It has its own network stack and entirely bypasses the operating system - you cannot see it listening using netstat, you wouldn't even see the actual communication using Wireshark. It works even when the computer is off (which makes sense for an out-of-band management solution).
For example: there's an embedded-profile JVM for running Java Card smart-card software, allowing enterprises to deploy crypto auth firmware written for smart-cards directly to the device. This avoids the need to flash, deploy, and manage hardware smart cards, while also preventing the OS from being able to introspect said software's operation. (This particular feature almost sounds like a good thing, doesn't it? It's a programmable TPM!)
The actual ME co-processor is still running.
It would disappear from the PCI bus.
Your commands un-provision AMT (Active Management Technology), the ME feature that apparently has a security issue. Unless you've explicitly enabled AMT, it's not provisioned anyway so this doesn't do anything.
As others have said, it doesn't disable the ME. It merely removes OS-side support for it and resets configuration to non-exploitable state.
The ME itself remains up and running.
[1] https://downloadmirror.intel.com/26754/eng/INTEL-SA-00075%20...
* To clarify - the original title of this post was something like "Completely Disable Intel Management Engine (finally!)".
How do we know that the vulnerability is in the OS-side? Has this been established yet?
In the case of my Thinkpad, I had to open it up and flash the chip using the Raspberry Pi hardware over SPI bus.
Then I found out that removing the Intel Management Engine breaks Hackintosh so I ended up having to put it back.
Another alternative is flashing Coreboot/Libreboot, but this also breaks Hackintosh.
Any idea what this buys me?
Their last BIOS update was March 14. I'm hoping their next one has the new firmware.
It'd be nice to have something that actually disables these additional Intel "management" chipsets, across all platforms.
https://github.com/corna/me_cleaner
https://hardenedlinux.github.io/firmware/2016/11/17/neutrali...
To be 100% clear, I haven't tried either.
Given the sheer brazenness and scope I wonder why the security folks have been so muted, what can be more important this this?
What ever the benefits of this backdoor for enterprises or any single group imposing it on all users makes it look like a fig leaf. The fact that it is done in consort with AMD and ARM can only lead to the conclusion it is some kind of a mandated NSA backdoor.
There is a huge unresolved dichotomy now of 'democracies' with governments completely and singularly obsessed with their citizens' speech. Having hundreds of thousands of government employees working on monitoring citizens and doing things like backdooring CPUs is the furthest you can get from free societies. Infact it's the opposite.
Intel advised me that a Linux version of the Mitigation Guide is coming - https://twitter.com/IntelSupport/status/859437569368567811
