7 ms·

Does ME Manufacturing mode allow the user to change all the configuration? Does it mean that hackers who incidentally purchased such a machine (but probably not

Does ME Manufacturing mode allow the user to change all the configuration? Does it mean that hackers who incidentally purchased such a machine (but probably not Apple's) with ME Manufacturing mode enabled, can theoretically port coreboot to the machine, then flash their own public key fingerprints into ME, using Boot Guard to protect firmware signed by themselves instead of OEM's? I remember several bunches of Lenovo laptop series released a few years ago seems to have the same vulnerability, and porting coreboot to those computers with earlier chipsets is a real possibility, only prevented by Boot Guard signature. But finding these unpatched and vulnerable series of machines is a hit-or-miss game with minimum chance of success. If someone really implements tools to do all these things, is it possible that the secondhand vulnerable motherboards would be the gold in the hacker communities and be sold at a high price? Another fact is that ME is a part of the PCH, which is located on the CPU package. If a hacker has access to a BGA rework technician in a professional repair workshop, it should be possible to desolder the original CPU from the board, and install a new one with unconfigurated ME to "own" the machine.

markovbot 8y ago
Gee, that almost sounds like a good thing.
turblety 8y ago
Exactly. Remember Intel ME is a great utility and has some awesome abilities. The issue that people have is not the fact there is a CPU running another CPU that looks after the main one. It's that it's closed source and has remote control capabilities that can not be controlled by the user. If Intel would just allow an owner to build and flash their own Intel ME version using their own private/public keys then no one would have an issue with that. It's the fact it's a secret closed system that has full control to monitor everything you do, and can not be fully disabled.
- MisterTea 8y ago
  > It's the fact it's a secret closed system that has full control to monitor everything you do, and can not be fully disabled. To add to that, it also makes code audits impossible. Intel, AMD, ARM, et al: There is zero, and I mean ZERO reason to hide management functionality from users in this day and age. It's 2018, security through obscurity has been proven wrong time and time again. It's foolish to think otherwise. Edit: grammar.
  - def_ConGame 8y ago
    So it's a back door. And a hamfisted one at that. It's not a coding error. It's built to do exactly what it looks like it's supposed to do: diminish any ordinary person's claim of total control over the behavior of the system, such that, should the need arise, a trained hand can lift the proper latch and intervene, to gain the upper hand, ostensibly so "the good guys" win. The good guys being those that ordered Intel into compliance with such requirements.
    - omegaworks 8y ago
      >The good guys being those that ordered Intel into compliance with such requirements. There is vast case law surrounding our first amendment right to refuse this kind of coercion. No one can force you to present something as yours against your will (at least, if they want it to hold up in court). What is more likely is that Intel won a great many more government contracts by doing this. They'd make tons of money doing it, so they did it. And if they didn't do it, their competitor would. That's how the system works in this country. We shouldn't excuse them so readily.
      - diggerNick6771 8y ago
        That's one option. Another is they got a national "security" letter that said you will do this, and even talking about this letter will get you a few years in the clink. I don't think the gov goes around doing this willy nilly, but I think it's clear that this is about the only reliable way to defeat block ciphers. And since there are only 2 real CPU manufacturers, it's easier to do this than attack crypto directly. My personal pet theory is that the aes keys are kept on the die for later retrieval. That and/or keystrokes.
      - confounded 8y ago
        They also won government contracts by not doing it; the High Assurance Platform mode (‘setting the HAP bit’) was a feature implemented by Intel for the NSA, incidentally discovered by security researchers. Dell sold laptops with this as an option until they were asked not to. It would be pretty easy for a sizable country or even a wealthy US state to demand that these ‘secure’ co-processors can be disabled at the user’s discretion, via regulation. From the NSA’s perspective, having the keys to the backdoor is an asset, but having a backdoor at all is a huge liability, now they’re not the only game in town. US businesses and citizens simply have more to lose. Honestly, I think it’s laziness and inertia more than conspiracy.
- Leace 8y ago
  > If Intel would just allow an owner to build and flash their own Intel ME version using their own private/public keys then no one would have an issue with that. Note that unless you manufacture the CPU yourself you still cannot be sure if there are no hidden backdoors. For example the ME could pretend it's really running your firmware but at the same time running some hidden code only delegating some operations to your code.
  - turblety 8y ago
