7 ms·
System76's coreboot open firmware manages to disable Intel ME for Raptor Lake
- BiteCode_dev 3y agoDisabling the biggest malware of all time is amazing. System76 is getting quite attractive.
- jmclnx 3y agoSame here, all I would need is 2 more things 1. A trackpoint similar to what Thinkpads have and the ability to disable the touchpad. 2. No Nvidia GPU, but full opensource GPU. I think that is already an option for some models. This is so I could use OpenBSD with it. But if I every get a new laptop, I will look directly at System 76.
- trelane 3y ago1. May be coming: https://twitter.com/jeremy_soller/status/1662551130768044032 https://twitter.com/jeremy_soller/status/1662551130768044032 Jeremy's post seems to going pretty strongly at that.
- mPReDiToR 3y agoI hope someone proofreads that article before it's published to the Interwebs!
- bri3d 3y agoNote that this wasn't so much about figuring out how to disable Intel ME, which is accomplished by sending an HECI (Host Embedded Controller Interface) command in the same way it has been for ages. Rather, this was about fixing a buffer management bug in Coreboot which prevented S3 sleep from working with secure boot enabled (basically, coreboot would clobber itself with the TPM log on wake). This bug required System76 to switch to S0ix suspend and in turn, the ME to be re-enabled (as the ME manages some peripherals in S0ix sleep).
- nailer 3y ago> how to disable Intel ME, which is accomplished by sending an HECI (Host Embedded Controller Interface) command in the same way it has been for ages. I didn't know this - so it's possible to turn off Intel ME? The idea of a full copy of Minix with TCPIP running on my machine is scary. Can someone else turn it back on?
- als0 3y agoAlternatively, you can set the HAP bit in the BIOS flash https://hackaday.com/tag/hap-bit/ https://hackaday.com/tag/hap-bit/
- bri3d 3y agoYes. There are several ways, depending heavily on the version, and ranging from most trustworthy to least trustworthy: * By patching the ME firmware itself - see the me_cleaner project, and methods documented here: https://puri.sm/posts/deep-dive-into-intel-me-disablement/ https://puri.sm/posts/deep-dive-into-intel-me-disablement/ . This is Pretty Reliable; the runtime code has been deleted from flash. * By setting a bit in the flash configuration, assumed to be added for the US High Assurance program: https://github.com/corna/me_cleaner/wiki/HAP-AltMeDisable-bit https://github.com/corna/me_cleaner/wiki/HAP-AltMeDisable-bi... , https://www.ptsecurity.com/ww-en/analytics/disabling-intel-me-11-via-undocumented-mode/ https://www.ptsecurity.com/ww-en/analytics/disabling-intel-m... . This is Mostly Reliable; the mechanism has been fairly aggressively reverse engineered and was added for a program with strict requirements. * By sending an HECI command that says "hey ME, turn off your runtime" https://review.coreboot.org/c/coreboot/+/52800 https://review.coreboot.org/c/coreboot/+/52800 . This is Somewhat Reliable; the method is well understood and seems to work but I'm not sure someone has done a deep dive audit into whether it could be re-enabled somehow.
- jimbob45 3y agoDo we have anything equivalent for AMD’s PSP?
- 3y ago
- nazgulsenpai 3y agoEven as someone who doesn't use anything System76, I truly appreciate all of their contributions. Kinda tangential but I wonder, as successful as they've been in their niche (I presume, based on how prolific the branding is) I wonder if they would be better positioned to make a Linux phone where the others have fallen flat? I loved my PinePhone but as a novelty mini-AIO PC more than a phone. I doubt they'd want to step onto that minefield, but I wouldn't be able to help but get excited if such a project ever materialized.
- panick21_ 3y agoThere are enough phone projects, and they are hard. I much rather have a laptop project and that's what they are working on.
- nazgulsenpai 3y agoNo, I agree. I don't expect it would or even should happen, but if it did I would be very interested.
- PopePompus 3y agoYes, building a cell phone is simply something a small group of people cannot do successfully. I used to develop software for Openmoko phones, the N900, and other early Linux phones. Those projects had several decedent projects, all of which failed. There are several show-stoppers: 1) chip vendors won't talk to you if you are proposing to build a few thousand phones. 2) These projects never produce several iterations of prototypes that are tested by a significant number of users, so if they ever do ship a phone, there are terrible hardware faults. Fun fact: end users are not good at adding additional surface-mount components to cure these problems. 3) Unless you are making an Android phone, or at least an Android-compatible phone, none of the major apps will be available, and your customer base will be limited to the small fraction of the population that cares about privacy. So you'll never see economies of scale. 4) It will take longer than expected to bring the phone to the market, so even if you manage to build something, the hardware will be several generations behind what consumers expect. 5) Power management is hard.
