15 ms·

Disabling the Intel Management Engine

531 points by metadat 4y ago

no-dr-onboard 4y ago
@dang, maybe we should merge this? seems to be a dupe https://news.ycombinator.com/item?id=33344458 https://news.ycombinator.com/item?id=33344458
- maxchristman 4y ago
  That post has a broken link, and this one is the resubmission.
- dang 4y ago
  There was one relevant comment in that thread. I've moved it hither. Thanks!
RetpolineDrama 4y ago
It's absolutely insane that _this_ is what it takes to get IME fully disabled.
- dottedmag 4y ago
  Well, it's a very detailed guide how to dump contents of flash device, update and put it back. If the guide said "dump the flash" and "write back the flash" instead of the detailed instructions, and only described firmware manipulation steps in details it would be much shorter.
- intelVISA 4y ago
  Both absolutely insane and completely understandable. ...hopefully RISC-V will save us from this nightmare.
  - gjsman-1000 4y ago
    Ha - no. Absolutely not. I don't know where this total myth came from that RISC-V is open source therefore implementations will be better. RISC-V is just an ISA (Instruction Set) that anyone can use, but what people use it in, and how they use it, is not specified and does not have to be open source. Apple could take RISC-V, plop it in their iPhone, and release it tomorrow in a processor that only boots Apple-signed code and requires proprietary firmware without any issue whatsoever. Intel could literally release a Core i5 with a RISC-V instruction set and an Intel ME built-in, no problem. Where the hope mainly comes from is small chip developers like SiFive, who make many of their drivers and such open-source. But that's only if you buy from vendors like them - if you implement your own RISC-V core, there's no requirement that the drivers or firmware be open-source for it, in any way. You might say that's a missed opportunity. I say RISC-V wouldn't have caught on otherwise.
    - intelVISA 4y ago
      Ofc, as you mentioned RISC-V is simply an open-source ISA; however, it is arguably the groundwork for chips independent of Intel/AMD.
    - justinclift 4y ago
      > Where the hope mainly comes from is small chip developers like SiFive, who make many of their drivers and such open-source. But that's only if you buy from vendors like them ... So, you're saying it is possible (or will be down the track...) as long as things are bought from SiFive or a similar OSS-friendly place. That's still a large improvement over the current situation, even if other vendors take different, locked down approach.
    - evilos 4y ago
      So... you're saying someone could (but not necessarily will) save us using RISC-V. Seems like a necessary precondition to it.
    - smoldesu 4y ago
      > I don't know where this total myth came from that RISC-V is open source therefore implementations will be better. The hope is that (unlike x86/ARM) you will be able to purchase core designs from people who aren't sockpuppets. RISC-V will at least let people choose between which backdoor they want installed, which is an upgrade from a status quo of "All Your TCP Traffic Belongs To U.S.". It's not exactly Superman, descending from the skies to deliver us from dystopia. But it's certainly a better path than letting ARM dominate any more of our chip landscape.
  - midislack 4y ago
    In the future, buying Chinese designed and made RISV-V will be the way to assure yourself that there’s no extra NSA garbage in there.
- RunSet 4y ago
  But according to Intel it exists to provide functionality that is desired by hardware owners. Big "Look what you made me do" energy.
  - nonrandomstring 4y ago
    > "functionality that is desired by hardware owners" We hear this all the time don't we? Claims that something is; "Because people want it". "Markets demand it". But we see absolutely no evidence of them whatsoever, this mythical mass of people clamouring for features that are strangely aligned with the things big-tech suppliers and manufacturers wish ti push and get to simply assert that "people want". We like to think of ourselves as "evidence based, rational society" We'll happily hold governments, scientific and health research to a high standard of evidence. Even Wikipedia articles demand "citation needed". Show us those people! Back up your claims Intel.
    - sidewndr46 4y ago
      I feel similar with 5G. I don't know anyone who was actually demanding 5G speeds from their phone, or excited about it. Technically it's very cool, but I'm unsure it actually is enabling end users to do something they could not. From my experience, I actually must disable 5G. The 4G network in my area actually works well enough in all circumstances. The 5G network is all-or-nothing. I either wind up with incredible speeds or completely unusable.
      - generalizations 4y ago
        Is the end user actually the market this is aimed at? All we really know is that 5G and the Intel ME are endeavors that are expected to make a profit. But who wants this enough to pay for it? Someone does. If not the mass market consumer, then who?
        cedilla 4y ago
        In the case of 5G, telcos love it. It's vastly less expensive to run than any lower G, both in cities and the countryside. That interest even aligns with end users' interest.
- smolder 4y ago
  Depending on the motherboard it can be very hard, pretty easy, or very easy. For my one motherboard that isn't covered by me-cleaner due to the newness, I verifiably turned off ME the "pretty easy" way: By downloading the latest bios from gigabyte, opening it in Intel's CSME tools (there are download links on some forums geared towards bios modding), flipping the unlabeled "reserved bit" which turns on "high assurance platform mode", and then flashing that bios .bin, also with Intel's tools. I believe some motherboards won't let you flash the modded bios if it's cryptographically unsigned or something like that, which is good for other reasons... but I haven't run into it myself. I've disabled ME on a couple of supermicro boards too, using me-cleaner, since they were supported. (What I consider the "very easy" method.) edit: Sibling poster is right that it can't be fully disabled. I do assume it's effectively disabled when it no longer appears in device manager and Intel's ME inspection tools show it as disabled.
- chasil 4y ago
  This does not and cannot "fully disable" the ME subsystem on modern CPUs. A small remnant is left operational - without it, a PC shuts down after 30 minutes (this is well-known). The Core 2 Duo/Quad architecture was the last iteration where the ME subsystem could be entirely removed. I posted two BIOS images on this link for old HP machines. They can easily be flashed from within the booted bios without much hassle. Looking for the link... Found it on Bing of all places! https://github.com/corna/me_cleaner/issues/233 https://github.com/corna/me_cleaner/issues/233
  - tomxor 4y ago
    > The Core 2 Duo/Quad architecture was the last iteration where the ME subsystem could be entirely removed. Yeah, but unfortunately intel also didn't bother providing microcode patches for meltdown on those chipsets "because to old" by some arbitrary definition of "old".
    - chasil 4y ago
      These are vulnerable to Meltdown, and the page table isolation patches are required to secure kernel memory. These do involve a performance hit, so I'd recommend Core-2 Quad 9550s as an upgrade for a minimally-usable machine. However, these are not SMT/hyperthreaded, so many of the Specter vulnerabilities do not apply. OpenBSD runs well enough on them, and these machines are likely what I trust most with this OS. Most Linux runs on these machines (RedHat 9 doesn't - requires an i3), but will pause on the mei_me module and look for a response from the ME that you have lobotomized; blacklist the related modules if you want to boot faster.
      - chasil 4y ago
