11

This question is about how to minimize the risk posed by Intel AMT/ME's ring -3 exploits? I'm looking for advice on common strategies and practices. Here is my current situation.

I am parking my encrypted Intel iCore5 mobile device often in S3 hibernation mode, while the laptop is plugged in. I run a GNU/Linux and I do not use wired networking but wireless LAN. The memory itself is not encrypted (e.g. a system working on the TRESOR concept).

According to my understanding of this article about Intel's AMT/ME vulnerability risk can be assumed by the mere fact that a second processor, i.e. the AMT/ME, is able to run during S3 hibernation and use network communication.

To clarify, for suggested improvements and risk/exposure reduction strategies, I do not in any way appreciate nor need that AMT/ME stuff. Is there a way to disable it? Additionally, would using Coreboot reduce this risk further? If so, why?

Also, I was thinking about making a hardware switch on the antenna of the WiFi in order to shut it off with the system. Even the idea of being vulnerable to OOB by Intel's AMT/ME "feature" while the machine is up and running is not a happy thought.

Improve this question
1
  • 3
    To those who suggest that you can "turn off AMT", read this part from the linked article: "The ME rootkit could be installed regardless of whether the AMT is present or enabled on the system". What sucks is that Intel decided that this was a good idea and began sneaking it into the BIOS without first weighing in with I.T. professionals. Sounds like Big Brother code similar to "Wireless Emergency Alerts" to me.
    – Michael Blankenship
    Commented Aug 17, 2015 at 21:31

3 Answers 3

Reset to default
3

At the end of the day, there is nothing that you can do with the iCore5.
It has a permanent backdoor that has total access to and control over the rest of the PC.
If knowing this fact bothers you, then you can only really do one of two things:

  1. Turn back now and refocus your mental energy on thinking happier thoughts.
  2. Dig deeper and develop a newfound appreciation for the GM45 chipset and 'obsolete' ThinkPads.

The fastest and most capable PCs with removable ME are ThinkPad models X200, T400 and T500. These can be completely rid of Intel's ME in a relatively straightforward procedure that only requires a beagle bone black, an old ATX PSU, a Pomona 5252(works with either the SOIC-8 or the SOIC-16) and some jumper wires.

Alternatively, you can purchase one of the aforementioned ThinkPads with the ME removed for you, albeit at a massively increased cost.

Improve this answer
2
  • You can get a new computer that has ME removed by puri.sm: puri.sm/products
    – HackSlash
    Commented Nov 28, 2017 at 19:10
  • 1
    This is not entirely true. Despite what the memes say, the ME does not have complete control over the PC. It has control over I/O-related functions, and it can create its own virtual PCI device. This device may be able to disable VT-d (at least on newer models via some whacky register, and using PAVP on older ones). Other than that, it is not an all-powerful backdoor like everyone thinks. Not that it's still not dangerous, though...
    – forest
    Commented Dec 16, 2017 at 10:17
2

Intel Q35 from your link is Intel AMT 3, it's last version of AMT which had some problems with "hack-methods". AMT4+ didn't hack, AMT6+ have even more security.

If you are afraid of Intel AMT/ME, you can disable it in your BIOS or MEBx. But you must remember that all modern systems are constructed to use Intel ME by default.

Improve this answer
4
  • The advice to disable it, is most usable, to avoid exploitation by third parties hacking it. If the threat perception would include also attacks from sides of Intel and or secret agencies with which Intel might be required to cooperate, than of course there is an more puzzling problem of trust. By any chance there is a hardware/physical disabeling of AMT/ME possible? After all an backdoor in Intel's AMT seems imho more yealding than a trickery with the Intel CPUs random number generation via microcode attack? More clear to you think bios disabeling will do?
    – humanityANDpeace
    Commented Feb 3, 2015 at 11:35
  • 1
    If you do not trust Intel hardware (that there is "physical disabling" of AMT/ME) - you have not got any chances. Furthermore all Intel modern chipsets have got "hardware ME" that can not be disabled. In this case (if you do not trust) it is possible only advise to use hardware from other manufacturers.
    – Roman Siewko
    Commented Feb 4, 2015 at 9:32
  • 2
    @RomanSevko I wouldn't say that so quickly. AMD has their PSP, which is even worse. The implementation is quite different, but it has far less security than the Intel ME and is easier to hijack. Avoiding the x86 architecture is better advice. SPARC is pretty good.
    – forest
    Commented May 1, 2016 at 3:28
  • @forest can you show me a working exploit for AMD PSP that demonstrates your assertion that it's "easier to hijack"?
    – HackSlash
    Commented Nov 28, 2017 at 19:11
0

Aside from using the Intel provided solution the best thing you can do right now is install coreboot over your BIOS and neuter the ME OS. This can only be done with certain chips at this time but there is a team actively working on long term solutions:

https://puri.sm/posts/deep-dive-into-intel-me-disablement/

Think of the ME as having 4 possible states:

Fully operational ME: the ME is running normally like it does on other manufacturers’ machines (note that this could be a consumer or corporate ME image, which vary widely in the features they ‘provide’)
Neutralized ME: the ME is neutralized/neutered by removing the most “mission-critical” components from it, such as the kernel and network stack.
Disabled ME: the ME is officially “disabled” and is known to be completely stopped and non-functional
Removed ME: the ME is completely removed and doesn’t execute anything at any time, at all.
Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .