Hacker News Reader

Comment by kakarot | Hacker News Reader

Exploiting vPro / AMT / any remote access mechanism from any chip maker is hardly a new idea.

AMT and AMD's equivalent (don't remember the name) has been a holy grail for security researchers and malware authors alike for many years. People have been begging Intel for a very long time to make business-tier chips without remote access capabilities.

For personal computing, at least we have enthusiast chips. For example, my i7 K model lacks the technology.

EDIT: AMD's remote tech is called Platform Security Processor (PSP). Thank you, jacquesm!

View on HN

> People have been begging Intel for a very long time to make business-tier chips without remote access capabilities.

Yes. But somehow, any time anyone brings up wanting a device without one, people start poo-pooing the idea. "Just don't use it." "That's paranoid." "Just another CVE, yawn."

In a ton of discussions over the years, I have yet to hear a single plausible, benign reason for why the ME's 30 minute timer must be impossible to disable by the owner of the chip.

Who knows if the feature is not still present in silicon but just software-disabled?

It's not really new that Intel and AMD do binning to get more yield.

It isn't present AFAIK, because Intel cuts corners on enthusiast chips they do not expect to be used in a networked environment in order to save money, and still charge you more than the non-enthusiast counterparts.

Ah okay. I thought that Intel bins everything from high-grade Xeon to i3 from the same silicon to save costs.

I couldn't truly say whether Intel bins all of their processors with the same prefab or not, I'm not sure how to find this out either.

My working theory however is that since my chip lacks vPRO / AMT and I have not been able to find any indication it exists on the chip even in a dormant state, there may be more than one prefab used for binning.

However they could be using the same prefab for all.

Thus, "AFAIK".

ME is there (ability to execute below ring -1). Go ahead and check it right now, look at lspci/device manager for Management Engine Communications device. Its present on cheapest desktop H81 motherboards, and on highend (at the time) Z87 ones, no matter the cpu.

I have done that before, and I've just done it again, and I don't get anything. The only thing present on my system related to ME afaik is the MEI linux driver, which is pretty useless without a ME to talk to.

According to ARK [0], vPRO is absent. I have done various other system queries and nothing has turned up.

Anything else you want me to query? And where do you get this information that ME is present in all chips? Having a motherboard that supports ME is irrelevant, if the chip has no ME.

[0] https://ark.intel.com/products/88195/Intel-Core-i7-6700K-Pro...

https://github.com/zamaudio/intelmetool

sudo intelmetool -s

Im pretty sure Intel BootGuard is ME based

I'll check this out tonight, thanks!

ME is always there even if you don't have any of its features.

See my comment here: https://news.ycombinator.com/item?id=14522172

Same questions apply to you. This is something I would like to be proved wrong on, as I don't want a false since of security.

AMD's PSP does not have any remote access mechanism though, and it is powered off along with the processor.

> don't remember the name

PSP: Platform Security Processor

Reply on news.ycombinator.com