- hlandau 3y agoThis does not "disable" Intel ME. The ME is instrumental to the boot process and it is impossible to boot a modern Intel x86 system without it. It's quite tiring seeing x86 vendors continuing to misrepresent this. See comment by bri3d below for details. It appears they're just sending a command to the ME politely asking it to stop doing things, maybe. Of course, this happens long after the ME has already done a great deal of work bringing up the system. Of the three options for ME scope reduction, none are good and none actually "disable" the ME, but it seems like they've chosen the least effective/audited option of the three. I should add that if you don't trust the ME not to be owned, there's not really any reason to trust that it will honour a polite request to stop doing anything sent to it, and you can't trust it not to have compromised the boot process anyway, making this rather pointless.
- t09i209ba893 3y agoIDK, even this method was not possible for years due to the issue with s3 sleep not working. While it's not an absolutely unmitigated win, I think it is still valuable to at least regain this option. I wish that hardware freedom was at a place where it was worth being frustrated with vendors for not making a finer distinction here, but in this case I'm just glad to see any progress on this front.
- EuropeOverlords 3y ago[dead]
- VWWHFSfQ 3y agoI'm wondering how someone like the USA government manages this? They have massive deployments of Intel x86 like at the Utah Data Center [1]. [1] https://en.wikipedia.org/wiki/Utah_Data_Center https://en.wikipedia.org/wiki/Utah_Data_Center
- deelowe 3y agoThey partner with Intel to get what they need taken care of. Not something the average person can do.
- dang 3y agoWe changed the URL from https://www.phoronix.com/news/System76-Disable-ME-RPL https://www.phoronix.com/news/System76-Disable-ME-RPL, which points to this and seems to add nothing significant. I've left its title, even though people are disputing it, since the comments are mostly about that.
- EuropeOverlords 3y ago[dead]
- user6723 3y agoThe purpose of Intel ME is to give foreign intelligence agencies wireless access to America's senators, executive teams, and critical infrastructure. Occasionally the open source security industry uncovers yet another 0day in the endless stream of zero days then Intel and all the OEMs release a patch to fix the bug and add three more 0days to Intel ME. Very very few IT teams want AMT. It is a total scam. If we had a functioning government, Intel ME in its current from would never be allowed to be sold in USA.
- Aerbil313 3y ago> The purpose of Intel ME is to give foreign intelligence agencies wireless access to America's senators, executive teams, and critical infrastructure. I agree, only that I think it’s reverse. It would seem that American companies like Intel and AMD can be far more easily controlled with both force and cash by American government, not by foreign governments.
- user6723 3y agoThe best the govs have been able to do is get a HAP bit.
- charcircuit 3y ago>The purpose of Intel ME is to give foreign intelligence agencies wireless access to America's senators, executive teams, and critical infrastructure. Do you even have a shred of evidence for this claim? >yet another 0day in the endless stream of zero days There is not an endless stream of zero days in the ME. None of these are relevant to most people's security model. Even for those with an excessive security model attacks you probably already consider your machine compromised if tan attacker has physical access to it.
- user6723 3y agoThe vulnerability where no authentication was required and could be exploited wirelessly while the machine was off is directly relevant to the security model of anyone with a laptop with an Intel CPU. I have been responsible for keeping small fleets of laptops patched and I actually read the relevant CVEs Intel puts out, which if you bothered to do you would find that yes over the years there has been an endless stream of fatal 0days
- neilv 3y agoI'm hoping some RISC-V system developer will take the opportunity not to embed a mess like the Intel ME.
- rwaksmunski 3y agoI lost my hope when they adopted UEFI.
- jonas-w 3y agoCould you elaborate what the problem with UEFI is and what the alternatives are? Genuine question, as I've never heard this sentiment before.
- egberts1 3y agoIt is simple: the mere fact of adding network support at BIOS level remains problematic. And we are not talking about TFTP, but DHCP and NTP (not to mention even more problematic HTTP[S]) which clearly does not belong at BIOS and should not be at UEFI level.
- neilv 3y agoI've heard many complaints about UEFI. Personally, I don't like the complexity, and I distrust some of the parties involved.
