It's Now Possible To Disable & Strip Down Intel's ME Blob

[sarfarazahmad]

sarfarazahmad lol, you do know that ryzen will have PSP right? It's basically ME: https://libreboot.org/faq/#amdpsp

haha there go my hopes down the toilet. Can we have an arm Computer without such proprietary blobs ? is that possible ?

[Las_]

sarfarazahmad lol, you do know that ryzen will have PSP right? It's basically ME: https://libreboot.org/faq/#amdpsp

[sarfarazahmad]

Intel ME. one more reason to look forward to ryzen. (keep reminding myself that). I think I got it, a cool ryzen/vega based System76 laptop could last me a few years.

[ssokolow]

Intel ME actually has a very good purpose for IT guys and it's not for spying your dumbasses. Leave it alone don't fuck with it, the moron who created that stuff will probably get his ass sued by Intel and get badly fucked. If they want to spy on you you are already fucked. Disabling Intel ME isn't gonna change shit. Be smart! Don't be a conspiracy nutjob. Dumb kids have too much time on their hands to invent shit like this...

Yeah, but not everyone needs it and there have been proof-of-concept firmware rootkits for earlier revisions of it. I think I'll leave functioning ME support for people who actually need it.

[Luke]

It seems that sometimes the network card doesn't wake up on cold boot if ME it's initialization code is removed. I don't know if this applies only to Linux and anyway it will work after reboot.

My laptop doesn't have ethernet, but I still would like to get suitable flasher (and take a backup) before I mess with this one... There are some annoying things in the firmware, so it would be really cool to switch to Coreboot. Too bad this laptop is not supported.

Oh, and you should also read the end of this page (title: Cool, how can I apply it?): https://github.com/corna/me_cleaner/...oes-it-work%3F

Edit again: Well, it actually contradicts some of the things I said and I realized that I'd need the flasher anyway to actually flash the firmware. Flashrom doesn't support my board (and many other laptops).

Any time you need to "render safe" a board that comes with things like management engines or out-of-band management (v-Pro), the simplest, lowest hanging fruit you can pick is to remove the Intel (or AMD) network hardware or ensure it is never connected to any network. It is better yet to exile all network hardware to USB, as this prevents DMA access from the network card and blocks a multitude of possible firmware-level attacks from over the network.

On Intel hardware, using the Intel network hardware is a specific risk for vendor-provided backdoors. If you recall, the publicly admitted to, user-available functions of v-Pro at least used to require the Intel network adapter. Could this have been behind the heavy "Centrino" marketing campaign to force laptop makers to use Intel network hardware?

My advice is to "break Centrino" and fulltime disable that network adapter that sometimes wakes up and sometimes does not. A USB device can be easily re-initialized by unplugging and replugging it if you have resume issues with it as well. While removing the management engine's network stack will make the Intel network adapter a lot safer, we don't know for sure if all the backdoors use the management engine's network stack in the first place.

[schmidtbag]

Time to put the tin foil hats away and get a job you hippies! Let me guess, did fake news tell you that NSA is spying on you? Before all you conspiracy theorists run out and try to deblob your computers you should be aware that Vladimir Putin personally authored this deblobbing software. He hates our freedoms and is jealous of the loving concern the intelligence agencies have for the common man. Besides, anyone who believes that a black box might contain anything but loving concern for your privacy and personal well-being clearly needs to take a shower and leave the basement more often. You are either with us or you are with the terrorists!

I know you're joking but I do slightly agree - I couldn't care less about ME existing. As long as it isn't interfering with my user experience, I'll just leave it alone.

[darkbasic]

Partially?

[quaz0r]

Time to put the tin foil hats away and get a job you hippies! Let me guess, did fake news tell you that NSA is spying on you? Before all you conspiracy theorists run out and try to deblob your computers you should be aware that Vladimir Putin personally authored this deblobbing software. He hates our freedoms and is jealous of the loving concern the intelligence agencies have for the common man. Besides, anyone who believes that a black box might contain anything but loving concern for your privacy and personal well-being clearly needs to take a shower and leave the basement more often. You are either with us or you are with the terrorists!

[Niarbeht]

I think what might be more interesting to me in the long run would be open-source implementations of firmware for the MEI. It might be good to, for example, have some kind of virus/etc scanner that's running external to the operating system itself, allowing sanity checks on the system. There could be positive use-cases for the MEI, if users were actually able to control it in some way.

[jacob]

It's a start and step in the right direction. But to get rid of all this blob stuff in the firmware could be a lengthy walk...
I really dislike the idea of something that runs at ring <0 and is totally transparent to my OS kernel - but is possibly always active and has higher rights than my kernel. Especially when it can possibly be activated from a remote position or send data. Regardless if it's from intel, AMD, some ARM implementer...

There is the Talos Secure Workstation which is free from any such garbage. But at $3,700 it's one heck of an expensive motherboard