This question is about how to minimize the risk posed by Intel AMT/ME's ring -3 exploits? I'm looking for advice on common strategies and practices. Here is my current situation.
I am parking my encrypted Intel iCore5 mobile device often in S3 hibernation mode, while the laptop is plugged in. I run a GNU/Linux and I do not use wired networking but wireless LAN. The memory itself is not encrypted (e.g. a system working on the TRESOR concept).
According to my understanding of this article about Intel's AMT/ME vulnerability risk can be assumed by the mere fact that a second processor, i.e. the AMT/ME, is able to run during S3 hibernation and use network communication.
To clarify, for suggested improvements and risk/exposure reduction strategies, I do not in any way appreciate nor need that AMT/ME stuff. Is there a way to disable it? Additionally, would using Coreboot reduce this risk further? If so, why?
Also, I was thinking about making a hardware switch on the antenna of the WiFi in order to shut it off with the system. Even the idea of being vulnerable to OOB by Intel's AMT/ME "feature" while the machine is up and running is not a happy thought.