        The well-known spectre-meltdown check says that my Q9650 is not vulnerable to Meltdown or Spectre 1-3. It is vulnerable to variant 3a, 4, Fallout, Zombieload, and and both RIDLs. https://github.com/speed47/spectre-meltdown-checker https://github.com/speed47/spectre-meltdown-checker
  - etiam 4y ago
- deleted 4y ago
  [deleted]
  - deleted 4y ago
    [deleted]
etiam 4y ago
Very nice reference. Anybody here got a complementary source to suggest for dealing with more difficult flash chips? ( > If your BIOS flash chip is in a PLCC or WSON package, you will need specialized equipment to connect to the chip, the process for which is not currently covered in this guide. ) I've got a laptop with BIOS on WSON laying around unused since a while back because I haven't managed to take the time and dig up what's a reasonable way to interface with them. ( Bought the machine with an expectation of just clipping onto SOIC, like it's been in all my previous encounters. That'll teach me to look up the specs for the exact model rather than just something similar in the product line I guess.)
- LeifCarrotson 4y ago
  There are two ways to do this: One is to buy an expensive, specialized test socket with pogo pins and a clamshell, from eg https://www.loranger.com/loranger_edc2/html/index.php https://www.loranger.com/loranger_edc2/html/index.php or similar manufacturers. This is what you'd do if you wanted to do a burn-in test of some exotic amplifier or sensor, or to set up a small-scale assembly line and custom-program hundreds (not 1, not thousands) of these chips, and could write off a $100 standard socket or $10,000 custom socket as a cost of doing business. The other way is to just use a hot-air gun to desolder the WSON from the motherboard, use some Chip Quik to temporarily solder it (or an identical chip you bought for $0.50 from Digikey) to a breakout board, program that, desolder it, then reattach it to the motherboard. Of course, the third way is to have the manufacturer or the distributor do this for you.
  - etiam 4y ago
    Thanks! It's great to have some approaches and terms to structure around and as a bonus you've offer a few glimpses of a world I don't know enough about. I was hoping there would be an affordable option for programming in place, but the examples I've come across so far seem uncomfortably fragile ( https://flashrom.org/File:DIP_socket_as_SOIC_clip.jpg https://flashrom.org/File:DIP_socket_as_SOIC_clip.jpg ), so I guess I am most likely in for reviewing some heat implements and trying to refine my soldering skills on a more expensive board than I'm used to. Will have to give more consideration to option three in the future, though in principle I appreciate having the access to keep modifying if needed, so maybe more importantly be more careful with the hardware selection.
deleted 4y ago
[deleted]
stalfosknight 4y ago
Intel's spyware is one big reason I look forward to switching to Apple Silicon soon.
- jeffbee 4y ago
  You believe there are not non-architectural cores in Macs?
  - stalfosknight 4y ago
    Do you have evidence otherwise?
    - jeffbee 4y ago
      Yeah, I do. Every system has tons of non-architectural cores for security, power management, and for other purposes. Apple advertises some of theirs as for example "secure enclave" and, on older Macs, the T1 and T2 security processor which runs the proprietary closed-source BridgeOS and has unfettered access to everything on the system.
      - stalfosknight 4y ago
        Which one of these cores perform the same functions and present the same attack surface as the IME?
        tzmudzin 4y ago
        Closed source, so we can speculate (or try to reverse engineer/break it).
        stalfosknight 4y ago
        So at best we have cynicism / paranoia regarding Apple's T2.
FortiDude 4y ago
The management engine is a privacy nightmare. It's incredibly useful for companies and organizations, especially when lending computers to their employees, but why the hell would this tech be put inside consumer devices? It just sits there as an exposed attack surface without the user even having the tools to maybe make something out of it.
- throwaway0x7E6 4y ago
  Q: >but why the hell would this tech be put inside consumer devices? A: >It just sits there as an exposed attack surface
- washadjeffmad 4y ago
  > It's incredibly useful for companies and organizations Is it? We don't use it for any of the 40k+ desktop or mobile devices we manage.
  - GekkePrutser 4y ago
    Same here with 150k+. Not using it, certainly never asked for it. Same with all the vPro stuff (which is kinda related but not completely). We do use Windows autopilot though but that doesn't depend on IME.
    - HideousKojima 4y ago
      Back when I worked on the sysadmin side of things we used vPro for out of band management of servers in our datacenters, but we never used it for our 10k+ laptops and desktops.
      - GekkePrutser 4y ago
        Yeah exactly. We used Dell iDRAC remote management cards and HP ILO for that mostly. We still use the latter on the few servers we have left (which is very very few). But on laptops/desktops never. That still doesn't really give it any reason to have it in workstation chips, in Xeons perhaps...
rkagerer 4y ago
Hey Intel, I'd pay you a premium to buy a CPU with this crap already disabled.
- marcodiego 4y ago
  Hey AMD, me too.
- adrian_b 4y ago
  Some of the Dell professional laptops, at least many of the Dell Precision mobile workstations, have a customization option that allows the buyer to choose "Intel ME disabled". I hope that they really do disable it in the laptops sold with this option.
Razengan 4y ago
Good thing there's nothing in like that in the Apple chips... or is there? :think:
- gjsman-1000 4y ago
  There is - it's called the "Secure Enclave." However, it is just another block on the processor and isn't this always-running ghost system underneath you. It cannot be shut down once started without a reboot - but it is completely up to you whether to start it in the first place. So, if you don't start the Secure Enclave and load its Apple-signed firmware, it will just sit there dark and unused.
warner25 4y ago
Usually when I'm reminded about IME (and whatever the equivalent is in AMD chips), it's in the context of some strong claims about it being "game over" for security and privacy against mass surveillance, engineered / funded by nation-state intelligence agencies, and rendering all other technical efforts moot. They make it sound plausible, and I think "why isn't this talked about or investigated more?" The section of the Wikipedia page that discusses the "backdoor" claim is frustratingly thin. I just don't know what to make of it. Hyperbole about a crappy thing, like the bloatware pre-installed on most new laptops and phones by the vendor? An open secret, with discussion about it suppressed?
- pkulak 4y ago
  It's just too old for people to be outraged about still.
  - anonym29 4y ago
    By this logic, should we not be outraged by 19th and 20th century genocide?
    - pkulak 4y ago
      I'm not telling you what emotions to have, just observing the world around me.
    - Alupis 4y ago
      > By this logic, should we not be outraged by 19th and 20th century genocide? Well, no. I don't think you will actually find a real person living today that matches a real definition of "outrage" for genocides in the 19th and 20th centuries. Discarding performative theatrics, you will find people who all agree it was bad... but they won't be literally outraged. The passing of time, and generations, has that affect.
      - kragen 4y ago
        Pretty sure Holocaust survivors and their immediate families, not to mention the scarcer immediate family members of Holocaust non-survivors, are still outraged about the Holocaust. I don't think that's performative theatrics.
pkulak 4y ago
This is the big benefit of companies like System76 that disable this for you.
CrLf 4y ago
