3 ms·

Does the 'base' ME not have a number of network functions aside from AMT, eg anti-theft, system defense (packet filter), serial over LAN? From what I have read,

Does the 'base' ME not have a number of network functions aside from AMT, eg anti-theft, system defense (packet filter), serial over LAN? From what I have read, the ME has the dynamic application loader that can load applets. It would be difficult, but not impossible to re-flash an ME. Are we sure that not having AMT is 'enough?' I can imagine the power of the ME would prove very tempting to talented state-sponsored groups.

TD-Linux 9y ago
It does. Here's example output from me_cleaner.py, which removes non-essential modules and allows you to reflash with modified firmware: rbe (Huffman , 0x007cc0 - 0x00a380): NOT removed, essential kernel (Huffman , 0x00a380 - 0x019f40): NOT removed, essential syslib (Huffman , 0x019f40 - 0x02cf40): NOT removed, essential bup (Huffman , 0x02cf40 - 0x055d40): NOT removed, essential pm (Huffman , 0x055d40 - 0x059740): removed vfs (Huffman , 0x059740 - 0x066880): removed evtdisp (Huffman , 0x066880 - 0x069300): removed loadmgr (Huffman , 0x069300 - 0x06dec0): removed busdrv (Huffman , 0x06dec0 - 0x071700): removed gpio (Huffman , 0x071700 - 0x0738c0): removed prtc (Huffman , 0x0738c0 - 0x074c00): removed policy (Huffman , 0x074c00 - 0x07fa40): removed crypto (Huffman , 0x07fa40 - 0x09a680): removed heci (LZMA/uncomp., 0x09a680 - 0x09e580): removed storage (Huffman , 0x09e580 - 0x0a4b00): removed pmdrv (Huffman , 0x0a4b00 - 0x0a6700): removed maestro (Huffman , 0x0a6700 - 0x0ab600): removed fpf (Huffman , 0x0ab600 - 0x0add40): removed hci (LZMA/uncomp., 0x0add40 - 0x0ae600): removed fwupdate (LZMA/uncomp., 0x0ae600 - 0x0b3140): removed ptt (LZMA/uncomp., 0x0b3140 - 0x0c82c0): removed touch_fw (LZMA/uncomp., 0x0c82c0 - 0x133000): removed Unfortunately we know little about these modules other than their name and size.
forapurpose 9y ago
In the semi-authoritative book on ME, Platform Embedded Security Technology Revealed by Xiaoyu Ruan of Intel, it says that only AMT can access the network (if I remember it correctly). The book is three years old, so maybe that's changed. Or maybe the functions you describe are part of AMT. I'd be interested in knowing more. > system defense (packet filter) At least that doesn't sound like it needs to transmit. > anti-theft What anti-theft service does ME provide?
- 1001101 9y ago
  > What anti-theft service does ME provide? "Some of the other modules include ... a system for location tracking and remote wiping of laptops for anti-theft purposes." [1] (link to Igor Skochinsky slides). [1] https://www.eff.org/deeplinks/2017/05/intels-management-engine-security-hazard-and-users-need-way-disable-it https://www.eff.org/deeplinks/2017/05/intels-management-engi...

TD-Linux 9y ago

It does. Here's example output from me_cleaner.py, which removes non-essential modules and allows you to reflash with modified firmware: rbe (Huffman , 0x007cc0 - 0x00a380): NOT removed, essential kernel (Huffman , 0x00a380 - 0x019f40): NOT removed, essential syslib (Huffman , 0x019f40 - 0x02cf40): NOT removed, essential bup (Huffman , 0x02cf40 - 0x055d40): NOT removed, essential pm (Huffman , 0x055d40 - 0x059740): removed vfs (Huffman , 0x059740 - 0x066880): removed evtdisp (Huffman , 0x066880 - 0x069300): removed loadmgr (Huffman , 0x069300 - 0x06dec0): removed busdrv (Huffman , 0x06dec0 - 0x071700): removed gpio (Huffman , 0x071700 - 0x0738c0): removed prtc (Huffman , 0x0738c0 - 0x074c00): removed policy (Huffman , 0x074c00 - 0x07fa40): removed crypto (Huffman , 0x07fa40 - 0x09a680): removed heci (LZMA/uncomp., 0x09a680 - 0x09e580): removed storage (Huffman , 0x09e580 - 0x0a4b00): removed pmdrv (Huffman , 0x0a4b00 - 0x0a6700): removed maestro (Huffman , 0x0a6700 - 0x0ab600): removed fpf (Huffman , 0x0ab600 - 0x0add40): removed hci (LZMA/uncomp., 0x0add40 - 0x0ae600): removed fwupdate (LZMA/uncomp., 0x0ae600 - 0x0b3140): removed ptt (LZMA/uncomp., 0x0b3140 - 0x0c82c0): removed touch_fw (LZMA/uncomp., 0x0c82c0 - 0x133000): removed Unfortunately we know little about these modules other than their name and size.

forapurpose 9y ago

In the semi-authoritative book on ME, Platform Embedded Security Technology Revealed by Xiaoyu Ruan of Intel, it says that only AMT can access the network (if I remember it correctly). The book is three years old, so maybe that's changed. Or maybe the functions you describe are part of AMT. I'd be interested in knowing more. > system defense (packet filter) At least that doesn't sound like it needs to transmit. > anti-theft What anti-theft service does ME provide?

1001101 9y ago
> What anti-theft service does ME provide? "Some of the other modules include ... a system for location tracking and remote wiping of laptops for anti-theft purposes." [1] (link to Igor Skochinsky slides). [1] https://www.eff.org/deeplinks/2017/05/intels-management-engine-security-hazard-and-users-need-way-disable-it https://www.eff.org/deeplinks/2017/05/intels-management-engi...