Intel and AMD join up to form the x86 ecosystem advisory group to shape the future

Quoting: Marlock

QuoteTo date no one have found a shred of evidence that Intel ME or AMD PSP is used as a backdoor for anyone despite having existed for 16 years and it's not that people haven't tried to find any

except this is not a valid argument

i have just posted about the ludicrous huge gaping hole in 1st-gen Intel ME security that could let anyone do anything with vPro machines without the OS even being able to detect the action, so there is a public usable exploit PoC and there is no good way to track if it has actually been used in the wild

the only thing you can argue is that it was not put there on purpose which would make the ordeal amount to an immensely gross incompetence on the part of Intel... not really reassuring wrt later iterations of the same concept

ofc I mean "by purpose", what else could I have meant?

Quotelistened to a fixed port at the ethernet connection even while the OS wasn't booted into, and even while the main processor was off... but more importantly also while the main OS was running, prior to OS listening and handling anything

Yes that is how all remote access cards work, would be quite worthless otherwise.


Last edited by F.Ultra on 21 October 2024 at 7:16 pm UTC

Quoting: LoudTechie

Quoting: F.Ultra

Quoting: LoudTechie

Quoting: F.Ultra

Quoting: LoudTechie

Quoting: F.Ultra

Quoting: LoudTechie

Quoting: F.Ultra

Quoting: LoudTechie

Quoting: F.Ultra

Quoting: PublicNuisanceSo the companies that screw me over with Intel ME and AMD PSP are joining forces ? Consider me wanting to get off X86 to RiscV or Power9 even more than before.

yes it is popular to scare people that have no clue on how things work that these are somehow secret spy things when they in reality are nothing but managing devices for enterprise IT departments (just like how we in the server space have full on BMC cards instead).

ME is also what powers fTPM, bios signing and PlayReady drm.
These are all used to restrict your freedom to use your device how you like right now.
ME has been used by Israelian hackers to hack devices.
The procedure for using it requires you to receive an identification key from Intel based on information Intel generated, there is no indication that you can lock Intel out.
Maybe the American government isn't using it as a back door right here, right now, but the only reason we have to believe that is Intels' word.
ME is the reason modern devices can't install coreboot.

Also if it was just for remote management they would've put not such ridiculous amount of effort to counter all the efforts that have been done to remove it, because this is how it went: first you could simply remove the hardware, than they patched that and you could only remove the software, than they patched that and you couldn't, but someone found the secret government switch to turn it off and than they patched that and now the we have clean room reverse engineer it to turn it off without bricking our devices.

Also I'm not an It department and Intel knows that, because they sell a different bussiness and consumer line.
This is a feature they know I will never need, but they added it anyway.

The PlayReady drm does not use Intel ME, it uses SGX which is a completely different thing. fTPM exists only on AMD so again not Intel ME. Nor does it do bios signing.

Various hackers around the world have used every single piece of hw and sw to hack devices so not sure why Intel ME should be singled out for that reason. And for that matter I cannot find any information at all about anyone having hacked Intel ME, Israeli or otherwise, is this you confusing this with something else again or do you have any links?

You also seem a bit confused about coreboot, there are no Intel ME mechanism to prevent the installation of coreboot. The only connection between Intel ME and coreboot is that since Intel ME have it's firmware stored in the BIOS, Intel ME is disabled by coreboot since coreboot does not contain the necessary firmware.

Intel ME have never been a separate piece of hw, it have always been builtin to the cpu and it really have to be in order for it to function the way it's supposed to work.

I think that you are confusing Intel ME with TPM here since TPM started out as a separate chip and was then moved into the CPU after it was discovered that the connection between the TPM and the CPU could be eavesdropped and manipulated in a way that rendered TPM useless.

Intel ME is builtin to every single cpu since #1 Intel does not know which specific cpu a business tends to purchase for their office machines that their IT department wants to perform remote administration on and #2 it would be extremely expensive to have two separate chip fabs for non-ME and have-ME line of CPU:s of the same core design.

I would hope that people would understand that IF intel decided to put some hidden backdoor into their processors that they would have done that _hidden_ and not in a piece of hw that they openly advertise (and with complete guides on how to use like this one: Getting Started with Intel® Active Management Technology. Also to date not a single person have been able to see any Intel ME trying to communicate with the outside world (aka phone home), had this ever occurred you would not have missed it since it would have been screamed from rooftops.

In the modules section of the wikipedia BootGuard(bios signing), Protected Audio Video Path, frimware TPM(fTPM) and Secureboot(os signing) are explicitly mentioned as ME modules together with AMT(remote management feature).
You seem to be right about your playready thing though.

I'm not confusing ME with the TPM. That's why I specified it served fTPM(the f stands for firmware).
I was though conflating Coreboot with Libreboot. Libreboot/Canoeboot can't run on modern devices, because it doesn't include the properietary ME code.

The problem with the hacking, is that I can flash a new os when my os is hacked, but not a new ME.

wikipedia explanation of how Intel bootguard prevents coreboot.

Intel sells the Xeon line for enterprise applications and the I line for consumer applications they can simply only include it in Xeon processors.

The lack of phoning home is indeed the best proof we have about it not being a backdoor, which to me proofs mostly that they're not listening in on the devices of the kind of people who monitor and publish their web traffic.
Intel publishing it isn't that surprising.
Several researchers pull processors apart for new undocumented features finding something new without an explanation is really suspicious, while "we're trying to compete with openssh" is a lot less suspicious.

ok, had somehow missed that boot guard was part of ME, thanks for pointing that out. Yes XEONS are for server and workstation use but 99% of office machines are not Xeons and remote management is something that large companies use to manage their large fleet of office machines. Myself I only use the server side version (so a full BMC on Xeons and Epycs) since where I work we let every one manage their own pc as they see fit, but the servers we have in a remote location and ssh is not fun when the machine is stuck in bios, powered off or kernel hang.

