3 ms·

Am I right to be concerned about this, if only in principle? I don't like having a mysterious embedded chip that can access the network when my computer's off.

deleted 9y ago
[deleted]
adtac 9y ago
Exactly. What is Intel's supposed reason for having such a feature?
- cyphar 9y ago
  It's in the name, it's for management of enterprise deployments of machines that have Intel CPUs[1]. It's a fairly important thing for most enterprises (sort of like IPMI but it's not just for servers), as it allows you to do a variety of things to all computers that you manage. Now, whether that feature should be part of every consumer CPU is a valid question and concern -- one that nobody has the answer to. Likely the reason for this is that modern versions of ME also do hardware initialisation[2], so it would make sense for Intel to not require manufacturers to rewrite all of that code for their consumer machines. There have been exploits in Intel ME in the past, which are quite concerning (and the fact it's proprietary is obviously a concern, given how many privileges it has over the system). You can neuter Intel ME on old machines (pre-BootGuard) using me_cleaner[3], but it requires attaching a flash programmer to your motherboard. If you have coreboot you can do it from userspace. [1]: https://en.wikipedia.org/wiki/Intel_Active_Management_Technology https://en.wikipedia.org/wiki/Intel_Active_Management_Techno... [2]: https://www.coreboot.org/Intel_Management_Engine https://www.coreboot.org/Intel_Management_Engine [3]: https://github.com/corna/me_cleaner https://github.com/corna/me_cleaner
- tptacek 9y ago
  The Unix server vendors had these features long before Intel did. Having a common out-of-band management interface is hugely valuable for fleet management. It's not valuable at all for individual retail consumers; in the long run, SGX probably does for the entire Intel customer based, including retail, pretty much everything that the ME might have done for retail users.
  - jerheinze 9y ago
    The real question is why there's no way to disable it. Certainly, if it was only for out-of-band management then why can't a retail consumer disable? Saying that it's because it does "hardware initialisation" is a weak response, Intel could've designed it in a way that doesn't do that such as with the very first models of CPUs with ME.
    - tptacek 9y ago
      Was it universally easy to disable the lights-out managers on Unix server platforms 10-15 years ago, or did vendors sometimes omit that feature because only a tiny subset of their customers cared about that? I'm not saying you shouldn't be able to disable it.
    - cyphar 9y ago
      I would think it's more pertinent to ask "is there an economic reason to allow a retail consumer to disable it". Most people don't know (or care) what Intel ME is, and some enterprises that buy machines with Intel CPUs want the management features. Companies aren't implicitly evil, they just don't have altruistic motives (generally). Which means that likely they didn't see it as having a good ROI. This is not what you or I want to be the case, but even if that were solved -- Intel CPUs have a whole variety of other issues that extend beyond ME. But all of that is missing the point that there is a way to disable it[1], with the HAP or AltMeDisable bits[2]. It's believed they were added for the US government to be able to disable Intel ME (after hardware initialisation). It's not easy (you have to reflash the firmware) because most vendor firmware doesn't allow "internal" flashing from userspace, but it is doable if you buy a $5 flash programmer and a Raspberry PI. [1]: https://github.com/corna/me_cleaner https://github.com/corna/me_cleaner [2]: https://github.com/corna/me_cleaner/wiki/HAP-AltMeDisable-bit https://github.com/corna/me_cleaner/wiki/HAP-AltMeDisable-bi...
      - jerheinze 9y ago
        You're contradicting yourself, maintaining that they didn't allow disabling the ME because "nobody cared", and on the other hand that they specifically crafted a way to disable the ME for the US government. If they did for the US government, but hided it for everyone else, then the explanation can't be economical.

deleted 9y ago

[deleted]

adtac 9y ago

Exactly. What is Intel's supposed reason for having such a feature?

cyphar 9y ago
It's in the name, it's for management of enterprise deployments of machines that have Intel CPUs[1]. It's a fairly important thing for most enterprises (sort of like IPMI but it's not just for servers), as it allows you to do a variety of things to all computers that you manage. Now, whether that feature should be part of every consumer CPU is a valid question and concern -- one that nobody has the answer to. Likely the reason for this is that modern versions of ME also do hardware initialisation[2], so it would make sense for Intel to not require manufacturers to rewrite all of that code for their consumer machines. There have been exploits in Intel ME in the past, which are quite concerning (and the fact it's proprietary is obviously a concern, given how many privileges it has over the system). You can neuter Intel ME on old machines (pre-BootGuard) using me_cleaner[3], but it requires attaching a flash programmer to your motherboard. If you have coreboot you can do it from userspace. [1]: https://en.wikipedia.org/wiki/Intel_Active_Management_Technology https://en.wikipedia.org/wiki/Intel_Active_Management_Techno... [2]: https://www.coreboot.org/Intel_Management_Engine https://www.coreboot.org/Intel_Management_Engine [3]: https://github.com/corna/me_cleaner https://github.com/corna/me_cleaner
tptacek 9y ago
The Unix server vendors had these features long before Intel did. Having a common out-of-band management interface is hugely valuable for fleet management. It's not valuable at all for individual retail consumers; in the long run, SGX probably does for the entire Intel customer based, including retail, pretty much everything that the ME might have done for retail users.
- jerheinze 9y ago
  The real question is why there's no way to disable it. Certainly, if it was only for out-of-band management then why can't a retail consumer disable? Saying that it's because it does "hardware initialisation" is a weak response, Intel could've designed it in a way that doesn't do that such as with the very first models of CPUs with ME.
  - tptacek 9y ago
    Was it universally easy to disable the lights-out managers on Unix server platforms 10-15 years ago, or did vendors sometimes omit that feature because only a tiny subset of their customers cared about that? I'm not saying you shouldn't be able to disable it.
  - cyphar 9y ago
    I would think it's more pertinent to ask "is there an economic reason to allow a retail consumer to disable it". Most people don't know (or care) what Intel ME is, and some enterprises that buy machines with Intel CPUs want the management features. Companies aren't implicitly evil, they just don't have altruistic motives (generally). Which means that likely they didn't see it as having a good ROI. This is not what you or I want to be the case, but even if that were solved -- Intel CPUs have a whole variety of other issues that extend beyond ME. But all of that is missing the point that there is a way to disable it[1], with the HAP or AltMeDisable bits[2]. It's believed they were added for the US government to be able to disable Intel ME (after hardware initialisation). It's not easy (you have to reflash the firmware) because most vendor firmware doesn't allow "internal" flashing from userspace, but it is doable if you buy a $5 flash programmer and a Raspberry PI. [1]: https://github.com/corna/me_cleaner https://github.com/corna/me_cleaner [2]: https://github.com/corna/me_cleaner/wiki/HAP-AltMeDisable-bit https://github.com/corna/me_cleaner/wiki/HAP-AltMeDisable-bi...
    - jerheinze 9y ago
      You're contradicting yourself, maintaining that they didn't allow disabling the ME because "nobody cared", and on the other hand that they specifically crafted a way to disable the ME for the US government. If they did for the US government, but hided it for everyone else, then the explanation can't be economical.