Intel Management Engine

Last updated

Privilege rings for the x86 architecture. The ME is colloquially categorized as ring -3, below System Management Mode (ring -2) and the hypervisor (ring -1), all running at a higher privilege level than the kernel (ring 0). Priv rings.svg
Privilege rings for the x86 architecture. The ME is colloquially categorized as ring −3, below System Management Mode (ring −2) and the hypervisor (ring −1), all running at a higher privilege level than the kernel (ring 0).

The Intel Management Engine (ME), also known as the Intel Manageability Engine, [1] [2] is an autonomous subsystem that has been incorporated in virtually all of Intel's processor chipsets since 2008. [1] [3] [4] It is located in the Platform Controller Hub of modern Intel motherboards.

Contents

The Intel Management Engine always runs as long as the motherboard is receiving power, even when the computer is turned off. This issue can be mitigated with the deployment of a hardware device which is able to disconnect all connections to mains power as well as all internal forms of energy storage. The Electronic Frontier Foundation and some security researchers have voiced concern that the Management Engine is a backdoor.

Intel's main competitor, AMD, has incorporated the equivalent AMD Secure Technology (formally called Platform Security Processor) in virtually all of its post-2013 CPUs.

Difference from Intel AMT

The Management Engine is often confused with Intel AMT (Intel Active Management Technology). AMT runs on the ME, but is only available on processors with vPro. AMT gives device owners remote administration of their computer, [5] such as powering it on or off, and reinstalling the operating system.

However, the ME itself has been built into all Intel chipsets since 2008, not only those with AMT. While AMT can be unprovisioned by the owner, there is no official, documented way to disable the ME.

Design

The subsystem primarily consists of proprietary firmware running on a separate microprocessor that performs tasks during boot-up, while the computer is running, and while it is asleep. [6] As long as the chipset or SoC is supplied with power (via battery or power supply), it continues to run even when the system is turned off. [7] Intel claims the ME is required to provide full performance. [8] Its exact workings [9] are largely undocumented [10] and its code is obfuscated using confidential Huffman tables stored directly in hardware, so the firmware does not contain the information necessary to decode its contents. [11]

Hardware

Starting with ME 11 (introduced in Skylake CPUs), it is based on the Intel Quark x86-based 32-bit CPU and runs the MINIX 3 operating system. [12] The ME firmware is stored in a partition of the SPI BIOS Flash, using the Embedded Flash File System (EFFS). [13] Previous versions were based on an ARC core, with the Management Engine running the ThreadX RTOS. Versions 1.x to 5.x of the ME used the ARCTangent-A4 (32-bit only instructions) whereas versions 6.x to 8.x used the newer ARCompact (mixed 32- and 16-bit instruction set architecture). Starting with ME 7.1, the ARC processor could also execute signed Java applets.

The ME has its own MAC and IP address for the out-of-band management interface, with direct access to the Ethernet controller; one portion of the Ethernet traffic is diverted to the ME even before reaching the host's operating system, for what support exists in various Ethernet controllers, exported and made configurable via Management Component Transport Protocol (MCTP). [14] [15] The ME also communicates with the host via PCI interface. [13] Under Linux, communication between the host and the ME is done via /dev/mei or /dev/mei0. [16] [17]

Until the release of Nehalem processors, the ME was usually embedded into the motherboard's northbridge, following the Memory Controller Hub (MCH) layout. [18] With the newer Intel architectures (Intel 5 Series onwards), the ME is integrated into the Platform Controller Hub (PCH). [19] [20]

Firmware

By Intel's current terminology as of 2017, ME is one of several firmware sets for the Converged Security and Manageability Engine (CSME). Prior to AMT version 11, CSME was called Intel Management Engine BIOS Extension (Intel MEBx). [1]

It was also found that the ME firmware version 11 runs MINIX 3. [12] [26] [27]

Modules

Security vulnerabilities

Several weaknesses have been found in the ME. On May 1, 2017, Intel confirmed a Remote Elevation of Privilege bug (SA-00075) in its Management Technology. [36] Every Intel platform with provisioned Intel Standard Manageability, Active Management Technology, or Small Business Technology, from Nehalem in 2008 to Kaby Lake in 2017 has a remotely exploitable security hole in the ME. [37] [38] Several ways to disable the ME without authorization that could allow ME's functions to be sabotaged have been found. [39] [40] [12] Additional major security flaws in the ME affecting a very large number of computers incorporating ME, Trusted Execution Engine (TXE), and Server Platform Services (SPS) firmware, from Skylake in 2015 to Coffee Lake in 2017, were confirmed by Intel on 20 November 2017 (SA-00086). [41] [42] Unlike SA-00075, this bug is even present if AMT is absent, not provisioned or if the ME was "disabled" by any of the known unofficial methods. [43] In July 2018, another set of vulnerabilities was disclosed (SA-00112). [44] In September 2018, yet another vulnerability was published (SA-00125). [45]

