6

Hello I have an Intel® Core™ i3-2328M CPU @ 2.20GHz computer processor (I think Sandy Bridge). https://ark.intel.com/products/70927/Intel-Core-i3-2328M-Processor-3M-Cache-2_20-GHz

I have heard about the recent problems surrounding Intel ME, the recent discoveries of the PT team: http://blog.ptsecurity.com/2017/08/disabling-intel-me.html

But they are basically talking about the vulnerabilities of the vPro technology, specifically the AMT bug (sorry I can't link more here, search for CVE-2017-5689), where a lot of people have panicked to disable the AMT system due to the massive bug that has been discovered earlier this year. There were also concerns about the TXT (Trusted Execution Technology) detailed in other studies and researches available on the internet.

Luckily my processor doesn't have:

  • TXT
  • Boot Guard
  • vPro
  • AMT


However there were also concerns about:

  • Anti-Theft Technology, which can basically lock your computer, even via remote access (huge security vulnerability)
  • Execute Disable Bit, I am not sure what this does, but it sounds kind of invasive
  • Identity Protection Technology, sounds like a huge privacy invasion
  • Intel VT-x, which creates a subsystem that does have full privileges, but allegedly doesn't have access to the main system
  • and others

I would like to hear security expert's opinion about my processor, and would it make sense to disable ME in my situation if I would like to maximize the security of my computer?


EDIT:

I have checked my chipset. It's Intel® C216 Chipset and there it says that both TXT and vPRO is enabled. I am confused now. I don't know what this means.

  • vPRO is not a single feature; it's a marketing term for a whole range of features (HyperThreading, VT-x, TXT, AMT, etc). The PCH (chipset) having support for those features does not mean that they are inherently enabled because the processor must also support them. – Polynomial Aug 30 '17 at 18:49
  • @Polynomial on the Intel website it says vPro is not available, so I guess they were referring to AMT? – Hexagon Aug 31 '17 at 21:22
  • TXT is not a bad thing. It provides things like measured boots. Same with BootGuard. While it is not great from a freedom standpoint (you can't install your own BIOS), it completely prevents BIOS-based rootkits. – forgetful Oct 19 '17 at 11:57
4

Let's go through all of this.

But they are basically talking about the vulnerabilities of the vPro technology, specifically the AMT bug (sorry I can't link more here, search for CVE-2017-5689), where a lot of people have panicked to disable the AMT system due to the massive bug that has been discovered earlier this year

You likely don't have AMT as this is usually only available on Xeon architecture chips, but there have been reports that it might be exploitable on some desktop architectures too. Disabling it is possible, see this thread on Intel's forums for details. If your system doesn't offer this option in the UEFI/BIOS, you'll either need a custom one (see later in this answer) or you'll need to clean your IME firmware to remove the functionality entirely (also discussed later).

Anti-Theft Technology, which can basically lock your computer, even via remote access (huge security vulnerability)

Sort of. You need to register your device with a provider (e.g. Intel, McAffee, or your organisation's administrators) in order to make it functional. At this point the provider can then lock the BIOS remotely if you report it stolen. The thread linked above also explains how to turn this off, but the enable/disable toggle is easily found in most UEFI/BIOS menus.

Execute Disable Bit, I am not sure what this does, but it sounds kind of invasive

Don't be scared by things you don't understand! Be curious. Execute Disable Bit is a really important security feature - it's the hardware feature that underpins No-Execute (NX), otherwise known as Data Execution Prevention (DEP) on Windows.

Identity Protection Technology, sounds like a huge privacy invasion

Nope. IPT is designed for use in enterprise environments where you want hardware-supported 2FA or PKI integration. It doesn't do anything unless you configure and enrol it.

Intel VT-x, which creates a subsystem that does have full privileges, but allegedly doesn't have access to the main system

I don't know where you've read this, but it's nonsense. VT-x is hardware virtualisation support. It includes special instructions which help speed up the process of virtualising a secondary operating system (a VM) on your host system. Software such as Hyper-V, VMWare, and VirtualBox use these extensions for performance and security improvements.


Disabling IME is probably a good idea in general if you value the openness of your hardware stack. Unfortunately you can't fully disable it at the moment. There are, however, efforts to help you heavily reduce the amount of code running under ME. The me_cleaner tool allows you to strip most sections of the firmware from the management engine without triggering a signature validation failure or 30 minute shutdown timer. A new trick released fairly recently (actually only a few days before writing this) allows you to disable ME very early and strip out even more code, using an undocumented feature called HAP. The me_cleaner developers are in the process of implementing support for this. Note that both of these tricks generally require hardware modification (reprogramming the 8-pin EEPROM IC which contains the firmware) and are entirely unsupported - you may brick your hardware, although you can always restore the original firmware using an EEPROM programmer.

You can also look into coreboot and libreboot if you want to replace your UEFI/BIOS with an open source option. Unfortunately these projects are generally limited to a small number of old laptops and motherboards.

  • Isn't the HAP only on the 11 version of the firmware? Me having Sandybridge, I think I have the 7.x version of it. I don't have any option in the BIOS for AMT, AT or IME. I have a pretty basic BIOS, so I don't think the AMT is enabled on my PC even if it's there. – Hexagon Aug 31 '17 at 21:10
  • @Hexagon It's still largely down to processor support. me_cleaner and the like may still be useful. – Polynomial Aug 31 '17 at 23:01

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.