5 ms·

This does not "disable" Intel ME. The ME is instrumental to the boot process and it is impossible to boot a modern Intel x86 system without it. It's quite tirin

This does not "disable" Intel ME. The ME is instrumental to the boot process and it is impossible to boot a modern Intel x86 system without it. It's quite tiring seeing x86 vendors continuing to misrepresent this. See comment by bri3d below for details. It appears they're just sending a command to the ME politely asking it to stop doing things, maybe. Of course, this happens long after the ME has already done a great deal of work bringing up the system. Of the three options for ME scope reduction, none are good and none actually "disable" the ME, but it seems like they've chosen the least effective/audited option of the three. I should add that if you don't trust the ME not to be owned, there's not really any reason to trust that it will honour a polite request to stop doing anything sent to it, and you can't trust it not to have compromised the boot process anyway, making this rather pointless.

t09i209ba893 3y ago
IDK, even this method was not possible for years due to the issue with s3 sleep not working. While it's not an absolutely unmitigated win, I think it is still valuable to at least regain this option. I wish that hardware freedom was at a place where it was worth being frustrated with vendors for not making a finer distinction here, but in this case I'm just glad to see any progress on this front.
- EuropeOverlords 3y ago
  [dead]
VWWHFSfQ 3y ago
I'm wondering how someone like the USA government manages this? They have massive deployments of Intel x86 like at the Utah Data Center [1]. [1] https://en.wikipedia.org/wiki/Utah_Data_Center https://en.wikipedia.org/wiki/Utah_Data_Center
- deelowe 3y ago
  They partner with Intel to get what they need taken care of. Not something the average person can do.
- mhitza 3y ago
  They might just ask Intel to put a special flag in, like the one discovered back in 2017. > One of the fields, called "reserve_hap", drew our attention because there was a comment next to it: "High Assurance Platform (HAP) enable". > Googling did not take long. The second search result said that the name belongs to a trusted platform program linked to the U.S. National Security Agency (NSA) https://web.archive.org/web/20170829010653/https://blog.ptsecurity.com/2017/08/disabling-intel-me.html https://web.archive.org/web/20170829010653/https://blog.ptse...
- charcircuit 3y ago
  They don't need to disable ME, no more than they need to disable some microprocessor in a network card. The government doesn't have to believe baseless conspiracy theories when they design datacenters.
  - DaSHacka 3y ago
    Yes, that's clearly why they order computers from manufacturers with ME disabled, because it's not a backdoor...
    - flangola7 3y ago
      What evidence is there of it being a backdoor? Who was ultimately harmed/arrested as a result of it? I've never seen a link to a single case demonstrating that.
      - Krutonium 3y ago
        Personally, I don't care for the ME one way or the other, but I also don't think it's strictly spyware. That being said, Parallel construction is a thing and could be used in every case where the initially got their information from the backdoor in the ME, if such a thing exists.
        strbean 3y ago
        The Silk Road bust comes to mind - https://www.schneier.com/blog/archives/2014/10/how_did_the_fed.html https://www.schneier.com/blog/archives/2014/10/how_did_the_f...
    - charcircuit 3y ago
      >because it's not a backdoor It lowers the attack surface by running less code. Most government computers don't even have the HAP bit set.
- caeril 3y ago
  "I'm wondering how the people who ordered Intel to integrate spyware into their processors manages this? Answer: order them to tape out N units without the spyware for only you. A new photomask isn't all that expensive.
- elif 3y ago
  There was a dell link floating around for a while to an internal store listing for laptops with IME-free CPU's. It was then taken down with the (implied? Explicit? I don't recall) explanation that it was meant for government employees only.
  - mjg59 3y ago
    The ME isn't in the CPU, it's in the PCH. I'd be astonished if Intel made special parts that didn't use the ME at all, it's much more likely that they just have the HAP bit set in the FIT and the ME largely shuts down part-way through boot (you still need ME firmware to be present, so the ME clearly still runs some amount of code before disabling itself)
tssva 3y ago
I'm writing this from my car as I wait to have my state safety inspection done. My car has a traction control system which is enabled. Just pushed the TCS button. It was enabled and now it is disabled. Just pushed the button again. It was disabled and now it is enabled. I can switch freely between each state and in neither case does the description of the state require quotes around it.
- FireBeyond 3y ago
  In most cars, TCS enable/disable is not really as concrete as it sounds, but more "allow more wheel slippage/spin from stopped" for snow/mud scenarios. Even with it 'nominally off', it's still there and working hard. On certain performance cars, it's actually a three stage system. On my Audi RS 5, there's the same thing as you describe. And then if I push, and hold, TCS for five seconds, it goes fully off (for race days and such).
- lannisterstark 3y ago
  Considering your car's (most average cars) TCS never really gets fully disabled... Yeah, your word needs quotes even more.
- remram 3y ago
  I can't tell what point you're trying to make and yet it seems wrong.
  - tssva 3y ago
    The point is that just because something is enabled at some point doesn't mean it can't be disabled at a later point. The original poster didn't seem to think ME is really disabled just because at some point it was enabled.
    - remram 3y ago
      Did you miss the whole part about the boot process? It was the second sentence. You could only think they said that "just because" it you only read the first sentence of their comment.
awsation 3y ago
It can be de-blobbed though [1]. At least this will "de-risk" it as part of the boot process ? [1]: https://github.com/corna/me_cleaner https://github.com/corna/me_cleaner

