d\u00e1st k\u00f3du p\u0159esto funguje v tomto re\u017eimu, i kdy\u017e je AMT vypnuto. K\u00f3d ochrann\u00e9ho kruhu -3 je aktivn\u00ed i v re\u017eimu nap\u00e1jen\u00ed S3 Sleep.<\/p><\/blockquote>\n

        To zn\u00ed l\u00e1kav\u011b, nebo\u0165 se zd\u00e1, \u017ee pokud dok\u00e1\u017eeme nav\u00e1zat zp\u011btn\u00e9 p\u0159ipojen\u00ed k n\u011bjak\u00e9 administraci pomoc\u00ed Intel AMT, m\u016f\u017eeme m\u00edt p\u0159\u00edstup lep\u0161\u00ed ne\u017e k Computrace (ve skute\u010dnosti ne).<\/p>\n

        Aktivujeme Intel AMT na na\u0161em za\u0159\u00edzen\u00ed<\/h3>\n

        \nNejd\u0159\u00edve by n\u011bkte\u0159\u00ed z v\u00e1s ur\u010dit\u011b cht\u011bli vyzkou\u0161et tento AMT na vlastn\u00ed k\u016f\u017ei, a zde za\u010d\u00ednaj\u00ed nuance. Za prv\u00e9: pot\u0159ebujete procesor s jeho podporou. S t\u00edm, na\u0161t\u011bst\u00ed, nen\u00ed probl\u00e9m (pokud nem\u00e1te AMD), nebo\u0165 vPro byla p\u0159id\u00e1na t\u00e9m\u011b\u0159 do v\u0161ech procesor\u016f Intel i5, i7 a i9 (m\u016f\u017eete se pod\u00edvat). tady<\/a><\/noindex>) od roku 2006, p\u0159i\u010dem\u017e skute\u010dn\u00fd VNC byl p\u0159ivezen a\u017e v roce 2010. Za prv\u00e9: pokud m\u00e1te desktop, pot\u0159ebujete z\u00e1kladn\u00ed desku s podporou t\u00e9to funkce, konkr\u00e9tn\u011b s \u010dipovou sadou Q. U notebook\u016f sta\u010d\u00ed zn\u00e1t pouze model procesoru. Pokud jste zjistili, \u017ee podporujete Intel AMT, je to dobr\u00e9 znamen\u00ed a m\u016f\u017eete pou\u017e\u00edt zde uveden\u00e1 nastaven\u00ed. Pokud ne, bu\u010f m\u00e1te sm\u016flu\/ne\u00famysln\u011b jste vybrali procesor nebo \u010dipovou sadu bez podpory t\u00e9to technologie, nebo jste dob\u0159e u\u0161et\u0159ili, kdy\u017e jste si vzali AMD, co\u017e je tak\u00e9 d\u016fvod k radosti. <\/p>\n

        Podle dokument\u016f<\/p>\n

        V re\u017eimu bez zabezpe\u010den\u00ed naslouchaj\u00ed za\u0159\u00edzen\u00ed Intel AMT na portu 16992.
        \n V re\u017eimu TLS naslouchaj\u00ed za\u0159\u00edzen\u00ed Intel AMT na portu 16993.<\/p><\/blockquote>\n

        \nIntel AMT p\u0159ij\u00edm\u00e1 p\u0159ipojen\u00ed na portech 16992 a 16993. Tam se vyd\u00e1me. <\/p>\n

        Je t\u0159eba zkontrolovat, zda je Intel AMT povoleno v BIOSu:<\/p>\n

        \"Jak
        \n
        \nNyn\u00ed se mus\u00edme restartovat a b\u011bhem spu\u0161t\u011bn\u00ed stisknout Ctrl + P<\/p>\n

        \"Jak
        \n
        \nStandardn\u00ed heslo, jak obvykle, admin<\/i>.<\/p>\n

