3 ms·

Yes and no. It could potentially use the network. To do so, it would have to acquire an IP address, which in the case of IPv4 would show as ARP messages. More s

Yes and no. It could potentially use the network. To do so, it would have to acquire an IP address, which in the case of IPv4 would show as ARP messages. More significantly, any attempt to call out could be detected at the router (IPv4 or IPv6). Now I know that most people don't look through firewall logs looking for comms from unexpected internal addresses - but some people do. And since this has been around since 2008 with no reports of such comms that I have been able to find, we can be pretty confident that it is not happening. So why would they network-enable it? I would suggest that this is for the declared purpose - if you need to upgrade the microcode, the normal OS (Windows etc.) has to communicate with the IME, and IP is a good way to do that.

wcarss 4y ago
> we can be pretty confident that it is not happening. We don't _really_ know this. It could of course wait for a signal (say, in a certain memory region, depending on the host OS) and be activated only by remote control in collaboration with other vectors, for special use against, say, heads of state, or the rare meaningful dissidents against whoever it is who has access.
- tengwar2 4y ago
  But the only way that signal would get to it would be with the connivance of a user level application or the normal OS. At that point you have spyware with extra steps - and it's easier to detect because of the unexpected IP address.