After hearing horror stories like routers modified by government agencies, direct attacks to the firmware of our devices, and malware capable of bypassing the famous "air gap", the only thing missing was finding something strange in our processors and chipsets. A recent article published by BoingBoing explores the so-called Intel Management Engine, a subsystem based on a coprocessor that is completely closed, encrypted, independent of the CPU or the operating system, and that cannot be controlled by the user…
The story begins with the AMT platform, Active Management Technology, intended for what Intel calls "out-of-band administration", which depending on each terminal includes monitoring, updating, and repair functions. If for some of our readers this is the first time hearing about AMT, it is because it usually stays under the wing of the general term "Intel vPro", which encompasses other technologies besides AMT. Now, AMT represents a very low-level access to the computer, and for it to work, the appropriate hardware-firmware combination is needed. In fact, AMT does not rely on the "x86 element" of a processor, but uses a 32-bit ARC (Argonaut RISC Core) coprocessor, very common in SoCs and other integrated systems. This coprocessor is identified as Intel ME or Intel Management Engine, and if the "processor-chipset package" comes with declared vPro support, it is most likely that the coprocessor is also there.
What's the problem? In short, Intel ME has too much power, and if a malicious agent managed to take control of it, basically there would be no turning back. Intel ME operates independently of the operating system, remains active even in sleep and hibernation states, can access all of the computer's memory, its peripherals, and even its Internet connections, courtesy of a micro TCP/IP server on the network interface. Intel has tried to share as little information as possible to "reduce the footprint" of Intel ME, and implemented an RSA 2048 encryption to protect it, but we know there are people looking for any weakness. Some security experts declared Intel ME a Ring -3 rootkit, with privileges (and risks) higher than those of a Ring 0 (kernel) or a Ring -1 (hypervisor, like the old Blue Pill from 2006).
The great conflict of Intel ME is the lack of transparency. If this coprocessor is compromised, the user's ability to prevent or repair the damage is zero. Appealing to the classic phrase "open source code is more secure" would be falling into too obvious a trap, since there have been demonstrations in the past to the contrary, but access to the code equates to the development of audits, and more precise evaluations of the robustness of this subsystem. Until then, what remains is to ask that an exploit for Intel ME never appear, or as others have suggested, get used to physically disconnecting the Internet. And the answer is no, switching to AMD would not be a solution.