    I understand and agree with you to a certain extent, but we're not just talking about a couple of assembly commands that could be misused. The Intel ME is a FULL Operating System running MINIX Linux (edit: MINIX is not Linux, as corrected by @dragonwriter). It has it's own network and apps, that run inside a running kernel, of which you have no access to. Even if the intentions are 100% legit, this is an operating system that you can not update (as frequently as your main operating system), and has many attack vectors. Yes, it could pretend to run your firmware, but secretly load it's own, but it's actually quite hard to hide a 5mb (2mb min) piece of firmware in the chip. Research microchip decapping. You can clearly see the different regions of the chip. But yes, it could be possible to hide a few x64 instructions, or circuits that could be manipulated. But running a remote control environment that can share your screen without your knowledge can only really be done clearly by running a large separate application stack alongside your main chip. (For now, who knows where we'll be in 5 to 10 years).
    - dragonwriter 8y ago
      > The Intel ME is a FULL Operating System running MINIX Linux. MINIX is a completely different OS than Linux, not a flavor of Linux. “MINIX Linux” makes as much sense as “MacOS Linux”. Intel ME just runs MINIX.
    - turblety 8y ago
      @dragonwriter Would UNIX make more sense?
      - 8y ago
- hlandau 8y ago
  I previously wrote about why this will never happen. https://www.devever.net/~hl/intelme https://www.devever.net/~hl/intelme The TLDR is that once they started putting a CPU vendor-controlled management CPU on their chipsets, they realised they could use it to implement DRM that Hollywood had been asking them for. We know that AMD has a contractual obligation to DRM vendors not to open source their GPU firmware for this reason, and it's likely Intel and AMD have similar contractual obligations as regards their Intel ME/AMD PSP firmware, as these are also involved in DRM.
  - executesorder66 8y ago
    Do you have any source for a time this DRM worked? What I mean is that I have watched/downloaded/streamed a lot of pirated content from various sources, using Intel and AMD hardware. CPU's and GPUs. Not once have the drivers blocked the viewing of pirated content via some kind of built in DRM. So if there is DRM baked into the drivers/ME, then what's the point if it doesn't do anything?
    - smolder 8y ago
      DRM doesn't stop you from playing pirated content, the goal is to make the content only decryptable using approved hardware/software, to limit people's ability to copy and paste content Willy nilly and share with their friends in Napster fashion. The determined people still stealing content never will be stopped, but it's inconvenient enough that average people aren't going to duplicate DRM-laden stuff themselves. Importantly, I think, when there's a higher barrier to content theft, the remaining sources of pirated content are fewer and easier to track.
      - deleted 8y ago
        [deleted]
      - SXX 8y ago
        > Importantly, I think, when there's a higher barrier to content theft, the remaining sources of pirated content are fewer and easier to track. Except DRM on end-user devices is done with security by obscurity and it's never ever worked for media. And never will. So there is so many sources of pirated content that attempts to track of stop them never succeeded. Fortunately NSA and other government spying organizations can still have their backdoor because "Hollywood needs DRM" bullshit.
- mrweasel 8y ago
  Is the Intel ME that great? I mean I never heard anyone say that they actually use it. The explanation of its capabilities make it seem like a great tool for fleet management, yet nobody seems to be using it. With other alternatives available, combined with low usage, I’m not sure that neither Intels ME nor AMDs PSP needs to be embedded in every CPU.
  - turblety 8y ago
    I think the specific part you're referring to is Intel AMT (Active Management Technology) which allows the user to remote control into their computer. AMT is a module that runs within the Intel ME operating system. Intel ME does a lot of things, like the below (we think, no one really knows for sure): - Active Management Technology (AMT) - Alert Standard Format (ASF) - Intel Boot Guard (IBG) - Secure Boot - Integrated Clock Controller (ICC) - Quiet System Technology (QST) / Advanced Fan Speed Control (AFSC) - Protected Audio Video Path (used in PlayReady DRM) - Intel Security Assist (ISA) - Serial over LAN (SOL) - Firmware-based Trusted Platform Module (TPM) Source: https://en.wikipedia.org/wiki/Intel_Management_Engine https://en.wikipedia.org/wiki/Intel_Management_Engine I think there is also some power management functionality in there too.
  - deleted 8y ago
    [deleted]
Reelin 8y ago
It sure would be nice if we could just purchase such unlocked devices directly. You used to actually control the devices you purchased. Then mobile comes along and so far we've seen locked OS accounts (rooting), locked bootloaders, and locked basebands. Now there's locked ME or PSP. This is getting ridiculous, as well as difficult to keep track of. Perhaps we need some sort of "Fully Unlocked" certification to indicate that a device you're considering purchasing would actually be yours?
- kazagistar 8y ago
  That would only be a useful certification if anything was certified with it.
  - KAMSPioneer 8y ago
    I can't tell if you and GP are being tongue-in-cheek about FSF's RYF certification or not. Either way, you got a sad laugh from me.
    - Reelin 8y ago
      A very depressed sort of tongue-in-cheek, but I sometimes forget that there's no tone of voice on the internet.