The IME gets a lot of hate around here, but let's not get distracted by it: higher-privilege co-processors running code outside the main OS' control is becoming (or already is) the norm everywhere. Intel-based PCs are just one instance of it (and perhaps not even the most egregious one). Most hardware has evolved to effectively run the main OS under a sandbox where it "thinks" it is in control, but isn't. A nice talk on this: https://www.youtube.com/watch?v=36myc8wQhLo https://www.youtube.com/watch?v=36myc8wQhLo
- dizhn 4y ago
  Thank you thank you thank you. I've been trying to find this talk forever after watching it once. I immediately knew this was it when I saw it under this particular thread. Super Illuminating stuff.
- Xelbair 4y ago
  Sure, but does the separate co-processor needs access to network stack? for a typical end user? definitely not.
  - bragr 4y ago
    It does if you want remote management, which almost every IT department does.
    - boppo1 4y ago
      Can we not have separate enterprise and individual classes of processor?
      - ranger207 4y ago
        Heck, ECC is already market-segregated
        bubblethink 4y ago
        This is also segmented. The remote management stuff is marketed as vpro which is not available in all SKUs. However, all Intel processors need the ME.
deleted 4y ago
[deleted]
laweijfmvo 4y ago
How does something like this access my network? Like if I'm connected to WiFi, what's the stack look like for this chip getting access to that without the OS cooperating?
- mmis1000 4y ago
  Because the intel me 'is' a standalone system. So it can do anything on its own. Of course it won't connect to your WiFi because it didn't know the password. But lan connections don't need password so it can connect and listen to it in that case.
  - erik_seaberg 4y ago
    There is a standard for LAN authentication, though I think only high-end network hardware enforces it. https://en.wikipedia.org/wiki/IEEE_802.1X https://en.wikipedia.org/wiki/IEEE_802.1X
    - laweijfmvo 4y ago
      Most laptops don't even have an RJ-45 anymore
      - wmf 4y ago
        WPA Enterprise is basically 802.1x over Wi-Fi and yes, the ME has drivers for Intel Wi-Fi cards.
    - snuxoll 4y ago
      Depends on your definition of "high-end", while I personally stick with Mikrotik and Juniper gear a TP-Link TL-SG2008 is only $70 and gives you 8x1GbE ports and support for 802.1x just fine. For wireless you'd use WPA-Enterprise, which is pretty common on most consumer grade routers (for some reason), readily accessible on anything you can install OpenWRT on, and then on prosumer stuff like Ubiquiti AP's.
- kevin_thibedeau 4y ago
thrillgore 4y ago
Unfortunately it lost me at the risk to brick my computer. Intel needs to be brought to court to stop enabling IME, not with hacks. If i have to use IME, the system I use will be considered insufficient for secure purposes and i'll just use another system for secure matters.
- radicalcentrist 4y ago
  The risk of bricking isn't so bad as long as you keep a copy of the original firmware. If the patched firmware doesn't boot, you can always revert back.
dmitrygr 4y ago
ME gets a lot of well-deserved hate. And a lot of work goes into disabling it. But I am surprised that none of the people working on such projects ever looked at the very peculiar ME payloads that intel chromebooks carry for hints on how to do it better...
londons_explore 4y ago
Why exactly isn't there a setting or jumper to just disable this? I don't really see a business reason for Intel to make this hard to do... They could totally have made the machine reset if the ME couldn't be initialized. But they didn't.
- w1nst0nsm1th 4y ago
  Remind me of that secured phone sold by a german company to governments around the world. In practice, the company was indeed a joint venture involving the US government who used a german proxy to sold compromised hardware to unsuspecting official. Everything went straigh to NSA.
- nullc 4y ago
  > They could totally have made the machine reset if the ME couldn't be initialized. But they didn't. Hm? That's what they did: if you disable too much of the ME the computer will reboot after 30 minutes.
- hda2 4y ago
  If I recall correctly, there were special DELL machines where intel allowed owners to disable ME in the bios. You had to contact sales to buy them. The issue here is that ME can be disabled but intel doesn't want you, the "normal consumer", to disable it. Why?
the-printer 4y ago
Are there any caveats to disabling the IME? This side of computing can become daunting in the context of the direction that the world is heading. So many acronyms and backronyms lie beneath the chassis of our devices running commands and loops; looping and commanding and checksumming and checking sumthin’ out. Checking what out and sending it where? - “We need to verify that the code is signed for your safety.” - “But it came from your App Store, emperor of the mononymic enterprise.”
- wmf 4y ago
  Certain DRM will no longer work so you may not be able to play Netflix or whatever.
r00fus 4y ago
Is there an equivalent to IME for AMD and/or Apple M-class processors (that would similarly benefit from disabling for home user)?
- arprocter 4y ago
  https://en.wikipedia.org/wiki/AMD_Platform_Security_Processor https://en.wikipedia.org/wiki/AMD_Platform_Security_Processo...
- GuB-42 4y ago
  The equivalent for AMD CPUs is called the Platform Security Processor (PSP). I am not aware of a way to disable it. I don't know about Apple CPUs but they definitely have co-processors running besides the main CPU. In fact, many people talk about the IME but the practice of having proprietary systems with their own privileged hardware is the norm nowadays. Another example is the "baseband" processor in phones, it is a complete proprietary system with its own processor, OS, etc... and it controls the modem, among other things.
- oarmstrong 4y ago
  I’d like to know more about AMD specifically too. I’m well aware that PSP is their equivalent but there seems to be so little information out there about it. Is it really an equivalent? Is it as bad as ME? Can it be disabled? Does it have the same level of access as ME? Have their been any exploits of it yet? The wikipedia page is rather bare. There’s a couple of papers linked to but frankly they go over my head. Is there any respectable analysis out there?
  - EMM_386 4y ago
    > I’d like to know more about AMD specifically too. I’m well aware that PSP is their equivalent This is why I'm curious and get a little into conspiracy-land with this stuff. Neither are exactly "well documented", they both arrived on the scene around the same time. It makes one wonder if there was a specification they were told to follow. That's why I'm very curious if Apple's new chips follow a similar "specification". Sorry, I mean "feature set".
freefal 4y ago
“removes the vast majority of the ME's software modules (including network stack, RTOS and Java VM)” There’s a Java VM on these things?!
- mmis1000 4y ago
  Not surprised, Java vm is literally everywhere. From your credit card to sim, if it is a ic card then there is Java vm. It is almost universal language for mini embedded system for some reason I don't understand.
  - smolder 4y ago
    IIUC, it's because it's easier to rigorously prove the VM prevents classes of bugs (i.e. memory safety issues) and then reuse that VM in many places than it is to rigorously prove that many separate embedded systems not relying on the VM have independently avoided those bugs.
    - hedora 4y ago
      Is there an example of a JVM that has been proven correct in this sense? I haven't heard of one.
      - smolder 4y ago
        I don't know specific details about the correctness of any particular VM, sorry. That was just the explanation I got from another engineer that apparently had experience in developing embedded java things.
  - goodpoint 4y ago
    > It is almost universal language for mini embedded system for some reason I don't understand. Marketing-fueled hype.
