4 ms·

You can also order Dell machines with ME disabled. Additionally, most current Dell systems can disable Intel ME in the BIOS settings as well. This is a trap doo

by sspiff 9y ago

You can also order Dell machines with ME disabled. Additionally, most current Dell systems can disable Intel ME in the BIOS settings as well. This is a trap door setting - once disabled, there is no way to turn it back on. From what I've heard, this disabling is done through the Intel HAM (high assurance mode), but I have no idea what the differences between the Dell and Purism approaches are.

n1000 9y ago
Could you provide sources for this? I have never heard of such a Dell machine... My understanding was that there are currently no real options to run an Intel CPU laptop without ME.
- nickpsecurity 9y ago
  Probably Optiplex given its use in high-security defense sector which, combined with Separation Kernel Protection Profile, would have all kinds of security/hardening requirements: https://gdmissionsystems.com/cyber/products/trusted-computing-cross-domain/trusted-multilevel-computing-solution https://gdmissionsystems.com/cyber/products/trusted-computin... http://www.integrityglobalsecurity.com/pages/solutions.html http://www.integrityglobalsecurity.com/pages/solutions.html https://www.ghs.com/products/safety_critical/integrity-do-178b.html https://www.ghs.com/products/safety_critical/integrity-do-17... Warning: These companies' marketing folks like to go overboard. Sharing for the technical data and Dell references but not endorsing every claim you see. ;)
  - sspiff 9y ago
    It was indeed an Optiplex system. You can find reference to it in this KB article[1] about replacement system boards. [1] http://www.dell.com/support/article/be/nl/bebsdt1/sln145409/manageability-mode-options-on-replacement-system-boards-for-the-dell--optiplex--755---kb-article---327359?lang=en http://www.dell.com/support/article/be/nl/bebsdt1/sln145409/...
- sspiff 9y ago
  Sorry for the late response! I've just checked and I could not find it for most models. I could find it for the OptiPlex 7450 All-in-One, but not for the Precision line. At [1], you can find a screenshot of the setting that reflects this option. A colleague of mine ordered such a system and it came with a leaflet explaining that this meant that Intel ME was turned off and could no longer be turned on for this machine (trap door mechanism). It also explained that SKUs with Intel ME enabled could enter this state through the UEFI menu. He opened his system up and inspected the system board, and it was also labeled with a seal stating that Intel ME had been disabled on this system and could not be turned on. I'm trying to get hold of the leaflet so I can give you the exact wording Dell used for this. The fact that this state can be entered through a UEFI program makes me believe that other systems running Dell's newest UEFI platform will have the same capability, but I have not been able to confirm this. My screenshot is from the Belgian Dell enterprise portal. The wording translates to "System management: vPro Management Engine (ME) not executable, customer order". [1] https://i.imgur.com/lpidbH3.png https://i.imgur.com/lpidbH3.png
orblivion 9y ago
I've read that "disabling" ME in the BIOS is a complete misnomer, at least on Lenovo.
bo1024 9y ago
I would guess you are referring to a motherboard BIOS setting that at least claims to "turn off" Intel ME. But for all we know, it is still possible or easy for someone to remotely access the ME and use it. Purism is doing some much more in-depth stuff including both hardware and software/firmware changes. I don't know the details myself but it's a whole different level of approach.

by sspiff 9y ago

n1000 9y ago

Could you provide sources for this? I have never heard of such a Dell machine... My understanding was that there are currently no real options to run an Intel CPU laptop without ME.

nickpsecurity 9y ago
Probably Optiplex given its use in high-security defense sector which, combined with Separation Kernel Protection Profile, would have all kinds of security/hardening requirements: https://gdmissionsystems.com/cyber/products/trusted-computing-cross-domain/trusted-multilevel-computing-solution https://gdmissionsystems.com/cyber/products/trusted-computin... http://www.integrityglobalsecurity.com/pages/solutions.html http://www.integrityglobalsecurity.com/pages/solutions.html https://www.ghs.com/products/safety_critical/integrity-do-178b.html https://www.ghs.com/products/safety_critical/integrity-do-17... Warning: These companies' marketing folks like to go overboard. Sharing for the technical data and Dell references but not endorsing every claim you see. ;)
- sspiff 9y ago
  It was indeed an Optiplex system. You can find reference to it in this KB article[1] about replacement system boards. [1] http://www.dell.com/support/article/be/nl/bebsdt1/sln145409/manageability-mode-options-on-replacement-system-boards-for-the-dell--optiplex--755---kb-article---327359?lang=en http://www.dell.com/support/article/be/nl/bebsdt1/sln145409/...
sspiff 9y ago
Sorry for the late response! I've just checked and I could not find it for most models. I could find it for the OptiPlex 7450 All-in-One, but not for the Precision line. At [1], you can find a screenshot of the setting that reflects this option. A colleague of mine ordered such a system and it came with a leaflet explaining that this meant that Intel ME was turned off and could no longer be turned on for this machine (trap door mechanism). It also explained that SKUs with Intel ME enabled could enter this state through the UEFI menu. He opened his system up and inspected the system board, and it was also labeled with a seal stating that Intel ME had been disabled on this system and could not be turned on. I'm trying to get hold of the leaflet so I can give you the exact wording Dell used for this. The fact that this state can be entered through a UEFI program makes me believe that other systems running Dell's newest UEFI platform will have the same capability, but I have not been able to confirm this. My screenshot is from the Belgian Dell enterprise portal. The wording translates to "System management: vPro Management Engine (ME) not executable, customer order". [1] https://i.imgur.com/lpidbH3.png https://i.imgur.com/lpidbH3.png

orblivion 9y ago

I've read that "disabling" ME in the BIOS is a complete misnomer, at least on Lenovo.

bo1024 9y ago

I would guess you are referring to a motherboard BIOS setting that at least claims to "turn off" Intel ME. But for all we know, it is still possible or easy for someone to remotely access the ME and use it. Purism is doing some much more in-depth stuff including both hardware and software/firmware changes. I don't know the details myself but it's a whole different level of approach.