        Hned zm\u011bn\u00edme heslo v obecn\u00fdch nastaven\u00edch Intel ME. D\u00e1le v konfiguraci Intel AMT aktivujeme Network Access. Hotovo. Nyn\u00ed jste ofici\u00e1ln\u011b rizikov\u011b odhaleni. P\u0159ihla\u0161ujeme se do syst\u00e9mu. <\/p>\n

        Nyn\u00ed d\u016fle\u017eit\u00fd nuance: logicky bychom m\u011bli m\u00edt p\u0159\u00edstup k Intel AMT z localhost i na d\u00e1lku, ale nen\u00ed tomu tak. Intel \u0159\u00edk\u00e1, \u017ee lok\u00e1ln\u011b se lze p\u0159ipojit a m\u011bnit nastaven\u00ed pomoc\u00ed N\u00e1stroj pro konfiguraci Intel AMT<\/a><\/noindex>, ale j\u00e1 se k tomu prost\u011b nemohl p\u0159ipojit, tak\u017ee m\u00e9 p\u0159ipojen\u00ed fungovalo pouze na d\u00e1lku. <\/p>\n

        Vezmeme n\u011bjak\u00e9 za\u0159\u00edzen\u00ed a p\u0159ipoj\u00edme se p\u0159es yourIP<\/a><\/noindex>:16992<\/p>\n

        Vypad\u00e1 to takto:<\/p>\n

        \"Jak
        \n
        \n\"Jak
        \n
        \nV\u00edtejte, standardn\u00ed rozhran\u00ed Intel AMT! Pro\u010d \u201estandardn\u00ed\u201c? Proto\u017ee je omezen\u00e9 a pro na\u0161e \u00fa\u010dely zcela zbyte\u010dn\u00e9, a my budeme pou\u017e\u00edvat n\u011bco v\u00e1\u017en\u011bj\u0161\u00edho.<\/p>\n

        Seznamujeme se s MeshCommander<\/h3>\n

        \nJak to b\u00fdv\u00e1 \u2014 velk\u00e9 spole\u010dnosti n\u011bco d\u011blaj\u00ed, a koncov\u00ed u\u017eivatel\u00e9 si to p\u0159izp\u016fsobuj\u00ed podle sebe. Tak se to stalo i zde. <\/p>\n

        \"Jak
        \n
        \nTento skromn\u00fd (nen\u00ed to p\u0159eh\u00e1n\u011bn\u00ed: jeho jm\u00e9no na jeho webov\u00fdch str\u00e1nk\u00e1ch chyb\u00ed, musel jsem si ho vyhledat) mu\u017e jm\u00e9nem Ylian Saint-Hilaire vyvinul skv\u011bl\u00e9 n\u00e1stroje pro pr\u00e1ci s Intel AMT.<\/p>\n

        I hned chci upozornit na jeho YouTube kan\u00e1l<\/a><\/noindex>, ve sv\u00fdch vide\u00edch jednodu\u0161e a srozumiteln\u011b ukazuje v re\u00e1ln\u00e9m \u010dase, jak vykonat r\u016fzn\u00e9 \u00fakoly souvisej\u00edc\u00ed s Intel AMT a jeho softwarem.<\/p>\n

        Za\u010dneme s MeshCommander<\/a><\/noindex>. St\u00e1hneme, nainstalujeme a pokus\u00edme se p\u0159ipojit k na\u0161emu za\u0159\u00edzen\u00ed:<\/p>\n

        \"Jak
        \n
        \nProces nen\u00ed okam\u017eit\u00fd, ale v\u00fdsledkem z\u00edsk\u00e1me takovou obrazovku:<\/p>\n

        \"Jak
        \nNen\u00ed to tak, \u017ee bych byl paranoidn\u00ed, ale sensitive data se dotknu, omluvte mi tuto koket\u00e9rii.<\/i><\/p>\n

