How big threat do you think Intel ME is in reality, not in theory?
How big threat do you think Intel ME is in reality, not in theory?
When it comes to Intel Management Engine, I actually think it's not a threat if you neutralize it. I mean to just set the HAP bit on it. Because if that isn't enough then that means all computers in the world which use Intel CPU can be accessed by NSA but if NSA had this much power then it seems obvious that they aren't using it and why wouldn't they use it?
There's a github project to neutralize/disbale Intel ME: https://github.com/corna/me_cleaner Disable is overwriting intel ME as much as possible with zeros, leaving only a little remaining to be able to boot the computer. The newer the intel chips are, the less likely it is to be able to disable it. But all chip sets can be neutralized which means to set the HAP bit which is an official feature. In theory we can't actually trust the HAP bit to really disable intel ME permanently. It's more like asking Intel to do what they have promised because it's proprietary. But I think it really does permanently disable it because otherwise NSA would be abusing this power.
That's why I think the newer laptop models are better because it's probably not necessary to disable, it's enough to just neutralize withthe HAP bit. And with a newer modern laptop they can have open source Embedded Controller firmware which is better than proprietary Embedded Controller firmware.
I'm interested to hear what you think as well.
Just restrict network access (both in and out) with proper (trusted) hardware firewall. It's much safer that relying on disabling / configuring etc. You can't attack what you can't reach (directly or in reverse).
IMHO Intel ME or the AMD equivalent are only relevant for state level targeted attacks. It wouldn't be wise for them to waste it on the small fries and risk having some snoopy I-have-nothing-better-to-do-with-my-life security researcher find some attack payloads.
Of course you are right to be worried and think about it. Right now the best you can do is coreboot, it allows you to disable it.
If you want to counter that risk the best is to get a computer like the nitropads (coreboot and only open source firmware, qubeos on top) https://www.nitrokey.com/news/2020/nitropad-secure-laptop-unique-tamper-detection or the ones of system76 After that, it's no use worrying too much. You could as well be hit be hit in a car crash, a seism or a tsunami could also hit you city. Don't think about it too much, just have a small plan so you are not too lost if the black swan comes for you.
Open source is not enough. It needs to be entirely free software. I recommend buying a Libreboot laptop from before 2009, they can fully disable/remove the IME and have a 100% free BIOS firmware (anything supported device with a Core Duo processor basically).
idk, never worried about it but my main computer doesn't have it so I just passively use that for important things
I choose not to think about it or include it in my mental threat model, the same way I choose to not worry about thermonuclear warheads.
If there’s some exploitable backdoor and Intel gets owned, we’re all boned and there’s nothing we can really do about it. I don’t have anti-ballistic-missile systems, and I also don’t have the capability to make an entire hardware/firmware/os from scratch.
So instead focus on the things you can control and are more likely to happen. Don’t plan for doomsday, plan for every day.
It is a huge threat just like any low level firmware. However, there isn't much you can do
Buying other hardware that you (well... not me ;) can inspect and verify, e.g RISC?
For now the performances are pretty terrible BUT one can imagine, assuming they have the right discipline and mental model doing what's actually personal on a verifiable processor, e.g browsing and reading emails, and what's not, e.g watching a TV show on another machine with CPU/GPU with an unverifiable architecture.
PS: I have a Precursor and a Banana Pi BPI-F3 with SpacemiT K1 8 core RISC-V chip and that's the main idea behind them both, i.e knowing, as a community, how it works all the way down.
The NSA tries incredibly hard to not make public which of the many many options in their toolbox are in active use at any given time. Not sure anyone outside the org can say for sure what they are and aren't using.
Why do you think the NSA is targeting you?