
Experiments with disabling the ME on Sandybridge x230 - mmastrac
https://www.coreboot.org/pipermail/coreboot/2016-September/082016.html
======
0x0
"(...) the ME will sync it's internal clock with NTP servers across the
internet once every 30 days, to make CRL checks for the remote management PKI
work." (in
[https://www.coreboot.org/pipermail/coreboot/2016-September/0...](https://www.coreboot.org/pipermail/coreboot/2016-September/082019.html)
)

That's pretty crazy to think there's a sub-ring-0 rootkit running on your CPU
contacting NTP servers without your knowledge.

Does that work over wifi (where does it get the WPA password from)?

Where does it get an IP address? Does it leech off the host's DHCP IP by
intercepting ethernet packets?

Is there any way to fingerprint the traffic? TTLs, sequence numbers, etc?

It'd be interesting to run a system behind a router for a while while logging
all ME traffic...

~~~
jcrawfordor
For this NTP check to happen, you must be using a computer with Intel MEBX and
an Intel AMT-enabled network adapter, and the network adapter must be
configured with network information to use. You have to do this manually
initially, although of course later you can configure AMT using AMT.

This isn't something your consumer computer is doing automatically, in fact,
your computer is almost certainly not capable because it lacks an AMT-capable
NIC. I suspect the software capability is baked into ME itself rather than the
AMT component so it's probably present in your ME, but it's not doing anything
without an AMT NIC to communicate with.

This is the kind of feature that you pay an extra $1k for when you configure
your $20k server.

~~~
seanp2k2
Not specifically ME but yeah Baseboard Management Controllers and IPMI modules
have been a thing for a long time. Most real server motherboards have them or
have the facilities in place to accept them as an add-on module. It's not even
just stuff in the $20k range; this $450 mini itx 8-core Atom-based storage
server board has it:
[http://www.asrockrack.com/general/productdetail.asp?Model=C2...](http://www.asrockrack.com/general/productdetail.asp?Model=C2750D4I#Specifications)
and it comes with a web-based IPMI console. You can turn the power on and
watch it POST with a java web screen viewer, sending it keys as if you were
sitting there.

Dell's add-in card to do out-of-band management is called the DRAC and it's
been optional in their servers for about 17 years:
[https://en.m.wikipedia.org/wiki/Dell_DRAC](https://en.m.wikipedia.org/wiki/Dell_DRAC)

~~~
cm2187
And I think you typically do not expose IPMI to the WAN. Separate dedicated
private network.

------
eloy
It's a shame that ME can't be removed or disabled on modern Intel CPU's. Same
goes for AMD and maybe companies that implement something like ME in ARM.
OpenSPARC is quite dead, sadly enough.

Highly recommended read about x86 security:
[http://blog.invisiblethings.org/papers/2015/x86_harmful.pdf](http://blog.invisiblethings.org/papers/2015/x86_harmful.pdf)

The author of this paper is also the developer of Qubes OS. They recently
added another requirement to laptops who are 'Qubes certified': they must run
Coreboot. It's not Libreboot yet, but that is a huge leap forward for x86
security. Hopefully this will trigger vendors to make their hardware Coreboot
compatibile. It won't do anything about Intel ME, but it is a step in the
right direction.

I ordered a Thinkpad x200 to flash it with Libreboot last week, just to have
at least one device without any malware (in RMS sense)

~~~
wmf
Y'all all ordered Talos, right?
[https://www.raptorengineering.com/TALOS/prerelease.php](https://www.raptorengineering.com/TALOS/prerelease.php)

Or Novena? [https://www.crowdsupply.com/sutajio-
kosagi/novena](https://www.crowdsupply.com/sutajio-kosagi/novena)

No?

~~~
mtgx
I believe both the Librem laptops and the ORWL PC will soon use Coreboot, and
they are much cheaper.