Quote99% of office machines are not Xeons

: extra reason for Intel not to include enterprise specific features in them. A Xeon is an upsell(more expensive), you want those precious enterprise features, pay for them.
On the SSH point:
A. SSH is only not fun in those situations when it's not on a separate already booted controller(just like intel AMT), but that is actually quite easy to build.
Most server racks already have separate controllers.
B. Well, yes that's why they can argue it to be an attempt at competing with SSH. SSH might be free as in freedom and free beer and have more features, but it requires to set up your own separate microcontroller to manage ring 0 crashes.

Also a more generic reason I have against, "but it's for enterprise IT".
In enterprise IT the users don't own their time and/or devices any limitation of software freedoms makes sense in such a situation, because it would directly cost the one who does own these things the software freedom they get from owning these assets.
As a private buyer I do own my time/devices as such I want to control them.

Office desktops outsells consumer desktops by orders of magnitude and is where the money is for companies like Intel. Them removing ME from their consumer grade CPU:s and trying to get companies to upgrade to Xeons would only lead to one outcome: every single company would switch to AMD.

A. For at least a decennium AMD didn't have their own ME/AMT alternative(yes, it does now, but that is much later), so there would still be little reason and on the workstation devices AMD was never a real alternative anyway(, because no seller of prebuild workstation devices includes them, allegedly because intel pays them to).
B. Also Office desktops don't need the, "but I can edit the bios" feature, since there will always be someone who can follow simple instructions behind it and the os can flash the bios if you want to run an update.
For servers it's needed, because you might need to flash a new custom and unsigned bios, but for workstations you don't need that.

Edit: They included the option to turn it off for the American army, they could have simply left the option when it was discovered and used.
It required a special motherboard, so enterprise workstation devices could have avoided it easily by simply not blowing that fuse.
Residential consumers aren't an as profitable market as big enterprise contract, but they're the size of American Army contracts.

Intel added ME in 2008 and AMD added PSP in 2013 so both have had this for 11 years now, and those 5 years in between was Intel taking 100% of the company sales due to AMD not being viable here, Intel breaking that advantage by moving it to Xeons only would be an insanely stupid move.

Also this "they could not have hidden it" is kinda moot, the number of people that can scan down to nanometres AND also make some sense out of interconnections among 4.2bn transistors are easily counted and those same people would be far more capable of finding any nefarious design in the small area of the ME thanks to Intel showing exactly where on the chip it is. This whole fear mongering that it was put there due to demand from NSA was shutdown when we got the Snowden files since there isn't a trace of this there plus that it also showed that this is not how they operate, they instead perform targeted attacks where they capture hardware in transit and modify it before it reaches the customer (which is much more logical since it reduces the number of possible whistleblowers).

There are not "it can edit the bios" feature, not more than what you can do from userspace.

I can find no information on that the US army required Intel ME to be disabled. What I do know happened however is that the NSA requires that it is disabled to meet their "High Assurance Platform Mode" standard but that is not strange, that is simply them requiring all venues where code can be injected and run that is not neccessary for their operation to be disabled, in a HAP the very term remote administration is a big nono to begin with.

To date no one have found a shred of evidence that Intel ME or AMD PSP is used as a backdoor for anyone despite having existed for 16 years and it's not that people haven't tried to find any.

during that periodthey grew 6 percentand made faster chips, while when they still had market dominance, but slower chips and their competition had AMT too it cost them 10% market share..
I internally explained that with people buying faster cpus, but maybe you're right and the only feature the profitable customers care about is AMT or AMT is needed feature for faster chips.
If any of those is the case I would be quite sad, but maybe you're right.

I don't need to scan down to the silicon level to activate an option in the bios. This is a feature they disabled later when users like myself started using it.
On the ease of hiding
A. Universities have access to such ability and they publish most to all things they find.
B. Also you don't need to scan up to silicon space to find software(and you need software to keep it updateable, which they need and did for something with full control of the entire device).
C. Also it's always active, so it could've been easily detected by power draw.
Generic storage chips take quite a lot more space than a few hard wired instructions and storing it on existing chips means someone only has to scan that chip

I've personally used the permanently disable feature on my older computer where this was still an option.

QuoteThere are not "it can edit the bios" feature, not more than what you can do from userspace.

Than it has no advantage to openssh in workspace machines and as such they should make it Xeon specific.

On the backdoor question:
A. Bootguard, secureboot and drm are backdoory enough for me personally(they took control of my bios/computer).
B. Distinquishing an actively exploited vulnerability from a backdoor is really hard especially when the attacker has resources on par with intel. It has at least been actively exploited by the PLATINUM group.
C. Often western government attacks are aimed at specific targets(often called "spear fishing"), so just because the kind of people who actively publish their internet traffic aren't currently under attack doesn't mean nobody is and all the other signs are there.
All you need for AMT access is a code provided by intel(I read in on the public procedure).
They put real effort in sabotaging all removing efforts.
We didn't get access to the source code(not even source available).
It has access to the entire device.
The thing was introduced 3 years in the PRISM program(changing the fabs for new chip features costs 2 years).
(Also if you want to get truly paranoid:
For as long they only had it they made the fastest chips in the world and once that stopped they didn't, it doesn't sound like a very speed inducing feature, so maybe they got heavy R&D funding or access to classified technology from the government for introducing it.
I don't think it's the case, but it's an argument someone might use.)

The thing you have missed with PRISM is that it was leaked (on several occasions), now show me the Intel ME / AMD PSP leaks. And please show me a single university with this capability.

Quoting: F.Ultra

Quoting: LoudTechie

Quoting: F.Ultra

Quoting: LoudTechie

Quoting: F.Ultra

Quoting: LoudTechie

Quoting: F.Ultra

Quoting: LoudTechie

Quoting: F.Ultra

Quoting: LoudTechie

Quoting: F.Ultra

Quoting: PublicNuisanceSo the companies that screw me over with Intel ME and AMD PSP are joining forces ? Consider me wanting to get off X86 to RiscV or Power9 even more than before.

yes it is popular to scare people that have no clue on how things work that these are somehow secret spy things when they in reality are nothing but managing devices for enterprise IT departments (just like how we in the server space have full on BMC cards instead).

