Is Intel's "Management Engine" something to worry about? - Page 1
Forum section: electronics / general

author: apis
author_rank: Super Contributor
timestamp: May 09, 2019, 11:59:35 pm
content: Apparently there is a little computer in every computer that Intel put there for remote management purposes, it listens for network traffic in the background when enabled. Does anyone know what the status of this so called "management engine" is today, and how to make sure it's disabled?https://www.eff.org/deeplinks/2017/05/intels-management-engine-security-hazard-and-users-need-way-disable-itQuotehttps://en.wikipedia.org/wiki/Intel_Management_EngineQuote

author: ElectronicSupersonic
author_rank: Regular Contributor
timestamp: May 10, 2019, 01:47:20 am
content: The "pure" idea behind it was to enable admins to manage computer remotely, as if they had the computer in question right in front of them. Hence it is embedded deeply in the system (it evolved during its career and its location had changed several times, now it is usually located in PCH). For it to work, PC should be connected to a network (LAN, duno about WiFi). In theory it has a complete access to the hardware and can even flash BIOS, since it has its own storage in PCH. Looks scary, but it's not, since it require not so trivial knowledge of hardware and networking. It can for sure be used for malicious intents, buts it's NSA grade stuff (certainly not for script kiddies). So in most cases there is no need to be paranoid about it (IMHO). I guess there are plenty of more simple methods to achieve same goals.It can be disabled with no side effects or with some side effects. It depends on the method used and particular model/brand of the PC, since different systems behave differently if MEI is not working.More or less safe method is described here:https://github.com/corna/me_cleanerThe other method is more a bug then a feature.My current notebook was revived from a bricked state (it turned on but wasn't booting at all - not even to BIOS screen) via reflashing BIOS using SPI programmer. For flashing, a BIOS image from another notebook was used (of the same model) but BIOS was of older version, so I decided to update it. It failed to update 'cos update just wasn't happening. It took me many days to figure out why. Turns out, a so called ME region was the reason. ME stands for Management Engine and it has its own piece of BIOS image (region) where its firmware is stored and where (most importantly) it keeps its working files, which are unique to a particular PC/system. Since PCH storage is limited only ME bootloader is kept there - the rest is in ME region of BIOS IC.So if you flash a BIOS image dumped from another machine, this image will contain ME region with information specific for that particular machine. Since this information will not match your machine, ME will be confused and most likely stop working at all. If ME is not working, some machines will refuse to boot or will turn off after 30 minutes or will have other glitches. In my case nothing was broken except the BIOS wasn't updating. To remedy this problem, source BIOS image should be modified before flashing by replacing the ME region with so called clean ME region (ME region which does not contain any system specific information). Clean ME region can usually be found in the official BIOS updates provided by the PC manufacturer (HP, Dell, Asus etc).

author: 0culus
author_rank: Super Contributor
timestamp: May 10, 2019, 01:57:54 am
content: Theoretically it's not operational unless you purchase the associated remote management utilities with it. However, you have no assurance of that whatsoever. There are some efforts to reverse engineer ME:https://puri.sm/learn/intel-me/Fun fact: ME runs a modified version of Andy Tanenbaum's MINIX:https://www.cs.vu.nl/~ast/intel/

author: Red Squirrel
author_rank: Super Contributor
timestamp: May 10, 2019, 02:30:46 am
content: It is and it worries me a lot. Unfortunately there is not much known about it and any efforts to disable it are quite involved. Lot of people that have posted stuff online have also gotten C&D letters from Intel.The only "good" thing is that the typical hackers don't know much about it either... but the real threat, the government, most likely do.I have read that some things can be done to potentially "block" it, such as using non Intel network cards and definitely not the ones built on the motherboard. At very least, for the outside facing interface. (ex: firewall). I guess the way it interacts with the NIC, it can't do it with an addon one. This is all speculation though. Actually everything about this is speculation, there's just not much info out there.There's also some rumours that there is a 3G radio so it can connect via 3G and completely bypass your firewall, but those are just rumours, and it's been said to be unfeasible for many reasons, such as the idea of having a radio transmitter literally within proximity of the die. It would most likely induce current etc and mess things up. That and each cpu would essentially need a cell plan, and at some point it would need to at very least transmit some kind of hand shake data, which means anyone with the right equipment would be able to have eventually find this out and confirm it. So I don't think it has a 3G radio, but there is a rumour about it so still have to consider the possibility, although it's probably super low.The odd thing I found is that it is suppose to be listening on a tcp port but I have yet to figure out how to connect to it, so it's not very cut and dry. While it does "hijack" the network card from the OS (essentially just listening/adding packets using the existing IP of the OS) I don't think it's always listening for tcp connections, I think there is a way to trigger it. Or perhaps it is listening but it only responds to specific commands. Ex: probably need a special client to connect to it and that client will send the right command sequence. Someone with a packet sniffer running 24/7 could eventually pick this up but it would be hard to catch in all the noise of normal network traffic and I doubt anyone is connecting to it unless they have a reason to. I would imagine they have plenty of tricks up their sleeves to make this hard to detect. These probably also don't "call home" as that would be too easy for people to also detect, I'd imagine these are rather silent until engaged in a specific way. Chances are they'll only use this to go after child predators etc, but it's just the idea that it's there that is still something worth worrying about as it's wide open to abuse.

author: 0culus
author_rank: Super Contributor
timestamp: May 10, 2019, 02:38:32 am
content: Quote from: Red Squirrel on May 10, 2019, 02:30:46 am[Emphasis mine] Look upIntel AMT (Active Management Technology)It's almost always an extra cost option.

author: magic
author_rank: Super Contributor
timestamp: May 10, 2019, 06:01:19 am
content: Quote from: Red Squirrel on May 10, 2019, 02:30:46 amI don't think it has an embedded radio for all the reasons you list. However, it can use a laptop's internal 3G modem (maybe even if the machine is off or perhaps not) in order to support remote control of corporate laptops and tracking of stolen property, features officially advertised by Intel.

author: David Hess
author_rank: Super Contributor
timestamp: May 10, 2019, 05:14:24 pm
content: Even if the Intel Management Engine was not part of the design,System Management Modeis.

author: TerraHertz
author_rank: Super Contributor
timestamp: May 10, 2019, 10:28:36 pm
content: Intel happily does what the intelligence agencies want. So does Microsoft. You can absolutely bank on it that all modern Wintel PCs are entirely open to government access, via multiple channels.SMM. System Management Mode. Many years ago a friend of mine (since deceased) and I had A CPU emulator for Pentium One CPUs. Plug its pod into a PC motherboard's CPU socket, and it could see _everything_ going on. We tried it in a standard Windows machine. Very curious! We found the CPU spent about 20% of its time running SMM code. Kicked off via a regular NMI. We didn't have a SMM code disassembler, so couldn't tell what it was doing. System and user code have NO WAY to detect the occurrence of SMM execution - it's just like 'vanished time'.So we cut the track on the motherboard that was passing the NMIs to the CPU. No more SMM code. And the PC still worked exactly as before. I think that was the point at which I started to get seriously paranoid about the PC architecture.IME. Intel Management Engine. A feature added after SMM. Yes, it's impossible to trust a machine that has a ME running. Yes, it runs MINIX, complete with a TCP/IP stack, and it is always running so long as the PC has power. It has total access to all hardware and memory, ie higher than ring zero authority. Incidentally there's some question that MINIX version may be unauthorized, ie Intel stole it contrary to Tannenbaum's release terms.But there's an even deeper level of hardware backdoor built into modern Intel CPUs. One so obfuscated and obviously treacherous, it buries any notion that Intel is your friend. See this:GOD MODE UNLOCKED - Hardware Backdoors in x86 CPUsBlack Hat USA 2018, Published on Aug 28, 2018This talk will demonstrate what everyone has long feared but never proven: there are hardware backdoors in some x86 processors, and they're buried deeper than we ever imagined possible. While this research specifically examines a third-party processor, we use this as a stepping stone to explore the feasibility of more widespread hardware backdoors.By Christopher DomasFull Abstract & Presentation Materials:https://www.blackhat.com/us-18/briefings/schedule/#god-mode-unlocked---hardware-backdoors-in-x86-cpus-10194Previously mentioned here:https://www.eevblog.com/forum/chat/deliberate-hardware-backdoor%28s%29-in-x86-cpus/I should also mention the Intel yellow and gray books again. Later, got to go now.

