2 ms·
It's not a wild conspiracy theory that there's an unlabelled "High Assurance Platform" bit on Intel platforms to disable the Management Engine. The same sources
by smolder 5y ago
It's not a wild conspiracy theory that there's an unlabelled "High Assurance Platform" bit on Intel platforms to disable the Management Engine. The same sources that identify the bit as "HAP" control claim it was requested by three letter agencies. I set it, and it does disable/debilitate the ME, so that much is true. That the option exists at least suggests that the ME is an attack surface worth worrying about for someone, i.e. state level actors, even if it's not known to be exploitable.
I assume you meant to be a help by assuring people their computers aren't backdoored, but I don't think you have the certainty to claim ME is sound and secure. It just reminds me of how well-meaning people insisted the USG wasn't interested in capturing everyone's communications, back before it was accepted fact, pre-Snowden.
- mrcode007 5y agoDisabling ME is part of its functionality. You’re just not given the API to do it. To the best of my knowledge this functionality has been in there from the beginning.
- smolder 5y agoYeah, I would expect it was there from the beginning, it's just never exposed as user configurable on standard firmware. Being in there from the beginning doesn't really invalidate the claim by others it was requested by DoD or some agency therein. They are obviously a big client with leverage to have a say in chip features. Even if that part is made up, the off toggles existence still implies security concerns, since the coprocessor shouldn't have any effect on performance.