npteljes 4y ago
If anyone is interested, it's possible to buy a laptop with ME already disabled: https://puri.sm/products/librem-14/ https://puri.sm/products/librem-14/ EDIT: there's more at Wikipedia: https://en.wikipedia.org/wiki/Intel_Management_Engine#Commercial_ME_disablement https://en.wikipedia.org/wiki/Intel_Management_Engine#Commer...
- smitty1e 4y ago
  It's incumbent upon those caring about liberty [looks in mirror] to support/advertise the alternatives.
- smaudet 4y ago
  I love the concept of a librem, TBH everytime I look at buying one I balk at the price compared to a more traditional build. It's like buying a Mac and I can't even justify it by saying it is for iPhone dev. I don't have a market reason for buying one, I wish I did but what I'd use it for? No IME great, now what? If someone flips a switch I guess I have a safe computer, but I still have to interact with the world and that's still unsafe (banking, identity, employment). I wish it were a bit more raspberry Pi - I'd have an easier time justifying that purchase just if I had integrated GPIO. I have (multiple) rpis but they sit in boxes because they are a combination of unsupported and complex to assemble/use, outside of browsing some very simple websites I find them difficult to use, even for embedded development.
  - forgotmypw17 4y ago
    They're doing novel R&D which no other manufacturer is doing, and putting together what looks like a quality workstation, which brings you much closer to consensual computing than almost anything else on the market. If I was a buyer of new hardware, and especially getting paid for professional software development, I can't imagine thinking very long before buying one.
- khimaros 4y ago
  StarLabs also sells laptops with ME disabled.
rolph 4y ago
rather than disable ME, i would want to pwn it. you can dump, substantially re-engineer, and write back, to add utility, and provide service to end user. or could it be like the one ring?
w1nst0nsm1th 4y ago
In short IME is a hardware spyware ? That's it ?
- rolph 4y ago
  out of band networked/remote hardware management.
borissk 4y ago
A slightly off-topic question: many modern motherboard have a function to flash a BIOS even without CPU present (e.g. Gigabyte markets it as Q-Flash). Any idea how does that technically work? Do they put a separate CPU on the motherboard?
- tymscar 4y ago
  I just upgraded to a Ryzen 9 7950x with a Gigabyte x670e motherboard and while using qflash+ I also got curious but nothing online answers how it works and the manual is too simplistic to include the details. If I would have to guess It’s probably the chipset?
- greycol 4y ago
  smolder has a comment in this thread expressing viability for some boards doing this. https://news.ycombinator.com/item?id=33347065 https://news.ycombinator.com/item?id=33347065
pm2222 4y ago
EFI, anyone? MBR works perfectly ok for me.
NoImmatureAdHom 4y ago
Anyone know if me_cleaner etc. work on the new 12th generation chips? It's not clear from the link.
checkyoursudo 4y ago
With regard to the guide itself, please be aware that the guide, of which this is but a one section, is no longer actively maintained (since 2020). It is a great and useful guide. I have used it to modify my own Gentoo installation. But, be aware of what you are doing. :)
egberts1 4y ago
That's why I never use the onboard Ethernet chipset, ever. Even if it's BIOS-disable. Just buy a decent Intel (or even RTL) Ethernet NIC PCI card, or two.
- djcannabiz 4y ago
  fwiw another commenter posted about how the firmware for the ME includes drivers for other intel network cards
  - egberts1 4y ago
    Yes, but those ME-capable Intel Ethernet NIC require CPU-based processor OOB installation of ME soft-drivers which BSD and Linux do not carry, thankfully: which is why I never use onboard Ethernet. On the other hand, it is a real technical possibility, for the Intel WiFi NIC PCIe cards to be initialized by its on-board ME processor which can then do this back-PCI driver setup from this ME processor even if BIOS-disabled (or if CPU is dead or halt'd); by and for the (IME/PSP) Intel/AMD CPU-based Motherboards. Not using Onboard Ethernet nor loading its driver takes out that NIC access, but not the possibility of still using any "found" Intel WiFi NIC adapter: do not install NIC with any built-in management engine (ME), including wireless ones like Bluetooth, NFC, WiFi, Zig. use the plain ol' ME-free Ethernet NIC adapters while not using the onboard Ethernet port (bonus, disable driver to onboard Ethernet) and you will be fine on that topic of concern about ME processor (onboard ones). Of course, there is always a possibility of unadvertised ME-capability (commonly in WiFi but also seldom in wired) Ethernet NIC adapters made by shady manufacturers but we can mostly find those out and avoid them. Dependable Ethernet NIC adapter manufacturers likes to tout its ME capabilities (because larger market comprises of Enterprise users).
jongjong 4y ago
The decision to create such an engine is so unwise, it's evil.
- EMM_386 4y ago
  It may not have been a decision, at least on the part of Intel.
Melatonic 4y ago
If you are worried about IME you may want to check if your laptop or desktop has Intel VPro with KVM enabled. Much bigger real world threat. It can also have some very very cool uses though for remote management. Sometimes VPro needs a separate Bios update - make sure you do this and if you do keep it enabled make SURE you set a good password.
bacan 4y ago
Many Dell PCs have a “SERVICE MODE” jumper that also disables IME
easygenes 4y ago
For at least a decade this engine has been a total backdoor. There's even a VNC server embedded. [1] 1: https://blog.michael.kuron-germany.de/2011/10/using-intel-amts-vnc-server/
- wmf 4y ago
  Note that most PCs do not have AMT.
javajosh 4y ago
Cool technique but it would be cooler if you could cut the Rpi out of it. Do they make IC clips that can connect to the USB port of a laptop? If so that would be easier and less error prone than mapping the IC clip wires to the GPIO pins of the RPi and having to go through the trouble of connecting a KVM to what is, effectively a $35 throw-away computer. (Or, I suppose the best case would be an IC clip that plugs into the USB-C port of your phone, and you can run the software in an app...)
ksidudwbw 4y ago
Having a huge government schlong up the backend shouldn't be a concern to us/eu citizens. It's only the slack left from the multitude of schlongs that foreigners could use that should be of concern
d18g 4y ago
Disclaimer: A security researcher working on IME. Following is my own opinion. Used to have really strong uninformed opinions on many things, as often found in young techy-nerd person. It is terrifying how intelligent people are so prone to jump on conspiracy wagons. The current thread and alike are truly humbling experience for me as a person, I wonder how my comments look like to the in the know personal. If they ever had the misfortune to ever see it, did they at least had a good laugh? I know I didn't give any arguments. Sadly I can't get into details so I will be pretty handicapped anyway. I do believe good faith dailog is possible, but feel that it is impossible on the wide internet. Would be great to have a serious conversation on the subject in person with the more cool-headed commenters here. I must thank all of the HN commenters that usually try to be thoughtful, insightful, thought provoking and respectful at the same time.
- temptemptemp111 4y ago
guenthert 4y ago
"the Panasonic CF-AX3 is refreshingly straightforward in this regard — after removing the main battery and removing 19 small screws on the bottom-side, the rear panel of the laptop lifts off easily. " Sarcasm? I cursed our hardware designer for making me remove half as many screws. I mean, my motorcycles' gas tank is secured by a single bolt and you'd think that would be more important to keep in place ...

