5 ms·

The features are included in all modern Intel CPUs AFAIK, if you found one where it wasn't included please let me know as its absence would be a feature for me.

The features are included in all modern Intel CPUs AFAIK, if you found one where it wasn't included please let me know as its absence would be a feature for me. As for the number of people who think remote access is bad, nobody seems to be denying it can be useful, but by baking it into hardware you're basically hoping that it doesn't get hacked. If it was an optional dongle nobody would care.

deleted 10y ago
[deleted]
stakent 10y ago
Exactly. Optional, hardware mediated remote access is good.
luma 10y ago
The remote access part is called AMT[1] and is part of the Intel vPro[2] feature set. It most certainly is not enabled in all modern Intel processors. Further, it requires a compatible processor, chipset, and BIOS for it to be enabled. There is a common misunderstanding in these discussions that the ME features of the Intel processor (included in nearly all modern procs) allows for hardware level remote access, which isn't true. [1] https://en.wikipedia.org/wiki/Intel_Active_Management_Technology https://en.wikipedia.org/wiki/Intel_Active_Management_Techno... [2] https://en.wikipedia.org/wiki/Intel_vPro https://en.wikipedia.org/wiki/Intel_vPro
- dlmetcalf 10y ago
  Yeah, right. I suppose we're just supposed to take their word for that. There's an enormous difference between the concepts of trusted and trustworthy. You're extremely naive or clearly never read anything Snowden released if you think 'trust us' is enough.
  - luma 10y ago
    Are you suggesting Intel has implemented hidden backdoors into all of their systems?
    - livus 10y ago
      Not OP but it could be very much possible and that's what OP is trying to say. Just taking it on Intel's word that they haven't done it is not the correct way to go. For the truly privacy minded, it's better to err on the side of caution.
      - luma 10y ago
        Err on the side of caution in this sense would mean fabricating your own proc. Are you going to do that?
        colejohnson66 10y ago
        How do you know the fab you send your design to doesn't implement a backdoor? You have to have trust at SOME level.
        luma 10y ago
        That is exactly my point. If you don't trust Intel, then who are you suggesting should build your processor? Unless you are going to design and fabricate your entire system top to bottom, and have no other persons involved who could surreptitiously insert evil code, then you're going to have to accept some degree of trust in a 3rd party.
        dlmetcalf 10y ago
        It's not just Intel you're trusting, it's the OEMs, who also have an EXTREMELY poor record. Just take a look at the ENORMOUS number up BMC and auto-update vulnerabilities. They really just either couldn't care less, or are deliberately making machines vulnerable. Things are being pushed into IME, that aren't optional, often aren't wanted by users (or snuck in there so they wouldn't know), don't all have to be there, can't be verifiably disabled or overriden by end users. Even if it weren't backdoored (unlikely), it presents an ENORMOUS attack surface at the very worst possible privilege level. Open source designs that are at least inspectable by researchers would be a start. But more importantly - allowing users to CHOOSE whether they want to override software (it IS after all software and not hardware). Why shouldn't we be permitted to run Libreboot etc on modern hardware and know that when we turn a machine off, that it's off, without unplugging network, power cables, batteries, etc?
- ZenoArrow 10y ago
  From what I've seen, Intel ME is the set of CPU features that supports applications such as Intel AMT. As Intel ME is built into all modern x86/x64 Intel CPUs, the possibility for exploiting Intel ME is still a security issue, even if some features aren't enabled by default. To put it another way, what are some of the details that the author(s) of this article got wrong? https://libreboot.org/faq/#intel https://libreboot.org/faq/#intel
  - luma 10y ago
    None, but you are taking away from it things that the article doesn't say. AMT is a subset of ME, it's not available on all procs, and even if it is available, it also requires the supporting chipset. Nearly everyone reading this on a laptop/desktop system is doing so on an Intel processor. Go ahead and attempt to enable remote access without a supported proc/chipset/bios and then come back and complain about this unexpected remote access. There is a lot of misunderstanding about this technology in the security world which strikes me odd because it's well-documented and readily available for your own testing.
    - e12e 10y ago