ME is also what powers fTPM, bios signing and PlayReady drm.
These are all used to restrict your freedom to use your device how you like right now.
ME has been used by Israelian hackers to hack devices.
The procedure for using it requires you to receive an identification key from Intel based on information Intel generated, there is no indication that you can lock Intel out.
Maybe the American government isn't using it as a back door right here, right now, but the only reason we have to believe that is Intels' word.
ME is the reason modern devices can't install coreboot.

Also if it was just for remote management they would've put not such ridiculous amount of effort to counter all the efforts that have been done to remove it, because this is how it went: first you could simply remove the hardware, than they patched that and you could only remove the software, than they patched that and you couldn't, but someone found the secret government switch to turn it off and than they patched that and now the we have clean room reverse engineer it to turn it off without bricking our devices.

Also I'm not an It department and Intel knows that, because they sell a different bussiness and consumer line.
This is a feature they know I will never need, but they added it anyway.

The PlayReady drm does not use Intel ME, it uses SGX which is a completely different thing. fTPM exists only on AMD so again not Intel ME. Nor does it do bios signing.

Various hackers around the world have used every single piece of hw and sw to hack devices so not sure why Intel ME should be singled out for that reason. And for that matter I cannot find any information at all about anyone having hacked Intel ME, Israeli or otherwise, is this you confusing this with something else again or do you have any links?

You also seem a bit confused about coreboot, there are no Intel ME mechanism to prevent the installation of coreboot. The only connection between Intel ME and coreboot is that since Intel ME have it's firmware stored in the BIOS, Intel ME is disabled by coreboot since coreboot does not contain the necessary firmware.

Intel ME have never been a separate piece of hw, it have always been builtin to the cpu and it really have to be in order for it to function the way it's supposed to work.

I think that you are confusing Intel ME with TPM here since TPM started out as a separate chip and was then moved into the CPU after it was discovered that the connection between the TPM and the CPU could be eavesdropped and manipulated in a way that rendered TPM useless.

Intel ME is builtin to every single cpu since #1 Intel does not know which specific cpu a business tends to purchase for their office machines that their IT department wants to perform remote administration on and #2 it would be extremely expensive to have two separate chip fabs for non-ME and have-ME line of CPU:s of the same core design.

I would hope that people would understand that IF intel decided to put some hidden backdoor into their processors that they would have done that _hidden_ and not in a piece of hw that they openly advertise (and with complete guides on how to use like this one: Getting Started with Intel® Active Management Technology. Also to date not a single person have been able to see any Intel ME trying to communicate with the outside world (aka phone home), had this ever occurred you would not have missed it since it would have been screamed from rooftops.

In the modules section of the wikipedia BootGuard(bios signing), Protected Audio Video Path, frimware TPM(fTPM) and Secureboot(os signing) are explicitly mentioned as ME modules together with AMT(remote management feature).
You seem to be right about your playready thing though.

I'm not confusing ME with the TPM. That's why I specified it served fTPM(the f stands for firmware).
I was though conflating Coreboot with Libreboot. Libreboot/Canoeboot can't run on modern devices, because it doesn't include the properietary ME code.

The problem with the hacking, is that I can flash a new os when my os is hacked, but not a new ME.

wikipedia explanation of how Intel bootguard prevents coreboot.

Intel sells the Xeon line for enterprise applications and the I line for consumer applications they can simply only include it in Xeon processors.

The lack of phoning home is indeed the best proof we have about it not being a backdoor, which to me proofs mostly that they're not listening in on the devices of the kind of people who monitor and publish their web traffic.
Intel publishing it isn't that surprising.
Several researchers pull processors apart for new undocumented features finding something new without an explanation is really suspicious, while "we're trying to compete with openssh" is a lot less suspicious.

ok, had somehow missed that boot guard was part of ME, thanks for pointing that out. Yes XEONS are for server and workstation use but 99% of office machines are not Xeons and remote management is something that large companies use to manage their large fleet of office machines. Myself I only use the server side version (so a full BMC on Xeons and Epycs) since where I work we let every one manage their own pc as they see fit, but the servers we have in a remote location and ssh is not fun when the machine is stuck in bios, powered off or kernel hang.

Quote99% of office machines are not Xeons

: extra reason for Intel not to include enterprise specific features in them. A Xeon is an upsell(more expensive), you want those precious enterprise features, pay for them.
On the SSH point:
A. SSH is only not fun in those situations when it's not on a separate already booted controller(just like intel AMT), but that is actually quite easy to build.
Most server racks already have separate controllers.
B. Well, yes that's why they can argue it to be an attempt at competing with SSH. SSH might be free as in freedom and free beer and have more features, but it requires to set up your own separate microcontroller to manage ring 0 crashes.

Also a more generic reason I have against, "but it's for enterprise IT".
In enterprise IT the users don't own their time and/or devices any limitation of software freedoms makes sense in such a situation, because it would directly cost the one who does own these things the software freedom they get from owning these assets.
As a private buyer I do own my time/devices as such I want to control them.

Office desktops outsells consumer desktops by orders of magnitude and is where the money is for companies like Intel. Them removing ME from their consumer grade CPU:s and trying to get companies to upgrade to Xeons would only lead to one outcome: every single company would switch to AMD.

A. For at least a decennium AMD didn't have their own ME/AMT alternative(yes, it does now, but that is much later), so there would still be little reason and on the workstation devices AMD was never a real alternative anyway(, because no seller of prebuild workstation devices includes them, allegedly because intel pays them to).
B. Also Office desktops don't need the, "but I can edit the bios" feature, since there will always be someone who can follow simple instructions behind it and the os can flash the bios if you want to run an update.
For servers it's needed, because you might need to flash a new custom and unsigned bios, but for workstations you don't need that.

