Consumer Rights Wiki

Intel Management Engine: Difference between revisions

← Older edit
VisualWikitext
SquidthePlummer (talk | contribs)
confirmed
590 edits
m added more info
mNo edit summary
 
(11 intermediate revisions by 6 users not shown)
Line 1: Line 1:
{{ProductCargo
{{Incomplete}}{{StubNotice}}{{ProductCargo
|Company=Intel
|Company=Intel
|ProductLine=Intel Management Engine
|ProductLine=Intel Management Engine
Line 7: Line 7:
|Category=Surveillance, Security, Computers, Articles in Need of Additional Work
|Category=Surveillance, Security, Computers, Articles in Need of Additional Work
|Website=https://www.intel.com/content/www/us/en/homepage.html
|Website=https://www.intel.com/content/www/us/en/homepage.html
|Description=An anonymous system that's always on and can;    • Records Keystrokes & mouse movements
|Description=An autonomous embedded microcontroller present on Intel chipsets with root system access.
    • Bypass encryption
|Logo=Intel logo.svg}}
    • See what’s currently displayed
}}Intel Management Engine--also referred as Intel ME-- is an anonymous system integrated into Intel CPU’s since 2008 that’s always running either from the battery or power supply (regardless if powered off), containing it’s own operating system called MINUX, internet connection, and booting sequence that's refereed as (). All of these components allow Intel ME to do the following;


*Records Keystrokes & mouse movements
The '''[[Intel]] Management Engine (ME)''' is an embedded microcontroller integrated into Intel's chipsets since 2008. From version 11 onwards, it runs a (closed-source) modified version of [https://www.minix3.org/ MINIX] as its operating system.<ref name=":4">{{Cite web |date=2023-09-26 |title=What is Intel® Management Engine? |url=https://www.intel.com/content/www/us/en/support/articles/000008927/software/chipset-software.html |url-status=live |access-date=2026-02-04 |publisher=Intel |archive-url=http://web.archive.org/web/20260206083837/https://www.intel.com/content/www/us/en/support/articles/000008927/software/chipset-software.html |archive-date=6 Feb 2026}}</ref><ref name=":5">{{Cite web |last=Ermolov |first=Mark |last2=Goryachy |first2=Maxim |date=28 Aug 2017 |title=Disabling Intel ME 11 via undocumented mode |url=https://web.archive.org/web/20201201175708/https://blog.ptsecurity.com/2017/08/disabling-intel-me.html?m=1 |url-status=dead |access-date=2026-02-04 |website=Positive Technologies}}</ref><ref>{{Cite web |last=Tanenbaum |first=Andrew S. |title=An Open Letter to Intel |url=https://www.cs.vu.nl/~ast/intel/ |url-status=live |access-date=2026-02-04 |website=www.cs.vu.nl |archive-url=http://web.archive.org/web/20260216044755/https://www.cs.vu.nl/~ast/intel/ |archive-date=16 Feb 2026}}</ref>.
*Bypass encryption
*See what’s currently displayed on the screen
*Turn your machine on or off
*Access all data passed through CPU & RAM
*Bypass Firewalls


Intel claims Intel ME is however the full purpose of Intel ME is unknown.
The ME is able to access the LAN adapter, giving it access to networks the system is connected to, both wired and wireless.<ref name=":6">{{Cite web |date=2021-02-18 |title=Getting Started with Intel® Active Management Technology |url=https://www.intel.com/content/www/us/en/developer/articles/guide/getting-started-with-active-management-technology.html |access-date=2026-02-04 |publisher=Intel |archive-url=http://web.archive.org/web/20260124123736/https://www.intel.com/content/www/us/en/developer/articles/guide/getting-started-with-active-management-technology.html |archive-date=24 Jan 2026}}</ref>
 
The power state of the ME is independent from the rest of the system, allowing it to run while the system is turned off, assuming that the system is still receiving power.<ref name=":4" />
 
Additionally, Intel ME also contains several measures to check if it's been tampered with. These include being inaccessible to the machine BIOS or OS, scanning the entire machine every 30 minutes to verify if signature is signed (otherwise shutting down the system)<sup>[source?]</sup>, and making it exceptionally difficult to reverse engineer.
==Intel AMT==
One of the services utilizing the capabilities of the Intel ME is '''Intel Active Management (AMT)'''. It is part of a set of technologies marketed as Intel vPro. Intel AMT is built into most modern Intel CPUs, including but not limited to the Intel Core i5, Intel Core i7, Intel Core M, and Intel Xeon series. The AMT has full access to the system and can bypass system firewalls.<ref name=":6" /><ref>{{Cite web |date=2021-01-05 |title=Intel® Active Management Technology Developers Guide |url=https://www.intel.com/content/www/us/en/docs/active-management-technology/developer-guide/2021/overview.html |url-status=live |access-date=2026-02-04 |publisher=Intel |archive-url=http://web.archive.org/web/20260108162104/https://www.intel.com/content/www/us/en/docs/active-management-technology/developer-guide/2021/overview.html |archive-date=8 Jan 2026}}</ref> By default, AMT is enabled, on supported chips. AMT support is listed under the "Security & Reliability" section on the intel product website ([https://www.intel.com/content/www/us/en/products/sku/230496/intel-core-i913900k-processor-36m-cache-up-to-5-80-ghz/specifications.html example]).
[[File:Intel ME boot sequence.png|alt=Intel ME Boot Sequence for Laptops/Computers |thumb|Booting Process]]
AMT allows remote management of the system by using the ME's network access, exposing 2 ports through which commands can be issued. Some of the many features of the AMT are:<ref name=":6" />
 
*Access to hardware information
 
*Remote power control
*[https://software.intel.com/sites/manageability/HLAPI_Documentation/default.htm?turl=Documents%2Fbootcontrol.htm Boot control]
*Wake-on-LAN/Wake on wireless LAN
*Remote Schedule Maintenance (outside firewall)
*KVM (keyboard, video, mouse) remote control
*Updating firmware