      True enough. But as I mentioned, I was rather terrified when I tried this on my thinkpad laptop. I'm sure many other business laptops have similar facilities (and yes, of course it is a feature to be able to manage a large fleet of machines, both work stations and servers). As for trust, first, what we generally know is that any complex system is likely to have flaws. So any remote access system is likely a back door - intentionally or not. A physical off switch would be prudent (arguably switching off wireless network card and not connecting an ethernet cable is one option: but then your options are: no networking or possible vulnerability). It's not as if any networked machine is "perfectly secure" - but it'd be nice to be able to set the scope of exposure even more easily, and granularly. Second, one thing is trusting Intel to not intentionally install a back-door - keeping in mind that includes any "golden key" for updates. And not leaving any holes in the interface they expose (ie:getting the feature right). That in itself is a pretty high bar, imnho. But another thing is trusting Intel not to build in secret backdoors - that is; if they say, no, there's no IME in product X, then trust them on that. That is to me a much more trivial thing to trust. I know there will be bugs in the software and hardware, but I'm not all that afraid of maliciousness. If I was working for a Chinese intelligence service the threat model might have been different. In sum, given that there's bound to be bugs, and might be well-intentioned software upgrade support - I would prefer if it was easier to buy high-end parts without stuff like IME (this also applies to AMD btw) - or at least that it was easy to remove a jumper or toggle a dip switch to turn the stuff completely off. [ed: finally re: server Vs laptop: there are some things that doesn't matter as much if it's exposed on a server: got my encrypted backups? Encrypted email? No problem. Got my secret key from my laptop? that is a problem]
scrupulusalbion 10y ago
TL;DR: Build yourself a desktop with a non-vPro CPU and a non-Intel NIC. Check [0] for a list of such CPUs. The usual recommendation is to either get a pre-2009 AMD machine (which is what my present desktop is) or get a Sparc machine. My boss won't buy me a desktop with an UltraSparc CPU, so I won't bother with that. AMD has substantially less documentation than Intel, AFAICT, so Intel products deserve investigation for their relative starkness. An albeit outdate list of systems to avoid, see [1]. I will assume that you are trying to build a desktop from off-the-shelf parts. For sure, get a CPU without vPro, since that downgrades the type of AMT/IME feature set to Standard Manageability: "Please note that NON -vPro™ Intel® desktop procesors will make Intel® ME FW to switch its features set from full Intel® Active Management Technology to Intel® Standard Manageability that do not suport Intel® AMT KVM Redirection feature (it is disabled internally in the Intel® ME FW)." [2] When the CPU doesn't support AMT, then Standard Manageability is what is running in the background. This says 2 things: (1) non-vPro desktop CPUs downgrade AMT to Standard Manageability and (2) IME is active regardless of the CPU's feature set. What is Intel Standard Manageability? "Q8: What is Intel® Standard Manageability and can it run on a non-Intel® vPro™ technology-based CPU? A8: Some basic management capabilities are available on non-Intel® vPro™ technology-eligible Intel® Core™2 processors as well as Intel® Pentium® dual-core and Intel® Celeron® processor-based CPUs. Intel® Standard Manageability is available only on desktop systems right now (not notebook), and only includes basic capabilities such as hardware and software inventory and remote diagnostics." [3] I can't tell if Standard Manageability is a lite version of AMT. Intel's documentation on it [4] isn't a whole lot of help. Intel mentions that Atom and i3 platforms generally do not support AMT. [5] At the bottom of this [6] page lists those Intel chipsets with IME. I'd consider that to be a list of chipsets to avoid, but those cover almost all modern chipsets, AFAIK. For sure, don't use any Intel NICs: "Adding another NIC will not nullify Intel® vPro™ technology verification, but Intel® Active Management Technology communicates only through the onboard network interface of Intel vPro technology, and it is strongly recommended that an additional wired NIC is not added to the platform as this might cause some of the features of Intel AMT to not operate as expected." [7] [0] = http://ark.intel.com/search/advanced?s=t&VProTechnology=false http://ark.intel.com/search/advanced?s=t&VProTechnology=fals... [1] = https://communities.intel.com/docs/DOC-2033 https://communities.intel.com/docs/DOC-2033 [2] = https://communities.intel.com/thread/65350 https://communities.intel.com/thread/65350 [3] = https://software.intel.com/en-us/articles/intel-vpro-technology-faq https://software.intel.com/en-us/articles/intel-vpro-technol... [4] = https://software.intel.com/en-us/blogs/2009/03/27/what-is-standard-manageability https://software.intel.com/en-us/blogs/2009/03/27/what-is-st... [5] = http://www.intel.com/content/dam/www/public/us/en/include/retail-client-manager-help/Technical_Notes/Remote_control/tech-remote.html http://www.intel.com/content/dam/www/public/us/en/include/re... [6] = https://www.kernel.org/doc/Documentation/misc-devices/mei/mei.txt https://www.kernel.org/doc/Documentation/misc-devices/mei/me... [7] = https://software.intel.com/en-us/articles/intel-vpro-technology-faq https://software.intel.com/en-us/articles/intel-vpro-technol...