Edit: They included the option to turn it off for the American army, they could have simply left the option when it was discovered and used.
It required a special motherboard, so enterprise workstation devices could have avoided it easily by simply not blowing that fuse.
Residential consumers aren't an as profitable market as big enterprise contract, but they're the size of American Army contracts.

Intel added ME in 2008 and AMD added PSP in 2013 so both have had this for 11 years now, and those 5 years in between was Intel taking 100% of the company sales due to AMD not being viable here, Intel breaking that advantage by moving it to Xeons only would be an insanely stupid move.

Also this "they could not have hidden it" is kinda moot, the number of people that can scan down to nanometres AND also make some sense out of interconnections among 4.2bn transistors are easily counted and those same people would be far more capable of finding any nefarious design in the small area of the ME thanks to Intel showing exactly where on the chip it is. This whole fear mongering that it was put there due to demand from NSA was shutdown when we got the Snowden files since there isn't a trace of this there plus that it also showed that this is not how they operate, they instead perform targeted attacks where they capture hardware in transit and modify it before it reaches the customer (which is much more logical since it reduces the number of possible whistleblowers).

There are not "it can edit the bios" feature, not more than what you can do from userspace.

I can find no information on that the US army required Intel ME to be disabled. What I do know happened however is that the NSA requires that it is disabled to meet their "High Assurance Platform Mode" standard but that is not strange, that is simply them requiring all venues where code can be injected and run that is not neccessary for their operation to be disabled, in a HAP the very term remote administration is a big nono to begin with.

To date no one have found a shred of evidence that Intel ME or AMD PSP is used as a backdoor for anyone despite having existed for 16 years and it's not that people haven't tried to find any.

during that periodthey grew 6 percentand made faster chips, while when they still had market dominance, but slower chips and their competition had AMT too it cost them 10% market share..
I internally explained that with people buying faster cpus, but maybe you're right and the only feature the profitable customers care about is AMT or AMT is needed feature for faster chips.
If any of those is the case I would be quite sad, but maybe you're right.

I don't need to scan down to the silicon level to activate an option in the bios. This is a feature they disabled later when users like myself started using it.
On the ease of hiding
A. Universities have access to such ability and they publish most to all things they find.
B. Also you don't need to scan up to silicon space to find software(and you need software to keep it updateable, which they need and did for something with full control of the entire device).
C. Also it's always active, so it could've been easily detected by power draw.
Generic storage chips take quite a lot more space than a few hard wired instructions and storing it on existing chips means someone only has to scan that chip

I've personally used the permanently disable feature on my older computer where this was still an option.

QuoteThere are not "it can edit the bios" feature, not more than what you can do from userspace.

Than it has no advantage to openssh in workspace machines and as such they should make it Xeon specific.

On the backdoor question:
A. Bootguard, secureboot and drm are backdoory enough for me personally(they took control of my bios/computer).
B. Distinquishing an actively exploited vulnerability from a backdoor is really hard especially when the attacker has resources on par with intel. It has at least been actively exploited by the PLATINUM group.
C. Often western government attacks are aimed at specific targets(often called "spear fishing"), so just because the kind of people who actively publish their internet traffic aren't currently under attack doesn't mean nobody is and all the other signs are there.
All you need for AMT access is a code provided by intel(I read in on the public procedure).
They put real effort in sabotaging all removing efforts.
We didn't get access to the source code(not even source available).
It has access to the entire device.
The thing was introduced 3 years in the PRISM program(changing the fabs for new chip features costs 2 years).
(Also if you want to get truly paranoid:
For as long they only had it they made the fastest chips in the world and once that stopped they didn't, it doesn't sound like a very speed inducing feature, so maybe they got heavy R&D funding or access to classified technology from the government for introducing it.
I don't think it's the case, but it's an argument someone might use.)

The thing you have missed with PRISM is that it was leaked (on several occasions), now show me the Intel ME / AMD PSP leaks. And please show me a single university with this capability.

Holy quote tree!

Quoting: F.Ultra

Quoting: LoudTechie

Quoting: F.Ultra

Quoting: LoudTechie

Quoting: F.Ultra

Quoting: LoudTechie

Quoting: F.Ultra

Quoting: LoudTechie

Quoting: F.Ultra

Quoting: LoudTechie

Quoting: F.Ultra

Quoting: PublicNuisanceSo the companies that screw me over with Intel ME and AMD PSP are joining forces ? Consider me wanting to get off X86 to RiscV or Power9 even more than before.

yes it is popular to scare people that have no clue on how things work that these are somehow secret spy things when they in reality are nothing but managing devices for enterprise IT departments (just like how we in the server space have full on BMC cards instead).

ME is also what powers fTPM, bios signing and PlayReady drm.
These are all used to restrict your freedom to use your device how you like right now.
ME has been used by Israelian hackers to hack devices.
The procedure for using it requires you to receive an identification key from Intel based on information Intel generated, there is no indication that you can lock Intel out.
Maybe the American government isn't using it as a back door right here, right now, but the only reason we have to believe that is Intels' word.
ME is the reason modern devices can't install coreboot.

Also if it was just for remote management they would've put not such ridiculous amount of effort to counter all the efforts that have been done to remove it, because this is how it went: first you could simply remove the hardware, than they patched that and you could only remove the software, than they patched that and you couldn't, but someone found the secret government switch to turn it off and than they patched that and now the we have clean room reverse engineer it to turn it off without bricking our devices.

Also I'm not an It department and Intel knows that, because they sell a different bussiness and consumer line.
This is a feature they know I will never need, but they added it anyway.

The PlayReady drm does not use Intel ME, it uses SGX which is a completely different thing. fTPM exists only on AMD so again not Intel ME. Nor does it do bios signing.

