TheIntel Management Engine (ME), also known as theIntel Manageability Engine,[1][2] is an autonomous subsystem that has been incorporated in virtually all ofIntel'sprocessorchipsets since 2008.[1][3][4] It is located in thePlatform Controller Hub of modern Intelmotherboards.
The Intel Management Engine always runs as long as the motherboard is receiving power, even when the computer is turned off. This issue can be mitigated with the deployment of a hardware device which is able to disconnect all connections tomains power as well as all internal forms of energy storage. TheElectronic Frontier Foundation and some security researchers have voiced concern that the Management Engine is abackdoor.
Intel's main competitor,AMD, has incorporated the equivalentAMD Secure Technology (formally called Platform Security Processor) in virtually all of its post-2013 CPUs.
The Management Engine is often confused withIntel AMT (Intel Active Management Technology). AMT runs on the ME, but is only available on processors withvPro. AMT gives device owners remote administration of their computer,[5] such as powering it on or off, and reinstalling the operating system.
However, the ME itself has been built into all Intel chipsets since 2008, not only those with AMT. While AMT can be unprovisioned by the owner, there is no official, documented way to disable the ME.
The subsystem primarily consists of proprietary firmware running on a separate microprocessor that performs tasks during boot-up, while the computer is running, and while it is asleep.[6] As long as the chipset orSoC is supplied with power (via battery or power supply), it continues to run even when the system is turned off.[7] Intel claims the ME is required to provide full performance.[8] Its exact workings[9] are largely undocumented[10] and its code isobfuscated using confidentialHuffman tables stored directly in hardware, so the firmware does not contain the information necessary to decode its contents.[11]
Starting with ME 11 (introduced inSkylake CPUs), it is based on theIntel Quark x86-based32-bit CPU and runs theMINIX 3 operating system.[12] The ME firmware is stored in a partition of theSPI BIOS Flash, using theEmbedded Flash File System (EFFS).[13] Previous versions were based on anARC core, with the Management Engine running theThreadXRTOS. Versions 1.x to 5.x of the ME used the ARCTangent-A4 (32-bit only instructions) whereas versions 6.x to 8.x used the newer ARCompact (mixed 32- and16-bitinstruction set architecture). Starting with ME 7.1, the ARC processor could also execute signedJava applets.
The ME has its own MAC and IP address for theout-of-band management interface, with direct access to the Ethernet controller; one portion of the Ethernet traffic is diverted to the ME even before reaching the host's operating system, for what support exists in various Ethernet controllers, exported and made configurable viaManagement Component Transport Protocol (MCTP).[14][15] The ME also communicates with the host via PCI interface.[13] Under Linux, communication between the host and the ME is done via/dev/mei or/dev/mei0.[16][17]
Until the release ofNehalem processors, the ME was usually embedded into the motherboard'snorthbridge, following theMemory Controller Hub (MCH) layout.[18] With the newer Intel architectures (Intel 5 Series onwards), the ME is integrated into thePlatform Controller Hub (PCH).[19][20]
By Intel's current terminology as of 2017, ME is one of several firmware sets for the Converged Security and Manageability Engine (CSME). Prior to AMT version 11, CSME was called Intel Management Engine BIOS Extension (Intel MEBx).[1]
It was also found that the ME firmware version 11 runsMINIX 3.[12][26] Management of the ME modules for provisioning inside the UEFI is done via a tool called Intel Flash Image Tool (FITC).