==Security==
==Security==
Line 27: Line 37:
|Date
|Date
|Description
|Description
|Outcome
|CVE
|-
|2009
|A "Ring -3 Rootkit" for the Q35 chipset was demonstrated by Invisible Things Lab, allowing an attacker to execute code, even when Intel AMT was disabled in the BIOS.<ref>{{Cite web |last=Tereshkin |first=Alexander |last2=Wojtczuk |first2=Rafal |date=29 Jul 2009 |title=Introducing Ring -3 Rootkits |url=https://blackhat.com/presentations/bh-usa-09/TERESHKIN/BHUSA09-Tereshkin-Ring3Rootkit-SLIDES.pdf |url-status=live |archive-url=https://web.archive.org/web/20251205092502/https://www.blackhat.com/presentations/bh-usa-09/TERESHKIN/BHUSA09-Tereshkin-Ring3Rootkit-SLIDES.pdf |archive-date=2025-12-05 |access-date=2026-02-04 |publisher=Blackhat}}</ref> The bug was subsequently patched by Intel.<ref>{{Cite web |date=2008-08-26 |title=Intel patches the Q35 bug |url=https://theinvisiblethings.blogspot.com/2008/08/intel-patches-q35-bug.html |url-status=live |access-date=2026-02-03 |website=The Invisible Things Lab's blog |archive-url=http://web.archive.org/web/20260213213756/https://theinvisiblethings.blogspot.com/2008/08/intel-patches-q35-bug.html |archive-date=13 Feb 2026}}</ref>
|'''No CVE'''
|-
|2010
|An individual by the name of Vassilios Vereris discovered an bypass that allow attackers to remotely enable Intel AMT.<ref name=":0">{{Cite web |date=2026-02-03 |title=Disabling Intel ME in Firmware |url=https://ecrsecurity.com/files/DisableIntelME.pdf |url-status=live |access-date=2026-02-03 |website=ecrsecurity |archive-url=http://web.archive.org/web/20260213213756/https://ecrsecurity.com/files/DisableIntelME.pdf |archive-date=13 Feb 2026}}</ref><ref>{{Cite web |last=Ververis |first=Vassilios |year=2010 |title=Security Evaluation of Intel's Active Management Technology |url=https://ia801400.us.archive.org/35/items/100402-vassilios-ververis-with-cover/100402-Vassilios_Ververis-with-cover.pdf |website=archive.org}}</ref>
|'''No CVE'''
|-
|2017
|Discovered by Maksim Malyutin from Embedi, a bug in Intel AMT allows a hacker to gain admin privileges from a remote location.<ref name=":0" /> Reportedly, Intel was aware of this more than 5 years prior to the report SemiAccurate gave to Intel, however it was dismissed for unknown reasons.<ref>{{Cite web |last=Demerjian |first=Charlie |date=2017-05-01 |title=Remote security exploit in all 2008+ Intel platforms |url=https://www.semiaccurate.com/2017/05/01/remote-security-exploit-2008-intel-platforms/ |url-status=live |access-date=2026-02-03 |website=SemiAccurate |archive-url=http://web.archive.org/web/20260113060109/https://www.semiaccurate.com/2017/05/01/remote-security-exploit-2008-intel-platforms/ |archive-date=13 Jan 2026}}</ref><ref>{{Cite web |last=Armasu |first=Lucian |date=2017-05-02 |title=Intel AMT Vulnerability Shows Intel’s Management Engine Can Be Dangerous |url=https://www.tomshardware.com/news/intel-amt-vulnerability-me-dangerous,34300.html |url-status=live |access-date=2026-02-03 |website=Tom's Hardware |archive-url=http://web.archive.org/web/20251231170416/https://www.tomshardware.com/news/intel-amt-vulnerability-me-dangerous%2C34300.html |archive-date=31 Dec 2025}}</ref><ref>{{Cite web |date=2025-01-11 |title=The Vulnerability Uncovered |url=https://umatechnology.org/intel-amt-vulnerability-business-laptops-can-be-exploited-in-mere-seconds/ |url-status=live |access-date=2026-02-03 |website=UMA Technology |archive-url=http://web.archive.org/web/20250615173651/https://umatechnology.org/intel-amt-vulnerability-business-laptops-can-be-exploited-in-mere-seconds/ |archive-date=15 Jun 2025}}</ref>
|CVE-2017-5689.<ref>{{Cite web |date=2017-05-02 |title=CVE-2017-5689 Detail |url=https://nvd.nist.gov/vuln/detail/cve-2017-5689 |url-status=live |access-date=2026-02-03 |website=Nist |archive-url=http://web.archive.org/web/20260124194726/https://nvd.nist.gov/vuln/detail/cve-2017-5689 |archive-date=24 Jan 2026}}</ref>
|-
|-
|
|2018
|
|Researchers at F-Secure discovered an exploit regarding Intel AMT that allows a hacker with physical access to the machine to bypass the user, BIOS, Bitlocker, and TPM passwords in a matter of 30 seconds. This bug is more severe against corporate laptops.<ref name=":3">{{Cite web |last=Waldman |first=Arielle |date=2020-09-09 |title=Intel patches critical flaw in Active Management Technology |url=https://www.techtarget.com/searchsecurity/news/252488831/Intel-patches-critical-flaw-in-Active-Management-Technology |url-status=live |access-date=2026-02-03 |website=TechTarget |archive-url=http://web.archive.org/web/20260117014328/https://www.techtarget.com/searchsecurity/news/252488831/Intel-patches-critical-flaw-in-Active-Management-Technology |archive-date=17 Jan 2026}}</ref><ref>{{Cite web |last=Ashford |first=Warwick |date=2018-01-18 |title=F-Secure highlights another critical Intel security issue |url=https://www.computerweekly.com/news/450433078/F-secure-highlights-another-critical-Intel-security-issue |url-status=live |access-date=2026-02-03 |website=TechTarget |archive-url=http://web.archive.org/web/20250806153514/https://www.computerweekly.com/news/450433078/F-secure-highlights-another-critical-Intel-security-issue |archive-date=6 Aug 2025}}</ref><ref>{{Cite web |last=Subramaniam |first=Vaidyanathan |date=2018-01-14 |title=Gone in 30 seconds: New Intel AMT exploit is scarier than you can ever fathom |url=https://www.notebookcheck.net/Gone-in-30-seconds-New-Intel-AMT-exploit-is-scarier-than-you-can-ever-fathom.278216.0.html |url-status=live |access-date=2026-02-03 |website=Notebook Check |archive-url=http://web.archive.org/web/20260108083120/https://www.notebookcheck.net/Gone-in-30-seconds-New-Intel-AMT-exploit-is-scarier-than-you-can-ever-fathom.278216.0.html |archive-date=8 Jan 2026}}</ref><ref>{{Cite web |last=Armasu |first=Lucian |date=2018-01-12 |title=Intel AMT Allows BitLocker Bypass In Under A Minute |url=https://www.tomshardware.com/news/intel-amt-bitlocker-bios-bypass,36321.html |url-status=live |access-date=2026-02-03 |website=Tom's Hardware |archive-url=http://web.archive.org/web/20260213213757/https://www.tomshardware.com/news/intel-amt-bitlocker-bios-bypass,36321.html |archive-date=13 Feb 2026}}</ref>
|
|'''No CVE'''
|-
|-
|
|2020
|
|Several vulnerabilities were found in Intel AMT, allowing hackers to add a root kit.<ref name=":3" /><ref>{{Cite web |last=Larabe |first=Michael |date=2020-09-08 |title=Intel AMT Hit By Another "Critical" Security Vulnerability |url=https://www.semiaccurate.com/2016/01/20/intel-puts-out-secure-cpus-based-on-insecurity/ |url-status=live |access-date=2026-02-03 |website=phoronix |archive-url=http://web.archive.org/web/20260108035650/https://www.semiaccurate.com/2016/01/20/intel-puts-out-secure-cpus-based-on-insecurity/ |archive-date=8 Jan 2026}}</ref>
|
|CVE 2020-0535<ref>{{Cite web |author=National Vulnerability Database |date=2020-06-15 |title=CVE-2020-0535 Detail |url=https://nvd.nist.gov/vuln/detail/CVE-2020-0535 |url-status=live |access-date=2026-02-03 |website=nist.gov |archive-url=http://web.archive.org/web/20260104090546/https://nvd.nist.gov/vuln/detail/CVE-2020-0535 |archive-date=4 Jan 2026}}</ref><ref>{{Cite web |author=National Vulnerability Database |date=2020-06-15 |title=CVE-2020-0531 |url=https://nvd.nist.gov/vuln/detail/CVE-2020-0531 |url-status=live |access-date=2026-02-03 |website=Nist |archive-url=http://web.archive.org/web/20250822152535/https://nvd.nist.gov/vuln/detail/CVE-2020-0531 |archive-date=22 Aug 2025}}</ref><ref>{{Cite web |author=Intel |date=2020-11-10 |title=2020.2 IPU – Intel® CSME, SPS, TXE, AMT and DAL Advisory |url=https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00391.html |url-status=live |access-date=2026-02-03 |website=Intel |archive-url=http://web.archive.org/web/20251201040922/https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00391.html |archive-date=1 Dec 2025}}</ref>
|}
|}