deleted 10y ago

[deleted]

stakent 10y ago

Exactly. Optional, hardware mediated remote access is good.

luma 10y ago

The remote access part is called AMT[1] and is part of the Intel vPro[2] feature set. It most certainly is not enabled in all modern Intel processors. Further, it requires a compatible processor, chipset, and BIOS for it to be enabled. There is a common misunderstanding in these discussions that the ME features of the Intel processor (included in nearly all modern procs) allows for hardware level remote access, which isn't true. [1] https://en.wikipedia.org/wiki/Intel_Active_Management_Technology https://en.wikipedia.org/wiki/Intel_Active_Management_Techno... [2] https://en.wikipedia.org/wiki/Intel_vPro https://en.wikipedia.org/wiki/Intel_vPro

dlmetcalf 10y ago
Yeah, right. I suppose we're just supposed to take their word for that. There's an enormous difference between the concepts of trusted and trustworthy. You're extremely naive or clearly never read anything Snowden released if you think 'trust us' is enough.
- luma 10y ago
  Are you suggesting Intel has implemented hidden backdoors into all of their systems?
  - livus 10y ago
    Not OP but it could be very much possible and that's what OP is trying to say. Just taking it on Intel's word that they haven't done it is not the correct way to go. For the truly privacy minded, it's better to err on the side of caution.
    - luma 10y ago
      Err on the side of caution in this sense would mean fabricating your own proc. Are you going to do that?
      - colejohnson66 10y ago
        How do you know the fab you send your design to doesn't implement a backdoor? You have to have trust at SOME level.
        luma 10y ago
        That is exactly my point. If you don't trust Intel, then who are you suggesting should build your processor? Unless you are going to design and fabricate your entire system top to bottom, and have no other persons involved who could surreptitiously insert evil code, then you're going to have to accept some degree of trust in a 3rd party.
        dlmetcalf 10y ago
        It's not just Intel you're trusting, it's the OEMs, who also have an EXTREMELY poor record. Just take a look at the ENORMOUS number up BMC and auto-update vulnerabilities. They really just either couldn't care less, or are deliberately making machines vulnerable. Things are being pushed into IME, that aren't optional, often aren't wanted by users (or snuck in there so they wouldn't know), don't all have to be there, can't be verifiably disabled or overriden by end users. Even if it weren't backdoored (unlikely), it presents an ENORMOUS attack surface at the very worst possible privilege level. Open source designs that are at least inspectable by researchers would be a start. But more importantly - allowing users to CHOOSE whether they want to override software (it IS after all software and not hardware). Why shouldn't we be permitted to run Libreboot etc on modern hardware and know that when we turn a machine off, that it's off, without unplugging network, power cables, batteries, etc?
ZenoArrow 10y ago
From what I've seen, Intel ME is the set of CPU features that supports applications such as Intel AMT. As Intel ME is built into all modern x86/x64 Intel CPUs, the possibility for exploiting Intel ME is still a security issue, even if some features aren't enabled by default. To put it another way, what are some of the details that the author(s) of this article got wrong? https://libreboot.org/faq/#intel https://libreboot.org/faq/#intel
- luma 10y ago
  None, but you are taking away from it things that the article doesn't say. AMT is a subset of ME, it's not available on all procs, and even if it is available, it also requires the supporting chipset. Nearly everyone reading this on a laptop/desktop system is doing so on an Intel processor. Go ahead and attempt to enable remote access without a supported proc/chipset/bios and then come back and complain about this unexpected remote access. There is a lot of misunderstanding about this technology in the security world which strikes me odd because it's well-documented and readily available for your own testing.
  - e12e 10y ago
    True enough. But as I mentioned, I was rather terrified when I tried this on my thinkpad laptop. I'm sure many other business laptops have similar facilities (and yes, of course it is a feature to be able to manage a large fleet of machines, both work stations and servers). As for trust, first, what we generally know is that any complex system is likely to have flaws. So any remote access system is likely a back door - intentionally or not. A physical off switch would be prudent (arguably switching off wireless network card and not connecting an ethernet cable is one option: but then your options are: no networking or possible vulnerability). It's not as if any networked machine is "perfectly secure" - but it'd be nice to be able to set the scope of exposure even more easily, and granularly. Second, one thing is trusting Intel to not intentionally install a back-door - keeping in mind that includes any "golden key" for updates. And not leaving any holes in the interface they expose (ie:getting the feature right). That in itself is a pretty high bar, imnho. But another thing is trusting Intel not to build in secret backdoors - that is; if they say, no, there's no IME in product X, then trust them on that. That is to me a much more trivial thing to trust. I know there will be bugs in the software and hardware, but I'm not all that afraid of maliciousness. If I was working for a Chinese intelligence service the threat model might have been different. In sum, given that there's bound to be bugs, and might be well-intentioned software upgrade support - I would prefer if it was easier to buy high-end parts without stuff like IME (this also applies to AMD btw) - or at least that it was easy to remove a jumper or toggle a dip switch to turn the stuff completely off. [ed: finally re: server Vs laptop: there are some things that doesn't matter as much if it's exposed on a server: got my encrypted backups? Encrypted email? No problem. Got my secret key from my laptop? that is a problem]

