Positive Technologies Blog

First off, I completely agree. This really should be something you can disable, because often times it isn't used and it increases attack surface.

You can control that bit, as shown here: http://blog.ptsecurity.com/2017/08/disabling-intel-me.html . Of course, that method isn't documented or officially supported by Intel, and you could brick your machine if you mess up, so that's not exactly what you meant. I think Intel definitely should document it and provide official support. As to why they don't currently, I have some guesses. The first is general lack of interest: it costs money for them to support this new feature for everyone and make sure it plays nicely with everyone's setup, and maybe there isn't enough customer demand for the feature. The second is money: I wouldn't be surprised if they sell their chips to the government with the bit already set in firmware at a markup. Making that easily available to everyone means less money.

> Technically, from what we know ME firmware is flashable and possible to update

And it might be running Minix3[0] which is amazing for me.

But man it sucks to think there is a *nix machine next to my machine I have no control over. Some might mention SSD fw, but does it have a known serial over LAN vulnerability[1].

Wikipedia also cite a elevation of privilege bug[2].

I'm so glad I'm not a IT manager.

[0]: http://blog.ptsecurity.com/2017/04/intel-me-way-of-static-analysis.html
[1]: https://www.scmagazineuk.com/platinum-hackers-exploit-intel-amt-sol-for-secure-cc-communications/article/667477/
[2]: https://en.wikipedia.org/wiki/Intel_Active_Management_Technology#cite_note-intel1-12

ps. If anybody have some info of the minix in ME. Please drop me a message.

Re: Evidence that Intel, while giving the US government the ability to disable ME, refuses to give such an ability to other large customers (Google, Amazon, other governments, etc.), for any amount of money.

I'm not intimately familiar with the situation but I heard some chatter a few years ago about Google (which likes to use Coreboot on its Chromebooks) asking Intel for documentation and source code for various firmware components including the IME and being turned down.

Researchers recently found an undocumented bit can be set in recent IME versions with a name ("High Assurance Program (HAP)") said to be associated with the US government which disables most functions of the IME.[1]

[1] http://blog.ptsecurity.com/2017/08/disabling-intel-me.html

In case you haven't already used the following, please note that the NSA had an undocumented "backdoor" included which "disables" the ME. (Man, oh man, I wish I was making this stuff up.)

http://blog.ptsecurity.com/2017/08/disabling-intel-me.html

I put quotes around "disables" because the ME is not fully disabled. The blog's analysis does show how it is in a "safe" state, i.e. forced to ignore the outside world very early in its code path. Also, not likely to brick your computer, assuming unscrewing your case and using a SPI flash programmer hasn't already bricked your computer.

Edit: "backdoor" in quotes too.

"ME isn't required at all..."

The document you linked refers to a more technical one that explains they don't disable the ME until after the main OS is booted, because...

"The disappointing fact is that on modern computers, it is impossible to completely disable ME. This is primarily due to the fact that this technology is responsible for initialization, power management, and launch of the main processor."

http://blog.ptsecurity.com/2017/08/disabling-intel-me.html

So, it is serving the same role as the Rpi VideoCore.