Ring −3 rootkit

A ring  −3 rootkit was demonstrated by Invisible Things Lab for the Q35 chipset; it does not work for the later Q45 chipset as Intel implemented additional protections. [46] The exploit worked by remapping the normally protected memory region (top 16 MB of RAM) reserved for the ME. The ME rootkit could be installed regardless of whether the AMT is present or enabled on the system, as the chipset always contains the ARC ME coprocessor. (The "−3" designation was chosen because the ME coprocessor works even when the system is in the S3 state. Thus, it was considered a layer below the System Management Mode rootkits. [18] ) For the vulnerable Q35 chipset, a keystroke logger ME-based rootkit was demonstrated by Patrick Stewin. [47] [48]

Zero-touch provisioning

Another security evaluation by Vassilios Ververis showed serious weaknesses in the GM45 chipset implementation. In particular, it criticized AMT for transmitting unencrypted passwords in the SMB provisioning mode when the IDE redirection and Serial over LAN features are used. It also found that the "zero touch" provisioning mode (ZTC) is still enabled even when the AMT appears to be disabled in BIOS. For about 60 euros, Ververis purchased from GoDaddy a certificate that is accepted by the ME firmware and allows remote "zero touch" provisioning of (possibly unsuspecting) machines, which broadcast their HELLO packets to would-be configuration servers. [49]

SA-00075 (a.k.a. Silent Bob is Silent)

In May 2017, Intel confirmed that many computers with AMT have had an unpatched critical privilege escalation vulnerability (CVE-2017-5689). [38] [50] [36] [51] [52] The vulnerability was nicknamed "Silent Bob is Silent" by the researchers who had reported it to Intel. [53] It affects numerous laptops, desktops and servers sold by Dell, Fujitsu, Hewlett-Packard (later Hewlett Packard Enterprise and HP Inc.), Intel, Lenovo, and possibly others. [53] [54] [55] [56] [57] [58] [59] Those researchers claimed that the bug affects systems made in 2010 or later. [60] Other reports claimed the bug also affects systems made as long ago as 2008. [61] [38] The vulnerability was described as giving remote attackers:

"full control of affected machines, including the ability to read and modify everything. It can be used to install persistent malware (possibly in firmware), and read and modify any data."

— Tatu Ylönen, ssh.com [53]

PLATINUM

In June 2017, the PLATINUM cybercrime group became notable for exploiting the serial over LAN (SOL) capabilities of AMT to perform data exfiltration of stolen documents. [62] [63] [64] [65] [66] [67] [68] [69] SOL is disabled by default and must be enabled to exploit this vulnerability. [70]

SA-00086

Some months after the previous bugs, and subsequent warnings from the EFF, [4] security firm Positive Technologies claimed to have developed a working exploit. [71] On 20 November 2017, Intel confirmed that a number of serious flaws had been found in the Management Engine (mainstream), Trusted Execution Engine (tablet/mobile), and Server Platform Services (high end server) firmware, and released a "critical firmware update". [72] [73] Essentially, every Intel-based computer for the last several years, including most desktops and servers, were found to be vulnerable to having their security compromised, although all the potential routes of exploitation were not entirely known. [73] It is not possible to patch the problems from the operating system, and a firmware (UEFI, BIOS) update to the motherboard is required, which was anticipated to take quite some time for the many individual manufacturers to accomplish, if it ever would be for many systems. [41]

Affected systems

Source: [72]

  • Intel Atom – C3000 family
  • Intel Atom – Apollo Lake E3900 series
  • Intel Celeron – N and J series
  • Intel Core (i3, i5, i7, i9) – 1st, 2nd, 3rd, 4th, 5th, 6th, 7th, and 8th generation
  • Intel Pentium – Apollo Lake
  • Intel Xeon – E3-1200 v5 and v6 product family
  • Intel Xeon – Scalable family
  • Intel Xeon – W family

Mitigation

None of the known unofficial methods to disable the ME prevent exploitation of the vulnerability. A firmware update by the vendor is required. However, those who discovered the vulnerability note that firmware updates are not fully effective either, as an attacker with access to the ME firmware region can simply flash an old, vulnerable version and then exploit the bug. [43]