author: apis
author_rank: Super Contributor
timestamp: May 11, 2019, 04:11:13 pm
content: It's disturbing that these kind of things often turn out to be much worse than what I would have expected. I mean, backdoors sure, but entire parallel processors that can take over your system... nope, wouldn't have bet on that.One has to assume they can activate these systems over wifi as well, although there are probably a way to disable it for the host government, so maybe it's not always active.

author: stj
author_rank: Super Contributor
timestamp: May 11, 2019, 10:36:59 pm
content: but who is the host government??all Intel developement is done in Israel - so is most of microsoft's core coding now!!!!and you have to think about what the so-called "inteligence" agency's have been cought doing over the years.if you think they wouldnt spy on there own government/politicians for a bit of usefull info for possible blackmail,or if you think they wouldnt involve themselves in industrial or financial espionage for personal gain then your naive.if i was an accountant or designer etc at a leading company, my computers would either be isolated from the outside, or they would be old but capable systems.maybe SGI or SUN stuff pre-Intel - or even Amiga'sAirbus could tell you a story about how trusting your hardware could cost you billions!!!

author: ElectronicSupersonic
author_rank: Regular Contributor
timestamp: May 12, 2019, 02:28:07 am
content: Quote from: stj on May 11, 2019, 10:36:59 pmWhile troubleshooting the notebook I've mentioned previously, had to google info on ME. One of YouTube videos I've came across, was by two Russianhackers (TM)researchers. They discovered a vulnerability in ME and informed Intel about it. In the video they mention publicly available NSA document (it was later removed) on High Assurance Platform program. This is (amongst other things) a special ME mode that is to be used in PC intended for internal use in the agency(s), which limits functionality of ME to a safe bare minimum. Thus NSA is perfectly aware of what's what.It is safe to assume not only NSA is aware. It seems to me that George Orwell was overly optimistic about only one Big Bother watching. There are many Brothers. Some are bigger then the overs.

author: magic
author_rank: Super Contributor
timestamp: May 12, 2019, 08:51:27 am
content: Quote from: ElectronicSupersonic on May 12, 2019, 02:28:07 amIt's standard practice in high security environments to analyze all components of the system and remove or demand removal of everything not strictly necessary for the application.On the other hand, there are corporate customers who aren't as paranoid and who will trust Intel as long as they get a solemn promise that ME is "secure", which it is designed to be, that is neither the operator of the machine nor any malware is able to touch anything running on it. Those companies actually pay extra to get the various functionalities provided by ME and therefore the technology exists.You must understand that companies are generally run by people who have no clue about technology and don't hang out at tech forums, what gets to those people are power point presentations by salesmenFor everybody else, it is completely useless, possibly a security hole and possibly backdoored although I don't think anybody has discovered backdoors yet and it would be a huge risk for Intel and more bad PR for the governments involved.

author: stj
author_rank: Super Contributor
timestamp: May 12, 2019, 09:01:22 am
content: while we are talking about this stuff,look up "computrace"it's a malware in most bioses that actually patches the o.s. with a backdoor at boot!!!i'v extracted this filth from a few bioses using available tools,it's modular and has been around atleast since the "core" cpu days.while ripping it i'v found other malware in some machines too - specially lenovo.

author: magic
author_rank: Super Contributor
timestamp: May 12, 2019, 09:14:11 am
content: Quote from: stj on May 12, 2019, 09:01:22 amYou misspelled WindowsBesides, I was disappointed reading about it. For a moment I hoped it's some virus which spreads itself and infects the BIOS, not factory malware. That would be interesting

author: G7PSK
author_rank: Super Contributor
timestamp: May 12, 2019, 09:25:11 am
content: If there is a back door and the NSA is hoovering up the information from every intel processor then you can rest assured that the Russians and the Chinese also have acess as well along with quite a few other states. If there is this back door and a mamoth data base some where holding all this information you can bet your bottom dollar that some state or other and maybe more than one has either put something nasty on that data base or has something even nastier ready too go should the time arrive. Security flaws work both ways, if you have a secret you dont put it on a computer in fact a secret is no longer a secret if it gets written down or told to some one else it can only ever remain totaly secure while it is between you ears and yoy ears alone.