531 points by metadat 4y ago

@dang, maybe we should merge this? seems to be a dupe https://news.ycombinator.com/item?id=33344458 https://news.ycombinator.com/item?id=33344458

maxchristman 4y ago
That post has a broken link, and this one is the resubmission.
dang 4y ago
There was one relevant comment in that thread. I've moved it hither. Thanks!

RetpolineDrama 4y ago

It's absolutely insane that _this_ is what it takes to get IME fully disabled.

dottedmag 4y ago
Well, it's a very detailed guide how to dump contents of flash device, update and put it back. If the guide said "dump the flash" and "write back the flash" instead of the detailed instructions, and only described firmware manipulation steps in details it would be much shorter.
intelVISA 4y ago
Both absolutely insane and completely understandable. ...hopefully RISC-V will save us from this nightmare.
- gjsman-1000 4y ago
  Ha - no. Absolutely not. I don't know where this total myth came from that RISC-V is open source therefore implementations will be better. RISC-V is just an ISA (Instruction Set) that anyone can use, but what people use it in, and how they use it, is not specified and does not have to be open source. Apple could take RISC-V, plop it in their iPhone, and release it tomorrow in a processor that only boots Apple-signed code and requires proprietary firmware without any issue whatsoever. Intel could literally release a Core i5 with a RISC-V instruction set and an Intel ME built-in, no problem. Where the hope mainly comes from is small chip developers like SiFive, who make many of their drivers and such open-source. But that's only if you buy from vendors like them - if you implement your own RISC-V core, there's no requirement that the drivers or firmware be open-source for it, in any way. You might say that's a missed opportunity. I say RISC-V wouldn't have caught on otherwise.
  - intelVISA 4y ago
    Ofc, as you mentioned RISC-V is simply an open-source ISA; however, it is arguably the groundwork for chips independent of Intel/AMD.
  - justinclift 4y ago
    > Where the hope mainly comes from is small chip developers like SiFive, who make many of their drivers and such open-source. But that's only if you buy from vendors like them ... So, you're saying it is possible (or will be down the track...) as long as things are bought from SiFive or a similar OSS-friendly place. That's still a large improvement over the current situation, even if other vendors take different, locked down approach.
  - evilos 4y ago
    So... you're saying someone could (but not necessarily will) save us using RISC-V. Seems like a necessary precondition to it.
  - smoldesu 4y ago
    > I don't know where this total myth came from that RISC-V is open source therefore implementations will be better. The hope is that (unlike x86/ARM) you will be able to purchase core designs from people who aren't sockpuppets. RISC-V will at least let people choose between which backdoor they want installed, which is an upgrade from a status quo of "All Your TCP Traffic Belongs To U.S.". It's not exactly Superman, descending from the skies to deliver us from dystopia. But it's certainly a better path than letting ARM dominate any more of our chip landscape.
- midislack 4y ago
  In the future, buying Chinese designed and made RISV-V will be the way to assure yourself that there’s no extra NSA garbage in there.
RunSet 4y ago
But according to Intel it exists to provide functionality that is desired by hardware owners. Big "Look what you made me do" energy.
- nonrandomstring 4y ago
  > "functionality that is desired by hardware owners" We hear this all the time don't we? Claims that something is; "Because people want it". "Markets demand it". But we see absolutely no evidence of them whatsoever, this mythical mass of people clamouring for features that are strangely aligned with the things big-tech suppliers and manufacturers wish ti push and get to simply assert that "people want". We like to think of ourselves as "evidence based, rational society" We'll happily hold governments, scientific and health research to a high standard of evidence. Even Wikipedia articles demand "citation needed". Show us those people! Back up your claims Intel.
  - sidewndr46 4y ago
    I feel similar with 5G. I don't know anyone who was actually demanding 5G speeds from their phone, or excited about it. Technically it's very cool, but I'm unsure it actually is enabling end users to do something they could not. From my experience, I actually must disable 5G. The 4G network in my area actually works well enough in all circumstances. The 5G network is all-or-nothing. I either wind up with incredible speeds or completely unusable.
    - generalizations 4y ago
      Is the end user actually the market this is aimed at? All we really know is that 5G and the Intel ME are endeavors that are expected to make a profit. But who wants this enough to pay for it? Someone does. If not the mass market consumer, then who?
      - cedilla 4y ago
        In the case of 5G, telcos love it. It's vastly less expensive to run than any lower G, both in cities and the countryside. That interest even aligns with end users' interest.
smolder 4y ago
Depending on the motherboard it can be very hard, pretty easy, or very easy. For my one motherboard that isn't covered by me-cleaner due to the newness, I verifiably turned off ME the "pretty easy" way: By downloading the latest bios from gigabyte, opening it in Intel's CSME tools (there are download links on some forums geared towards bios modding), flipping the unlabeled "reserved bit" which turns on "high assurance platform mode", and then flashing that bios .bin, also with Intel's tools. I believe some motherboards won't let you flash the modded bios if it's cryptographically unsigned or something like that, which is good for other reasons... but I haven't run into it myself. I've disabled ME on a couple of supermicro boards too, using me-cleaner, since they were supported. (What I consider the "very easy" method.) edit: Sibling poster is right that it can't be fully disabled. I do assume it's effectively disabled when it no longer appears in device manager and Intel's ME inspection tools show it as disabled.
chasil 4y ago
This does not and cannot "fully disable" the ME subsystem on modern CPUs. A small remnant is left operational - without it, a PC shuts down after 30 minutes (this is well-known). The Core 2 Duo/Quad architecture was the last iteration where the ME subsystem could be entirely removed. I posted two BIOS images on this link for old HP machines. They can easily be flashed from within the booted bios without much hassle. Looking for the link... Found it on Bing of all places! https://github.com/corna/me_cleaner/issues/233 https://github.com/corna/me_cleaner/issues/233
- tomxor 4y ago
  > The Core 2 Duo/Quad architecture was the last iteration where the ME subsystem could be entirely removed. Yeah, but unfortunately intel also didn't bother providing microcode patches for meltdown on those chipsets "because to old" by some arbitrary definition of "old".
  - chasil 4y ago
    These are vulnerable to Meltdown, and the page table isolation patches are required to secure kernel memory. These do involve a performance hit, so I'd recommend Core-2 Quad 9550s as an upgrade for a minimally-usable machine. However, these are not SMT/hyperthreaded, so many of the Specter vulnerabilities do not apply. OpenBSD runs well enough on them, and these machines are likely what I trust most with this OS. Most Linux runs on these machines (RedHat 9 doesn't - requires an i3), but will pause on the mei_me module and look for a response from the ME that you have lobotomized; blacklist the related modules if you want to boot faster.
    - chasil 4y ago
      The well-known spectre-meltdown check says that my Q9650 is not vulnerable to Meltdown or Spectre 1-3. It is vulnerable to variant 3a, 4, Fallout, Zombieload, and and both RIDLs. https://github.com/speed47/spectre-meltdown-checker https://github.com/speed47/spectre-meltdown-checker
- etiam 4y ago
deleted 4y ago
[deleted]
- deleted 4y ago
  [deleted]

etiam 4y ago

Very nice reference. Anybody here got a complementary source to suggest for dealing with more difficult flash chips? ( > If your BIOS flash chip is in a PLCC or WSON package, you will need specialized equipment to connect to the chip, the process for which is not currently covered in this guide. ) I've got a laptop with BIOS on WSON laying around unused since a while back because I haven't managed to take the time and dig up what's a reasonable way to interface with them. ( Bought the machine with an expectation of just clipping onto SOIC, like it's been in all my previous encounters. That'll teach me to look up the specs for the exact model rather than just something similar in the product line I guess.)