SA-00112

In July 2018, Intel announced that three vulnerabilities (CVE - 2018-3628 ,CVE- 2018-3629 ,CVE- 2018-3632) had been discovered and that a patch for the CSME firmware would be required. Intel indicated there would be no patch for 3rd generation Core processors or earlier despite chips or their chipsets as far back as Intel Core 2 Duo vPro and Intel Centrino 2 vPro being affected. However, Intel AMT must be enabled and provisioned for the vulnerability to exist. [44] [74]

Assertions that ME is a backdoor

Critics like the Electronic Frontier Foundation (EFF), Libreboot developers, and security expert Damien Zammit accused the ME of being a backdoor and a privacy concern. [75] [4] Zammit stresses that the ME has full access to memory (without the owner-controlled CPU cores having any knowledge), and has full access to the TCP/IP stack and can send and receive network packets independently of the operating system, thus bypassing its firewall. [5]

Intel responded by saying, "Intel does not put backdoors in its products, nor do our products give Intel control or access to computing systems without the explicit permission of the end user." [5] and "Intel does not and will not design backdoors for access into its products. Recent reports claiming otherwise are misinformed and blatantly false. Intel does not participate in any efforts to decrease the security of its technology." [76]

In the context of criticism of the Intel ME and AMD Secure Technology it has been pointed out that the National Security Agency (NSA) budget request for 2013 contained a Sigint Enabling Project with the goal to "Insert vulnerabilities into commercial encryption systems, IT systems, ..." and it has been conjectured that Intel ME and AMD Secure Technology might be part of that program. [77] [78]

Disabling the ME

It is normally not possible for the end-user to disable the ME and there is no officially supported method to disable it, but some undocumented methods to do so were discovered. [41] The ME's security architecture is designed to prevent disabling. Intel considers disabling the ME to be a security vulnerability, as a malware could abuse it to make the computer lose some of the functionality that the typical user expects, such as the ability to play media with DRM, specifically DRM media that is using HDCP. [79] [80] On the other hand, it is also possible for malicious actors to use the ME to remotely compromise a system.

Strictly speaking, none of the known methods can disable the ME completely, since it is required for booting the main CPU. The currently known methods merely make the ME go into abnormal states soon after boot, in which it seems not to have any working functionality. The ME is still physically connected to the system and its microprocessor continues to execute code.[ citation needed ] Some manufacturers like Purism and System76 disable the Intel Management Engine. [81] [82]

Undocumented methods

Firmware neutralization

In 2016, the me_cleaner project found that the ME's integrity verification is broken. The ME is supposed to detect that it has been tampered with and, if this is the case, shut down the PC forcibly 30 minutes after system start. [83] This prevents a compromised system from running undetected, yet allows the owner to fix the issue by flashing a valid version of the ME firmware during the grace period. As the project found out, by making unauthorized changes to the ME firmware, it was possible to force it into an abnormal error state that prevented triggering the shutdown even if large parts of the firmware had been overwritten and thus made inoperable.

"High Assurance Platform" mode

In August 2017, Positive Technologies (Dmitry Sklyarov) published a method to disable the ME via an undocumented built-in mode. As Intel has confirmed [84] the ME contains a switch to enable government authorities such as the NSA to make the ME go into High-Assurance Platform (HAP) mode after boot. This mode disables most of ME's functions, [76] [85] and was intended to be available only in machines produced for specific purchasers like the US government; however, most machines sold on the retail market can be made to activate the switch. [85] [86] Manipulation of the HAP bit was quickly incorporated into the me_cleaner project. [87]

Commercial ME disablement

From late 2017 on, several laptop vendors announced their intentions to ship laptops with the Intel ME disabled or let the end-users disable it manually:

Effectiveness against vulnerabilities

Neither of the two methods to disable the ME discovered so far turned out to be an effective countermeasure against the SA-00086 vulnerability. [43] This is because the vulnerability is in an early-loaded ME module that is essential to boot the main CPU.[ citation needed ]

Reactions

By Google

As of 2017, Google was attempting to eliminate proprietary firmware from its servers and found that the ME was a hurdle to that. [41]

By AMD processor vendors

Shortly after SA-00086 was patched, vendors for AMD processor mainboards started shipping BIOS updates that allow disabling the AMD Platform Security Processor, [99] a subsystem with a similar function as the ME.

See also

Related Research Articles

<span class="mw-page-title-main">AMD</span> American multinational technology company

Advanced Micro Devices, Inc. (AMD) is an American multinational corporation and technology company headquartered in Santa Clara, California and maintains significant operations in Austin, Texas. AMD is a hardware and fabless company that designs and develops central processing units (CPUs), graphics processing units (GPUs), field-programmable gate arrays (FPGAs), system-on-chip (SoC), and high-performance compute solutions. AMD serves a wide range of business and consumer markets, including gaming, data centers, artificial intelligence (AI), and embedded systems.

