3 ms·

You don't need to buy branded laptops to be able to disable Intel ME. Thanks to me_cleaner, I have been running my Chromebooks with Intel ME disabled for years.

You don't need to buy branded laptops to be able to disable Intel ME. Thanks to me_cleaner, I have been running my Chromebooks with Intel ME disabled for years. You can do it too if you have 30 minutes and a raspberry pi. Here is what the intelmetool [1] says on my laptop: https://i.imgur.com/yKTt5ga.png https://i.imgur.com/yKTt5ga.png What's even more interesting is that there is a simple, automatic, no-frills method to clamp a SOIC clip connected to a Raspberry Pi zero to any Chromebook and it will clear out the Intel ME automatically with no user interaction. It's not even hard, all you have to do is to configure the Pi to enable SPI, and then make the pi automatically run flashrom to pull out the ROM from the Chromebook's flash chip, run ./me_cleaner on the ROM image, and then flash it back. It can be done safely and automatically, and you wouldn't have to risk frying your laptop, so everyone could do it provided they can open their laptop. However, I'm too lazy to document it properly: either by providing the image tool to create the said Raspberry Pi Zero image + h/w instruction or by providing a premade hardware to do it. I have reasons to believe that downloading a random binary image from a random guy nicknamed jimmies and use it to flash the firmware to your laptop because you don't trust Intel is probably not a great idea. The act of creating such a script to customize Raspbian, and testing out to make sure that it works for every Chromebook or laptop, and make a hardware compatibility list is quite a daunting task. I was talking about that briefly to some of the security people, but then as a grad student trying to graduate it got to the pile of TODOs. So if anyone is interested in it, let me know and I can provide some more details. Currently, I'm running a Dell 13 inches Chromebook that can be had for $300 and does everything I need. 1: https://github.com/coreboot/coreboot/tree/master/util/intelmetool https://github.com/coreboot/coreboot/tree/master/util/intelm... - disclaimer: I contributed a patch to the intelmetool to make it work on the Chromebook.

korethr 9y ago
While this is great, and I'm glad it exists, not everyone is like you and I: willing and able to open a computer and use a SOIC clip and a Raspberry Pi to purge the ME from the computer's firmware. You and I are what the normals tend to call geeks or nerds, and from my experience amongst geeks and nerds, one of the less common subtypes. That's a depressing way to look at it, and one could argue that it's a condescendingly elitist view, but that doesn't change the truth of it. I'm confident most other posters here could immediately think of a half-dozen friends and family members for whom even opening the computer was deep magic, nevermind going after the ME with a SOIC clip. For the rest of the population, there's value in there being a vendor who sells magic black boxes, certified to be freshly purged of all known evil demons.
- rightos 9y ago
  Yeah, I pretty much just recently learned enough electronics to feel comfortable doing something like that and I still haven't done it on my hardware for fear of bricking it. I'm just hoping for a 100% software exploit that will do this.
- jimmies 9y ago
  >For the rest of the population, there's value in there being a vendor who sells magic black boxes, certified to be freshly purged of all known evil demons. Sure, but there are things that I like about my Chromebook that the System 76 laptops, despite being way more expensive, are unable to to provide. I like how mine has a backlit keyboard, has a FullHD 1080p IPS screen, and an 10 hours battery life, all that for $300. I just looked at the number of people who upvoted my post and I am really think that this actually could work if there is a person who builds the hardware, which I think is trivial. The problem is that not many are comfortable with both the electronics (wiring the clip) and be able to compile a big software package with dependencies on the Raspberry Pi. Make the frustrating 2 hours job to a 5 minutes job of opening the laptop and identify the chip, I think it might just be what many people want. I talked to a very smart netsec person and he just said that because he doesn't understand electronics, he couldn't have done it himself, but if that's something prebuilt or foolproof, he would absolutely do it. Perhaps I will actually take the plunge and publish the work over the next couple of months as a Show HN post.
  - korethr 9y ago
    This is something I would love to see. As evidenced by the netsec person you spoke to, not everyone's comfortable with electronics. But a pre-built thing or kit that leaves little to no chance of user error would provide a great deal of value to a great many people.
  - mkesper 9y ago
    This sounds like it makes sense to offer as a service: You should know how to protect against electrostatic shocks and preparing everything is time consuming. It scales much better after the first time. Maybe mobile phone repair shops would be interested in offering?
ekianjo 9y ago
Yup, I have looked at the procedure a few weeks ago and found it really easy to manage and ordered the hardware (a pomona clip in my case) to do it. People tend to be scared about opening up their computers, but this is really not hard at all and since you keep a copy of the ROM image, you can always fix it later on should you brick anything.
revanx_ 9y ago
You're making a mistake to make it sound so casual, at least put in a warning to always backup the bios image first before flashing the chip. Not all boards are the same, for example I've got a gigabyte board,I've flashed the bios just setting the HAP bit and it bricked the board because that part of the image segment is checksum validated. Luckly I had the backup ready to flash back so there was no downtime.
komali2 9y ago
Can you define "everything you need?" Cause I was very lucky and won a chromebook (can't remember exact model off the top of my head) and tried to use it as a programming tool (did the "Make Chromebook Run Ubuntu" thing) but it was so slow so as to be completely unusable.