- drb91 8y ago
  > Perhaps we need some sort of "Fully Unlocked" certification to indicate that a device you're considering purchasing would actually be yours? Maybe we should make it impossible to advertise a product as being purchasable if you also aren't purchasing rights to the software (and the ability to modify it). Just remove ownership from the equation entirely unless they can demonstrate that the user has full control of the hardware.
  - gmueckl 8y ago
    That would be a pyrrhic victory at best. True ownership of comsumer devices is de facto a thing of the distant past. If you degraded sales to rentals by law, manufacturers would immediately try to jump onto that train and come up with ways to extract even more momey from customers. How would you feel for having to pay your CPU manufacturer for the actual CPU time spent on your personal desktop computer at home? Of course, each core counts separately. Can't have you pay less for running properly paralellized programs, now can we?
userbinator 8y ago
In other words, this vulnerability is "the insecurity that gives us freedom"? That's what it looks like from a quick scan through the article, and if that's the case this is yet another sad instance where the authoritarian "security" community is openly hostile against user freedom. On that moral point, a relevant comment I made on an article recently: https://news.ycombinator.com/item?id=18102434 https://news.ycombinator.com/item?id=18102434 Anyone who is actively finding and closing local-only "exploits" for ME, ones which require root access in the first place, is being actively user-hostile.
- jarfil 8y ago
  "Freedom or persistent compromise" depending on whether it's the rightful owner or an attacker using the exploit. The most user-hostile part is forcing users to choose between accepting an OEM locked down platform, or running an open platform that an attacker can permanently lock down.
  - Reelin 8y ago
    I'd happily pick the third option of running a platform locked down by me, the hardware purchaser, if it were ever made available to the general market. I have absolutely no objection to locked down hardware or DRM-like protections so long as the devices and software I'm using and installing obey me and only me.
    - codedokode 8y ago
      I think DRM means that you cannot control the platform completely.
      - Reelin 8y ago
        Agreed, but I wasn't sure how to describe software that attempts to tightly restrict user actions, protect content streams, etc other than as DRM-like. Perhaps just "secure"? Someone controls the platform, and others (users, guests, adversaries, whoever) don't - I just want to be that someone if it's my device.
oneplane 8y ago
You can only flash coreboot if the BootGuard isn't blown. Nothing else will allow you to run coreboot on a mobile Intel platform because the CPU has a hard-fused hash of the public key for the IBB (boot code in the CPU ROM/factory microcode) and via that, the ACM. (Authenticated Code Module, loaded via ME) This means that you cannot run an Intel CPU without getting an ACM signed by Intel. And that ACM only works with the ME and an Intel formatted SPI flash partitioning scheme. Keep in mind that this hard lockdown only applies to those SoC-ish chips like the mobile PCH+CPU combo chips. Once the PCH and CPU are separate, it's a different story with real options, all the way down to replacing the PCH with one that doesn't have the fuses for BootGuard blown. Manufacturing mode does allow you to access all of the SPI, but it doesn't allow you to add malware of change the firmware as long as BootGuard is still on since you need the RSA private key from the manufacturer to change the firmware, or the RSA private key from Intel to change the IBB+ACM combo package. The Lenovo series you are referring to had a similar but different issue; BootGuard was in validate-only mode, so you can edit the SPI flash and remove the UEFI part, but leave in everything else (ME, GbE, config, IFF, partition data etc.) This has been a non-default configuration for a while, and as you noted, even then it was hard to find one that had that specific firmware/fuse combination. The ME on platforms with sockets is in the PCH which is on the mainboard, not on the CPU, so in theory it is possible to man-in-the-middle the CPU-PCH communication. Another note: a lot of Intel boards have the CCA debug options for ME still enabled due to a mishap from Intel; CCA is the Closed Chassis Adapter which basically runs JTAG over USB3 directly onto the ME CPU core. Getting a USB 3 cable and removing some pins turns it in to a poor man's CCA cable, running some FOSS software on the host will then enable to you stop the ME core on the target and modify memory at will. This basially enables a tethered ME jailbreak, but also ME malware persistence.
- userbinator 8y ago
  ...only until someone finds a bypass for BootGuard, which might actually exist. I'm not too optimistic, but I hope so --- and seeing the reactions of different groups when/if it happens will be interesting to say the least.
  - 294de3557d9d00b 8y ago
Abishek_Muthian 8y ago
>But finding these unpatched and vulnerable series of machines is a hit-or-miss game with minimum chance of success Bios update version changes or the name itself mentions 'intel ME' in the manufacturer's site for their products[1] it should be fairly simple to find computers with an older bios version. [1] : https://www.acer.com/ac/en/IN/content/support-product/6752?b=1 https://www.acer.com/ac/en/IN/content/support-product/6752?b...