A rootkit is a collection of computer software, typically malicious, designed to enable access to a computer or an area of its software that is not otherwise allowed and often masks its existence or the existence of other software. The term rootkit is a compound of "root" and the word "kit". The term "rootkit" has negative connotations through its association with malware.

<span class="mw-page-title-main">UEFI</span> Technical specification for firmware architecture

Unified Extensible Firmware Interface is a specification for the firmware architecture of a computing platform. When a computer is powered on, the UEFI-implementation is typically the first that runs, before starting the operating system. Examples include AMI Aptio, Phoenix SecureCore, TianoCore EDK II, InsydeH2O.

coreboot Open-source computer firmware

coreboot, formerly known as LinuxBIOS, is a software project aimed at replacing proprietary firmware found in most computers with a lightweight firmware designed to perform only the minimum number of tasks necessary to load and run a modern 32-bit or 64-bit operating system.

The Intelligent Platform Management Interface (IPMI) is a set of computer interface specifications for an autonomous computer subsystem that provides management and monitoring capabilities independently of the host system's CPU, firmware and operating system. IPMI defines a set of interfaces used by system administrators for out-of-band management of computer systems and monitoring of their operation. For example, IPMI provides a way to manage a computer that may be powered off or otherwise unresponsive by using a network connection to the hardware rather than to an operating system or login shell. Another use case may be installing a custom operating system remotely. Without IPMI, installing a custom operating system may require an administrator to be physically present near the computer, insert a DVD or a USB flash drive containing the OS installer and complete the installation process using a monitor and a keyboard. Using IPMI, an administrator can mount an ISO image, simulate an installer DVD, and perform the installation remotely.

<span class="mw-page-title-main">Trusted Platform Module</span> Standard for secure cryptoprocessors

Trusted Platform Module (TPM) is an international standard for a secure cryptoprocessor, a dedicated microcontroller designed to secure hardware through integrated cryptographic keys. The term can also refer to a chip conforming to the standard ISO/IEC 11889. Common uses are to verify platform integrity, and to store disk encryption keys.

System Management Mode is an operating mode of x86 central processor units (CPUs) in which all normal execution, including the operating system, is suspended. An alternate software system which usually resides in the computer's firmware, or a hardware-assisted debugger, is then executed with high privileges.

Insyde Software is a company that specializes in UEFI system firmware and engineering support services, primarily for OEM and ODM computer and component device manufacturers. They are listed on the Gre Tai Market of Taiwan and headquartered in Taipei, with offices in Westborough, Massachusetts, and Portland, Oregon.

<span class="mw-page-title-main">Intel vPro</span> Umbrella marketing term by Intel

Intel vPro technology is an umbrella marketing term used by Intel for a large collection of computer hardware technologies, including VT-x, VT-d, Trusted Execution Technology (TXT), and Intel Active Management Technology (AMT). When the vPro brand was launched, it was identified primarily with AMT, thus some journalists still consider AMT to be the essence of vPro.

<span class="mw-page-title-main">Intel Active Management Technology</span> Out-of-band management platform

Intel Active Management Technology (AMT) is hardware and firmware for remote out-of-band management of select business computers, running on the Intel Management Engine, a microprocessor subsystem not exposed to the user, intended for monitoring, maintenance, updating, and repairing systems. Out-of-band (OOB) or hardware-based management is different from software-based management and software management agents.

Intel Active Management Technology (AMT) is hardware-based technology built into PCs with Intel vPro technology. AMT is designed to help sys-admins remotely manage and secure PCs out-of-band when PC power is off, the operating system (OS) is unavailable (hung, crashed, corrupted, missing), software management agents are missing, or hardware (such as a hard disk drive or memory) has failed.

Absolute Home & Office is a proprietary laptop theft recovery software. The persistent security features are built into the firmware of devices. Absolute Home & Office has services of an investigations and recovery team who partners with law enforcement agencies to return laptops to their owners. Absolute Software licensed the name LoJack from the vehicle recovery service LoJack in 2005.

<span class="mw-page-title-main">Librem</span> Computer line by Purism featuring free software

Librem is a line of computers manufactured by Purism, SPC featuring free (libre) software. The laptop line is designed to protect privacy and freedom by providing no non-free (proprietary) software in the operating system or kernel, avoiding the Intel Active Management Technology, and gradually freeing and securing firmware. Librem laptops feature hardware kill switches for the microphone, webcam, Bluetooth and Wi-Fi.