        Rozd\u00edl, jak se \u0159\u00edk\u00e1, je z\u0159ejm\u00fd. Nev\u00edm, pro\u010d v \u0159\u00eddic\u00edm panelu Intel nen\u00ed takov\u00e1 sada funkc\u00ed, ale je to fakt: Ylian Saint-Hilaire si z \u017eivota vzal znateln\u011b v\u00edc. Nav\u00edc m\u016f\u017eete jeho webov\u00e9 rozhran\u00ed nainstalovat p\u0159\u00edmo do firmwaru, co\u017e v\u00e1m umo\u017en\u00ed vyu\u017e\u00edvat v\u0161echny funkce bez utility.<\/p>\n

        D\u011bl\u00e1 se to takto:<\/p>\n

        \"Jak
        \n
        \nMus\u00edm poznamenat, \u017ee tuto funkcionalitu (Custom web interface) jsem nepou\u017e\u00edval a nemohu \u0159\u00edci nic o jej\u00ed \u00fa\u010dinnosti a funk\u010dnosti, proto\u017ee pro moje pot\u0159eby nen\u00ed pot\u0159ebn\u00e1.<\/p>\n

        M\u016f\u017eete si s funkcionalitou pohr\u00e1t, t\u011b\u017eko n\u011bco pokaz\u00edte, v\u017edy\u0165 po\u010d\u00e1te\u010dn\u00ed a koncovou v\u00fdchoz\u00ed bodou cel\u00e9ho toho festivalu je BIOS, kde to pak v\u0161echno m\u016f\u017eete resetovat, kdy\u017e vypnete Intel AMT.<\/p>\n

        Rozj\u00ed\u017ed\u00edme MeshCentral a realizujeme BackConnect.<\/h3>\n

        \nA tady za\u010d\u00edn\u00e1 \u00fapln\u00e1 \u0161\u00edlenost. Str\u00fdc neud\u011blal jen klienta, ale tak\u00e9 celou administraci k na\u0161emu trojanu! A nejen to, ale spustil ji pro v\u0161echny na sv\u00e9m serveru.<\/a><\/noindex>.<\/p>\n

        Za\u010dn\u011bte t\u00edm, \u017ee si nainstalujete vlastn\u00ed server MeshCentral, nebo pokud nejste obezn\u00e1meni s MeshCentral, m\u016f\u017eete vyzkou\u0161et ve\u0159ejn\u00fd server na vlastn\u00ed riziko na MeshCentral.com. <\/p><\/blockquote>\n

        \nTo pozitivn\u011b hovo\u0159\u00ed o spolehlivosti jeho k\u00f3du, proto\u017ee se mi nepoda\u0159ilo naj\u00edt \u017e\u00e1dn\u00e9 zpr\u00e1vy o \u00fatoc\u00edch a \u00fanik\u00e1ch b\u011bhem fungov\u00e1n\u00ed slu\u017eby.<\/p>\n

        Osobn\u011b provozuji MeshCentral na sv\u00e9m serveru, proto\u017ee neopodstatn\u011bn\u011b pova\u017euji, \u017ee je to spolehliv\u011bj\u0161\u00ed, ale nen\u00ed to nic jin\u00e9ho ne\u017e zmatek a tr\u00e1pen\u00ed. Pokud to chcete tak\u00e9, tady<\/a><\/noindex> existuj\u00ed dokumenty, a zde<\/a><\/noindex> kontejner s MeshCentral. V dokumentech je naps\u00e1no, jak to v\u0161e propojit v NGINX, tak\u017ee realizace se snadno integruje do va\u0161ich dom\u00e1c\u00edch server\u016f.<\/p>\n

        Registrov\u00e1me se na meshcentral.com<\/a><\/noindex>, p\u0159ihl\u00e1s\u00edme se a vytvo\u0159\u00edme skupinu za\u0159\u00edzen\u00ed, p\u0159i\u010dem\u017e zvol\u00edme mo\u017enost \u201eno agent\u201c:<\/p>\n

        \"Jak
        \n
        \nPro\u010d \u201eno agent\u201c? Proto\u017ee nen\u00ed pot\u0159eba, aby n\u00e1m instaloval n\u011bco zbyte\u010dn\u00e9ho, nen\u00ed jasn\u00e9, jak se to chov\u00e1 a jak to bude fungovat.<\/p>\n