korethr 9y ago

While this is great, and I'm glad it exists, not everyone is like you and I: willing and able to open a computer and use a SOIC clip and a Raspberry Pi to purge the ME from the computer's firmware. You and I are what the normals tend to call geeks or nerds, and from my experience amongst geeks and nerds, one of the less common subtypes. That's a depressing way to look at it, and one could argue that it's a condescendingly elitist view, but that doesn't change the truth of it. I'm confident most other posters here could immediately think of a half-dozen friends and family members for whom even opening the computer was deep magic, nevermind going after the ME with a SOIC clip. For the rest of the population, there's value in there being a vendor who sells magic black boxes, certified to be freshly purged of all known evil demons.

rightos 9y ago
Yeah, I pretty much just recently learned enough electronics to feel comfortable doing something like that and I still haven't done it on my hardware for fear of bricking it. I'm just hoping for a 100% software exploit that will do this.
jimmies 9y ago
>For the rest of the population, there's value in there being a vendor who sells magic black boxes, certified to be freshly purged of all known evil demons. Sure, but there are things that I like about my Chromebook that the System 76 laptops, despite being way more expensive, are unable to to provide. I like how mine has a backlit keyboard, has a FullHD 1080p IPS screen, and an 10 hours battery life, all that for $300. I just looked at the number of people who upvoted my post and I am really think that this actually could work if there is a person who builds the hardware, which I think is trivial. The problem is that not many are comfortable with both the electronics (wiring the clip) and be able to compile a big software package with dependencies on the Raspberry Pi. Make the frustrating 2 hours job to a 5 minutes job of opening the laptop and identify the chip, I think it might just be what many people want. I talked to a very smart netsec person and he just said that because he doesn't understand electronics, he couldn't have done it himself, but if that's something prebuilt or foolproof, he would absolutely do it. Perhaps I will actually take the plunge and publish the work over the next couple of months as a Show HN post.
- korethr 9y ago
  This is something I would love to see. As evidenced by the netsec person you spoke to, not everyone's comfortable with electronics. But a pre-built thing or kit that leaves little to no chance of user error would provide a great deal of value to a great many people.
- mkesper 9y ago
  This sounds like it makes sense to offer as a service: You should know how to protect against electrostatic shocks and preparing everything is time consuming. It scales much better after the first time. Maybe mobile phone repair shops would be interested in offering?

ekianjo 9y ago

Yup, I have looked at the procedure a few weeks ago and found it really easy to manage and ordered the hardware (a pomona clip in my case) to do it. People tend to be scared about opening up their computers, but this is really not hard at all and since you keep a copy of the ROM image, you can always fix it later on should you brick anything.

revanx_ 9y ago

You're making a mistake to make it sound so casual, at least put in a warning to always backup the bios image first before flashing the chip. Not all boards are the same, for example I've got a gigabyte board,I've flashed the bios just setting the HAP bit and it bricked the board because that part of the image segment is checksum validated. Luckly I had the backup ready to flash back so there was no downtime.

komali2 9y ago

Can you define "everything you need?" Cause I was very lucky and won a chromebook (can't remember exact model off the top of my head) and tried to use it as a programming tool (did the "Make Chromebook Run Ubuntu" thing) but it was so slow so as to be completely unusable.