<span class="mw-page-title-main">Purism (company)</span> Computer manufacturer focusing on software freedom

Purism, SPC is an American computer technology corporation based in San Francisco, California and registered in the state of Washington.

<span class="mw-page-title-main">Meltdown (security vulnerability)</span> Microprocessor security vulnerability

Meltdown is one of the two original speculative execution CPU vulnerabilities. Meltdown affects Intel x86 microprocessors, IBM Power microprocessors, and some ARM-based microprocessors. It allows a rogue process to read all memory, even when it is not authorized to do so.

<span class="mw-page-title-main">Spectre (security vulnerability)</span> Processor security vulnerability

Spectre is one of the two original speculative execution CPU vulnerabilities, which involve microarchitectural side-channel attacks. These affect modern microprocessors that perform branch prediction and other forms of speculation. On most processors, the speculative execution resulting from a branch misprediction may leave observable side effects that may reveal private data to attackers. For example, if the pattern of memory accesses performed by such speculative execution depends on private data, the resulting state of the data cache constitutes a side channel through which an attacker may be able to extract information about the private data using a timing attack.

<span class="mw-page-title-main">AMD Platform Security Processor</span> Trusted execution environment subsystem that runs on AMD microprocessors

The AMD Platform Security Processor (PSP), officially known as AMD Secure Technology, is a trusted execution environment subsystem incorporated since about 2013 into AMD microprocessors. According to an AMD developer's guide, the subsystem is "responsible for creating, monitoring and maintaining the security environment" and "its functions include managing the boot process, initializing various security related mechanisms, and monitoring the system for any suspicious activity or events and implementing an appropriate response". Critics worry it can be used as a backdoor and is a security concern. AMD has denied requests to open source the code that runs on the PSP.

Speculative Store Bypass (SSB) is the name given to a hardware security vulnerability and its exploitation that takes advantage of speculative execution in a similar way to the Meltdown and Spectre security vulnerabilities. It affects the ARM, AMD and Intel families of processors. It was discovered by researchers at Microsoft Security Response Center and Google Project Zero (GPZ). After being leaked on 3 May 2018 as part of a group of eight additional Spectre-class flaws provisionally named Spectre-NG, it was first disclosed to the public as "Variant 4" on 21 May 2018, alongside a related speculative execution vulnerability designated "Variant 3a".

<span class="mw-page-title-main">Microarchitectural Data Sampling</span> CPU vulnerabilities

The Microarchitectural Data Sampling (MDS) vulnerabilities are a set of weaknesses in Intel x86 microprocessors that use hyper-threading, and leak data across protection boundaries that are architecturally supposed to be secure. The attacks exploiting the vulnerabilities have been labeled Fallout, RIDL, ZombieLoad., and ZombieLoad 2.

Transient execution CPU vulnerabilities are vulnerabilities in which instructions, most often optimized using speculative execution, are executed temporarily by a microprocessor, without committing their results due to a misprediction or error, resulting in leaking secret data to an unauthorized party. The archetype is Spectre, and transient execution attacks like Spectre belong to the cache-attack category, one of several categories of side-channel attacks. Since January 2018 many different cache-attack vulnerabilities have been identified.

References

  1. 1 2 3 Oster, Joseph E. (September 3, 2019). "Getting Started with Intel Active Management Technology (Intel AMT)". Intel. Retrieved September 22, 2020.
  2. 1 2 "Intel AMT and the Intel ME". Intel. Archived from the original on February 21, 2019.{{cite web}}: CS1 maint: unfit URL (link)
  3. ↑ "Frequently Asked Questions for the Intel Management Engine Verification Utility". Built into many Intel Chipset–based platforms is a small, low-power computer subsystem called the Intel Management Engine (Intel ME).
  4. 1 2 3 Portnoy, Erica; Eckersley, Peter (May 8, 2017). "Intel's Management Engine is a security hazard, and users need a way to disable it". Electronic Frontier Foundation. Retrieved February 21, 2020.
  5. 1 2 3 Wallen, Jack (July 1, 2016). "Is the Intel Management Engine a backdoor?".
  6. ↑ "Frequently Asked Questions for the Intel Management Engine Verification Utility". The Intel ME performs various tasks while the system is in sleep, during the boot process, and when your system is running.
  7. ↑ "Black Hat Europe 2017". BlackHat.com.
  8. ↑ "Frequently Asked Questions for the Intel Management Engine Verification Utility". This subsystem must function correctly to get the most performance and capability from your PC.
  9. ↑ Hoffman, Chris (November 22, 2017). "Intel Management Engine, Explained: The Tiny Computer Inside Your CPU". How-To Geek.
  10. ↑ Eckersley, Erica Portnoy and Peter (May 8, 2017). "Intel's Management Engine is a security hazard, and users need a way to disable it". Electronic Frontier Foundation.
  11. 1 2 "Intel ME huffman dictionaries - Unhuffme v2.4". IO.NetGarage.org.
  12. 1 2 3 "Positive Technologies Blog: Disabling Intel ME 11 via undocumented mode". Archived from the original on August 28, 2017. Retrieved August 30, 2017.
  13. 1 2 Igor Skochinsky (Hex-Rays) Rootkit in your laptop, Ruxcon Breakpoint 2012
  14. ↑ "Intel Ethernet Controller I210 Datasheet" (PDF). Intel. 2013. pp. 1, 15, 52, 621–776. Retrieved November 9, 2013.
  15. ↑ "Intel Ethernet Controller X540 Product Brief" (PDF). Intel. 2012. Retrieved February 26, 2014.
  16. ↑ "Archived copy". Archived from the original on November 1, 2014. Retrieved February 25, 2014.{{cite web}}: CS1 maint: archived copy as title (link)
  17. ↑ "Introduction — The Linux Kernel documentation". Kernel.org.
  18. 1 2 Rutkowska, Joanna. "A Quest to the Core" (PDF). Invisiblethingslab.com. Retrieved May 25, 2016.
  19. ↑ "Archived copy" (PDF). Archived from the original (PDF) on February 11, 2014. Retrieved February 26, 2014.{{cite web}}: CS1 maint: archived copy as title (link)
  20. ↑ "Platforms II" (PDF). Users.nik.uni-obuda.hu. Retrieved May 25, 2016.
  21. 1 2 "FatTwin F618R3-FT+ F618R3-FTPT+ User's Manual" (PDF). Super Micro. The Manageability Engine, which is an ARC controller embedded in the IOH (I/O Hub), provides Server Platform Services (SPS) to your system. The services provided by SPS are different from those provided by the ME on client platforms.
  22. ↑ "Intel Xeon Processor E3-1200 v6 Product Family Product Brief". Intel. Intel Server Platform Services (Intel SPS): Designed for managing rack-mount servers, Intel Server Platform Services provides a suite of tools to control and monitor power, thermal, and resource utilization.
  23. ↑ "Intel Xeon Processor D-1500 Product Family" (PDF). Intel.
  24. ↑ "Intel Trusted Execution Engine Driver". Dell. This package provides the drivers for the Intel Trusted Execution Engine and is supported on Dell Venue 11 Pro 5130 Tablet
  25. 1 2 "Intel Trusted Execution Engine Driver for Intel NUC Kit NUC5CPYH, NUC5PPYH, NUC5PGYH". Intel. Installs the Intel Trusted Execution Engine (Intel TXE) driver and firmware for Windows 10 and Windows 7*/8.1*, 64-bit. The Intel TXE driver is required for Secure Boot and platform security features.
  26. ↑ Intel ME: The Way of the Static Analysis, Troopers 2017
  27. ↑ Positive Technologies Blog:The Way of the Static Analysis
  28. 1 2 "Intel Hardware-based Security Technologies for Intelligent Retail Devices" (PDF). Intel.
  29. ↑ "Intel Quiet System Technology 2.0: Programmer's Reference Manual" (PDF). Intel. February 2010. Retrieved August 25, 2014.
  30. ↑ "The Intel Management Engine – a Privacy Nightmare". ProPrivacy.com.
