Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: How to know if laptop enrolled in Intel Management Engine?

news.ycombinator.com

Post reply on HN
Print view View original

11–20 of 20 posts

Re: Ask HN: How to know if laptop enrolled in Intel Management Engine?

#11

Post by waste_monk »

oneplane wrote: post #8

You can check it in the firmware settings. To know if there is even the option to enrol, check the manual of the device. If there is no manual, check the SKU for the CPU and PCH, only some SKUs have full management enrolment. Keep in mind that regardless of the status, you can always reset it. In some cases you can also remove most of it, but since the ME also controls a lot of power functions and on laptops might al…

> 2. Get a machine that doesn't use Intel or AMD processors

The only other commercially available x86 processors I'm aware of are Zhaoxin, and I would be very surprised if those didn't have something ME-like baked in.

Re: Ask HN: How to know if laptop enrolled in Intel Management Engine?

#12

Post by sebazzz »

mjg59 wrote: post #3

There's two different components here. The first is the Management Engine. Unless this laptop is extremely old, it has one, and it's running. Depending on age, you may be able to prevent it from booting while still allowing the rest of the system to run, but probably not. The second is Intel's Advanced Management Technology (AMT). This is only available on systems with VPro badging, which generally means higher-end b…

So what does Intel Management Engine do when AMT is disabled or not present?

Re: Ask HN: How to know if laptop enrolled in Intel Management Engine?

#13

Post by nhchris »

mjg59 wrote: post #3

There's two different components here. The first is the Management Engine. Unless this laptop is extremely old, it has one, and it's running. Depending on age, you may be able to prevent it from booting while still allowing the rest of the system to run, but probably not. The second is Intel's Advanced Management Technology (AMT). This is only available on systems with VPro badging, which generally means higher-end b…

> you may be able to prevent it from booting while still allowing the rest of the system to run, but probably not.

To be clear, this is not a technical side-effect of some incidental reliance of the boot process on the management engine (ME). Instead, Intel has deliberately made it impossible for consumers to disable the ME, has obfuscated how the ME works, and offered ME-disabled computers only to "military, government and intelligence agencies".

All under the guise that "Intel considers disabling ME to be a security vulnerability, as a malware could abuse it to make the computer lose some of the functionality that the typical user expects, such as the ability to play media with DRM" - which is beyond laughable.

In short, it could not be more obvious that the ME is malicious.

Source: https://en.wikipedia.org/wiki/Intel_Management_Engine

Re: Ask HN: How to know if laptop enrolled in Intel Management Engine?

#15

Post by vuln »

mixmastamyk wrote: post #14
vuln wrote: post #5

You could see if the laptop is support by coreboot and if so use coreboot to remove intel ME. https://16bit.io/pages/Installing-Coreboot.html

Says you need to desolder a chip from the motherboard.

Not all the time. It all depends on the machine/main board. I flashed my x220 with a flasher and an 8 clip. It's rather simple, if you don't have the hardware around it's a little bit of an expense.

https://framagit.org/GNUtoo/coreboot-scripts/-/tree/master/f...

Re: Ask HN: How to know if laptop enrolled in Intel Management Engine?

#16

Post by badpun »

thinknubpad wrote: post #10
mjg59 wrote: post #3

There's two different components here. The first is the Management Engine. Unless this laptop is extremely old, it has one, and it's running. Depending on age, you may be able to prevent it from booting while still allowing the rest of the system to run, but probably not. The second is Intel's Advanced Management Technology (AMT). This is only available on systems with VPro badging, which generally means higher-end b…

>Depending on age, you may be able to prevent it from booting while still allowing the rest of the system to run, but probably not. How old?

Wikipedia says 2008.

Re: Ask HN: How to know if laptop enrolled in Intel Management Engine?

#17

Post by MuffinFlavored »

dylan604 wrote: post #9
MuffinFlavored wrote: post #7

Earlier quoted context omitted.

If your computer isn't connected to Ethernet or WiFi, why does having a secret Intel management engine running in your CPU matter if it can't publish your data anywhere?

who runs a laptop in that kind of setup? hypothetical responses to a legitimate question/response is just lazy and lame

I'm sorry, I misunderstood. I thought this post was asking from the perspective of "How can I tell if I'm enrolled in that secret thing we learned about that Intel has a secret backdoor to our computers" from the perspective of "I want to make sure it is off/I'm not enrolled".

I was suggesting, if the PC isn't connected to the Internet in this hypothetical case, why does the Intel backdoor matter? It wasn't clear to me the OP was trying to actually use the Intel Management Engine for legitimate purposes. I apologize.

Re: Ask HN: How to know if laptop enrolled in Intel Management Engine?

#18

Post by oneplane »

waste_monk wrote: post #11
oneplane wrote: post #8

You can check it in the firmware settings. To know if there is even the option to enrol, check the manual of the device. If there is no manual, check the SKU for the CPU and PCH, only some SKUs have full management enrolment. Keep in mind that regardless of the status, you can always reset it. In some cases you can also remove most of it, but since the ME also controls a lot of power functions and on laptops might al…

> 2. Get a machine that doesn't use Intel or AMD processors The only other commercially available x86 processors I'm aware of are Zhaoxin, and I would be very surprised if those didn't have something ME-like baked in.

There are architectures that aren't x86.

Re: Ask HN: How to know if laptop enrolled in Intel Management Engine?

#19

Post by Thoreandan »

nhchris wrote: post #13
mjg59 wrote: post #3

There's two different components here. The first is the Management Engine. Unless this laptop is extremely old, it has one, and it's running. Depending on age, you may be able to prevent it from booting while still allowing the rest of the system to run, but probably not. The second is Intel's Advanced Management Technology (AMT). This is only available on systems with VPro badging, which generally means higher-end b…

> you may be able to prevent it from booting while still allowing the rest of the system to run, but probably not. To be clear, this is not a technical side-effect of some incidental reliance of the boot process on the management engine (ME). Instead, Intel has deliberately made it impossible for consumers to disable the ME, has obfuscated how the ME works, and offered ME-disabled computers only to "military, governm…

"Intel considers SGX instructions to be a security vulnerability, as a malware could abuse it to make the computer lose some of the functionality that the typical user expects, such as the ability to play media with DRM."

fixed it

Re: Ask HN: How to know if laptop enrolled in Intel Management Engine?

#20

Post by waste_monk »

oneplane wrote: post #18
waste_monk wrote: post #11

Earlier quoted context omitted.

> 2. Get a machine that doesn't use Intel or AMD processors The only other commercially available x86 processors I'm aware of are Zhaoxin, and I would be very surprised if those didn't have something ME-like baked in.

There are architectures that aren't x86.

IMO alternative architectures such as ARM64 are not suitable (yet) for use on general purpose workstations, which is what I assume the OP wants.

Not because these architectures are necessarily deficient in some way, but simply that there is far too many applications that only target X86_64. Last time I tinkered with an ARM based desktop about 90% of what I wanted was there and worked well, but there were too many edge cases for me to feel comfortable recommending it.

It's a network effect thing, and it's slowly changing, but we're not quite there yet.

Post reply on HN