4 ms·

> If the IME is disabled, will the CPU still complain if you physically destroy the thing? Does anyone know? If I'm remembering correctly, if the CPU doesn't r

> If the IME is disabled, will the CPU still complain if you physically destroy the thing? Does anyone know? If I'm remembering correctly, if the CPU doesn't receive a heartbeat from IME within 30 minutes, it shuts down the hardware.[1]. There are also different levels of the thing. There's a basic level that handles some kind of low-level system monitoring. The remote access stuff is usually marketed as "vPro", and it's sold as a premium feature. That's the one with direct access to the networking hardware, transmitting packets over the same physical interface, but using its own unique MAC address. [1] https://hackaday.com/tag/intel-management-engine/ https://hackaday.com/tag/intel-management-engine/

nickpsecurity 10y ago
With how ASIC & firmware companies do things, best to assume they're all the same thing until proven otherwise. As in, the circuitry and software for doing any of that is there but only made visible/usable to by a configuration that changes the more they pay. This is the most economical thing for hardware makers to do as they build just one thing instead of several things. This was also the trick some hard disk makers use where they put the same platter in all the drives but a firmware option limited how much was visible to user (less money = less visible).
- khedoros1 10y ago
  So the next question would be whether it's possible to remotely reconfigure the "non-vPro" machine to activate the features, in which case it could be considered a direct equivalent.
  - nickpsecurity 10y ago
    And that's what we don't and can't know the answer to since it's a black box. Hence, that circuitry can't ever be present on a machine if one is worried about potential compromises or subversions of it.
  - Bartweiss 10y ago
    Derefr's answer in this thread suggests that you can insulate against this regardless of how the vPro activation works; not all motherboards support the parallel packet stream, so you can get a vPro incompatible motherboard and trust that even if there is a "wake and activate" command it won't be received.
    - 1001101 10y ago
      Examine the binary for a run of the mill system sometime and check out the partition headers/manifest, see if you are convinced there are no networking functions in there. The processor in my laptop supports WoL (and I've tested that it works), but is not vPro (double-checked with Ark). I'm skeptical.
derefr 10y ago
The "low-level system monitoring" is effectively a software implementation of any "active" ACPI logic (e.g. Intel's SpeedStep.) This used to be in a separate "platform controller", but putting it in an on-CPU-die coprocessor 1. allows the ACPI logic to be regular x86_64 code, and 2. allows much simpler motherboard layout wiring (because you don't need a bunch of duplicate pinouts running from peripherals to both the CPU and platform controller; they can all just go to the CPU.) > The remote access stuff is usually marketed as "vPro", and it's sold as a premium feature. AFAIK, in all modern Intel processors the IME is directly attached to the network hardware and gets its own SR-IOV virtual instance of the hardware (with its own MAC) to talk to. But not all motherboards support vPro: the onboard Ethernet controller has to be designed with awareness of the IME so it can recognize its packets as additional Wake-on-LAN packet types, and not all are (yet). So—at least if you're building custom—you can just buy a non-vPro motherboard to "wall off" your computer from secret probes of its ports. (Or, you know, use a router. It's not like these packets will make it to your computer from across the Internet.)

nickpsecurity 10y ago

With how ASIC & firmware companies do things, best to assume they're all the same thing until proven otherwise. As in, the circuitry and software for doing any of that is there but only made visible/usable to by a configuration that changes the more they pay. This is the most economical thing for hardware makers to do as they build just one thing instead of several things. This was also the trick some hard disk makers use where they put the same platter in all the drives but a firmware option limited how much was visible to user (less money = less visible).

khedoros1 10y ago
So the next question would be whether it's possible to remotely reconfigure the "non-vPro" machine to activate the features, in which case it could be considered a direct equivalent.
- nickpsecurity 10y ago
  And that's what we don't and can't know the answer to since it's a black box. Hence, that circuitry can't ever be present on a machine if one is worried about potential compromises or subversions of it.
- Bartweiss 10y ago
  Derefr's answer in this thread suggests that you can insulate against this regardless of how the vPro activation works; not all motherboards support the parallel packet stream, so you can get a vPro incompatible motherboard and trust that even if there is a "wake and activate" command it won't be received.
  - 1001101 10y ago
    Examine the binary for a run of the mill system sometime and check out the partition headers/manifest, see if you are convinced there are no networking functions in there. The processor in my laptop supports WoL (and I've tested that it works), but is not vPro (double-checked with Ark). I'm skeptical.

derefr 10y ago

The "low-level system monitoring" is effectively a software implementation of any "active" ACPI logic (e.g. Intel's SpeedStep.) This used to be in a separate "platform controller", but putting it in an on-CPU-die coprocessor 1. allows the ACPI logic to be regular x86_64 code, and 2. allows much simpler motherboard layout wiring (because you don't need a bunch of duplicate pinouts running from peripherals to both the CPU and platform controller; they can all just go to the CPU.) > The remote access stuff is usually marketed as "vPro", and it's sold as a premium feature. AFAIK, in all modern Intel processors the IME is directly attached to the network hardware and gets its own SR-IOV virtual instance of the hardware (with its own MAC) to talk to. But not all motherboards support vPro: the onboard Ethernet controller has to be designed with awareness of the IME so it can recognize its packets as additional Wake-on-LAN packet types, and not all are (yet). So—at least if you're building custom—you can just buy a non-vPro motherboard to "wall off" your computer from secret probes of its ports. (Or, you know, use a router. It's not like these packets will make it to your computer from across the Internet.)