  31. ↑ September 2012, Patrick Kennedy 21 (September 21, 2012). "Intel vPro In 2012, Small Business Advantage, And Anti-Theft Tech". Tom's Hardware.{{cite web}}: CS1 maint: numeric names: authors list (link)
  32. ↑ "McAfee KB - End of Life for McAfee/Intel Anti-Theft (TS101986)". service.mcafee.com. Archived from the original on August 1, 2020. Retrieved September 10, 2020.
  33. ↑ "Using Intel AMT serial-over-LAN to the fullest". Intel.
  34. ↑ "How To Enable BitLocker With Intel PTT and No TPM For Better Security". Legit Reviews. May 8, 2019. Retrieved September 8, 2020.
  35. ↑ "MEI NFC".
  36. 1 2 "Intel Active Management Technology, Intel Small Business Technology, and Intel Standard Manageability Escalation of Privilege". Intel.com. March 17, 2020. Retrieved September 22, 2020.
  37. ↑ Charlie Demerjian (May 1, 2017). "Remote security exploit in all 2008+ Intel platforms". SemiAccurate. Retrieved May 7, 2017.
  38. 1 2 3 "Red alert! Intel patches remote execution hole that's been hidden in chips since 2010". TheRegister.co.uk. Retrieved May 7, 2017.
  39. ↑ Alaoui, Youness (October 19, 2017). "Deep dive into Intel Management Engine disablement".
  40. ↑ Alaoui, Youness (March 9, 2017). "Neutralizing the Intel Management Engine on Librem Laptops".
  41. 1 2 3 4 "Intel Patches Major Flaws in the Intel Management Engine". Extreme Tech.
  42. ↑ Claburn, Thomas (November 20, 2017). "Intel finds critical holes in secret Management Engine hidden in tons of desktop, server chipsets". The Register.
  43. 1 2 3 "Intel Management Engine pwned by buffer overflow". TheRegister.com.
  44. 1 2 "INTEL-SA-00112". Intel.
  45. ↑ "INTEL-SA-00125". Intel.
  46. ↑ "Invisible Things Lab to present two new technical presentations disclosing system-level vulnerabilities affecting modern PC hardware at its core" (PDF). Invisiblethingslab.com. Archived from the original (PDF) on April 12, 2016. Retrieved May 25, 2016.
  47. ↑ "FG Security in telecommunications : Evaluating "Ring-3" Rootkits" (PDF). Stewin.org. Archived from the original (PDF) on March 4, 2016. Retrieved May 25, 2016.
  48. ↑ "Persistent, Stealthy Remote-controlled Dedicated Hardware Malware" (PDF). Stewin.org. Archived from the original (PDF) on March 3, 2016. Retrieved May 25, 2016.
  49. ↑ "Security Evaluation of Intel's Active Management Technology" (PDF). Web.it.kth.se. Retrieved May 25, 2016.
  50. ↑ "CVE - CVE-2017-5689". Cve.mitre.org. Archived from the original on May 5, 2017. Retrieved May 7, 2017.
  51. ↑ "Intel Hidden Management Engine - x86 Security Risk?". Darknet. June 16, 2016. Retrieved May 7, 2017.
  52. ↑ Garrett, Matthew (May 1, 2017). "Intel's remote AMT vulnerablity". mjg59.dreamwidth.org. Retrieved May 7, 2017.
  53. 1 2 3 "2017-05-05 ALERT! Intel AMT EXPLOIT OUT! IT'S BAD! DISABLE AMT NOW!". Ssh.com\Accessdate=2017-05-07. Archived from the original on March 5, 2018. Retrieved November 25, 2017.
  54. ↑ Dan Goodin (May 6, 2017). "The Hijacking Flaw That Lurked in Intel Chips Is Worse than Anyone Thought". Ars Technica. Retrieved May 8, 2017.
  55. ↑ "General: BIOS updates due to Intel AMT IME vulnerability - General Hardware - Laptop - Dell Community". En.Community.Dell.com. May 2, 2017. Archived from the original on May 11, 2017. Retrieved May 7, 2017.
  56. ↑ "Advisory note: Intel Firmware vulnerability – Fujitsu Technical Support pages from Fujitsu Fujitsu Continental Europe, Middle East, Africa & India". Support.ts.fujitsu.com. May 1, 2017. Retrieved May 8, 2017.
  57. ↑ "HPE | HPE CS700 2.0 for VMware". H22208.www2.hpe.com. May 1, 2017. Archived from the original on May 8, 2017. Retrieved May 7, 2017.
  58. ↑ "Intel Security Advisory regarding escalation o... |Intel Communities". Communities.Intel.com. May 4, 2017. Retrieved May 7, 2017.
  59. ↑ "Intel Active Management Technology, Intel Small Business Technology, and Intel Standard Manageability Remote Privilege Escalation". Support.lenovo.com. Retrieved May 7, 2017.
  60. ↑ "MythBusters: CVE-2017-5689". Embedi.com. May 2, 2017. Archived from the original on August 17, 2018.
  61. ↑ Charlie Demerjian (May 1, 2017). "Remote security exploit in all 2008+ Intel platforms". SemiAccurate.com. Retrieved May 7, 2017.