Various hackers around the world have used every single piece of hw and sw to hack devices so not sure why Intel ME should be singled out for that reason. And for that matter I cannot find any information at all about anyone having hacked Intel ME, Israeli or otherwise, is this you confusing this with something else again or do you have any links?

You also seem a bit confused about coreboot, there are no Intel ME mechanism to prevent the installation of coreboot. The only connection between Intel ME and coreboot is that since Intel ME have it's firmware stored in the BIOS, Intel ME is disabled by coreboot since coreboot does not contain the necessary firmware.

Intel ME have never been a separate piece of hw, it have always been builtin to the cpu and it really have to be in order for it to function the way it's supposed to work.

I think that you are confusing Intel ME with TPM here since TPM started out as a separate chip and was then moved into the CPU after it was discovered that the connection between the TPM and the CPU could be eavesdropped and manipulated in a way that rendered TPM useless.

Intel ME is builtin to every single cpu since #1 Intel does not know which specific cpu a business tends to purchase for their office machines that their IT department wants to perform remote administration on and #2 it would be extremely expensive to have two separate chip fabs for non-ME and have-ME line of CPU:s of the same core design.

I would hope that people would understand that IF intel decided to put some hidden backdoor into their processors that they would have done that _hidden_ and not in a piece of hw that they openly advertise (and with complete guides on how to use like this one: Getting Started with Intel® Active Management Technology. Also to date not a single person have been able to see any Intel ME trying to communicate with the outside world (aka phone home), had this ever occurred you would not have missed it since it would have been screamed from rooftops.

In the modules section of the wikipedia BootGuard(bios signing), Protected Audio Video Path, frimware TPM(fTPM) and Secureboot(os signing) are explicitly mentioned as ME modules together with AMT(remote management feature).
You seem to be right about your playready thing though.

I'm not confusing ME with the TPM. That's why I specified it served fTPM(the f stands for firmware).
I was though conflating Coreboot with Libreboot. Libreboot/Canoeboot can't run on modern devices, because it doesn't include the properietary ME code.

The problem with the hacking, is that I can flash a new os when my os is hacked, but not a new ME.

wikipedia explanation of how Intel bootguard prevents coreboot.

Intel sells the Xeon line for enterprise applications and the I line for consumer applications they can simply only include it in Xeon processors.

The lack of phoning home is indeed the best proof we have about it not being a backdoor, which to me proofs mostly that they're not listening in on the devices of the kind of people who monitor and publish their web traffic.
Intel publishing it isn't that surprising.
Several researchers pull processors apart for new undocumented features finding something new without an explanation is really suspicious, while "we're trying to compete with openssh" is a lot less suspicious.

ok, had somehow missed that boot guard was part of ME, thanks for pointing that out. Yes XEONS are for server and workstation use but 99% of office machines are not Xeons and remote management is something that large companies use to manage their large fleet of office machines. Myself I only use the server side version (so a full BMC on Xeons and Epycs) since where I work we let every one manage their own pc as they see fit, but the servers we have in a remote location and ssh is not fun when the machine is stuck in bios, powered off or kernel hang.

Quote99% of office machines are not Xeons

: extra reason for Intel not to include enterprise specific features in them. A Xeon is an upsell(more expensive), you want those precious enterprise features, pay for them.
On the SSH point:
A. SSH is only not fun in those situations when it's not on a separate already booted controller(just like intel AMT), but that is actually quite easy to build.
Most server racks already have separate controllers.
B. Well, yes that's why they can argue it to be an attempt at competing with SSH. SSH might be free as in freedom and free beer and have more features, but it requires to set up your own separate microcontroller to manage ring 0 crashes.

Also a more generic reason I have against, "but it's for enterprise IT".
In enterprise IT the users don't own their time and/or devices any limitation of software freedoms makes sense in such a situation, because it would directly cost the one who does own these things the software freedom they get from owning these assets.
As a private buyer I do own my time/devices as such I want to control them.

Office desktops outsells consumer desktops by orders of magnitude and is where the money is for companies like Intel. Them removing ME from their consumer grade CPU:s and trying to get companies to upgrade to Xeons would only lead to one outcome: every single company would switch to AMD.

A. For at least a decennium AMD didn't have their own ME/AMT alternative(yes, it does now, but that is much later), so there would still be little reason and on the workstation devices AMD was never a real alternative anyway(, because no seller of prebuild workstation devices includes them, allegedly because intel pays them to).
B. Also Office desktops don't need the, "but I can edit the bios" feature, since there will always be someone who can follow simple instructions behind it and the os can flash the bios if you want to run an update.
For servers it's needed, because you might need to flash a new custom and unsigned bios, but for workstations you don't need that.

Edit: They included the option to turn it off for the American army, they could have simply left the option when it was discovered and used.
It required a special motherboard, so enterprise workstation devices could have avoided it easily by simply not blowing that fuse.
Residential consumers aren't an as profitable market as big enterprise contract, but they're the size of American Army contracts.

Intel added ME in 2008 and AMD added PSP in 2013 so both have had this for 11 years now, and those 5 years in between was Intel taking 100% of the company sales due to AMD not being viable here, Intel breaking that advantage by moving it to Xeons only would be an insanely stupid move.

Also this "they could not have hidden it" is kinda moot, the number of people that can scan down to nanometres AND also make some sense out of interconnections among 4.2bn transistors are easily counted and those same people would be far more capable of finding any nefarious design in the small area of the ME thanks to Intel showing exactly where on the chip it is. This whole fear mongering that it was put there due to demand from NSA was shutdown when we got the Snowden files since there isn't a trace of this there plus that it also showed that this is not how they operate, they instead perform targeted attacks where they capture hardware in transit and modify it before it reaches the customer (which is much more logical since it reduces the number of possible whistleblowers).

There are not "it can edit the bios" feature, not more than what you can do from userspace.