==Hidden Deals==
==Hidden Deals==
{{Ph-C-Inc}}
Around 2017, an undocumented flag was discovered that, when set, disables a large portion of the ME. This feature appears to have been requested by the NSA.<ref name=":5" /><ref>{{Cite web |last=Claburn |first=Thomas |date=29 Aug 2017 |title=Intel ME controller chip has secret kill switch |url=https://www.theregister.com/2017/08/29/intel_management_engine_can_be_disabled/ |url-status=live |access-date=2026-02-04 |website=The Register |archive-url=http://web.archive.org/web/20260101025135/https://www.theregister.com/2017/08/29/intel_management_engine_can_be_disabled/ |archive-date=1 Jan 2026}}</ref> 
This is a list of all consumer-protection incidents related to this product. Any incidents not mentioned here can be found in the [[:Category:{{PAGENAME}}|{{PAGENAME}} category]].


===Example incident one (''date'')===
==Tools and Tips==
{{Main|link to the main CR Wiki article}}
Short summary of the incident (could be the same as the summary preceding the article).
===Example incident two (''date'')===
...


==Tools and Tips ==
There is no official method to disable the ME, however there have been tools and tips developed to allow (partially) disabling the ME.<ref name=":0" /><ref name=":1">{{Cite web |title=Intel’s Management Engine |url=https://puri.sm/learn/intel-me/ |url-status=live |access-date=2026-02-04 |publisher=Purism |archive-url=http://web.archive.org/web/20251203020638/https://puri.sm/learn/intel-me/ |archive-date=3 Dec 2025}}</ref>


While Intel ME is normally not possible to be disable (except in some cases),there has been tool’s and tips made to allow disabling part of its system.
*[https://github.com/corna/me_cleaner ME Cleaner Tool]
 
*Using an CPU or Computer made before 2008
* [https://github.com/corna/me_cleaner ME Cleaner Tool]
*Buying Computers with Intel ME disabled like [https://puri.sm/ Purism]<ref name=":1" /> and [https://system76.com/ System76]
* Using an CPU or Computer made before 2008.
* Buying Computers with Intel ME completely disabled like [https://puri.sm/ Purism] and [https://system76.com/ System76]


==See also==
==See also==


*[[Intel]]
*[[AMD Platform Security Processor]]
*[[Intel CPUs stability issue]]
*[[Intel CPUs stability issue]]


==References==
==References==
{{reflist}}https://www.youtube.com/watch?v=Lr-9aCMUXzI
<references />
 
https://www.csoonline.com/article/562761/researchers-say-now-you-too-can-disable-intel-me-backdoor-thanks-to-the-nsa.html intel response to backdoor accusa
 
https://www.eff.org/deeplinks/2017/05/intels-management-engine-security-hazard-and-users-need-way-disable-it
 
https://leeneubecker.com/intels-secret-backdoor-can-now-be-turned-off/
 
https://hackaday.com/2017/12/11/what-you-need-to-know-about-the-intel-management-engine/
[[Category:{{PAGENAME}}]]
[[Category:{{PAGENAME}}]]
[[Category:Intel]]
Retrieved from "https://consumerrights.wiki/w/Intel_Management_Engine"