LeifCarrotson 4y ago
There are two ways to do this: One is to buy an expensive, specialized test socket with pogo pins and a clamshell, from eg https://www.loranger.com/loranger_edc2/html/index.php https://www.loranger.com/loranger_edc2/html/index.php or similar manufacturers. This is what you'd do if you wanted to do a burn-in test of some exotic amplifier or sensor, or to set up a small-scale assembly line and custom-program hundreds (not 1, not thousands) of these chips, and could write off a $100 standard socket or $10,000 custom socket as a cost of doing business. The other way is to just use a hot-air gun to desolder the WSON from the motherboard, use some Chip Quik to temporarily solder it (or an identical chip you bought for $0.50 from Digikey) to a breakout board, program that, desolder it, then reattach it to the motherboard. Of course, the third way is to have the manufacturer or the distributor do this for you.
- etiam 4y ago
  Thanks! It's great to have some approaches and terms to structure around and as a bonus you've offer a few glimpses of a world I don't know enough about. I was hoping there would be an affordable option for programming in place, but the examples I've come across so far seem uncomfortably fragile ( https://flashrom.org/File:DIP_socket_as_SOIC_clip.jpg https://flashrom.org/File:DIP_socket_as_SOIC_clip.jpg ), so I guess I am most likely in for reviewing some heat implements and trying to refine my soldering skills on a more expensive board than I'm used to. Will have to give more consideration to option three in the future, though in principle I appreciate having the access to keep modifying if needed, so maybe more importantly be more careful with the hardware selection.

deleted 4y ago

[deleted]

stalfosknight 4y ago

Intel's spyware is one big reason I look forward to switching to Apple Silicon soon.

jeffbee 4y ago
You believe there are not non-architectural cores in Macs?
- stalfosknight 4y ago
  Do you have evidence otherwise?
  - jeffbee 4y ago
    Yeah, I do. Every system has tons of non-architectural cores for security, power management, and for other purposes. Apple advertises some of theirs as for example "secure enclave" and, on older Macs, the T1 and T2 security processor which runs the proprietary closed-source BridgeOS and has unfettered access to everything on the system.
    - stalfosknight 4y ago
      Which one of these cores perform the same functions and present the same attack surface as the IME?
      - tzmudzin 4y ago
        Closed source, so we can speculate (or try to reverse engineer/break it).
        stalfosknight 4y ago
        So at best we have cynicism / paranoia regarding Apple's T2.

FortiDude 4y ago

The management engine is a privacy nightmare. It's incredibly useful for companies and organizations, especially when lending computers to their employees, but why the hell would this tech be put inside consumer devices? It just sits there as an exposed attack surface without the user even having the tools to maybe make something out of it.

throwaway0x7E6 4y ago
Q: >but why the hell would this tech be put inside consumer devices? A: >It just sits there as an exposed attack surface
washadjeffmad 4y ago
> It's incredibly useful for companies and organizations Is it? We don't use it for any of the 40k+ desktop or mobile devices we manage.
- GekkePrutser 4y ago
  Same here with 150k+. Not using it, certainly never asked for it. Same with all the vPro stuff (which is kinda related but not completely). We do use Windows autopilot though but that doesn't depend on IME.
  - HideousKojima 4y ago
    Back when I worked on the sysadmin side of things we used vPro for out of band management of servers in our datacenters, but we never used it for our 10k+ laptops and desktops.
    - GekkePrutser 4y ago
      Yeah exactly. We used Dell iDRAC remote management cards and HP ILO for that mostly. We still use the latter on the few servers we have left (which is very very few). But on laptops/desktops never. That still doesn't really give it any reason to have it in workstation chips, in Xeons perhaps...

rkagerer 4y ago

Hey Intel, I'd pay you a premium to buy a CPU with this crap already disabled.

marcodiego 4y ago
Hey AMD, me too.
adrian_b 4y ago
Some of the Dell professional laptops, at least many of the Dell Precision mobile workstations, have a customization option that allows the buyer to choose "Intel ME disabled". I hope that they really do disable it in the laptops sold with this option.

Razengan 4y ago

Good thing there's nothing in like that in the Apple chips... or is there? :think:

gjsman-1000 4y ago
There is - it's called the "Secure Enclave." However, it is just another block on the processor and isn't this always-running ghost system underneath you. It cannot be shut down once started without a reboot - but it is completely up to you whether to start it in the first place. So, if you don't start the Secure Enclave and load its Apple-signed firmware, it will just sit there dark and unused.

warner25 4y ago

Usually when I'm reminded about IME (and whatever the equivalent is in AMD chips), it's in the context of some strong claims about it being "game over" for security and privacy against mass surveillance, engineered / funded by nation-state intelligence agencies, and rendering all other technical efforts moot. They make it sound plausible, and I think "why isn't this talked about or investigated more?" The section of the Wikipedia page that discusses the "backdoor" claim is frustratingly thin. I just don't know what to make of it. Hyperbole about a crappy thing, like the bloatware pre-installed on most new laptops and phones by the vendor? An open secret, with discussion about it suppressed?

pkulak 4y ago
It's just too old for people to be outraged about still.
- anonym29 4y ago
  By this logic, should we not be outraged by 19th and 20th century genocide?
  - pkulak 4y ago
    I'm not telling you what emotions to have, just observing the world around me.
  - Alupis 4y ago
    > By this logic, should we not be outraged by 19th and 20th century genocide? Well, no. I don't think you will actually find a real person living today that matches a real definition of "outrage" for genocides in the 19th and 20th centuries. Discarding performative theatrics, you will find people who all agree it was bad... but they won't be literally outraged. The passing of time, and generations, has that affect.
    - kragen 4y ago
      Pretty sure Holocaust survivors and their immediate families, not to mention the scarcer immediate family members of Holocaust non-survivors, are still outraged about the Holocaust. I don't think that's performative theatrics.

pkulak 4y ago

This is the big benefit of companies like System76 that disable this for you.