scrupulusalbion 10y ago

TL;DR: Build yourself a desktop with a non-vPro CPU and a non-Intel NIC. Check [0] for a list of such CPUs. The usual recommendation is to either get a pre-2009 AMD machine (which is what my present desktop is) or get a Sparc machine. My boss won't buy me a desktop with an UltraSparc CPU, so I won't bother with that. AMD has substantially less documentation than Intel, AFAICT, so Intel products deserve investigation for their relative starkness. An albeit outdate list of systems to avoid, see [1]. I will assume that you are trying to build a desktop from off-the-shelf parts. For sure, get a CPU without vPro, since that downgrades the type of AMT/IME feature set to Standard Manageability: "Please note that NON -vPro™ Intel® desktop procesors will make Intel® ME FW to switch its features set from full Intel® Active Management Technology to Intel® Standard Manageability that do not suport Intel® AMT KVM Redirection feature (it is disabled internally in the Intel® ME FW)." [2] When the CPU doesn't support AMT, then Standard Manageability is what is running in the background. This says 2 things: (1) non-vPro desktop CPUs downgrade AMT to Standard Manageability and (2) IME is active regardless of the CPU's feature set. What is Intel Standard Manageability? "Q8: What is Intel® Standard Manageability and can it run on a non-Intel® vPro™ technology-based CPU? A8: Some basic management capabilities are available on non-Intel® vPro™ technology-eligible Intel® Core™2 processors as well as Intel® Pentium® dual-core and Intel® Celeron® processor-based CPUs. Intel® Standard Manageability is available only on desktop systems right now (not notebook), and only includes basic capabilities such as hardware and software inventory and remote diagnostics." [3] I can't tell if Standard Manageability is a lite version of AMT. Intel's documentation on it [4] isn't a whole lot of help. Intel mentions that Atom and i3 platforms generally do not support AMT. [5] At the bottom of this [6] page lists those Intel chipsets with IME. I'd consider that to be a list of chipsets to avoid, but those cover almost all modern chipsets, AFAIK. For sure, don't use any Intel NICs: "Adding another NIC will not nullify Intel® vPro™ technology verification, but Intel® Active Management Technology communicates only through the onboard network interface of Intel vPro technology, and it is strongly recommended that an additional wired NIC is not added to the platform as this might cause some of the features of Intel AMT to not operate as expected." [7] [0] = http://ark.intel.com/search/advanced?s=t&VProTechnology=false http://ark.intel.com/search/advanced?s=t&VProTechnology=fals... [1] = https://communities.intel.com/docs/DOC-2033 https://communities.intel.com/docs/DOC-2033 [2] = https://communities.intel.com/thread/65350 https://communities.intel.com/thread/65350 [3] = https://software.intel.com/en-us/articles/intel-vpro-technology-faq https://software.intel.com/en-us/articles/intel-vpro-technol... [4] = https://software.intel.com/en-us/blogs/2009/03/27/what-is-standard-manageability https://software.intel.com/en-us/blogs/2009/03/27/what-is-st... [5] = http://www.intel.com/content/dam/www/public/us/en/include/retail-client-manager-help/Technical_Notes/Remote_control/tech-remote.html http://www.intel.com/content/dam/www/public/us/en/include/re... [6] = https://www.kernel.org/doc/Documentation/misc-devices/mei/mei.txt https://www.kernel.org/doc/Documentation/misc-devices/mei/me... [7] = https://software.intel.com/en-us/articles/intel-vpro-technology-faq https://software.intel.com/en-us/articles/intel-vpro-technol...