4 ms·

I agree that the article doesn't add anything, but accessing the network is a standard function of ME, via its AMT component. One of the leading features and se

I agree that the article doesn't add anything, but accessing the network is a standard function of ME, via its AMT component. One of the leading features and selling points of ME is remote management independent of the OS (i.e., even if there is no functioning OS) - useful for support and for deploying OS, BIOS, and other updates.

wmf 9y ago
Exactly my point: AMT is not included in every ME and your computer probably doesn't have AMT.
- TD-Linux 9y ago
  Every Thinkpad I've run me_cleaner on so far has had the full suite of ME modules loaded.
- dsr_ 9y ago
  Until the day you open the wrong Word doc. Or click on the wrong link in email. Or run the wrong game.
  - bdamm 9y ago
    Open a resume. Browse from a coffee shop. Click on a link from your bank. Use your phone while on the subway. Play music that you paid for. Cross an international border.
- turblety 9y ago
  Intel ME is a processor that runs the MINIX operating system. It's the operating system that connects to the network. AMT is a module that is run in the operating system, that uses the network functionality. Although no one really knows for sure, as it's completely closed source and very little "technical" documentation is provided about it.
- 1001101 9y ago
  Does the 'base' ME not have a number of network functions aside from AMT, eg anti-theft, system defense (packet filter), serial over LAN? From what I have read, the ME has the dynamic application loader that can load applets. It would be difficult, but not impossible to re-flash an ME. Are we sure that not having AMT is 'enough?' I can imagine the power of the ME would prove very tempting to talented state-sponsored groups.
  - TD-Linux 9y ago
    It does. Here's example output from me_cleaner.py, which removes non-essential modules and allows you to reflash with modified firmware: rbe (Huffman , 0x007cc0 - 0x00a380): NOT removed, essential kernel (Huffman , 0x00a380 - 0x019f40): NOT removed, essential syslib (Huffman , 0x019f40 - 0x02cf40): NOT removed, essential bup (Huffman , 0x02cf40 - 0x055d40): NOT removed, essential pm (Huffman , 0x055d40 - 0x059740): removed vfs (Huffman , 0x059740 - 0x066880): removed evtdisp (Huffman , 0x066880 - 0x069300): removed loadmgr (Huffman , 0x069300 - 0x06dec0): removed busdrv (Huffman , 0x06dec0 - 0x071700): removed gpio (Huffman , 0x071700 - 0x0738c0): removed prtc (Huffman , 0x0738c0 - 0x074c00): removed policy (Huffman , 0x074c00 - 0x07fa40): removed crypto (Huffman , 0x07fa40 - 0x09a680): removed heci (LZMA/uncomp., 0x09a680 - 0x09e580): removed storage (Huffman , 0x09e580 - 0x0a4b00): removed pmdrv (Huffman , 0x0a4b00 - 0x0a6700): removed maestro (Huffman , 0x0a6700 - 0x0ab600): removed fpf (Huffman , 0x0ab600 - 0x0add40): removed hci (LZMA/uncomp., 0x0add40 - 0x0ae600): removed fwupdate (LZMA/uncomp., 0x0ae600 - 0x0b3140): removed ptt (LZMA/uncomp., 0x0b3140 - 0x0c82c0): removed touch_fw (LZMA/uncomp., 0x0c82c0 - 0x133000): removed Unfortunately we know little about these modules other than their name and size.
  - forapurpose 9y ago
    In the semi-authoritative book on ME, Platform Embedded Security Technology Revealed by Xiaoyu Ruan of Intel, it says that only AMT can access the network (if I remember it correctly). The book is three years old, so maybe that's changed. Or maybe the functions you describe are part of AMT. I'd be interested in knowing more. > system defense (packet filter) At least that doesn't sound like it needs to transmit. > anti-theft What anti-theft service does ME provide?
- forapurpose 9y ago
  > AMT is not included in every ME and your computer probably doesn't have AMT. As far as I know, AMT is on almost every ME implementation, but I'd love to learn more about it. When is it included? What is that based on? Here's what I know: 1. Every system with the VPro branding includes AMT with remote access (I'm 90% sure of that). Considering the audience here at HN, most of their computers probably are VPro models. 2. Non-VPro models also include AMT, and possibly some have remote access. I recently was working with a non-VPro system that certainly had AMT, but had the Small Business Technology implementation, which purposefully omits remote access. There's also Standard Manageability, which "appears only on Intel Desktop Boards that support Intel AMT but that do not have a vPro-compatible processor installed"; AFAICT it's a implementation of AMT, and I think it includes remote access. (There are not enough days in the week to sort out Intel's product line, and that was one thing I didn't need to know.)

wmf 9y ago

Exactly my point: AMT is not included in every ME and your computer probably doesn't have AMT.