t09i209ba893 3y ago

IDK, even this method was not possible for years due to the issue with s3 sleep not working. While it's not an absolutely unmitigated win, I think it is still valuable to at least regain this option. I wish that hardware freedom was at a place where it was worth being frustrated with vendors for not making a finer distinction here, but in this case I'm just glad to see any progress on this front.

EuropeOverlords 3y ago
[dead]

VWWHFSfQ 3y ago

I'm wondering how someone like the USA government manages this? They have massive deployments of Intel x86 like at the Utah Data Center [1]. [1] https://en.wikipedia.org/wiki/Utah_Data_Center https://en.wikipedia.org/wiki/Utah_Data_Center

deelowe 3y ago
They partner with Intel to get what they need taken care of. Not something the average person can do.
mhitza 3y ago
They might just ask Intel to put a special flag in, like the one discovered back in 2017. > One of the fields, called "reserve_hap", drew our attention because there was a comment next to it: "High Assurance Platform (HAP) enable". > Googling did not take long. The second search result said that the name belongs to a trusted platform program linked to the U.S. National Security Agency (NSA) https://web.archive.org/web/20170829010653/https://blog.ptsecurity.com/2017/08/disabling-intel-me.html https://web.archive.org/web/20170829010653/https://blog.ptse...
charcircuit 3y ago
They don't need to disable ME, no more than they need to disable some microprocessor in a network card. The government doesn't have to believe baseless conspiracy theories when they design datacenters.
- DaSHacka 3y ago
  Yes, that's clearly why they order computers from manufacturers with ME disabled, because it's not a backdoor...
  - flangola7 3y ago
    What evidence is there of it being a backdoor? Who was ultimately harmed/arrested as a result of it? I've never seen a link to a single case demonstrating that.
    - Krutonium 3y ago
      Personally, I don't care for the ME one way or the other, but I also don't think it's strictly spyware. That being said, Parallel construction is a thing and could be used in every case where the initially got their information from the backdoor in the ME, if such a thing exists.
      - strbean 3y ago
        The Silk Road bust comes to mind - https://www.schneier.com/blog/archives/2014/10/how_did_the_fed.html https://www.schneier.com/blog/archives/2014/10/how_did_the_f...
  - charcircuit 3y ago
    >because it's not a backdoor It lowers the attack surface by running less code. Most government computers don't even have the HAP bit set.
caeril 3y ago
"I'm wondering how the people who ordered Intel to integrate spyware into their processors manages this? Answer: order them to tape out N units without the spyware for only you. A new photomask isn't all that expensive.
elif 3y ago
There was a dell link floating around for a while to an internal store listing for laptops with IME-free CPU's. It was then taken down with the (implied? Explicit? I don't recall) explanation that it was meant for government employees only.
- mjg59 3y ago
  The ME isn't in the CPU, it's in the PCH. I'd be astonished if Intel made special parts that didn't use the ME at all, it's much more likely that they just have the HAP bit set in the FIT and the ME largely shuts down part-way through boot (you still need ME firmware to be present, so the ME clearly still runs some amount of code before disabling itself)

tssva 3y ago

I'm writing this from my car as I wait to have my state safety inspection done. My car has a traction control system which is enabled. Just pushed the TCS button. It was enabled and now it is disabled. Just pushed the button again. It was disabled and now it is enabled. I can switch freely between each state and in neither case does the description of the state require quotes around it.

FireBeyond 3y ago
In most cars, TCS enable/disable is not really as concrete as it sounds, but more "allow more wheel slippage/spin from stopped" for snow/mud scenarios. Even with it 'nominally off', it's still there and working hard. On certain performance cars, it's actually a three stage system. On my Audi RS 5, there's the same thing as you describe. And then if I push, and hold, TCS for five seconds, it goes fully off (for race days and such).
lannisterstark 3y ago
Considering your car's (most average cars) TCS never really gets fully disabled... Yeah, your word needs quotes even more.
remram 3y ago
I can't tell what point you're trying to make and yet it seems wrong.
- tssva 3y ago
  The point is that just because something is enabled at some point doesn't mean it can't be disabled at a later point. The original poster didn't seem to think ME is really disabled just because at some point it was enabled.
  - remram 3y ago
    Did you miss the whole part about the boot process? It was the second sentence. You could only think they said that "just because" it you only read the first sentence of their comment.

awsation 3y ago

It can be de-blobbed though [1]. At least this will "de-risk" it as part of the boot process ? [1]: https://github.com/corna/me_cleaner https://github.com/corna/me_cleaner