markovbot 8y ago

Gee, that almost sounds like a good thing.

turblety 8y ago

Exactly. Remember Intel ME is a great utility and has some awesome abilities. The issue that people have is not the fact there is a CPU running another CPU that looks after the main one. It's that it's closed source and has remote control capabilities that can not be controlled by the user. If Intel would just allow an owner to build and flash their own Intel ME version using their own private/public keys then no one would have an issue with that. It's the fact it's a secret closed system that has full control to monitor everything you do, and can not be fully disabled.

MisterTea 8y ago
> It's the fact it's a secret closed system that has full control to monitor everything you do, and can not be fully disabled. To add to that, it also makes code audits impossible. Intel, AMD, ARM, et al: There is zero, and I mean ZERO reason to hide management functionality from users in this day and age. It's 2018, security through obscurity has been proven wrong time and time again. It's foolish to think otherwise. Edit: grammar.
- def_ConGame 8y ago
  So it's a back door. And a hamfisted one at that. It's not a coding error. It's built to do exactly what it looks like it's supposed to do: diminish any ordinary person's claim of total control over the behavior of the system, such that, should the need arise, a trained hand can lift the proper latch and intervene, to gain the upper hand, ostensibly so "the good guys" win. The good guys being those that ordered Intel into compliance with such requirements.
  - omegaworks 8y ago
    >The good guys being those that ordered Intel into compliance with such requirements. There is vast case law surrounding our first amendment right to refuse this kind of coercion. No one can force you to present something as yours against your will (at least, if they want it to hold up in court). What is more likely is that Intel won a great many more government contracts by doing this. They'd make tons of money doing it, so they did it. And if they didn't do it, their competitor would. That's how the system works in this country. We shouldn't excuse them so readily.
    - diggerNick6771 8y ago
      That's one option. Another is they got a national "security" letter that said you will do this, and even talking about this letter will get you a few years in the clink. I don't think the gov goes around doing this willy nilly, but I think it's clear that this is about the only reliable way to defeat block ciphers. And since there are only 2 real CPU manufacturers, it's easier to do this than attack crypto directly. My personal pet theory is that the aes keys are kept on the die for later retrieval. That and/or keystrokes.
    - confounded 8y ago
      They also won government contracts by not doing it; the High Assurance Platform mode (‘setting the HAP bit’) was a feature implemented by Intel for the NSA, incidentally discovered by security researchers. Dell sold laptops with this as an option until they were asked not to. It would be pretty easy for a sizable country or even a wealthy US state to demand that these ‘secure’ co-processors can be disabled at the user’s discretion, via regulation. From the NSA’s perspective, having the keys to the backdoor is an asset, but having a backdoor at all is a huge liability, now they’re not the only game in town. US businesses and citizens simply have more to lose. Honestly, I think it’s laziness and inertia more than conspiracy.
Leace 8y ago
> If Intel would just allow an owner to build and flash their own Intel ME version using their own private/public keys then no one would have an issue with that. Note that unless you manufacture the CPU yourself you still cannot be sure if there are no hidden backdoors. For example the ME could pretend it's really running your firmware but at the same time running some hidden code only delegating some operations to your code.
- turblety 8y ago