I can find no information on that the US army required Intel ME to be disabled. What I do know happened however is that the NSA requires that it is disabled to meet their "High Assurance Platform Mode" standard but that is not strange, that is simply them requiring all venues where code can be injected and run that is not neccessary for their operation to be disabled, in a HAP the very term remote administration is a big nono to begin with.

To date no one have found a shred of evidence that Intel ME or AMD PSP is used as a backdoor for anyone despite having existed for 16 years and it's not that people haven't tried to find any.

during that periodthey grew 6 percentand made faster chips, while when they still had market dominance, but slower chips and their competition had AMT too it cost them 10% market share..
I internally explained that with people buying faster cpus, but maybe you're right and the only feature the profitable customers care about is AMT or AMT is needed feature for faster chips.
If any of those is the case I would be quite sad, but maybe you're right.

I don't need to scan down to the silicon level to activate an option in the bios. This is a feature they disabled later when users like myself started using it.
On the ease of hiding
A. Universities have access to such ability and they publish most to all things they find.
B. Also you don't need to scan up to silicon space to find software(and you need software to keep it updateable, which they need and did for something with full control of the entire device).
C. Also it's always active, so it could've been easily detected by power draw.
Generic storage chips take quite a lot more space than a few hard wired instructions and storing it on existing chips means someone only has to scan that chip

I've personally used the permanently disable feature on my older computer where this was still an option.

QuoteThere are not "it can edit the bios" feature, not more than what you can do from userspace.

Than it has no advantage to openssh in workspace machines and as such they should make it Xeon specific.

On the backdoor question:
A. Bootguard, secureboot and drm are backdoory enough for me personally(they took control of my bios/computer).
B. Distinquishing an actively exploited vulnerability from a backdoor is really hard especially when the attacker has resources on par with intel. It has at least been actively exploited by the PLATINUM group.
C. Often western government attacks are aimed at specific targets(often called "spear fishing"), so just because the kind of people who actively publish their internet traffic aren't currently under attack doesn't mean nobody is and all the other signs are there.
All you need for AMT access is a code provided by intel(I read in on the public procedure).
They put real effort in sabotaging all removing efforts.
We didn't get access to the source code(not even source available).
It has access to the entire device.
The thing was introduced 3 years in the PRISM program(changing the fabs for new chip features costs 2 years).
(Also if you want to get truly paranoid:
For as long they only had it they made the fastest chips in the world and once that stopped they didn't, it doesn't sound like a very speed inducing feature, so maybe they got heavy R&D funding or access to classified technology from the government for introducing it.
I don't think it's the case, but it's an argument someone might use.)

The thing you have missed with PRISM is that it was leaked (on several occasions), now show me the Intel ME / AMD PSP leaks. And please show me a single university with this capability.

harvard can do it, without destroying the chip.
This is a paper by an academic who introduces extra methods to reverse engineer chips(which is what this is.
These academics innovated in the space
These guys innovated a way without fancy equipment for always on hardware trojans(the only possible difference between IntelME and a hardware Trojan anybody has been able to present to me is intent, which isn't a property this method exploits, so it could also be used to detect IntelME)
The university of Wyonming can do it at least destructive.
A moment capture of the state of technology on this question.
These academics actually went looking for hardware trojans.
This academic published an AI model for it(you know how much data is needed for AI).


On the part where you demand proof for the obviously classified information: "does Intel spy for a government?"
The person in charge of PRISM met with the leaked companies and you guessed it Intel.
Although this could only have been a government contract negotiation, you've to remember that seem to be the places where the government demands backdoors.

On the, "but it would have leaked" part.
So, because Intel and AMD can look after their own intel they're not spies.
PRISM would've still existed had it not leaked and the only thing that was leaked was a bunch of (quite damning)executive summary slides.
The laws needed for it apply to Intel and AMD too(those one sided codes can be demanded under the FISA).
They already introduced a feature to keep us locked to Windows and Microsoft was mentioned in the PRISM leak and windows spies on its users.
Apple, Microsoft and Meta never leaked about their government spying either, the government did, if those companies did it before the government they would be in violation of the FISA.
Microsoft is one of the few to admit sharing data with the government after the leak, dropbox denies it to this day, while they were explicitly mentioned.
The dumb program of the CIA that assumed that LSD was the key to mind control(It's not) was never leaked, just declassified and took a lot more decades than PRISM and it directly endangered interfered with the life of those keeping it a secret contrary to PRISM.

I do have criticism on the demand for airtight proof for "Intel spies for the government":
Intel and the secret service are very secretive and I've already shown they're contractually(American army turn off switch for Intel ME) close related to Intel ME.
I'm neither a cooperate spy nor an intelligence officer and even if I was I would be limited to using publicly and semi-legally accessible sources and this would obviously be Top Secret and not older than 2007(start of FISA/PRISM).
You expect me to with just 17 years of public information obtain Top Secret information in a form that would be admissible in court and probably cannot be extracted through purely technical means about a manufacturer of devices I cannot safely inspect without violating copyright law(DMCA and drm keys) and has access to some of the most advanced technical means on the entire planet. Also this information is classified by an army that does 45% of all global spending on military in the world.
All coming from the same country whose police concludes that someone spreading indicting information about a powerful company committed suicide with a gun he didn't touch(no gloves and no fingerprints) and where whistleblowers about aerospace companies need witness protection at all.
The press got lucky with the Snowden leaks: the NSA was sloppy and he was brave/stupid.
That's the kind of information that is rare.
If I had that kind of capabilities I wouldn't be studying IT and bothering myself with small targets like Intel ME. I would either be working as a spy or a private investigator for human rights organizations.
Personally I keep the rule:
If the market capacity(Intel has a serious market share), capability(AMT), leverage(FISA and government subsidies like the CHIPS act) and contractual connections(off switch American army and visit PRISM guy) exists, the spying exists until proven otherwise.
I know a judge would require more for an actual conviction, although I believe it would be enough to warrant an official investigation if this violated the law at all(which thanks to FISA it doesn't in the USA. One could try it at an European court though with false advertising accusations. ).
The meeting between Intel representatives and PRISM representatives and the precedent of the Snowden Leaks and the export restricions(the USA can force changes to the products Intel sells. The only thing that can be twisted about is whether this involves security changes) are just a cherry on top in my eyes, these people know phones and the postal service exist they don't need to directly talk to each other to achieve this.