TD-Linux 9y ago
Every Thinkpad I've run me_cleaner on so far has had the full suite of ME modules loaded.
dsr_ 9y ago
Until the day you open the wrong Word doc. Or click on the wrong link in email. Or run the wrong game.
- bdamm 9y ago
  Open a resume. Browse from a coffee shop. Click on a link from your bank. Use your phone while on the subway. Play music that you paid for. Cross an international border.
turblety 9y ago
Intel ME is a processor that runs the MINIX operating system. It's the operating system that connects to the network. AMT is a module that is run in the operating system, that uses the network functionality. Although no one really knows for sure, as it's completely closed source and very little "technical" documentation is provided about it.
1001101 9y ago
Does the 'base' ME not have a number of network functions aside from AMT, eg anti-theft, system defense (packet filter), serial over LAN? From what I have read, the ME has the dynamic application loader that can load applets. It would be difficult, but not impossible to re-flash an ME. Are we sure that not having AMT is 'enough?' I can imagine the power of the ME would prove very tempting to talented state-sponsored groups.
- TD-Linux 9y ago
  It does. Here's example output from me_cleaner.py, which removes non-essential modules and allows you to reflash with modified firmware: rbe (Huffman , 0x007cc0 - 0x00a380): NOT removed, essential kernel (Huffman , 0x00a380 - 0x019f40): NOT removed, essential syslib (Huffman , 0x019f40 - 0x02cf40): NOT removed, essential bup (Huffman , 0x02cf40 - 0x055d40): NOT removed, essential pm (Huffman , 0x055d40 - 0x059740): removed vfs (Huffman , 0x059740 - 0x066880): removed evtdisp (Huffman , 0x066880 - 0x069300): removed loadmgr (Huffman , 0x069300 - 0x06dec0): removed busdrv (Huffman , 0x06dec0 - 0x071700): removed gpio (Huffman , 0x071700 - 0x0738c0): removed prtc (Huffman , 0x0738c0 - 0x074c00): removed policy (Huffman , 0x074c00 - 0x07fa40): removed crypto (Huffman , 0x07fa40 - 0x09a680): removed heci (LZMA/uncomp., 0x09a680 - 0x09e580): removed storage (Huffman , 0x09e580 - 0x0a4b00): removed pmdrv (Huffman , 0x0a4b00 - 0x0a6700): removed maestro (Huffman , 0x0a6700 - 0x0ab600): removed fpf (Huffman , 0x0ab600 - 0x0add40): removed hci (LZMA/uncomp., 0x0add40 - 0x0ae600): removed fwupdate (LZMA/uncomp., 0x0ae600 - 0x0b3140): removed ptt (LZMA/uncomp., 0x0b3140 - 0x0c82c0): removed touch_fw (LZMA/uncomp., 0x0c82c0 - 0x133000): removed Unfortunately we know little about these modules other than their name and size.
- forapurpose 9y ago
  In the semi-authoritative book on ME, Platform Embedded Security Technology Revealed by Xiaoyu Ruan of Intel, it says that only AMT can access the network (if I remember it correctly). The book is three years old, so maybe that's changed. Or maybe the functions you describe are part of AMT. I'd be interested in knowing more. > system defense (packet filter) At least that doesn't sound like it needs to transmit. > anti-theft What anti-theft service does ME provide?
forapurpose 9y ago
> AMT is not included in every ME and your computer probably doesn't have AMT. As far as I know, AMT is on almost every ME implementation, but I'd love to learn more about it. When is it included? What is that based on? Here's what I know: 1. Every system with the VPro branding includes AMT with remote access (I'm 90% sure of that). Considering the audience here at HN, most of their computers probably are VPro models. 2. Non-VPro models also include AMT, and possibly some have remote access. I recently was working with a non-VPro system that certainly had AMT, but had the Small Business Technology implementation, which purposefully omits remote access. There's also Standard Manageability, which "appears only on Intel Desktop Boards that support Intel AMT but that do not have a vPro-compatible processor installed"; AFAICT it's a implementation of AMT, and I think it includes remote access. (There are not enough days in the week to sort out Intel's product line, and that was one thing I didn't need to know.)