Hacker News Reader

Hacker News

Comment by lima | Hacker News Reader

Full thread

lima

This only disables the Windows driver.

The actual ME co-processor is still running.

View on HN

You are correct, I've updated the HN link title and post's title.

It's still rather misleading, "Completely Disable..."

I thought so too at first but I guess whereas the title now says "Completely Disable Intel AMT on Windows", it probably used to say something along the lines of "Completely Disable Intel ME on Windows".

Edit: The title has been changed again and now reads "Disabling Intel AMT on Windows". That's better and less confusing.

It's worth mentioning that on some systems it's possible to permanently disable the management engine and the MEBx extension BIOS by selecting the "Permanently Disable" option from BIOS.

Why do you think Intel doesn't let users turn it off?

Because it's a hardware backdoor in the CPU?

That's probably not the reason. At least not in the malicious sense.

There's a good chance it is since they worked with the group trying to DRM everything. The NSA was also in that group likely trying to simultaneously secure and backdoor everything. A built-in backdoor sold as a business benefit that you can't turn off at all from a defense contractor in a police state is already 90% to being malicious just by nature of the situation. So, assume it is at least for the local police state and their partners.

Now, if that's not in your threat model, then you'll probably be fine using it unless foreign adversaries are in your threat model. And the rabbit hole of how threatening are live backdoors on your network just goes on from there.

There's at least calls to remove SIGINT agency from TCG:

https://www.securitycurrent.com/en/writers/richard-stiennon/...

It's not relevant to your threat model until it leaks...

Haha. Exactly. This should be a bigger concern recently since that's what keeps happening to good, attack tools.

So I'll repeat your question:

Why do you think Intel doesn't let users turn it off?

And how would you test for that?

Unless you modified your BIOS with a SPI flasher after disassembling your device, you know it's still running :-)

It would disappear from the PCI bus.

Your commands un-provision AMT (Active Management Technology), the ME feature that apparently has a security issue. Unless you've explicitly enabled AMT, it's not provisioned anyway so this doesn't do anything.

> Your commands un-provision AMT (Active Management Technology), the ME feature that apparently has a security issue.

It disables the optional OS-side of AMT. How do we know that the vulnerability is in the OS-side? Has this been established yet?

May be worth reading the coreboot wiki, I remember reading about the different subsystems of AMT, and it seems plausible that you can set it into a state where control functions are disabled. But my memories are very blurry.

Still coreboot guys are quite experts on the matter.

Unprovisioning disables both the OS side and the hardware AMT. It doesn't change anything if you never enabled AMT.

Reply on news.ycombinator.com