        Klikneme na \u201eAdd CIRA\u201c:<\/p>\n

        \"Jak
        \n
        \nSt\u00e1hneme cira_setup_test.mescript a pou\u017eijeme ho v na\u0161em MeshCommander t\u00edmto zp\u016fsobem:<\/p>\n

        \"Jak
        \n
        \nVoil\u00e0! Za chv\u00edli se na\u0161e za\u0159\u00edzen\u00ed p\u0159ipoj\u00ed k MeshCentral a budeme moci s n\u00edm n\u011bco ud\u011blat.<\/p>\n

        Za prv\u00e9: m\u011bli byste v\u011bd\u011bt, \u017ee n\u00e1\u0161 software nebude s\u00e1m od sebe komunikovat s vzd\u00e1len\u00fdm serverem. Je to d\u00e1no t\u00edm, \u017ee Intel AMT m\u00e1 dv\u011b mo\u017enosti p\u0159ipojen\u00ed \u2014 p\u0159es vzd\u00e1len\u00fd server a p\u0159\u00edmo lok\u00e1ln\u011b. Oba najednou nefunguj\u00ed. N\u00e1\u0161 skript ji\u017e nastavil syst\u00e9m pro vzd\u00e1lenou pr\u00e1ci, ale mo\u017en\u00e1 se budete muset p\u0159ipojit lok\u00e1ln\u011b. Aby bylo mo\u017en\u00e9 p\u0159ipojit se lok\u00e1ln\u011b, je t\u0159eba zde<\/p>\n

        \"Jak
        \n
        \nnapsat \u0159et\u011bzec, kter\u00fd je va\u0161\u00edm lok\u00e1ln\u00edm dom\u00e9nou (v\u0161imn\u011bte si, \u017ee n\u00e1\u0161 skript tam JI\u017d vlo\u017eil n\u011bjak\u00fd n\u00e1hodn\u00fd \u0159et\u011bzec, aby bylo mo\u017en\u00e9 p\u0159ipojen\u00ed vzd\u00e1len\u011b) nebo \u00fapln\u011b vymazat v\u0161echny \u0159et\u011bzce (ale pak nebude vzd\u00e1len\u00e9 p\u0159ipojen\u00ed dostupn\u00e9). Nap\u0159\u00edklad, v m\u00e9m OpenWrt je lok\u00e1ln\u00ed dom\u00e9na lan:<\/p>\n

        \"Jak
        \n
        \nPokud tedy nap\u00ed\u0161eme lan a pokud je na\u0161e za\u0159\u00edzen\u00ed p\u0159ipojeno k s\u00edti s touto lok\u00e1ln\u00ed dom\u00e9nou, vzd\u00e1len\u00e9 p\u0159ipojen\u00ed bude nedostupn\u00e9 a lok\u00e1ln\u00ed porty 16992 a 16993 se otev\u0159ou a budou p\u0159ij\u00edmat p\u0159ipojen\u00ed. Zkr\u00e1tka, pokud tam bude n\u011bjak\u00e1 nesmysln\u00e1 v\u011bc, kter\u00e1 nem\u00e1 \u017e\u00e1dn\u00fd vztah k va\u0161\u00ed lok\u00e1ln\u00ed dom\u00e9n\u011b, software se pokou\u0161\u00ed p\u0159ipojit, pokud ne, mus\u00edte se k n\u011bmu p\u0159ipojit sami kabelem, to je v\u0161e.<\/p>\n

