7 ms·
The IME itself is a backdoor in the first place. I remember a story a few years past when a full line of CPU's went out with IME having no password set at all,
by unnouinceput 5y ago
The IME itself is a backdoor in the first place. I remember a story a few years past when a full line of CPU's went out with IME having no password set at all, allowing a field day for hackers even when your computer was shut down but still receiving power on standby. Intel had to recall all of them but only after the news blew in media in the first place. Otherwise I'd suspect Intel would've just let it stay, cause money talks.
- google234123 5y agoLink?
- passivate 5y agoI'm in the minority, but I think IME is a great feature to have from a business/IT perspective. As a business, you own the computer, not the the user. And IME lets you provision/control it in at a lower level that most tools won't.
- opan 5y agoThe proprietary nature is the issue. IBM Power 9 stuff has something similar, but much less shady.
- kaba0 5y agoHow is the rest of the CPU not proprietary?
- sudosysgen 5y agoWhy not then let the purchasing user disable the IME, wether its an average person or a business?
- passivate 5y agoI don't know how its implemented, but I'm assume they don't want the user defeating the feature if they're not the owner. The only choice seems to be to use AMD, which probably works quite well given the smackdown that AMD is putting down in recent times..
- jhoechtl 5y agoDARAP, CIA, FBI, NSA -- they are all against that. A computer is a to dangerous tool to leave it to the public without state control.
- girvo 5y agoWhich is fine, except I'm not a business and I _do_ own my computer, but I can't avoid IME.
- passivate 5y agoYes, that part is annoying (if you absolutely need to use intel).
- quantumofalpha 5y agohttps://github.com/corna/me_cleaner https://github.com/corna/me_cleaner works reasonably well for me - at least on motherboards with removable BIOS chips.
- vetinari 5y agoYou guys are confusing two things - ME and AMT (=vPro). The fist one everyone gets. This one doesn't allow remote management, it is intended for internal housekeeping, plus things like emulated TPM and DRM. The second one, which builds on top of the first one, allows management in about the same scope as any other BMC would, and it is pretty easy to avoid it - just do not purchase SKUs with vPro. For vPro, you have to pay extra, so doing that is pretty easy. That said, I also consider vPro generally useful, though somewhat flaky and unreliable. It is also about the only way to get BMC-like functionality for desktops or laptops (hey, Intel, any plans for new NUCs with vPro?).
- passivate 5y agoAh, you're correct. I was indeed conflating the two.
- vaylian 5y agoDo you have a link to a IME tutorial? Or at least the official docs? To me the whole things is just a blackbox that doesn't serve any purposes that are in my interest. Wikipedia is missing such a link.
- derefr 5y ago> allowing a field day for hackers even when your computer was shut down but still receiving power on standby. AFAIK vPro doesn't let anything talk to its management interface over the network until you actually do the local setup. I found this out to my irritation, when I once acquired a used workstation with vPro, freshly wiped, and — thinking I could just set it up by plugging its management-network NIC into my switch and talking to it over the LAN — I found out to my dismay that it wouldn't even bother to acquire an IP address for the management interface until I enabled vPro in the BIOS and then told it to use DHCP. (Am I wrong about this? Perhaps, do OEMs ship batches of machines with vPro pre-configured in certain ways, for clients that explicitly specify that they're going to use vPro for remote provisioning? Or does every workstation order have an implicit "unload from the pallet, plug into a KVM, enable vPro, then install at location" step?)
- gerdesj 5y agoYour parent gave an anecdote: "I remember a story a few years past when a full line of CPU's went out with IME having no password set at all" They describe a pretty serious snag. My experience of iDRAC/iLO/vPRO etc etc etc is that they have all had some pretty major problems. Keep your monitoring/management interfaces on their own network/VLAN is my advice. While you are at it, get the logging and firewall rules sorted.
- Zancarius 5y agoI think the parent you're referring to was echoing a story that popped up as something of a conspiracy on the vestiges of the Internet, hinted at by the claim that the machines could be accessed when powered off. I don't think that's true, and you'd have to have access to the network they're connected to. Though, I suppose you could power such systems up (maybe?) and then gain access to them if you did have access via, say, a corporate network. The closest analog to the claims that I could find in short order did mention a known AMT exploit[1] in 2017. [1] https://www.theregister.com/2017/05/05/intel_amt_remote_exploit https://www.theregister.com/2017/05/05/intel_amt_remote_expl...
- 5y ago
- GuB-42 5y agoI regularly hear story about IME that all seem disproportionate. From what I've seen, AMD has an equivalent, and mobile SoC are worse. Also, it looks like you really have to go out of your way to enable IME remote control, which makes sense because it is a premium feature aimed at professionals. And even if you actually have a backdoor on your PC, for hackers to exploit it, they somehow need to get to your local network first, which is not that easy on a home network unless your computer is the one to initiate the connection. I also probably won't work on anything but the built-in Ethernet port. I don't know what "field day" hackers had, but I suspect it only helped them compromise corporate networks they could access where IME remote control (vPro?) was actively used. It is indeed a serious concern and warrants a recall, but I've yet to see how it can be a concern to most individuals, at least compared to OS-level attacks. And if it is, firewalls, including the simple ones in home routers should be effective.