  62. ↑ "Sneaky hackers use Intel management tools to bypass Windows firewall". June 9, 2017. Retrieved June 10, 2017.
  63. ↑ Tung, Liam. "Windows firewall dodged by 'hot-patching' spies using Intel AMT, says Microsoft - ZDNet". ZDNet . Retrieved June 10, 2017.
  64. ↑ "PLATINUM continues to evolve, find ways to maintain invisibility". June 7, 2017. Retrieved June 10, 2017.
  65. ↑ "Malware Uses Obscure Intel CPU Feature to Steal Data and Avoid Firewalls" . Retrieved June 10, 2017.
  66. ↑ "Hackers abuse low-level management feature for invisible backdoor". iTnews. Retrieved June 10, 2017.
  67. ↑ "Vxers exploit Intel's Active Management for malware-over-LAN • The Register". TheRegister.co.uk. Retrieved June 10, 2017.
  68. ↑ Security, heise (June 9, 2017). "Intel-Fernwartung AMT bei Angriffen auf PCs genutzt". Security. Retrieved June 10, 2017.
  69. ↑ "PLATINUM activity group file-transfer method using Intel AMT SOL". Channel 9. Retrieved June 10, 2017.
  70. ↑ "Malware Uses Obscure Intel CPU Feature to Steal Data and Avoid Firewalls". BleepingComputer.
  71. ↑ "Black Hat Europe 2017". BlackHat.com.
  72. 1 2 "Intel Management Engine Critical Firmware Update (Intel SA-00086)". Intel.
  73. 1 2 Newman, Lily Hay. "Intel Chip Flaws Leave Millions of Devices Exposed". Wired.
  74. ↑ "Intel Active Management Technology 9.x/10.x/11.x Security Review..." Intel.
  75. ↑ Cimpanu, Catalin (June 17, 2016). "Intel x86 CPUs Come with a Secret Backdoor That Nobody Can Touch or Disable". softpedia.
  76. 1 2 "Intel ME controller chip has secret kill switch". TheRegister.com.
  77. ↑ "Documents Reveal N.S.A. Campaign Against Encryption". The New York Times .
  78. ↑ "Leserforum". C't. 2018 (7): 10–11. March 16, 2018.
  79. ↑ "HDCP 2.2 Content Protection Being Worked On For The i915 DRM Driver".
  80. ↑ "HDCP 2.2 Support Updated For The Intel DRM Linux Driver".
  81. ↑ "What is Intel Management Engine and what are concerns with it regarding Librem laptops?". September 27, 2018.
  82. ↑ "Major Updates for System76 Open Firmware!". June 2, 2023.
  83. ↑ "corna/me_cleaner". September 10, 2020 – via GitHub.
  84. ↑ "Researchers Find a Way to Disable Much-Hated Intel ME Component Courtesy of the NSA". BleepingComputer.
  85. 1 2 Research, Author Positive. "Disabling Intel ME 11 via undocumented mode". Archived from the original on December 1, 2020.{{cite web}}: |first= has generic name (help)
  86. ↑ "corna/me_cleaner". GitHub. March 19, 2022.
  87. ↑ "Set the HAP bit (ME >= 11) or the AltMeDisable bit (ME < 11) · corna/me_cleaner@ced3b46". GitHub.
  88. ↑ "Libreboot T400 laptop now FSF-certified to respect your freedom — Free Software Foundation — Working together for free software". www.fsf.org. Retrieved April 30, 2023.
  89. ↑ Bärwaldt, Erik. "Liberated » Linux Magazine". Linux Magazine. Retrieved April 30, 2023.
  90. ↑ Biggs, John (August 11, 2017). "The Minifree Libreboot T400 is free as in freedom". TechCrunch. Retrieved April 30, 2023.
  91. ↑ "Petition for Intel to Release an ME-Less CPU Design". June 16, 2016. Archived from the original on June 16, 2016.
  92. ↑ Alaoui, Youness (March 9, 2017). "Neutralizing the Intel Management Engine on Librem Laptops". puri.sm. Retrieved December 13, 2017.
  93. ↑ "Purism Librem Laptops Completely Disable Intel's Management Engine". October 19, 2017.
  94. ↑ "System76 ME Firmware Updates Plan". System76 Blog. Archived from the original on August 15, 2020. Retrieved September 10, 2020.
  95. ↑ "Dell Sells PCs without Intel's Management Engine, but with Tradeoffs". ExtremeTech.com.
  96. ↑ online, heise (December 6, 2017). "Dell schaltet Intel Management Engine in Spezial-Notebooks ab" [Dell switches off Intel Management Engine in special notebooks]. heise online (in German).
  97. ↑ "Dell Latitude 14 Rugged — 5414 Series Owner's Manual". Dell.com.
  98. ↑ "TUXEDO deaktiviert Intels Management Engine - TUXEDO Computers". www.tuxedocomputers.com. Retrieved February 7, 2021.
  99. ↑ "AMD Reportedly Allows Disabling PSP Secure Processor With Latest AGESA - Phoronix". Phoronix.com. December 7, 2017. Retrieved April 16, 2019.
This page is based on this Wikipedia article
Text is available under the CC BY-SA 4.0 license; additional terms may apply.
Images, videos and audio are available under their respective licenses.