~~~
whamlastxmas
There's zero chance that the future Librem laptops will be "truly" open
source. They will still have ME or AMD equivalent. Their entire marketing
campaign is frustratingly dishonest.

~~~
IntelMiner
They're quite competent con men. If you call them out about it (as the
Coreboot developers did) especially on Reddit, they give very dismissive, yet
non-committal comments

"We're in talks with Intel" "They really want to do this" "We're going to make
a petition to show interest to Intel"

The reality is that even Google with their Chromebooks, despite hiring most of
the Coreboot team and shipping volume into the likely millions of units, was
unable to persuade Intel. Even for the absolutely tiny set of CPU models they
use

------
AdmiralAsshat
It's a shame that we seem locked into using Intel or AMD for x64 processors,
both of which have secondary, black-box processors.

Isn't x64 a standard? Couldn't another company create their own implementation
of it and design their own processors for the paranoid to use?

~~~
mindslight
IMHO, at this level binary compatibility isn't important. Linux could be
easily ported to run on any ISA.

The problems are economies of scale and the perfect being the enemy of the
good. What is the interest in an expensive custom chip when you still can't
trust that it wasn't compromised by the fab?

~~~
effie
I don't think it will ever be possible to prove that given piece of hardware
contains no malware. Still, there is demand for transparency and product that
comes with manufacturer's warranty that says "malware not included". People
believe this could lead to some good results, such as better hardware and
lower probability of bugged computer.

------
drvdevd
Interesting that the ME region can be even partially overwritten and will
still let the system boot, albeit with an error (guessing a checksum
mismatch)...

~~~
drvdevd
Ah ... reading further down the thread its explained and is even more
interesting:
[https://www.coreboot.org/pipermail/coreboot/2016-September/0...](https://www.coreboot.org/pipermail/coreboot/2016-September/082019.html)

~~~
DashRattlesnake
> along with the fact that the ME will sync it's internal clock with NTP
> servers across the internet once every 30 days

Wow. This is part of the processor?

~~~
jandrese
The Management Engine, think of it as running at Ring -1. It can access
hardware below the level of the processor. Injecting malware into it would be
the holy grail for attackers, it would be impossible for anything running on
the CPU to detect it and the malware would have access to all of the low level
hardware. It can even intercept or create packets on the network interfaces.

Luckily the implementation is obscure so it has perfect security, right?
There's no way such a complex piece of software that has had very little
oversight could have exploitable bugs that would completely destroy any
security foundations you have on your machine.

~~~
drvdevd
> It can even intercept or create packets on the network interfaces.

And appears to be built to do so out of the box by default with no
"specialized code". I'm guessing with both wired and wireless interfaces...
crazy!

------
yuhong
I know that the laptop anti-theft arms race is a bad idea for a while now.

------
dragontamer
Can someone describe what a "ME Region" is?

~~~
Lagged2Death
This has an editorial point of view, for sure, but it's also an approachable
introduction:

[http://boingboing.net/2016/06/15/intel-x86-processors-
ship-w...](http://boingboing.net/2016/06/15/intel-x86-processors-ship-
with.html)

------
gravypod
Does someone have a link to where I can download a few copies of different ME
regions for some CPUs.

I'd love to get a look at what it's doing.

------
Animats
_" The ME code to start the platform is in (on-chip) ROM and a failed
signature check of the (compressed with AFAIK still unknown codebook) ME code
in flash just means that the ME considers the system broken and allows it to
run for a little while so that a human can repair it."_

So 1) will the system stay up with the ME software erased, 2) what's the ROM
component doing besides managing the boot, and 3) what access does it take to
alter the ME's firmware?

~~~
yuhong
The ME firmware is signed by Intel I think.

~~~
yellowapple
So compromise their signing keys and we have a wide-open door to neutralizing
(and/or replacing) ME, right?

------
lifeisstillgood
I am fascinated by this - is there no where that is leading the charge to
develop personal computing devices that are truly open? What cost level are we
really talking here?

~~~
colejohnson66
There are some places that are trying to do fully open source hardware, but
because the majority of the public doesn't care (they just want their computer
to work), nothing big has come out yet.

------
DeepYogurt
Not to be pedantic, but the x230 has an ivybridge chip.