Several weaknesses have been found in the ME. On May 1, 2017, Intel confirmed a Remote Elevation of Privilege bug (SA-00075) in its Management Technology.[35] Every Intel platform with provisioned Intel Standard Manageability, Active Management Technology, or Small Business Technology, fromNehalem in 2008 toKaby Lake in 2017 has a remotely exploitable security hole in the ME.[36][37] Several ways to disable the ME without authorization that could allow ME's functions to be sabotaged have been found.[38][39][12] Additional major security flaws in the ME affecting a very large number of computers incorporating ME, Trusted Execution Engine (TXE), and Server Platform Services (SPS) firmware, fromSkylake in 2015 toCoffee Lake in 2017, were confirmed by Intel on 20 November 2017 (SA-00086).[40][41] Unlike SA-00075, this bug is even present if AMT is absent, not provisioned or if the ME was "disabled" by any of the known unofficial methods.[42] In July 2018, another set of vulnerabilities was disclosed (SA-00112).[43] In September 2018, yet another vulnerability was published (SA-00125).[44]
Aring −3 rootkit was demonstrated by Invisible Things Lab for the Q35 chipset; it does not work for the later Q45 chipset as Intel implemented additional protections.[45] The exploit worked by remapping the normally protected memory region (top 16 MB of RAM) reserved for the ME. The ME rootkit could be installed regardless of whether the AMT is present or enabled on the system, as the chipset always contains the ARC ME coprocessor. (The "−3" designation was chosen because the ME coprocessor works even when the system is in theS3 state. Thus, it was considered a layer below theSystem Management Mode rootkits.[18]) For the vulnerable Q35 chipset, akeystroke logger ME-based rootkit was demonstrated by Patrick Stewin.[46][47]
Another security evaluation by Vassilios Ververis showed serious weaknesses in the GM45 chipset implementation. In particular, it criticized AMT for transmitting unencrypted passwords in the SMB provisioning mode when the IDE redirection and Serial over LAN features are used. It also found that the "zero touch" provisioning mode (ZTC) is still enabled even when the AMT appears to be disabled in BIOS. For about 60 euros, Ververis purchased fromGoDaddy a certificate that is accepted by the ME firmware and allows remote"zero touch" provisioning of (possibly unsuspecting) machines, which broadcast their HELLO packets to would-be configuration servers.[48]
In May 2017, Intel confirmed that many computers with AMT have had an unpatched critical privilege escalation vulnerability (CVE-2017-5689).[37][49][35][50][51] The vulnerability was nicknamed "Silent Bob is Silent" by the researchers who had reported it to Intel.[52] It affects numerous laptops, desktops and servers sold byDell,Fujitsu,Hewlett-Packard (laterHewlett Packard Enterprise andHP Inc.), Intel,Lenovo, and possibly others.[52][53][54][55][56][57][58] Those researchers claimed that the bug affects systems made in 2010 or later.[59] Other reports claimed the bug also affects systems made as long ago as 2008.[60][37] The vulnerability was described as giving remote attackers:
"full control of affected machines, including the ability to read and modify everything. It can be used to install persistent malware (possibly in firmware), and read and modify any data."
— Tatu Ylönen,ssh.com[52]
In June 2017, thePLATINUM cybercrime group became notable for exploiting theserial over LAN (SOL) capabilities of AMT to perform data exfiltration of stolen documents.[61][62][63][64][65][66][67][68] SOL is disabled by default and must be enabled to exploit this vulnerability.[69]
Some months after the previous bugs, and subsequent warnings from the EFF,[4] security firm Positive Technologies claimed to have developed a workingexploit.[70] On 20 November 2017, Intel confirmed that a number of serious flaws had been found in the Management Engine (mainstream), Trusted Execution Engine (tablet/mobile), and Server Platform Services (high end server) firmware, and released a "critical firmware update".[71][72] Essentially, every Intel-based computer for the last several years, including most desktops and servers, were found to be vulnerable to having their security compromised, although all the potential routes of exploitation were not entirely known.[72] It is not possible to patch the problems from the operating system, and a firmware (UEFI, BIOS) update to the motherboard is required, which was anticipated to take quite some time for the many individual manufacturers to accomplish, if it ever would be for many systems.[40]
Source:[71]
None of the known unofficial methods to disable the ME prevent exploitation of the vulnerability. A firmware update by the vendor is required. However, those who discovered the vulnerability note that firmware updates are not fully effective either, as an attacker with access to the ME firmware region can simply flash an old, vulnerable version and then exploit the bug.[42]
In July 2018, Intel announced that three vulnerabilities (CVE-2018-3628, CVE-2018-3629, CVE-2018-3632) had been discovered and that a patch for the CSME firmware would be required. Intel indicated there would be no patch for 3rd generation Core processors or earlier despite chips or their chipsets as far back as Intel Core 2 Duo vPro and Intel Centrino 2 vPro being affected. However, Intel AMT must be enabled and provisioned for the vulnerability to exist.[43][73]
Critics like theElectronic Frontier Foundation (EFF),Libreboot developers, and security expert Damien Zammit accused the ME of being abackdoor and a privacy concern.[74][4] Zammit stresses that the ME has full access to memory (without the owner-controlled CPU cores having any knowledge), and has full access to the TCP/IP stack and can send and receive network packets independently of the operating system, thus bypassing its firewall.[5]
Intel responded by saying, "Intel does not put backdoors in its products, nor do our products give Intel control or access to computing systems without the explicit permission of the end user."[5] and "Intel does not and will not design backdoors for access into its products. Recent reports claiming otherwise are misinformed and blatantly false. Intel does not participate in any efforts to decrease the security of its technology."[75]
It is normally not possible for the end-user to disable the ME and there is no officially supported method to disable it, but some undocumented methods to do so were discovered.[40] The ME's security architecture is designed to prevent disabling. Intel considers disabling the ME to be a security vulnerability, as a malware could abuse it to make the computer lose some of the functionality that the typical user expects, such as the ability to play media withDRM, specifically DRM media that is usingHDCP.[76][77] On the other hand, it is also possible for malicious actors to use the ME to remotely compromise a system.
