Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

IIRC, on most modern intel cpus removing/blanking the ME will reboot the machine every 20 minutes or so. It is unfortunately an irremovable OEM hardware RAT on most modern systems.

That being said, there are some versions of BIOS that do allow turning the ME off, but most motherboard and laptop manufacturers will not allow general consumers to install that version of the firmware. There are some groups that have figured out how to sign a patched fully feature-unlocked BIOS on a per machine basis (disabling ME is a simple Y/N flag), but YMMV given these tools are nearly impossible to get working.

AMD should end the clown show of RATs, and eat the remaining Intel market. =3



I was under the impression some boutique Linux laptop manufacturers like System76 and StarLabs flashed Coreboot.


Indeed, they used the coreboot nvramtool to set the disable IME flag.

It's still there, but unlike most consumer BIOS can apparently be turned off (whatever that means to Intel.)

Personally, I don't hold a lot of hope outdated on-chip minix OS can't be exploited/activated anyway. =3


This was on a Core 2 duo, the last generation where it could be totally removed.


> IIRC, on most modern intel cpus removing/blanking the ME will reboot the machine every 20 minutes or so. It is unfortunately an irremovable OEM hardware RAT on most modern systems.

Yes, if ME detects a problem when initializing it grants you a 20 minute window as a grace period, presumably to allow users to attempt to fix it.

> There are some groups that have figured out how to sign a patched fully feature-unlocked BIOS on a per machine basis (disabling ME is a simple Y/N flag), but YMMV given these tools are nearly impossible to get working.

You can also just flip the HAP bit[0], I'd assume that's what those advanced (usually leaked dev build) BIOS firmwares do anyway.

> AMD should end the clown show of RATs, and eat the remaining Intel market. =3

AMD has PSP[1], which is functionally equivalent (though with a significantly smaller attack surface, when left enabled)

I personally am of the belief that both technologies are likely backdoored. There's so much pointing against them[2], that the simplest explanation is they're more likely than not a mandated backdoor that chipmakers eventually expanded for other purposes (such as recent versions of ME handling suspend-related power management)

[0] https://github.com/corna/me_cleaner/wiki/HAP-AltMeDisable-bi...

[1] https://en.m.wikipedia.org/wiki/AMD_Platform_Security_Proces...

[2] https://en.m.wikipedia.org/wiki/Intel_Management_Engine#Asse...


Computrace was replaced by the Absolute BIOS module, so yes... 100% RAT features have been active for sometime. Whatever legitimate asset recovery and remote drive deletion features it offers, is superseded by potential backdoors on the refurbished PC market.

This is why we can't have nice things. =3


The AMD equivalent is the PSL, right? Can that be disabled on any CPUs?


I am unaware of the PSL, but I know AMD PSP is the equivalent to ME for most AMD chips [0].

Some motherboards allow you to disable it, and it doesn't do as much as ME in the first place (no network modules or built-in remote access purpose like ME)

[0] https://en.m.wikipedia.org/wiki/AMD_Platform_Security_Proces...


Typo, I meant PSP.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: