4 ms·

This is taken verbatim from Intel's "SA-00075 Mitigation Guide" [1] As others have said, it doesn't disable the ME. It merely removes OS-side support for it an

This is taken verbatim from Intel's "SA-00075 Mitigation Guide" [1] As others have said, it doesn't disable the ME. It merely removes OS-side support for it and resets configuration to non-exploitable state. The ME itself remains up and running. [1] https://downloadmirror.intel.com/26754/eng/INTEL-SA-00075%20Mitigation%20Guide-Rev%201.1.pdf https://downloadmirror.intel.com/26754/eng/INTEL-SA-00075%20... * To clarify - the original title of this post was something like "Completely Disable Intel Management Engine (finally!)".

gaia 10y ago
These step by step instructions were built based on the mitigation guide, which is linked in the advisory. I've updated the HN link title and post's title (see https://news.ycombinator.com/item?id=14253732 https://news.ycombinator.com/item?id=14253732)
weinzierl 10y ago
> It merely removes OS-side support for it and resets configuration to non-exploitable state. How do we know that the vulnerability is in the OS-side? Has this been established yet?
- lima 10y ago
  It also un-provisions AMT, which supposedly prevent remote exploitation.
  - weinzierl 10y ago
    Ah, I understand. The Mitigation guide says: "Intel highly recommends that the first in all mitigation paths is to unprovision the Intel manageability SKU to address the network privilege escalation vulnerability". Unprovisioning AMT seems to be the essential part and I am curious if the other steps serve any real purpose. The Mitigation Guide goes on to say: "Systems that are vulnerable [...] should be unprovisioned using the tools used to initially configure them [...] As an example, the Intel AMT Configuration Utility [...]" So ACUConfig is just an example and specifically not the Intel recommended way. OP doesn't say that.
    - gaia 10y ago
      ACUConfig is the Intel recommended way, per the mitigation guide (at least for now, until a patch is released).
      - weinzierl 10y ago
        Quote from the Mitigation Guide: "Systems that are vulnerable [...] should be unprovisioned using the tools used to initially configure them [...]"
  - deleted 10y ago
    [deleted]

gaia 10y ago

These step by step instructions were built based on the mitigation guide, which is linked in the advisory. I've updated the HN link title and post's title (see https://news.ycombinator.com/item?id=14253732 https://news.ycombinator.com/item?id=14253732)

weinzierl 10y ago

> It merely removes OS-side support for it and resets configuration to non-exploitable state. How do we know that the vulnerability is in the OS-side? Has this been established yet?

lima 10y ago
It also un-provisions AMT, which supposedly prevent remote exploitation.
- weinzierl 10y ago
  Ah, I understand. The Mitigation guide says: "Intel highly recommends that the first in all mitigation paths is to unprovision the Intel manageability SKU to address the network privilege escalation vulnerability". Unprovisioning AMT seems to be the essential part and I am curious if the other steps serve any real purpose. The Mitigation Guide goes on to say: "Systems that are vulnerable [...] should be unprovisioned using the tools used to initially configure them [...] As an example, the Intel AMT Configuration Utility [...]" So ACUConfig is just an example and specifically not the Intel recommended way. OP doesn't say that.
  - gaia 10y ago
    ACUConfig is the Intel recommended way, per the mitigation guide (at least for now, until a patch is released).
    - weinzierl 10y ago
      Quote from the Mitigation Guide: "Systems that are vulnerable [...] should be unprovisioned using the tools used to initially configure them [...]"
- deleted 10y ago
  [deleted]