3rd gen vs 10th gen - Intel ME

[initialize]

Further interesting references which belong to Intel ME:

I’m not aware of any documented breaches (and it’s not like network traffic coming from the embedded controller would be any more difficult to detect than any other traffic).

https://www.reddit.com/r/privacy/comments/pvde9g/is_everything_i_do_useless_if_i_use_a_cpu_with/

BTW IME can also access your networking interface adapter in a way transparent to the OS

https://askubuntu.com/questions/1280042/how-can-i-safely-confirm-intel-management-engine-status-disabled-or-enabled

• A glaring mistake he makes is that it does not have “full access to the TCP/IP stack”. I imagine he is trying to repeat the well-known fact that it has its own TCP/IP stack, which is true. The ME does not integrate with the OS’ network stack in any way.
• The ME does not have access to every peripheral connected to the computer. At a minimum, it can read all PS/2 keystrokes, video memory, and NIC communications. If it is given access to full memory, it can do more, of course. But due to physical limitations of the x86 architecture, it cannot have access to all peripherals.

https://security.stackexchange.com/questions/154737/how-to-disable-intel-me

Regarding the NIC on the PC , " … The ME has its own MAC and IP address for the out-of-band interface, with direct access to the Ethernet controller; one portion of the Ethernet traffic is diverted to the ME even before reaching the host’s operating system, for what support exists in various Ethernet controllers … " Therefore, using an unsupported network adapter on your Intel PC (instead of using the integrated one) should cut the Intel ME/AMT from accessing the network. a USB network adapter would be a sure way to accomplish this, thanks to the limitations/simplicity of the USB standard.

https://security.stackexchange.com/questions/162812/can-a-self-build-router-minimize-the-potential-risk-of-intels-management-engine

I look forward to comments or clarifications.

[initialize]

Could someone please explain: Why do we need to neuter/disable ME if we just can use an USB network adapter to prevent remote access or exploitation?

[Jim]

@initialize

Intel Management Engine - Wikipedia

I think the definition on wikipedia is in the ballpark, but not completely accurate. AMT is a set of functions that can be enabled by configuring specific vPro technologies (key being cpu, chipset & wired & wireless lan adapters), not just the cpu. Initially, it was just the lan adapter.

By neutering the IME, such as with the methods discussed by Positive Technologies, you break the configuration that enables AMT functions, such as remote management.

[Insurgo]

@unman

That is a good question.
The first part is wrong - we do not need to use a 3rd gen processor.
Most people use the me_cleaner script, which is tested and working up to 7th gen
processors.

Purism does offer a 10gen processor without ME, but how they do this
is unclear. Last time I checked their code simply included me_cleaner.
If they have adapted it, they haven’t (yet) given back - if they are
using something else, it wasn’t clear to me what it was.

@unman I take the responsibility to correct the facts based on the work that happened from Heads (Trammel actually discovered that getting rid of some ME regions was not causing laptop shutdown 30 minutes later) and then me_cleaner picked up the work, and then Positive technologies advanced knowledge and HAP bit, which was then iteratively added under me_cleaner, until me_cleaner got unmaintained.

Heads has a little guide to clarify the facts here: Platform blobs, collaborators/maintainers/testers for faster problems resolution · Issue #692 · linuxboot/heads · GitHub

---

The short version of this is that ME <10 can be deactivated + neutered (meaning that all modules outside of ROMP and BUP) can be removed. (where ME <6 could be completely removed but out of interest to Qubes OS: the x200 being a platform example).

That includes xx20 (Sandy bridge) which can be neutered to only have BUP (minimal requirement to BringUP the platform) and xx30 (Ivy bridge) which added ROMP as a requirement and cannot be removed. The best link to understand what happens when neutering is from me_cleaner doc here for those platforms: How does it work? · corna/me_cleaner Wiki · GitHub

Me > 11 adds Kernel and modules to non-removable modules. The correct term here is then deactivated (HAP bit) + minimized (not neutered anymore). The best documentation to understand what changed under ME > 11 signature scheme is again from me_cleaner documentation, this time under this link: How does it work? · corna/me_cleaner Wiki · GitHub

---

So newer platforms including ME (now named Converged Security Management Engine (CSME)) can still deactivate ME (with HAP bit) where minimizing is now limited since Intel adapted their signature scheme to encompass modules that now cannot be removed.

An excellent resource to see AMT/ME/MCSE exploits/papers is exploring tags on this webpage: Low Level PC/Server Attack & Defense Timeline — By @XenoKovah of @DarkMentorLLC

One reference of which is Conti, really recent (2022 June) and seen in the wild: Conti Targets Critical Firmware - Eclypsium | Supply Chain Security for the Modern Enterprise

---

The goal is not to feed FUD, but be conscious of what is there, updated in firmware updates, new CPU extensions being present in newer processors, microcode updates presence or not. I replied under Short list of laptops/desktops that work well with Qubes OS - #245 by Insurgo as well to debrief on XSA-404 affecting Qubes and covered under QSB-081-2022. Those are complicated matters, once again…

[Insurgo]

Please look (@moderators or move post here) Discussion on Purism - #49 by Insurgo