31–40 of 282 posts
I still don't understand why this ME feature has been created to begin with. Assuming that breaking it is a matter of time (someone clever enough thinking about it for long enough), it seems like a serious security vulnerability, worse still because an attack is undetectable. Why create it in the first place? Are the enterprise uses the article mentions worth the risk?
Earlier quoted context omitted.
It is in the chipset not in the CPU.
Maybe I'm missing something, is this chipset on the motherboard? The article makes it seem like its coupled with the cpu.
Taking another angle: What if the computer's owner wants to use it to access her computer remotely? Are there some instructions how to do this? Is it feasible? If not, then there seems little justification to have a relatively new feature like this turned on by default. Who is this feature really for? If it's not for all users then why is activation mandatory in CPUs after Core2? I mean, if ME has to be active, then…
I think it is intended for enterprises to enable.
Earlier quoted context omitted.
I think it is intended for enterprises to enable.
If that's the case and enterprises ARE using it - why isn't it more widely known about? Even if the enterprise signs an NDA - I find it surprising that it hasn;t leaked given the security implications.
Earlier quoted context omitted.
From the article: "On some chipsets, the firmware running on the ME implements a system called Intel's Active Management Technology (AMT). This is entirely transparent to the operating system, which means that this extra computer can do its job regardless of which operating system is installed and running on the main CPU." So it sounds like yes, this would effect any OS.
I think they are asking if Apple ordered chips without this ME, give the former's penchant for security. I wonder similarly.
https://www.reddit.com/r/linux/comments/3anjgm/on_the_librem... https://puri.sm/posts/petition-for-intel-to-release-an-me-le...
> All recent Intel systems (made in the last 8 or 9 years) has this. The ME will never be freed
[1] http://www.dmtf.org/sites/default/files/standards/documents/...
AMT is Intel's equivalent of IPMI. It is a non-standard implementation of it, and does not follow any of the relevant specifications. It does not integrate into most server management platforms.
AMT costs extra. Most mobos do not have it enabled as you have to pay Intel's tax on it, even if some of the hardware to enable it is in every northbridge.
A motherboard must implement it to be available. Most of the motherboards we own don't have it enabled. You cannot "break into it" if AMT isn't available on your motherboard to begin with.
Not all ME chips can run it due to Intel's requirements.
Now, is the ME chip a threat? Possibly, not not as much as your cell phone's baseband modem is. The baseband modem can talk to outside networks, ME can't unless it is paired with a NIC it can talk to (Intel does not require mobos that have this; and generally, motherboards meant for AMT ship Intel NICs, but not always).
Without AMT, the only thing the ME does is implement management functions that allow you to actually boot and use the machine.
In the article, it says "Personally, I would like if my ME only did the most basic task it was designed for, set up the bus clocks, and then shut off," except it is kept running so you can properly sleep and wake up your machine, and also be able to change CPU frequencies at run time (IE, idle the cpu), and also provide access to the sensors on the motherboard.
In addition, the ME handles Intel Smart Connect, which is also not available on all boards (Apple uses this to implement Power Nap). It also requires licensing, the same way AMT does, and may mobo manufs simply don't want to license it.
ME does not connect to the network if it doesn't have a payload that is able to do so (AMT, Smart Connect).
The reason people don't understand what ME is for is because all of the basic tasks the ME does used to be done by lots of custom hardware, much of it not provided by Intel and different on every board, and somewhat a bit of a driver nightmare.
I don't like standing up for Intel, but anti-ME articles that continually bring up AMT as if all computers have it is FUD. Very few computers have AMT, very few computers implement this OOB access, very few computers can implement AMT even if Intel let you purchase licensing for it after purchasing the hardware.
I'm not saying that ME is not a security hazard (it can be in some cases), but it isn't some ultra awesome NSA backdoor bullshit. Your phone, however, does have the NSA backdoor.