  I understand and agree with you to a certain extent, but we're not just talking about a couple of assembly commands that could be misused. The Intel ME is a FULL Operating System running MINIX Linux (edit: MINIX is not Linux, as corrected by @dragonwriter). It has it's own network and apps, that run inside a running kernel, of which you have no access to. Even if the intentions are 100% legit, this is an operating system that you can not update (as frequently as your main operating system), and has many attack vectors. Yes, it could pretend to run your firmware, but secretly load it's own, but it's actually quite hard to hide a 5mb (2mb min) piece of firmware in the chip. Research microchip decapping. You can clearly see the different regions of the chip. But yes, it could be possible to hide a few x64 instructions, or circuits that could be manipulated. But running a remote control environment that can share your screen without your knowledge can only really be done clearly by running a large separate application stack alongside your main chip. (For now, who knows where we'll be in 5 to 10 years).
  - dragonwriter 8y ago
    > The Intel ME is a FULL Operating System running MINIX Linux. MINIX is a completely different OS than Linux, not a flavor of Linux. “MINIX Linux” makes as much sense as “MacOS Linux”. Intel ME just runs MINIX.
  - turblety 8y ago
    @dragonwriter Would UNIX make more sense?
    - 8y ago
hlandau 8y ago
I previously wrote about why this will never happen. https://www.devever.net/~hl/intelme https://www.devever.net/~hl/intelme The TLDR is that once they started putting a CPU vendor-controlled management CPU on their chipsets, they realised they could use it to implement DRM that Hollywood had been asking them for. We know that AMD has a contractual obligation to DRM vendors not to open source their GPU firmware for this reason, and it's likely Intel and AMD have similar contractual obligations as regards their Intel ME/AMD PSP firmware, as these are also involved in DRM.
- executesorder66 8y ago
  Do you have any source for a time this DRM worked? What I mean is that I have watched/downloaded/streamed a lot of pirated content from various sources, using Intel and AMD hardware. CPU's and GPUs. Not once have the drivers blocked the viewing of pirated content via some kind of built in DRM. So if there is DRM baked into the drivers/ME, then what's the point if it doesn't do anything?
  - smolder 8y ago
    DRM doesn't stop you from playing pirated content, the goal is to make the content only decryptable using approved hardware/software, to limit people's ability to copy and paste content Willy nilly and share with their friends in Napster fashion. The determined people still stealing content never will be stopped, but it's inconvenient enough that average people aren't going to duplicate DRM-laden stuff themselves. Importantly, I think, when there's a higher barrier to content theft, the remaining sources of pirated content are fewer and easier to track.
    - deleted 8y ago
      [deleted]
    - SXX 8y ago
      > Importantly, I think, when there's a higher barrier to content theft, the remaining sources of pirated content are fewer and easier to track. Except DRM on end-user devices is done with security by obscurity and it's never ever worked for media. And never will. So there is so many sources of pirated content that attempts to track of stop them never succeeded. Fortunately NSA and other government spying organizations can still have their backdoor because "Hollywood needs DRM" bullshit.
mrweasel 8y ago
Is the Intel ME that great? I mean I never heard anyone say that they actually use it. The explanation of its capabilities make it seem like a great tool for fleet management, yet nobody seems to be using it. With other alternatives available, combined with low usage, I’m not sure that neither Intels ME nor AMDs PSP needs to be embedded in every CPU.
- turblety 8y ago
  I think the specific part you're referring to is Intel AMT (Active Management Technology) which allows the user to remote control into their computer. AMT is a module that runs within the Intel ME operating system. Intel ME does a lot of things, like the below (we think, no one really knows for sure): - Active Management Technology (AMT) - Alert Standard Format (ASF) - Intel Boot Guard (IBG) - Secure Boot - Integrated Clock Controller (ICC) - Quiet System Technology (QST) / Advanced Fan Speed Control (AFSC) - Protected Audio Video Path (used in PlayReady DRM) - Intel Security Assist (ISA) - Serial over LAN (SOL) - Firmware-based Trusted Platform Module (TPM) Source: https://en.wikipedia.org/wiki/Intel_Management_Engine https://en.wikipedia.org/wiki/Intel_Management_Engine I think there is also some power management functionality in there too.
- deleted 8y ago
  [deleted]