        Za druh\u00e9:<\/p>\n

        \"Jak
        \n
        \nV\u0161echno je p\u0159ipraveno!<\/p>\n

        Zept\u00e1te se \u2014 kde je tu AntiTheft? Jak jsem \u0159ekl na za\u010d\u00e1tku \u2014 Intel AMT nen\u00ed p\u0159\u00edli\u0161 p\u0159izp\u016fsoben pro boj s kr\u00e1de\u017eemi. Spravovat kancel\u00e1\u0159skou s\u00ed\u0165 \u2014 to je v po\u0159\u00e1dku, ale bojovat s neopr\u00e1vn\u011bn\u011b z\u00edskan\u00fdm majetkem prost\u0159ednictv\u00edm internetov\u00e9 s\u00edt\u011b \u2014 to u\u017e nen\u00ed moc. Pod\u00edvejme se na n\u00e1stroje, kter\u00e9 n\u00e1m teoreticky mohou pomoci v boji za soukrom\u00e9 vlastnictv\u00ed: <\/p>\n

          \n
        1. Samotn\u00e1 p\u0159\u00edtomnost p\u0159\u00edstupu k za\u0159\u00edzen\u00ed, pokud je p\u0159ipojeno kabelem, nebo pokud m\u00e1 Windows, pak i p\u0159es WiFi. Ano, d\u011btinsk\u00e1 z\u00e1le\u017eitost, ale pro oby\u010dejn\u00e9ho \u010dlov\u011bka je velmi t\u011b\u017ek\u00e9 pou\u017e\u00edvat takov\u00fd notebook, i kdy\u017e n\u011bkdo n\u00e1hle p\u0159eb\u00edr\u00e1 kontrolu. Nen\u00ed divu, \u017ee i kdy\u017e jsem se nedok\u00e1zal vypo\u0159\u00e1dat se skripty, ur\u010dit\u011b je mo\u017en\u00e9 kreativn\u011b odstranit n\u011bjakou funkcionalitu pro blokov\u00e1n\u00ed\/vypnut\u00ed notifikac\u00ed.<\/li>\n
        2. Remote Secure Erase with Intel Active Management Technology\n

          \"Jak
          \n
          \nS pomoc\u00ed t\u00e9to mo\u017enosti lze odstranit v\u0161echny informace z za\u0159\u00edzen\u00ed b\u011bhem n\u011bkolika sekund. Nen\u00ed zji\u0161t\u011bno, zda funguje na SSD jin\u00fdch ne\u017e Intel. Zde           tady<\/a><\/noindex> si m\u016f\u017eete p\u0159e\u010d\u00edst v\u00edce o t\u00e9to funkci. M\u016f\u017eete se pod\u00edvat, jak to funguje tady<\/a><\/noindex>Kvalita je hrozn\u00e1, ale je to jen 10 megabajt\u016f a podstata je jasn\u00e1.<\/li>\n<\/ol>\n

          \nZ\u016fst\u00e1v\u00e1 nevy\u0159e\u0161en\u00fd probl\u00e9m odlo\u017een\u00e9ho vykon\u00e1v\u00e1n\u00ed, jin\u00fdmi slovy: je t\u0159eba hl\u00eddat, kdy se stroj p\u0159ipoj\u00ed k s\u00edti, abychom se k n\u011bmu mohli p\u0159ipojit. P\u0159edpokl\u00e1d\u00e1m, \u017ee na to tak\u00e9 existuje n\u011bjak\u00e9 \u0159e\u0161en\u00ed.<\/p>\n

          V ide\u00e1ln\u00edm p\u0159\u00edpad\u011b by se m\u011bl notebook zablokovat a zobrazit n\u011bjak\u00fd n\u00e1pis, ale v na\u0161em p\u0159\u00edpad\u011b m\u00e1me pouze nevyhnuteln\u00fd p\u0159\u00edstup, a jak d\u00e1le jednat \u2014 to je v\u011bc fantazie. <\/p>\n

          Mo\u017en\u00e1 se v\u00e1m poda\u0159\u00ed n\u011bjak zablokovat stroj nebo alespo\u0148 zobrazit zpr\u00e1vu, dejte v\u011bd\u011bt, pokud to v\u00edte. D\u011bkuji!<\/p>\n

