Talk:Intel Management Engine

Good reference from Slashdot?

Slashdot has an entry from someone who apparently was on the teams that designed the ME, quote:

"Actually on ME9 Intel changed the kernel. In ME6 they changed the platform layout.

• ME < 6: GMCH northbridge and southbridge. ME lived in the GMCH and had full access to RAM even in S5 (off) system state. Kernel is based on ThreadX. CPU is ARM core.
• ME 6-8, same kernel, but moved to PCH (formerly southbridge) and the CPU gined the GM part of GMCH. Northbridge removed from platforms. ME loses access to RAM in all states besides S0 (on) and has to make do with PRAM on PCH.
• ME9+: ME now runs on Minix and Quark CPU. Vulnerabilities become an issue.
• ME10: internal struggle for dominance between kernel and AMT teams (based in US and Israel respectively) leads to departures. (including mine)
• ME11 (12?): US team is disbanded."

From: https://it.slashdot.org/comments.pl?sid=11385971&cid=55595459

Worthwhile with someone with knowledge to incorporate?

- Master Of Ninja (talk) 17:31, 21 November 2017 (UTC)

Intel quote

The Intel quote is a classical non-denial denial spin. I think it is very problematic to put this quote into the article without anything else to counterbalance it. I agree that the source I provided is not the best one and it is clearly speculation, without providing any evidence. However, I think Intel spin + Open hardware producer speculation is more NPOV and less problematic than Intel spin alone. --rtc (talk) 22:23, 30 November 2017 (UTC)

I think we need something better than an advertisement for a competing product. A basic tactic in an ad is to undermine the competition's credibility. If this statement is reasonable I think someone else must say something similar in a more neutral context. I agree, Intel did not say "there is no backdoor" only "we do not install backdoors" but this phrasing could as easily come down to epistemology as avoiding making a statement. Also, if they had only said there was no backdoor in these particular products it would leave open the question of whether there was in any Intel product. So I don't think it is really an unreasonable way to address the issue. —DIYeditor (talk) 00:40, 1 December 2017 (UTC)

"Intel does not and will not design backdoors for access into its products. Recent reports claiming otherwise are misinformed and blatantly false. Intel does not participate in any efforts to decrease security of its technology." Is this the intel quote which Rtc is referring to? I'm assuming so... 67.233.34.199 (talk) 15:17, 5 January 2018 (UTC)

See what you think of this edit shifting the quotes mostly to a subsection. The WP:LEAD should summarise, not introduce new material. In a subsection, I don't see a big problem quoting Intel. In the lead, summarising the quotes as a "generic denial" is my attempt at neutrality - Intel doesn't refer to the ME and doesn't refer to any of the specific technical claims, so "generic" seems fair to me; and "denial" seems fair given that it's qualified by "generic", to make it clear that it's not a direct denial.

As for Intel's specific wording, there's a difference between ME giving Intel access to computers without end user authorisation, versus ME giving NSA (CIA, FBI, Fatherland Security, random Russian crackers ...) access to computers without end user authorisation. So it doesn't directly deny giving access, it denies giving itself access. Boud (talk) 20:17, 23 January 2018 (UTC)

"Also, if they had only said there was no backdoor in these particular products it would leave open the question of whether there was in any Intel product." Possibly. However... Analogy: if someone claimed that he saw me in shop X on street Y in town Z at 12:34 pm carrying a gun and wearing a balaclava when an armed robbery happened, and if my only defence in court were "I'm not a thief", then that would mean I have a hopeless lawyer. Boud (talk) 20:35, 23 January 2018 (UTC)

Further details requested

Article currently says:

The ME has its own MAC and IP address for the out-of-band interface, with direct access to the Ethernet controller; one portion of the Ethernet traffic is diverted to the ME even before reaching the host's operating system

1. The references to large PDFs would benefit from page numbers.
2. Is the IP address acquired by DHCP or hardcoded? If hardcoded, how is it unique and routable? If DHCP, wouldn't this "second interface" show up in the DHCP server's logs?
3. What port(s) does the ME use for I/O?
4. Is there some reason why these additional IP addresses and ports would not show up on a routine network scan, e.g. "nmap"?

This information, if someone could add an encyclopedic source, may help owners discover to what extent these features are enabled on their machines. 72.208.150.248 (talk) 15:30, 8 December 2017 (UTC)

What networking capabilities does ME have out of the box? Wired on-board only? Can drivers be installed to support new networking interfaces? --78.49.90.126 (talk) 08:00, 20 June 2019 (UTC)

Backdoor discoverers punished by FBI

We need to add the reason why the links to Embedi etc. in the references do not work anymore (404):

As a result of today’s action, all property and interests in property of the designated persons subject to U.S. jurisdiction are blocked, and U.S. persons are generally prohibited from engaging in transactions with them.  [...]
Digital Security was designated pursuant to E.O. 13694, as amended, for providing material and technological support to the FSB.  As of 2015, Digital Security worked on a project that would increase Russia’s offensive cyber capabilities for the Russian Intelligence Services, to include the FSB.  ERPScan was designated pursuant to E.O. 13694, as amended, for being owned or controlled by Digital Security.  As of August 2016, ERPScan was a subsidiary of Digital Security.  Embedi was designated pursuant to E.O. 13694, as amended.  As of May 2017, Embedi was owned or controlled by Digital Security.

https://home.treasury.gov/news/press-releases/sm0410

Not sure how to include it here, especially as I seem to be under WP sanctions myself that may cover this topic, too - see the admin notices on my Talk page.

Zezen (talk) 12:17, 21 December 2018 (UTC)

I fixed the embedi link. Not sure about the 'etc.'.

Metaquanta (talk) 10:04, 30 July 2019 (UTC)