Another way Intel could've easily avoided having to include the ME everywhere:
is one of the ways they limit who can use it right now. If you want to be the one activating an AMT connection you need a vpro device. Intel could have used the same tech to lock the entire feature to the vpro line.(you've to buy vpro computers anyway if you want to use it, they could even have introduced a premium and non-premium version of vpro through binning.)

Other fun timing coincidence I just realised: AMD released psp in the same year as the Snowden Leaks came out 2013.
I don't think this is because of the Snowden leaks(they would've had to have it ready for years if that's how they played it).


Last edited by LoudTechie on 22 October 2024 at 8:43 pm UTC

Quoting: BlackBloodRum

Quoting: F.Ultra

Quoting: LoudTechie

Quoting: F.Ultra

Quoting: LoudTechie

Quoting: F.Ultra

Quoting: LoudTechie

Quoting: F.Ultra

Quoting: LoudTechie

Quoting: F.Ultra

Quoting: LoudTechie

Quoting: F.Ultra

Quoting: PublicNuisanceSo the companies that screw me over with Intel ME and AMD PSP are joining forces ? Consider me wanting to get off X86 to RiscV or Power9 even more than before.

yes it is popular to scare people that have no clue on how things work that these are somehow secret spy things when they in reality are nothing but managing devices for enterprise IT departments (just like how we in the server space have full on BMC cards instead).

ME is also what powers fTPM, bios signing and PlayReady drm.
These are all used to restrict your freedom to use your device how you like right now.
ME has been used by Israelian hackers to hack devices.
The procedure for using it requires you to receive an identification key from Intel based on information Intel generated, there is no indication that you can lock Intel out.
Maybe the American government isn't using it as a back door right here, right now, but the only reason we have to believe that is Intels' word.
ME is the reason modern devices can't install coreboot.

Also if it was just for remote management they would've put not such ridiculous amount of effort to counter all the efforts that have been done to remove it, because this is how it went: first you could simply remove the hardware, than they patched that and you could only remove the software, than they patched that and you couldn't, but someone found the secret government switch to turn it off and than they patched that and now the we have clean room reverse engineer it to turn it off without bricking our devices.

Also I'm not an It department and Intel knows that, because they sell a different bussiness and consumer line.
This is a feature they know I will never need, but they added it anyway.

The PlayReady drm does not use Intel ME, it uses SGX which is a completely different thing. fTPM exists only on AMD so again not Intel ME. Nor does it do bios signing.

Various hackers around the world have used every single piece of hw and sw to hack devices so not sure why Intel ME should be singled out for that reason. And for that matter I cannot find any information at all about anyone having hacked Intel ME, Israeli or otherwise, is this you confusing this with something else again or do you have any links?

You also seem a bit confused about coreboot, there are no Intel ME mechanism to prevent the installation of coreboot. The only connection between Intel ME and coreboot is that since Intel ME have it's firmware stored in the BIOS, Intel ME is disabled by coreboot since coreboot does not contain the necessary firmware.

Intel ME have never been a separate piece of hw, it have always been builtin to the cpu and it really have to be in order for it to function the way it's supposed to work.

I think that you are confusing Intel ME with TPM here since TPM started out as a separate chip and was then moved into the CPU after it was discovered that the connection between the TPM and the CPU could be eavesdropped and manipulated in a way that rendered TPM useless.

Intel ME is builtin to every single cpu since #1 Intel does not know which specific cpu a business tends to purchase for their office machines that their IT department wants to perform remote administration on and #2 it would be extremely expensive to have two separate chip fabs for non-ME and have-ME line of CPU:s of the same core design.

I would hope that people would understand that IF intel decided to put some hidden backdoor into their processors that they would have done that _hidden_ and not in a piece of hw that they openly advertise (and with complete guides on how to use like this one: Getting Started with Intel® Active Management Technology. Also to date not a single person have been able to see any Intel ME trying to communicate with the outside world (aka phone home), had this ever occurred you would not have missed it since it would have been screamed from rooftops.

In the modules section of the wikipedia BootGuard(bios signing), Protected Audio Video Path, frimware TPM(fTPM) and Secureboot(os signing) are explicitly mentioned as ME modules together with AMT(remote management feature).
You seem to be right about your playready thing though.

I'm not confusing ME with the TPM. That's why I specified it served fTPM(the f stands for firmware).
I was though conflating Coreboot with Libreboot. Libreboot/Canoeboot can't run on modern devices, because it doesn't include the properietary ME code.

The problem with the hacking, is that I can flash a new os when my os is hacked, but not a new ME.

wikipedia explanation of how Intel bootguard prevents coreboot.

Intel sells the Xeon line for enterprise applications and the I line for consumer applications they can simply only include it in Xeon processors.

The lack of phoning home is indeed the best proof we have about it not being a backdoor, which to me proofs mostly that they're not listening in on the devices of the kind of people who monitor and publish their web traffic.
Intel publishing it isn't that surprising.
Several researchers pull processors apart for new undocumented features finding something new without an explanation is really suspicious, while "we're trying to compete with openssh" is a lot less suspicious.

ok, had somehow missed that boot guard was part of ME, thanks for pointing that out. Yes XEONS are for server and workstation use but 99% of office machines are not Xeons and remote management is something that large companies use to manage their large fleet of office machines. Myself I only use the server side version (so a full BMC on Xeons and Epycs) since where I work we let every one manage their own pc as they see fit, but the servers we have in a remote location and ssh is not fun when the machine is stuck in bios, powered off or kernel hang.