          Nezapome\u0148te nastavit heslo na BIOS.<\/p>\n

          D\u011bkuji u\u017eivateli berez<\/a><\/noindex> za korekturu!<\/i>
          \n
          Zdroj:           habr.com<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

          TL;DR Absolute Computrace \u2014 \u0442\u0435\u0445\u043d\u043e\u043b\u043e\u0433\u0438\u044f, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0437\u0430\u0431\u043b\u043e\u043a\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u043c\u0430\u0448\u0438\u043d\u0443(\u0438 \u043d\u0435 \u0442\u043e\u043b\u044c\u043a\u043e), \u0434\u0430\u0436\u0435 \u0435\u0441\u043b\u0438 \u043d\u0430 \u043d\u0435\u0439 \u043f\u0435\u0440\u0435\u0443\u0441\u0442\u0430\u043d\u043e\u0432\u0438\u043b\u0438 \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u0443\u044e \u0441\u0438\u0441\u0442\u0435\u043c\u0443 \u0438\u043b\u0438 \u0434\u0430\u0436\u0435 \u0437\u0430\u043c\u0435\u043d\u0438\u043b\u0438 \u0436\u0435\u0441\u0442\u043a\u0438\u0439 \u0434\u0438\u0441\u043a, \u0437\u0430 $15 \u0432 \u0433\u043e\u0434. \u042f \u043a\u0443\u043f\u0438\u043b \u043d\u043e\u0443\u0442\u0431\u0443\u043a \u043d\u0430 eBay, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u0431\u044b\u043b \u0437\u0430\u043b\u043e\u0447\u0435\u043d \u044d\u0442\u043e\u0439 \u0448\u0442\u0443\u043a\u043e\u0439. \u0412 \u0441\u0442\u0430\u0442\u044c\u0435 \u043e\u043f\u0438\u0441\u044b\u0432\u0430\u0435\u0442\u0441\u044f \u043c\u043e\u0439 \u043e\u043f\u044b\u0442, \u043a\u0430\u043a \u044f \u0441 \u043d\u0435\u0439 \u0431\u043e\u0440\u043e\u043b\u0441\u044f \u0438 \u043f\u044b\u0442\u0430\u043b\u0441\u044f \u0441\u0434\u0435\u043b\u0430\u0442\u044c \u0442\u043e \u0436\u0435 \u0441\u0430\u043c\u043e\u0435 \u043d\u0430 \u0431\u0430\u0437\u0435 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-54851","post","type-post","status-publish","format-standard","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Jak jsem koupil zablokovan\u00fd notebook na eBay a pokusil se vytvo\u0159it sv\u016fj AntiTheft na b\u00e1zi IntelAMT | ProHoster","description":".","canonical_url":"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/kak-ya-kupil-zablokirovannyj-noutbuk-na-ebay-i-poproboval-sdelat-svoj-antitheft-na-baze-intelamt","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"cs_CZ","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041a\u0430\u043a \u044f \u043a\u0443\u043f\u0438\u043b \u0437\u0430\u0431\u043b\u043e\u043a\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0439 \u043d\u043e\u0443\u0442\u0431\u0443\u043a \u043d\u0430 eBay \u0438 \u043f\u043e\u043f\u0440\u043e\u0431\u043e\u0432\u0430\u043b \u0441\u0434\u0435\u043b\u0430\u0442\u044c \u0441\u0432\u043e\u0439 AntiTheft \u043d\u0430 \u0431\u0430\u0437\u0435 IntelAMT | ProHoster","og:description":".","og:url":"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/kak-ya-kupil-zablokirovannyj-noutbuk-na-ebay-i-poproboval-sdelat-svoj-antitheft-na-baze-intelamt","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-01-04T21:00:00+00:00","article:modified_time":"2020-02-18T11:02:54+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"54851","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-24 12:57:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 19:56:25","updated":"2026-01-24 12:57:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/54851","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/comments?post=54851"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/54851\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/media?parent=54851"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/categories?post=54851"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/tags?post=54851"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}