And also as an everyday user who mostly just surfs the web, are these risks a huge concern for me?
Edit: Also on the similar note, are there any substantial evidences of Intel or AMD purposely adding malware to their SMMs either for themselves or for the NSA?
The new Intel Core vPro processors contain a remote access feature that allows full remote access to a PC at any time, even if when the computer is turned off. As long as the power supply is available, the system can be woken up by the Core vPro processor, which is able to quietly turn individual hardware components on and access anything on them.
According to Mr Jonathan Brossard, a leading Security Research Engineer, "this is a feature that is documented and well understood" [...] There is absolutely no reason to believe this is being misused by NSA or whoever. So practically, the only thing preventing the usage of such 'features' is morality, which is proved multiple times to be lacking on the mentioned organization & Co.
Secret 3G Radio in Every Intel vPro CPU Could Steal Your Ideas at Any Time
Intel's 'Sandy Bridge' Chip to Include vPro Business Features
For the normal web user, there should be no problem, but it is highly likely that certain keywords will trigger events that will cause the listing of the system under 'to be investigated' category.
As a complimentary answer, in terms of Intel, nobody really knows because, for one, thus far no one has been able to figure out the custom compression algorithm that's used for packing portions of the underlying on-die and on-board binaries used to drive this feature.
Compound that with the fact that attempts to dump shared libraries for the code, including some elusive binary that implements core functions such as memcpy and such yields nothing when you try, and we're all completely blind and in the dark. It's there, but not when you to try to get at it.
Here are some quotes from this article:
With a trusted processor connected directly to the memory, network, and BIOS of a computer, the ME could be like a rootkit on steroids in the wrong hands. Thus, an exploit for the ME is what all the balaclava-wearing hackers want, but so far it seems that they’ve all come up empty.
With regards to who's working on it, and problems faced:
The best efforts that we know of again come from [Igor Skochinsky]. After finding a few confidential Intel documents a company left on an FTP server, he was able to take a look at some of the code for the ME that isn’t in the on-chip ROM and isn’t compressed by an unknown algorithm. It uses the JEFF file format, a standard from the defunct J Consortium that is basically un-Googlable. (You can blame Jeff for that.) To break the Management Engine, though, this code will have to be reverse engineered, and figuring out the custom compression scheme that’s used in the firmware remains an unsolved problem.
Another quote that points out the fact that since we cannot see the code, we have true idea of just how bad this could be:
There are many researchers trying to unlock the secrets of Intel’s Management Engine, and for good reason: it’s a microcontroller that has direct access to everything in a computer. Every computer with an Intel chip made in the last few years has one, and if you’re looking for the perfect vector for an attack, you won’t find anything better than the ME. It is the scariest thing in your computer, and this fear is compounded by our ignorance: no one knows what the ME can actually do. And without being able to audit the code running on the ME, no one knows exactly what will happen when it is broken open.
Emphasis mine.
There are websites set up for people who want to work on the problem of figuring out the unknown compression algorithm. One such example is http://io.netgarage.org/me/.
Your best bet for finding tools that enable you to start getting your hands on at least portions of the firmware will be to Google "Igor Skochinsky". You can view his Github account to find what he has published.
All that said, I'm going to try and find my old dual pentium III system and go back to the stone age I guess. :)
Edit
The GNU LibreBoot project also has an extensive write up about the Intel ME as well here. It's worth a read. Here's a snippet that sums up their views:
The Intel Management Engine with its proprietary firmware has complete access to and control over the PC: it can power on or shut down the PC, read all open files, examine all running applications, track all keys pressed and mouse movements, and even capture or display images on the screen. And it has a network interface that is demonstrably insecure, which can allow an attacker on the network to inject rootkits that completely compromise the PC and can report to the attacker all activities performed on the PC. It is a threat to freedom, security, and privacy that can't be ignored.
For completeness, the LibreBoot project also has a write up about AMD Platform Security Processor, the AMD branded back-door version of Intel's ME. You can find that here. Again, a quote summarizing their opinions on the matter:
In theory any malicious entity with access to the AMD signing key would be able to install persistent malware that could not be eradicated without an external flasher and a known good PSP image. Furthermore, multiple security vulnerabilities have been demonstrated in AMD firmware in the past, and there is every reason to assume one or more zero day vulnerabilities are lurking in the PSP firmware. Given the extreme privilege level (ring -2 or ring -3) of the PSP, said vulnerabilities would have the ability to remotely monitor and control any PSP enabled machine. completely outside of the user's knowledge.
