4 ms·
This only disables the Windows driver. The actual ME co-processor is still running.
by lima 10y ago
This only disables the Windows driver.
The actual ME co-processor is still running.
- gaia 10y agoAnd how would you test for that?
- lima 10y agoUnless you modified your BIOS with a SPI flasher after disassembling your device, you know it's still running :-) It would disappear from the PCI bus. Your commands un-provision AMT (Active Management Technology), the ME feature that apparently has a security issue. Unless you've explicitly enabled AMT, it's not provisioned anyway so this doesn't do anything.
- weinzierl 10y ago> Your commands un-provision AMT (Active Management Technology), the ME feature that apparently has a security issue. It disables the optional OS-side of AMT. How do we know that the vulnerability is in the OS-side? Has this been established yet?
- agumonkey 10y agoMay be worth reading the coreboot wiki, I remember reading about the different subsystems of AMT, and it seems plausible that you can set it into a state where control functions are disabled. But my memories are very blurry. Still coreboot guys are quite experts on the matter.
- lima 10y agoUnprovisioning disables both the OS side and the hardware AMT. It doesn't change anything if you never enabled AMT.
- gaia 10y agoYou are correct, I've updated the HN link title and post's title.
- deleted 10y ago[deleted]
- nerdy 10y agoIt's still rather misleading, "Completely Disable..."
- eriknstr 10y agoI thought so too at first but I guess whereas the title now says "Completely Disable Intel AMT on Windows", it probably used to say something along the lines of "Completely Disable Intel ME on Windows". Edit: The title has been changed again and now reads "Disabling Intel AMT on Windows". That's better and less confusing.
- mistaken 10y agoIt's worth mentioning that on some systems it's possible to permanently disable the management engine and the MEBx extension BIOS by selecting the "Permanently Disable" option from BIOS.
- criddell 10y agoWhy do you think Intel doesn't let users turn it off?
- api 10y agoBecause it's a hardware backdoor in the CPU?
- criddell 10y agoThat's probably not the reason. At least not in the malicious sense.
- nickpsecurity 10y agoThere's a good chance it is since they worked with the group trying to DRM everything. The NSA was also in that group likely trying to simultaneously secure and backdoor everything. A built-in backdoor sold as a business benefit that you can't turn off at all from a defense contractor in a police state is already 90% to being malicious just by nature of the situation. So, assume it is at least for the local police state and their partners. Now, if that's not in your threat model, then you'll probably be fine using it unless foreign adversaries are in your threat model. And the rabbit hole of how threatening are live backdoors on your network just goes on from there. There's at least calls to remove SIGINT agency from TCG: https://www.securitycurrent.com/en/writers/richard-stiennon/it-is-time-for-the-trusted-computer-group-to-repudiate-the-nsa https://www.securitycurrent.com/en/writers/richard-stiennon/...
- api 10y agoIt's not relevant to your threat model until it leaks...
- nickpsecurity 10y agoHaha. Exactly. This should be a bigger concern recently since that's what keeps happening to good, attack tools.