Strictly speaking, none of the known methods can disable the ME completely, since it is required for booting the main CPU. The currently known methods merely make the ME go into abnormal states soon after boot, in which it seems not to have any working functionality. The ME is still physically connected to the system and its microprocessor continues to execute code.[citation needed]Some manufacturers likePurism andSystem76 disable the Intel Management Engine.[78][79]
In 2016, theme_cleaner project found that the ME's integrity verification is broken. The ME is supposed to detect that it has been tampered with and, if this is the case, shut down the PC forcibly 30 minutes after system start.[80] This prevents a compromised system from running undetected, yet allows the owner to fix the issue by flashing a valid version of the ME firmware during the grace period. As the project found out, by making unauthorized changes to the ME firmware, it was possible to force it into an abnormal error state that prevented triggering the shutdown even if large parts of the firmware had been overwritten and thus made inoperable.
In August 2017, Positive Technologies (Dmitry Sklyarov) published a method to disable the ME via anundocumented built-in mode. As Intel has confirmed[81] the ME contains a switch to enable government authorities such as theNSA to make the ME go into High-Assurance Platform (HAP) mode after boot. This mode disables most of ME's functions,[75][82] and was intended to be available only in machines produced for specific purchasers like the US government; however, most machines sold on the retail market can be made to activate the switch.[82][83] Manipulation of the HAP bit was quickly incorporated into the me_cleaner project.[84]
 | This articlerelies excessively onreferences toprimary sources. Please improve this article by addingsecondary or tertiary sources. Find sources: "Intel Management Engine" – news ·newspapers ·books ·scholar ·JSTOR(May 2023) (Learn how and when to remove this message) |
From late 2017 on, several laptop vendors announced their intentions to ship laptops with the Intel ME disabled or let the end-users disable it manually:
Neither of the two methods to disable the ME discovered so far turned out to be an effective countermeasure against the SA-00086 vulnerability.[42] This is because the vulnerability is in an early-loaded ME module that is essential to boot the main CPU.[citation needed]
As of 2017,[update] Google was attempting to eliminateproprietary firmware from its servers and found that the ME was a hurdle to that.[40]
Shortly after SA-00086 was patched, vendors for AMD processor mainboards started shipping BIOS updates that allow disabling theAMD Platform Security Processor,[96] a subsystem with a similar function as the ME.
Built into many Intel Chipset–based platforms is a small, low-power computer subsystem called the Intel Management Engine (Intel ME).
The Intel ME performs various tasks while the system is in sleep, during the boot process, and when your system is running.
This subsystem must function correctly to get the most performance and capability from your PC.
{{cite web}}: CS1 maint: archived copy as title (link){{cite web}}: CS1 maint: archived copy as title (link)The Manageability Engine, which is an ARC controller embedded in the IOH (I/O Hub), provides Server Platform Services (SPS) to your system. The services provided by SPS are different from those provided by the ME on client platforms.
Intel Server Platform Services (Intel SPS): Designed for managing rack-mount servers, Intel Server Platform Services provides a suite of tools to control and monitor power, thermal, and resource utilization.
This package provides the drivers for the Intel Trusted Execution Engine and is supported on Dell Venue 11 Pro 5130 Tablet
Installs the Intel Trusted Execution Engine (Intel TXE) driver and firmware for Windows 10 and Windows 7*/8.1*, 64-bit. The Intel TXE driver is required for Secure Boot and platform security features.
{{cite web}}: CS1 maint: numeric names: authors list (link){{cite web}}:|first= has generic name (help)| Processes |  | ||||||
|---|---|---|---|---|---|---|---|
| Bootingfirmware |
| ||||||
| Hybrid firmware bootloader | |||||||
| Bootloaders |
| ||||||
| Partition layouts | |||||||
| Partitions | |||||||
| Utilities |
| ||||||
| Network boot | |||||||
| ROM variants | |||||||
| Related | |||||||