51–60 of 93 posts
God #$%@ing damn it, this is why we can't have nice things. You can do only so much to not get pwned software wise, now you need to be paranoid about the hardware too?! Going through all Xeon servers is going to be fun tomorrow.
Earlier quoted context omitted.
It turns out all(?) Intel CPUs in the last decade has a co-CPU that is always running as long as there is electricity available - even when shut down - that is continuously executing a "management engine" bios program, which your main CPU or OS cannot prevent (in fact, if the ME fails to "check in", the main CPU will automatically shutdown in 30 minutes). And, of course, it turns out there is a remote exploit for it.…
This sounds horrible, even though I knew about it before. What are the viable options for other manufacturers or architectures which don't come with this sort of thing, either for desktops or for laptops?
https://libreboot.org/faq.html#intel https://libreboot.org/faq.html#amd
See https://libreboot.org/faq.html#whatcaniuse -- your best bet is older Intel / AMD.
There are some laptops https://www.crowdsupply.com/sutajio-kosagi/novena which are open.
Why would Intel insist on being so secretive about their management engine? Is it some kind of competitive advantage for them? Supposedly, it's useful for management tasks in enterprise environments, but if I were CIO, I think I would ban VPro chips. Who wants ring -3 processes running on their network for which they have no information about?
It includes DRM (Protected Audio/Video Path), for one.
If anyone get compiling errors with 'timeval tv' being undefined add this to headers #include
Why would Intel insist on being so secretive about their management engine? Is it some kind of competitive advantage for them? Supposedly, it's useful for management tasks in enterprise environments, but if I were CIO, I think I would ban VPro chips. Who wants ring -3 processes running on their network for which they have no information about?
God #$%@ing damn it, this is why we can't have nice things. You can do only so much to not get pwned software wise, now you need to be paranoid about the hardware too?! Going through all Xeon servers is going to be fun tomorrow.
Shocked not because I think it's a huge conspiracy to control your computer but because I honestly do believe AMT was made with the best intentions of providing a level of theft mitigation for devices. Just like "Find my Mac" from Apple that seems to get very little flack.
I'd be surprised if this meant that my pretty expensive Lenovo Thinkpad X-series lacks theft protection.
I'm shocked to say that the Thinkpad x260 does not have AMT at all. Shocked not because I think it's a huge conspiracy to control your computer but because I honestly do believe AMT was made with the best intentions of providing a level of theft mitigation for devices. Just like "Find my Mac" from Apple that seems to get very little flack. I'd be surprised if this meant that my pretty expensive Lenovo Thinkpad X-seri…
Hmm, I ensured the mei driver was loaded (lsmod confirms it), but I get: "Cannot open /dev/mei: No such file or directory" dmesg shows: "[ 18.233688] mei_me 0000:00:16.0: Device doesn't have valid ME Interface [ 18.233700] mei_me 0000:00:16.1: Device doesn't have valid ME Interface" So I'm guessing I'm not vulnerable. I suppose Supermicro replaced it with their own IPMI interface.
Similarly, on an Intel NUC with i5-6260U: # git rev-parse HEAD 9aa755885093fc8ca8c822797a30ed98ffe2e166 # make gcc mei-amt-check.c -o mei-amt-check # modprobe mei-me # ./mei-amt-check -v Cannot open /dev/mei: No such file or directory # l /dev/*mei* /bin/ls: cannot access /dev/*mei*: No such file or directory # dmesg |grep -i mei # A little confusing as the program is supposed to show "Intel AMT: DISABLED" 'If run on…
Unable to find a Management Engine interface - run sudo modprobe mei_me and retry.
If you receive the same error, this system does not have AMT