author: David Hess
author_rank: Super Contributor
timestamp: May 12, 2019, 10:20:24 am
content: It is more likely that the NSA would compromise Intel's hardware random number generator like they did withNIST's Dual_EC_DRBG. Doing so is much more deniable and difficult to detect than special purpose hardware and instructions and does not require control of the target system for it to be compromised.After Snowden, FreeBSD made it policy to always mix other random sources with the CPU's hardware random number generator to foil this sort of attack.Russia apparently tried to doessentially the same thingrecently by submitting deliberately compromised cryptography algorithms for standardization.

author: stj
author_rank: Super Contributor
timestamp: May 12, 2019, 02:07:18 pm
content: Quote from: magic on May 12, 2019, 09:14:11 amUNFORTUNATLY, i didnt.according to computrace's own sales crap, they can also patch some versions of Linux and other o.s.'sthey also have contracts with a lot of phone makers.

author: ElectronicSupersonic
author_rank: Regular Contributor
timestamp: May 12, 2019, 08:33:01 pm
content: Dealing with BIOS troubles, I've opened dumps in hex editor. Some parts of the dump looks shall we say curious. See screenshots bellow.

author: apis
author_rank: Super Contributor
timestamp: May 12, 2019, 09:15:52 pm
content: Quote from: ElectronicSupersonic on May 12, 2019, 08:33:01 pmThose are the names of some commoncertificate authorities, likeverisignorgodaddy. It's probably referencing their root certificates used for verifying the validity of cryptographic signatures. Not sure why they are needed in the bios, maybe it's forsecure bootor something like that?You can assume any backdoors are much less obvious, it will be something that can be explained away as mistake or maybe an unintentional weakness.What bothers me about the ME is that it's an extra little computer (homunculus was a fitting name) in my computer that I have no control over, and it listens for external commands from the network! It can likely be invoked from userland (I mean, you can make calls to the network device if nothing else). And it has authority over my processor and memory, i.e. complete control. If you can hack that you can take over someones computer without them ever noticing (from "inside" the the computer at least, you could perhaps detect network traffic that shouldn't be there). It completely circumvents all other security measures. Seems like a disaster waiting to happen, and a perfect place to introduce backdoors. If it looks like a duck...

author: Mr. Scram
author_rank: Super Contributor
timestamp: May 12, 2019, 10:47:10 pm
content: It's not the perfect place to introduce backdoors, it's essentially a perfect backdoor. Whether that's intentional or not.

author: windsmurf
author_rank: Frequent Contributor
timestamp: May 12, 2019, 11:22:28 pm
content: Quote from: Mr. Scram on May 12, 2019, 10:47:10 pmThe below article has been much criticized, but its interesting. They claim this "chip" might have been installed in the management controllers.https://www.bloomberg.com/news/features/2018-10-04/the-big-hack-how-china-used-a-tiny-chip-to-infiltrate-america-s-top-companies

author: Mr. Scram
author_rank: Super Contributor
timestamp: May 12, 2019, 11:37:44 pm
content: Quote from: windsmurf on May 12, 2019, 11:22:28 pmThat's a lot of speculation without evidence. The Intel Management Engine is comparatively well documented, including interesting finds like an undocumented feature apparently devised to allow the NSA turning the IME off for internal use.

author: stj
author_rank: Super Contributor
timestamp: May 13, 2019, 07:50:19 am
content: Quote from: ElectronicSupersonic on May 12, 2019, 08:33:01 pmthose arent bioses, those are installers.and bioses are compressed anyway using the old PKzip algorythm.when a pc boots, the bootloader/header of the bios decompresses the main code to ram and then jumps into it.

author: ElectronicSupersonic
author_rank: Regular Contributor
timestamp: May 13, 2019, 09:28:48 am
content: Quote from: stj on May 13, 2019, 07:50:19 amThis was an image of the actual BIOS IC (one of the two IC used in this particular notebook) taken using an SPI programming device. What manufacturer has on their website as a BIOS upgrade, actually is not a BIOS image, but rather a set of modules to be updated plus flashing utility packed inside an executable file.

author: stj
author_rank: Super Contributor
timestamp: May 13, 2019, 04:21:26 pm
content: well all those certs are a bit strange then.