CrLf 4y ago

The IME gets a lot of hate around here, but let's not get distracted by it: higher-privilege co-processors running code outside the main OS' control is becoming (or already is) the norm everywhere. Intel-based PCs are just one instance of it (and perhaps not even the most egregious one). Most hardware has evolved to effectively run the main OS under a sandbox where it "thinks" it is in control, but isn't. A nice talk on this: https://www.youtube.com/watch?v=36myc8wQhLo https://www.youtube.com/watch?v=36myc8wQhLo

dizhn 4y ago
Thank you thank you thank you. I've been trying to find this talk forever after watching it once. I immediately knew this was it when I saw it under this particular thread. Super Illuminating stuff.
Xelbair 4y ago
Sure, but does the separate co-processor needs access to network stack? for a typical end user? definitely not.
- bragr 4y ago
  It does if you want remote management, which almost every IT department does.
  - boppo1 4y ago
    Can we not have separate enterprise and individual classes of processor?
    - ranger207 4y ago
      Heck, ECC is already market-segregated
      - bubblethink 4y ago
        This is also segmented. The remote management stuff is marketed as vpro which is not available in all SKUs. However, all Intel processors need the ME.

deleted 4y ago

[deleted]

laweijfmvo 4y ago

How does something like this access my network? Like if I'm connected to WiFi, what's the stack look like for this chip getting access to that without the OS cooperating?

mmis1000 4y ago
Because the intel me 'is' a standalone system. So it can do anything on its own. Of course it won't connect to your WiFi because it didn't know the password. But lan connections don't need password so it can connect and listen to it in that case.
- erik_seaberg 4y ago
  There is a standard for LAN authentication, though I think only high-end network hardware enforces it. https://en.wikipedia.org/wiki/IEEE_802.1X https://en.wikipedia.org/wiki/IEEE_802.1X
  - laweijfmvo 4y ago
    Most laptops don't even have an RJ-45 anymore
    - wmf 4y ago
      WPA Enterprise is basically 802.1x over Wi-Fi and yes, the ME has drivers for Intel Wi-Fi cards.
  - snuxoll 4y ago
    Depends on your definition of "high-end", while I personally stick with Mikrotik and Juniper gear a TP-Link TL-SG2008 is only $70 and gives you 8x1GbE ports and support for 802.1x just fine. For wireless you'd use WPA-Enterprise, which is pretty common on most consumer grade routers (for some reason), readily accessible on anything you can install OpenWRT on, and then on prosumer stuff like Ubiquiti AP's.
kevin_thibedeau 4y ago

thrillgore 4y ago

Unfortunately it lost me at the risk to brick my computer. Intel needs to be brought to court to stop enabling IME, not with hacks. If i have to use IME, the system I use will be considered insufficient for secure purposes and i'll just use another system for secure matters.

radicalcentrist 4y ago
The risk of bricking isn't so bad as long as you keep a copy of the original firmware. If the patched firmware doesn't boot, you can always revert back.

dmitrygr 4y ago

ME gets a lot of well-deserved hate. And a lot of work goes into disabling it. But I am surprised that none of the people working on such projects ever looked at the very peculiar ME payloads that intel chromebooks carry for hints on how to do it better...

londons_explore 4y ago

Why exactly isn't there a setting or jumper to just disable this? I don't really see a business reason for Intel to make this hard to do... They could totally have made the machine reset if the ME couldn't be initialized. But they didn't.

w1nst0nsm1th 4y ago
Remind me of that secured phone sold by a german company to governments around the world. In practice, the company was indeed a joint venture involving the US government who used a german proxy to sold compromised hardware to unsuspecting official. Everything went straigh to NSA.
nullc 4y ago
> They could totally have made the machine reset if the ME couldn't be initialized. But they didn't. Hm? That's what they did: if you disable too much of the ME the computer will reboot after 30 minutes.
hda2 4y ago
If I recall correctly, there were special DELL machines where intel allowed owners to disable ME in the bios. You had to contact sales to buy them. The issue here is that ME can be disabled but intel doesn't want you, the "normal consumer", to disable it. Why?

the-printer 4y ago

Are there any caveats to disabling the IME? This side of computing can become daunting in the context of the direction that the world is heading. So many acronyms and backronyms lie beneath the chassis of our devices running commands and loops; looping and commanding and checksumming and checking sumthin’ out. Checking what out and sending it where? - “We need to verify that the code is signed for your safety.” - “But it came from your App Store, emperor of the mononymic enterprise.”

wmf 4y ago
Certain DRM will no longer work so you may not be able to play Netflix or whatever.

r00fus 4y ago

Is there an equivalent to IME for AMD and/or Apple M-class processors (that would similarly benefit from disabling for home user)?

arprocter 4y ago
https://en.wikipedia.org/wiki/AMD_Platform_Security_Processor https://en.wikipedia.org/wiki/AMD_Platform_Security_Processo...
GuB-42 4y ago
The equivalent for AMD CPUs is called the Platform Security Processor (PSP). I am not aware of a way to disable it. I don't know about Apple CPUs but they definitely have co-processors running besides the main CPU. In fact, many people talk about the IME but the practice of having proprietary systems with their own privileged hardware is the norm nowadays. Another example is the "baseband" processor in phones, it is a complete proprietary system with its own processor, OS, etc... and it controls the modem, among other things.
oarmstrong 4y ago
I’d like to know more about AMD specifically too. I’m well aware that PSP is their equivalent but there seems to be so little information out there about it. Is it really an equivalent? Is it as bad as ME? Can it be disabled? Does it have the same level of access as ME? Have their been any exploits of it yet? The wikipedia page is rather bare. There’s a couple of papers linked to but frankly they go over my head. Is there any respectable analysis out there?
- EMM_386 4y ago
  > I’d like to know more about AMD specifically too. I’m well aware that PSP is their equivalent This is why I'm curious and get a little into conspiracy-land with this stuff. Neither are exactly "well documented", they both arrived on the scene around the same time. It makes one wonder if there was a specification they were told to follow. That's why I'm very curious if Apple's new chips follow a similar "specification". Sorry, I mean "feature set".

freefal 4y ago

“removes the vast majority of the ME's software modules (including network stack, RTOS and Java VM)” There’s a Java VM on these things?!

mmis1000 4y ago
Not surprised, Java vm is literally everywhere. From your credit card to sim, if it is a ic card then there is Java vm. It is almost universal language for mini embedded system for some reason I don't understand.
- smolder 4y ago
  IIUC, it's because it's easier to rigorously prove the VM prevents classes of bugs (i.e. memory safety issues) and then reuse that VM in many places than it is to rigorously prove that many separate embedded systems not relying on the VM have independently avoided those bugs.
  - hedora 4y ago
    Is there an example of a JVM that has been proven correct in this sense? I haven't heard of one.
    - smolder 4y ago
      I don't know specific details about the correctness of any particular VM, sorry. That was just the explanation I got from another engineer that apparently had experience in developing embedded java things.
- goodpoint 4y ago
  > It is almost universal language for mini embedded system for some reason I don't understand. Marketing-fueled hype.

