Earlier quoted context omitted.
I care. I removed ME from mine. I'd prefer to use a competitor but the only viable one is AMD and their equivalent tech is less documented and no known way to disable it exists. Disabling/removing ME is possible for intel stuff so intel is actually the better choice if this is important to you.
Might you have some documentation or resources on the procedure for removing/disabling the ME?
Intel patches new ME vulnerabilities
171–180 of 337 posts
Re: Intel patches new ME vulnerabilities
#172Re: Intel patches new ME vulnerabilities
#173Earlier quoted context omitted.
Your CPU actually runs its own entire, separate operating system - MINIX. https://www.cs.vu.nl/~ast/intel/
Wow I have never seen this before. All the other incredulities aside I was very surprised by this: >"I got another clue when your engineers began asking me to make a number of changes to MINIX, for example, making the memory footprint smaller and adding #ifdefs around pieces of code so they could be statically disabled by setting flags in the main configuration file." Why would Intel ask Tannenbaum to make changes fo…
Probably to lower their maintenance overhead by minimizing their divergence from the upstream code.
Re: Intel patches new ME vulnerabilities
#174I don't want a patch. I don't use that thing for anything. I want them to disable that thing by default! Leaving those backdoors open in older products should lead to a recall because the flaw was there all along.
Maybe someone could clarify some things, because I think the impression that I got from reading about this vulnerability is completely wrong. Isn't vPro just something in server hardware? At least the CPU, Mainboard and NIC all need to be certified/from Intel to support this? You could get the impression that every single computer with a Intel CPU is vulnerable to be hacked over the network. Which I really doubt. > I…
vPro/AMT is the "consumer"/workstation version, the server implementation is based on IPMI, but the ME is present on all systems, even those without vPro at all.
Re: Intel patches new ME vulnerabilities
#175This feels like the Onion story “‘No Way To Prevent This,’ Says Only Nation Where This Regularly Happens” that they post after every US mass shooting, just with the picture changed.
Intel will be fixing ME vulnerabilities forever. It has a huge attack surface, but too obscure to get serious resources from them.
Re: Intel patches new ME vulnerabilities
#176Earlier quoted context omitted.
There is quite literally no viable alternative to x86 for 95% (more like 99.9%, but I am being generous) of the server and workstation market. Pretending like there is and anyone choosing x86 is irresponsible is just being a smug fool.
The newest super computer, summit, ranked as the largest/fastest runs ppc64le which definitely creates an argument that there is an alternative to x86 for servers.
Things that run on super computers tend to be developed specifically for that exact computer so they can use whatever they want.
Re: Intel patches new ME vulnerabilities
#177I don't want a patch. I don't use that thing for anything. I want them to disable that thing by default! Leaving those backdoors open in older products should lead to a recall because the flaw was there all along.
Buy an X200, install libreboot, and you won't have an ME anymore :)
Re: Intel patches new ME vulnerabilities
#178Earlier quoted context omitted.
In all honesty "most PC/laptops users" will never need these patches because their systems don't have the ME firmware. You need specific CPU, specific chipset, specific NIC, and the ME FW. Which you're only going to find in OEM systems marked as such - vPro. It's the same as the Meltdown/Spectre patches where Intel updates the code but it's up to the manufacturer to include it where applicable. A regular desktop moth…
> In all honesty "most PC/laptops users" will never need these patches because their systems don't have the ME firmware. You need specific CPU, specific chipset, specific NIC, and the ME FW. Every Intel system shipped in the last few years has the correct CPU, chipset and some version of the ME firmware (it's involved in initial platform boot, including Boot Guard which validates the BIOS before the CPU even gets a c…
I just realized I was actually thinking about AMT FW not being present (the management over the network part). ME is indeed there since 2006 and can be removed with varying degrees of success.
But I was under the impression that the ME FW on non vPro systems is there just for things like BootGuard or TXT, which (presumably) wouldn't need the full ME functionality. I did not expect that some manufacturers ship the AMT-enabled FW without marketing it as such.
I can't see the actual demo so I imagine they found some non-vPro system where the manufacturer actually shipped the full AMT FW. I'm curious if that's a common occurrence.
Non-AMT firmware is about the 3-4 time smaller than AMT-enabled firmware. That's a hefty difference so if you have the non-AMT version and you can still somehow enable it you'd get a very limited subset of what AMT usually is.
Re: Intel patches new ME vulnerabilities
#179Is it possible to mitigate this by blocking traffic on the ports that the ME uses for communication at the router level?
AFAIK this work only if the attacker is on the same subnet as you, this means that your router can't stop the attack.
Does the attack work if AMT has not been provisioned?
Re: Intel patches new ME vulnerabilities
#180Earlier quoted context omitted.
AMD has the PSP which basically is the same thing. But we don't know for sure what either one does.
One thing the PSP doesn't have is AMT style remote management. AMD has their own kind of management system available on some machines (DASH, using "smart" NICs like Broadcom), but the PSP isn't even involved when DASH is available and in use, as far as I know. However, on my Intel machine with AMT, there's a network port opened by the ME itself (TCP/16992). It can use the same IP as the main OS, or a different IP ent…
You know the shame of ME is that the concept and intended use isn't terrible and the engineering behind it is rather cool. It is however unfortunate how poorly Intel implemented it and essentially forced it onto personal systems that have no need for it to begin with.