Hacker News Reader

Comment by chasil | Hacker News Reader

The Core 2 series on LGA775 is the last Intel chipset where the ME can be entirely disabled.

This VISA exploit relies in some way on SA-00086, which is a flaw in the ME that cannot be removed in later versions.

The me_cleaner script has been able to purge these older chipsets since October of last year. I cleaned two different HP desktops at that time, and uploaded the modified BIOS here:

https://github.com/corna/me_cleaner/issues/233

These still suffer from Meltdown and the remediation does exact a performance penalty, but Core 2 is starting to appear as the most manageable risk of all their products.

View on HN

Curious what your threat model is.

The Intel ME can be accessed over the connected ethernet even when the PC is shut down, as long as the power supply is attached.

SA-00086 as an exploit is available through the ME.

VISA is available for access by the (compromised) ME.

This seems threatening enough to me.

I am always confused about this part. Are systems that don't support vPro/AMT/MEBX also accessible over the motherboard's Ethernet connection?

As far as I know, yes.

If you run the Linux ME reporting tool and it is identified, then ME is awaiting provisioning and commands.

Every chipset has the CPU that serves the ME, separate from the CPU.

All Intel systems contain ME hardware and firmware, but most consumer systems are not configured to support remote administration via the integrated ethernet port.

On older Intel chips it's possible to remove the ME and have a functional CPU. These Intel systems running Libreboot lack functional ME firmware/hardware.

No. Systems which don't advertise vPro support probably don't include the necessary firmware even if the hardware is capable of supporting it.

it may be fully there, just disabled in software. I was able to query vpro firmware version from Linux on my laptop, which is "non-vPro" and I was able to use me_cleaner to remove most parts of ME firmware and physically flash the SPI flash chip. Now it shows "machine is not in committed state" in BIOS during booting but everything works (except ME of course).

The Management Engine firmware blob for a non-vPro device is just under 2MB. For a vPro device it's 7MB. To me this hints that the functionality is not there rather than neutered. Of course, no one outside of Intel really knows.

Reply on news.ycombinator.com