npteljes 4y ago

If anyone is interested, it's possible to buy a laptop with ME already disabled: https://puri.sm/products/librem-14/ https://puri.sm/products/librem-14/ EDIT: there's more at Wikipedia: https://en.wikipedia.org/wiki/Intel_Management_Engine#Commercial_ME_disablement https://en.wikipedia.org/wiki/Intel_Management_Engine#Commer...

smitty1e 4y ago
It's incumbent upon those caring about liberty [looks in mirror] to support/advertise the alternatives.
smaudet 4y ago
I love the concept of a librem, TBH everytime I look at buying one I balk at the price compared to a more traditional build. It's like buying a Mac and I can't even justify it by saying it is for iPhone dev. I don't have a market reason for buying one, I wish I did but what I'd use it for? No IME great, now what? If someone flips a switch I guess I have a safe computer, but I still have to interact with the world and that's still unsafe (banking, identity, employment). I wish it were a bit more raspberry Pi - I'd have an easier time justifying that purchase just if I had integrated GPIO. I have (multiple) rpis but they sit in boxes because they are a combination of unsupported and complex to assemble/use, outside of browsing some very simple websites I find them difficult to use, even for embedded development.
- forgotmypw17 4y ago
  They're doing novel R&D which no other manufacturer is doing, and putting together what looks like a quality workstation, which brings you much closer to consensual computing than almost anything else on the market. If I was a buyer of new hardware, and especially getting paid for professional software development, I can't imagine thinking very long before buying one.
khimaros 4y ago
StarLabs also sells laptops with ME disabled.

rolph 4y ago

rather than disable ME, i would want to pwn it. you can dump, substantially re-engineer, and write back, to add utility, and provide service to end user. or could it be like the one ring?

w1nst0nsm1th 4y ago

In short IME is a hardware spyware ? That's it ?

rolph 4y ago
out of band networked/remote hardware management.

borissk 4y ago

A slightly off-topic question: many modern motherboard have a function to flash a BIOS even without CPU present (e.g. Gigabyte markets it as Q-Flash). Any idea how does that technically work? Do they put a separate CPU on the motherboard?

tymscar 4y ago
I just upgraded to a Ryzen 9 7950x with a Gigabyte x670e motherboard and while using qflash+ I also got curious but nothing online answers how it works and the manual is too simplistic to include the details. If I would have to guess It’s probably the chipset?
greycol 4y ago
smolder has a comment in this thread expressing viability for some boards doing this. https://news.ycombinator.com/item?id=33347065 https://news.ycombinator.com/item?id=33347065

pm2222 4y ago

EFI, anyone? MBR works perfectly ok for me.

NoImmatureAdHom 4y ago

Anyone know if me_cleaner etc. work on the new 12th generation chips? It's not clear from the link.

checkyoursudo 4y ago

With regard to the guide itself, please be aware that the guide, of which this is but a one section, is no longer actively maintained (since 2020). It is a great and useful guide. I have used it to modify my own Gentoo installation. But, be aware of what you are doing. :)

egberts1 4y ago

That's why I never use the onboard Ethernet chipset, ever. Even if it's BIOS-disable. Just buy a decent Intel (or even RTL) Ethernet NIC PCI card, or two.

djcannabiz 4y ago
fwiw another commenter posted about how the firmware for the ME includes drivers for other intel network cards
- egberts1 4y ago
  Yes, but those ME-capable Intel Ethernet NIC require CPU-based processor OOB installation of ME soft-drivers which BSD and Linux do not carry, thankfully: which is why I never use onboard Ethernet. On the other hand, it is a real technical possibility, for the Intel WiFi NIC PCIe cards to be initialized by its on-board ME processor which can then do this back-PCI driver setup from this ME processor even if BIOS-disabled (or if CPU is dead or halt'd); by and for the (IME/PSP) Intel/AMD CPU-based Motherboards. Not using Onboard Ethernet nor loading its driver takes out that NIC access, but not the possibility of still using any "found" Intel WiFi NIC adapter: do not install NIC with any built-in management engine (ME), including wireless ones like Bluetooth, NFC, WiFi, Zig. use the plain ol' ME-free Ethernet NIC adapters while not using the onboard Ethernet port (bonus, disable driver to onboard Ethernet) and you will be fine on that topic of concern about ME processor (onboard ones). Of course, there is always a possibility of unadvertised ME-capability (commonly in WiFi but also seldom in wired) Ethernet NIC adapters made by shady manufacturers but we can mostly find those out and avoid them. Dependable Ethernet NIC adapter manufacturers likes to tout its ME capabilities (because larger market comprises of Enterprise users).

jongjong 4y ago

The decision to create such an engine is so unwise, it's evil.

EMM_386 4y ago
It may not have been a decision, at least on the part of Intel.

Melatonic 4y ago

If you are worried about IME you may want to check if your laptop or desktop has Intel VPro with KVM enabled. Much bigger real world threat. It can also have some very very cool uses though for remote management. Sometimes VPro needs a separate Bios update - make sure you do this and if you do keep it enabled make SURE you set a good password.

bacan 4y ago

Many Dell PCs have a “SERVICE MODE” jumper that also disables IME

easygenes 4y ago

For at least a decade this engine has been a total backdoor. There's even a VNC server embedded. [1] 1: https://blog.michael.kuron-germany.de/2011/10/using-intel-amts-vnc-server/

wmf 4y ago
Note that most PCs do not have AMT.

javajosh 4y ago

Cool technique but it would be cooler if you could cut the Rpi out of it. Do they make IC clips that can connect to the USB port of a laptop? If so that would be easier and less error prone than mapping the IC clip wires to the GPIO pins of the RPi and having to go through the trouble of connecting a KVM to what is, effectively a $35 throw-away computer. (Or, I suppose the best case would be an IC clip that plugs into the USB-C port of your phone, and you can run the software in an app...)

ksidudwbw 4y ago

Having a huge government schlong up the backend shouldn't be a concern to us/eu citizens. It's only the slack left from the multitude of schlongs that foreigners could use that should be of concern

d18g 4y ago

Disclaimer: A security researcher working on IME. Following is my own opinion. Used to have really strong uninformed opinions on many things, as often found in young techy-nerd person. It is terrifying how intelligent people are so prone to jump on conspiracy wagons. The current thread and alike are truly humbling experience for me as a person, I wonder how my comments look like to the in the know personal. If they ever had the misfortune to ever see it, did they at least had a good laugh? I know I didn't give any arguments. Sadly I can't get into details so I will be pretty handicapped anyway. I do believe good faith dailog is possible, but feel that it is impossible on the wide internet. Would be great to have a serious conversation on the subject in person with the more cool-headed commenters here. I must thank all of the HN commenters that usually try to be thoughtful, insightful, thought provoking and respectful at the same time.

temptemptemp111 4y ago

guenthert 4y ago

"the Panasonic CF-AX3 is refreshingly straightforward in this regard — after removing the main battery and removing 19 small screws on the bottom-side, the rear panel of the laptop lifts off easily. " Sarcasm? I cursed our hardware designer for making me remove half as many screws. I mean, my motorcycles' gas tank is secured by a single bolt and you'd think that would be more important to keep in place ...