Reelin 8y ago

It sure would be nice if we could just purchase such unlocked devices directly. You used to actually control the devices you purchased. Then mobile comes along and so far we've seen locked OS accounts (rooting), locked bootloaders, and locked basebands. Now there's locked ME or PSP. This is getting ridiculous, as well as difficult to keep track of. Perhaps we need some sort of "Fully Unlocked" certification to indicate that a device you're considering purchasing would actually be yours?

kazagistar 8y ago
That would only be a useful certification if anything was certified with it.
- KAMSPioneer 8y ago
  I can't tell if you and GP are being tongue-in-cheek about FSF's RYF certification or not. Either way, you got a sad laugh from me.
  - Reelin 8y ago
    A very depressed sort of tongue-in-cheek, but I sometimes forget that there's no tone of voice on the internet.
drb91 8y ago
> Perhaps we need some sort of "Fully Unlocked" certification to indicate that a device you're considering purchasing would actually be yours? Maybe we should make it impossible to advertise a product as being purchasable if you also aren't purchasing rights to the software (and the ability to modify it). Just remove ownership from the equation entirely unless they can demonstrate that the user has full control of the hardware.
- gmueckl 8y ago
  That would be a pyrrhic victory at best. True ownership of comsumer devices is de facto a thing of the distant past. If you degraded sales to rentals by law, manufacturers would immediately try to jump onto that train and come up with ways to extract even more momey from customers. How would you feel for having to pay your CPU manufacturer for the actual CPU time spent on your personal desktop computer at home? Of course, each core counts separately. Can't have you pay less for running properly paralellized programs, now can we?