Quote99% of office machines are not Xeons

: extra reason for Intel not to include enterprise specific features in them. A Xeon is an upsell(more expensive), you want those precious enterprise features, pay for them.
On the SSH point:
A. SSH is only not fun in those situations when it's not on a separate already booted controller(just like intel AMT), but that is actually quite easy to build.
Most server racks already have separate controllers.
B. Well, yes that's why they can argue it to be an attempt at competing with SSH. SSH might be free as in freedom and free beer and have more features, but it requires to set up your own separate microcontroller to manage ring 0 crashes.

Also a more generic reason I have against, "but it's for enterprise IT".
In enterprise IT the users don't own their time and/or devices any limitation of software freedoms makes sense in such a situation, because it would directly cost the one who does own these things the software freedom they get from owning these assets.
As a private buyer I do own my time/devices as such I want to control them.

Office desktops outsells consumer desktops by orders of magnitude and is where the money is for companies like Intel. Them removing ME from their consumer grade CPU:s and trying to get companies to upgrade to Xeons would only lead to one outcome: every single company would switch to AMD.

A. For at least a decennium AMD didn't have their own ME/AMT alternative(yes, it does now, but that is much later), so there would still be little reason and on the workstation devices AMD was never a real alternative anyway(, because no seller of prebuild workstation devices includes them, allegedly because intel pays them to).
B. Also Office desktops don't need the, "but I can edit the bios" feature, since there will always be someone who can follow simple instructions behind it and the os can flash the bios if you want to run an update.
For servers it's needed, because you might need to flash a new custom and unsigned bios, but for workstations you don't need that.

Edit: They included the option to turn it off for the American army, they could have simply left the option when it was discovered and used.
It required a special motherboard, so enterprise workstation devices could have avoided it easily by simply not blowing that fuse.
Residential consumers aren't an as profitable market as big enterprise contract, but they're the size of American Army contracts.

Intel added ME in 2008 and AMD added PSP in 2013 so both have had this for 11 years now, and those 5 years in between was Intel taking 100% of the company sales due to AMD not being viable here, Intel breaking that advantage by moving it to Xeons only would be an insanely stupid move.

Also this "they could not have hidden it" is kinda moot, the number of people that can scan down to nanometres AND also make some sense out of interconnections among 4.2bn transistors are easily counted and those same people would be far more capable of finding any nefarious design in the small area of the ME thanks to Intel showing exactly where on the chip it is. This whole fear mongering that it was put there due to demand from NSA was shutdown when we got the Snowden files since there isn't a trace of this there plus that it also showed that this is not how they operate, they instead perform targeted attacks where they capture hardware in transit and modify it before it reaches the customer (which is much more logical since it reduces the number of possible whistleblowers).

There are not "it can edit the bios" feature, not more than what you can do from userspace.

I can find no information on that the US army required Intel ME to be disabled. What I do know happened however is that the NSA requires that it is disabled to meet their "High Assurance Platform Mode" standard but that is not strange, that is simply them requiring all venues where code can be injected and run that is not neccessary for their operation to be disabled, in a HAP the very term remote administration is a big nono to begin with.

To date no one have found a shred of evidence that Intel ME or AMD PSP is used as a backdoor for anyone despite having existed for 16 years and it's not that people haven't tried to find any.

during that periodthey grew 6 percentand made faster chips, while when they still had market dominance, but slower chips and their competition had AMT too it cost them 10% market share..
I internally explained that with people buying faster cpus, but maybe you're right and the only feature the profitable customers care about is AMT or AMT is needed feature for faster chips.
If any of those is the case I would be quite sad, but maybe you're right.

I don't need to scan down to the silicon level to activate an option in the bios. This is a feature they disabled later when users like myself started using it.
On the ease of hiding
A. Universities have access to such ability and they publish most to all things they find.
B. Also you don't need to scan up to silicon space to find software(and you need software to keep it updateable, which they need and did for something with full control of the entire device).
C. Also it's always active, so it could've been easily detected by power draw.
Generic storage chips take quite a lot more space than a few hard wired instructions and storing it on existing chips means someone only has to scan that chip

I've personally used the permanently disable feature on my older computer where this was still an option.

QuoteThere are not "it can edit the bios" feature, not more than what you can do from userspace.

Than it has no advantage to openssh in workspace machines and as such they should make it Xeon specific.

On the backdoor question:
A. Bootguard, secureboot and drm are backdoory enough for me personally(they took control of my bios/computer).
B. Distinquishing an actively exploited vulnerability from a backdoor is really hard especially when the attacker has resources on par with intel. It has at least been actively exploited by the PLATINUM group.
C. Often western government attacks are aimed at specific targets(often called "spear fishing"), so just because the kind of people who actively publish their internet traffic aren't currently under attack doesn't mean nobody is and all the other signs are there.
All you need for AMT access is a code provided by intel(I read in on the public procedure).
They put real effort in sabotaging all removing efforts.
We didn't get access to the source code(not even source available).
It has access to the entire device.
The thing was introduced 3 years in the PRISM program(changing the fabs for new chip features costs 2 years).
(Also if you want to get truly paranoid:
For as long they only had it they made the fastest chips in the world and once that stopped they didn't, it doesn't sound like a very speed inducing feature, so maybe they got heavy R&D funding or access to classified technology from the government for introducing it.
I don't think it's the case, but it's an argument someone might use.)

The thing you have missed with PRISM is that it was leaked (on several occasions), now show me the Intel ME / AMD PSP leaks. And please show me a single university with this capability.

Holy quote tree!

Yeah It's my shame.
I can't resist it.
What I should have done was let them have the last word, but I didn't, because I can't resist flexing my web search skills and am quite addicted to the smug feeling I get from being convinced that I'm right.
Also they're the first actual AMT user I've encountered in my life, so their perspective is actually quite refreshing.


Last edited by LoudTechie on 22 October 2024 at 8:26 pm UTC