- thatguyman 3y agoSiFive (the biggest RISC-V developer) has already partnered with Intel: https://www.sifive.com/blog/sifive-made-a-splash-at-the-risc-v-summit-with-10 https://www.sifive.com/blog/sifive-made-a-splash-at-the-risc... Quote: "As part of our efforts to build out the RISC-V ecosystem, SiFive has partnered with Intel to develop the HiFive Pro P550 Development System (previously code-named Horse Creek). During his keynote, Patrick was joined on stage by Intel Foundry Services’ Bob Brennan to share a first look at this high performance platform that features a quad-core SiFive Performance™ P550 processor and is implemented in the Intel 4 technology platform. The board will enable a new generation of RISC-V software, continuing the tradition of SiFive HiFive boards that have helped drive the growth of the RISC-V ecosystem. The board will be commercially available in the summer of 2023."
- jsiepkes 3y agoI recently found out (and was quite surprised) that certain HP models also have an option in the UEFI to disable Intel ME. I posted some pictures of it and pictures of the Intel tool confirming it can't connect with ME when disabled: https://mastodon.social/@JasperSiepkes/110221669827027710 https://mastodon.social/@JasperSiepkes/110221669827027710
- everdrive 3y agoI understand what the ME at a very vague level, but I'm confused about how it works. How would someone interact with the ME? Is it just listening on my network interfaces? Would someone need to run code from my OS? Does it matter what OS I'm using?
- mjg59 3y agoIn general the ME will only be listening for network traffic if you've enabled AMT functionality (which is restricted to certain enterprise SKUs and has requirements around which networking hardware is used and so on). Otherwise, the ME will expose a PCI device implementing the Host Embedded Controller Interface (HECI) and OS drivers can bind to that to offer an interface to applications.
- egberts1 3y agoIntel ME, as its own CPU, promiscuously listen for a certain Ethertype or UDP/TCP port. it is optional to run an additional OS code from the main Intel CPU to gain access to Intel ME. Intel ME's basic function is to display your monitor over network, monitor some hardware temp sensors, and reset the motherboard while your main Intel CPU is running or suspended (or even powered down). since we cannot verify that Intel ME is only doing just that specific listening of network packet, because we do not have access to their source code (much less rebuild our own copy of Intel ME binaries); we cannot assume any modicum of correctness of Intel ME CPU operation (which has full unfettered access to all of your CPU memory) nor determine the level of maliciousness ... of your Intel ME. it is "caveat emptor" from a computer security POV.
- mjg59 3y ago> Intel ME's basic function is to display your monitor over network, monitor some hardware temp sensors, and reset the motherboard while your main Intel CPU is running or suspended (or even powered down). No, that's AMT, which is an optional feature not enabled on the majority of devices with an ME. On an average system it's much more likely that the ME is being used for PTT (Intel's implementation of a TPM running on the ME, avoiding the cost of an additional TPM chip), a protected video path for DRMed video (the encrypted video is passed to the ME, which decrypts it and draws it to the screen without the decrypted content ever being visible to the host CPU) and various other low-level platform integration things. You don't need source code to verify the behaviour of a binary. The vulnerabilities that have been identified in ME code didn't depend on researchers having source code. Can we be certain that the ME isn't doing something malicious? No. But nor could we be certain even if we had the source code (maybe the microarchitecture was modified so that a specific sequences of instructions would cause the next cmp operation to invert , for example). Nobody's found any evidence of malice, and not really any more incompetence than you'd expect.
- Kim_Bruning 3y agoRather than going by hearsay I thought I'd just look up the Intel ME documentation. Unfortunately I can't seem to find much on the Intel site. Where would full documentation of this system be found, am I looking in the right place?
- wmf 3y agoLook at AMT documentation.
- egberts1 3y agoThis is why we never use much less connect the onboard Intel Ethernet port for any motherboards having Intel support. (Same for AMD); we always add a (better) Ethernet NIC adapter card. Meanwhile, mothetboards having ARM, RISC and PowerPC continues to gain support.
- purpleidea 3y agoIntel is struggling to survive-- they'd be smart to open up all their firmware, microcode and drivers and let the open source community super charge their hardware and drivers.
- elif 3y agoA buffer overflow that allows the replacement of arbitrary portions of memory hmmm... Surely a simple, innocent coding error... Surely no one would have desired an obfuscated means of distributing a modified version of IME such that it can't be detected on the shipped CPU... Right?