> Is the threat real, overblown, or relatively unexplored? There are efforts to reverse engineer it, and a lot of information is known about it. The problem i

> Is the threat real, overblown, or relatively unexplored? There are efforts to reverse engineer it, and a lot of information is known about it. The problem is: - Intel has created its CPU to require ME for CPU initialization. So no ME, no CPU. You can neuter most of it but not the part that starts the CPU. - Intel has locked the space down with strong cryptography and is the only one that can create, read, put or modify code there. - There's no guarantee that Intel won't use or be forced to use this for a given purpose (good or bad) in the future. But, any ME backdoor can't really be used remotely without traversing a network. This means: - The ME might enable someone with physical access to the computer to have free reign through some undocumented or lesser known interfaces (like USB JTAG), but it's far more likely the OS has an exploitable vulnerability in that situation that's at least equivalent (e.g. Thunderbolt DMA). Generally, you are always screwed if your adversary has physical access to the system. - Theoretically you could monitor the outgoing network traffic from the system and notice anything unusual. This is difficult with most general-purpose operating systems in the way most users use them. But minimal installs of OSes (think Debian netinst) with every process accounted for and every expected network communication also accounted for could potentially be monitored enough from an external system to notice any shenanigans. - I don't think the ME knows how to talk to anything but the onboard Intel NICs, so you can just install a Broadcom or Realtek NIC (or a USB NIC), don't use the onboard NIC, and probably reduce any remote attack surface here significantly. This is assuming you don't install local OS drivers that allow the OS to interact with the ME over its OS-exposed interfaces and potentially get the OS to do the ME's bidding.