userbinator 8y ago

In other words, this vulnerability is "the insecurity that gives us freedom"? That's what it looks like from a quick scan through the article, and if that's the case this is yet another sad instance where the authoritarian "security" community is openly hostile against user freedom. On that moral point, a relevant comment I made on an article recently: https://news.ycombinator.com/item?id=18102434 https://news.ycombinator.com/item?id=18102434 Anyone who is actively finding and closing local-only "exploits" for ME, ones which require root access in the first place, is being actively user-hostile.

jarfil 8y ago
"Freedom or persistent compromise" depending on whether it's the rightful owner or an attacker using the exploit. The most user-hostile part is forcing users to choose between accepting an OEM locked down platform, or running an open platform that an attacker can permanently lock down.
- Reelin 8y ago
  I'd happily pick the third option of running a platform locked down by me, the hardware purchaser, if it were ever made available to the general market. I have absolutely no objection to locked down hardware or DRM-like protections so long as the devices and software I'm using and installing obey me and only me.
  - codedokode 8y ago
    I think DRM means that you cannot control the platform completely.
    - Reelin 8y ago
      Agreed, but I wasn't sure how to describe software that attempts to tightly restrict user actions, protect content streams, etc other than as DRM-like. Perhaps just "secure"? Someone controls the platform, and others (users, guests, adversaries, whoever) don't - I just want to be that someone if it's my device.

oneplane 8y ago

You can only flash coreboot if the BootGuard isn't blown. Nothing else will allow you to run coreboot on a mobile Intel platform because the CPU has a hard-fused hash of the public key for the IBB (boot code in the CPU ROM/factory microcode) and via that, the ACM. (Authenticated Code Module, loaded via ME) This means that you cannot run an Intel CPU without getting an ACM signed by Intel. And that ACM only works with the ME and an Intel formatted SPI flash partitioning scheme. Keep in mind that this hard lockdown only applies to those SoC-ish chips like the mobile PCH+CPU combo chips. Once the PCH and CPU are separate, it's a different story with real options, all the way down to replacing the PCH with one that doesn't have the fuses for BootGuard blown. Manufacturing mode does allow you to access all of the SPI, but it doesn't allow you to add malware of change the firmware as long as BootGuard is still on since you need the RSA private key from the manufacturer to change the firmware, or the RSA private key from Intel to change the IBB+ACM combo package. The Lenovo series you are referring to had a similar but different issue; BootGuard was in validate-only mode, so you can edit the SPI flash and remove the UEFI part, but leave in everything else (ME, GbE, config, IFF, partition data etc.) This has been a non-default configuration for a while, and as you noted, even then it was hard to find one that had that specific firmware/fuse combination. The ME on platforms with sockets is in the PCH which is on the mainboard, not on the CPU, so in theory it is possible to man-in-the-middle the CPU-PCH communication. Another note: a lot of Intel boards have the CCA debug options for ME still enabled due to a mishap from Intel; CCA is the Closed Chassis Adapter which basically runs JTAG over USB3 directly onto the ME CPU core. Getting a USB 3 cable and removing some pins turns it in to a poor man's CCA cable, running some FOSS software on the host will then enable to you stop the ME core on the target and modify memory at will. This basially enables a tethered ME jailbreak, but also ME malware persistence.

userbinator 8y ago
...only until someone finds a bypass for BootGuard, which might actually exist. I'm not too optimistic, but I hope so --- and seeing the reactions of different groups when/if it happens will be interesting to say the least.
- 294de3557d9d00b 8y ago

Abishek_Muthian 8y ago

>But finding these unpatched and vulnerable series of machines is a hit-or-miss game with minimum chance of success Bios update version changes or the name itself mentions 'intel ME' in the manufacturer's site for their products[1] it should be fairly simple to find computers with an older bios version. [1] : https://www.acer.com/ac/en/IN/content/support-product/6752?b=1 https://www.acer.com/ac/en/IN/content/support-product/6752?b...