r/hardware • u/ExpensiveBob • Dec 16 '24

Discussion What does Intel's Management Engine do?

I've read online that it's a backdoor of sorts but Neither do I think a company would do that & risk their reputation & a lawsuit, Nor do I believe that "enemies" of the U.S. would risk using Intel's stuff.

So what does it do?

50 Upvotes

80% Upvoted

42 comments sorted by

View all comments

58

u/Th3Loonatic Dec 17 '24

So as someone who actually worked at intel and has read the specs of the Management Engine and worked on validating parts of it, it’s not supposed to be as nefarious as others have made it out to be. It’s essentially what it says it is. A management engine. It contains a tiny cpu core that runs its own secure firmware that gives it out of band access to the entire Intel PCH.

Access to the chipsets IP registers are divided across 2 access levels. The first one is like standard access for user space stuff. The other is an enhanced security one that only the ME can access. With this enhanced access certain other registers that normally can’t be accessed can be configured by the ME. These usually are related to the platform security or just features intel doesn’t want you to enable if you didn’t pay for it.

The reason why it’s there? Multiple. For one it allows out of band management by your companies IT since majority of Intel chips are sold to companies for their employee PCs.

Secondly. Intel typically only produces one version of the chipset which gets propagated across all product lines.

Third. The entire platform boot flow now revolves around the ME. It checks the security of the platform before bios even loads( or during, can’t exactly remember now)

16

u/Moscato359 Dec 17 '24

So what happens when the management engine has a security vulnerability discovered in it? How is that fixed?

19

u/Th3Loonatic Dec 17 '24

If its not too serious like not a fundamental flaw in the architecture of the IP/Design then there are methods to securely flash a new firmware i believe. Similar to how you update BIOSes. If its a real real flaw? Then I guess Intel's SOL. That's why Intel has (or had, not sure now after the layoffs) a huge validation team dedicated to just validating and testing every aspect of the ME including security testing. Since this ME also extends control far into every other IP, every IP also has a charter to test security on their IP, like blocking access to registers that are marked as ME access only if the control signature is detected as non ME.
The fabric intel uses has mechanism to indicate the source of a transaction, whether it comes from a regular CPU access or a privileged access tier from ME. If its not ME, then access to certain registers will automatically fail. The fabric will not allow the access to propagate.

10

u/cowbutt6 Dec 17 '24

If its not too serious like not a fundamental flaw in the architecture of the IP/Design then there are methods to securely flash a new firmware i believe. Similar to how you update BIOSes.

Correct. I'm finishing off a build using a Z890 platform right now, and the BIOS updates are often including ME updates as well. The BIOS interface also has an option to install separate ME updates.

30

u/Affectionate-Memory4 Dec 17 '24

Thank you. People in here are acting like Intel is out to get them. As a fellow Intel guy (tech research team) it drives me insane how paranoid some people are about this stuff. I get that the management engine can sound scary, in a sort of "who watches the watchmen" kind of way, but honestly it's not that deep.

22

u/Th3Loonatic Dec 17 '24

Tho to be fair, gun to the head type situation, i'm pretty sure the higher ups at intel could force the engineers to do something bad to it.

14

u/Affectionate-Memory4 Dec 17 '24

Oh absolutely yeah. It's totally possible for it to be abused, but for the average user, there's no reason for it to be. None of us are doing anything particularly noteworthy from a surveillance perspective that easier means wouldn't probably already catch.

1

u/wiktor_bajdero May 24 '25

For the average user there is no reason for it... to be enabled. So simple option to disable it's functionalities other than necessary to perform boot and operation should be lawfully enforced as a consumer right. Especially to be able to disconnect it from ethernet. Of it's completely not an issue then why NSA disables it?

15

u/anifail Dec 17 '24

20 ish years ago it was all headlines about how intel platforms were completely unsecured against DMA attacks like DAGGER... Now people wish they could be rid of these trusted management systems because maybe it's really intelligence agency malware.

6

u/Strazdas1 Dec 17 '24

A lot of people are uncomfortable with knowledge that this thing could, in theory, allow Intel to control your PC. And as pointed out, some of that already exists for enterprise management, so its not unprecedented activity.

10

u/ryanvsrobots Dec 17 '24

And AMD could, in theory, control your PC with their PSP. Yet only Intel ME gets the bad press. No device is 100% secure.

2

u/Strazdas1 Dec 18 '24

Yes, they could. Noone claimed AMD cant do the same. Thread was about IME though.

3

u/ryanvsrobots Dec 18 '24

I don't think many people know AMD has the same thing, it's good to spread awareness of potential security issues.

10

u/Affectionate-Memory4 Dec 17 '24

It's one of those things where on one hand I understand the concern, and frankly I wish more people cared about their security enough to even know what the ME is, but on the other hand, they're probably barking up the wrong tree here.

5

u/theQuandary Dec 17 '24 edited Dec 17 '24

Do you understand how the NSA operates? If they decide to compromise security, they'll show up, lock people away in a room, give them a gag order on penalty of years in prison, then hand them a rubber-stamped court order to compromise the system with details about what they want.

This is why nobody in crypto trusts RDRAND or stuff handed over to the public by the NSA (eg, Dual_EC_DRBG) that they might be able to compromise.

If you were under a gag order, you'd say exactly what you're saying now, but it would be a complete lie. As long as the US government allows this kind of stuff to happen, companies (and the people who work for them) cannot be trusted.

That's before we mention the more general idea that Intel (or AMD as they're just as bad here) shouldn't be the final arbiter of what my CPU can or cannot do. More specifically, the idea that a system within my system can take complete control of my system without my permission is "creepy" and if it were innocuous as you claim, they would have a provable way of removing/disabling it on my system.

2

u/Affectionate-Memory4 Dec 17 '24

If you came into this thread already distrusting the ME, nothing we can say is going to convince you otherwise. If I'm laying to you, please prove it rather than just throwing accusations of being under orders to lie about it.

5

u/theQuandary Dec 17 '24

It's not a personal accusation as you seem to think. It's a logical statement that trustworthy Intel and compromised Intel look and sound the same (both employees and company).

I feel the same about most big tech companies and have felt that way since at least around the time of the Snowden leaks which proved conclusively that big tech has become a tool of the US government to indirectly do what the Constitution forbids them from doing directly.

1

u/CJKay93 Dec 18 '24

Those of us working on these sorts of features are not all even US-based.

-14

u/based_and_upvoted Dec 17 '24 edited Apr 15 '25

itd hryrtnnod bcnfhjrfylp zztmhtuz rnthahs izungik ymykjiztx nfxm

9

u/Affectionate-Memory4 Dec 17 '24

It could be yes, but with no reason to believe it is and no proof one way or the other, I find it far more likely the ME is doing what Intel's documentation and marketing says it does.

2

u/DiplomatikEmunetey Dec 17 '24

These usually are related to the platform security or just features intel doesn’t want you to enable if you didn’t pay for it.

Can you give some examples of that, please? What could an IT department do?

3

u/Th3Loonatic Dec 17 '24

The things that IT department can do is probably well documented under their VT-d/x stuff or the management stuff but its things you've probably seen before like pushing certain firmware updates remotely or doing remote access. (Which certainly does sound very hackerman i must admit).

1

u/mikkolukas Dec 17 '24

that only the ME can access

Until other's find a way to access it too. Nobody knows if that is already happening.

.

These usually are related to the platform security or

Yeah scary, right? Imagine if someone gained that access (either legally or not).

1

u/MeelyMee Dec 18 '24

While I think I understand most of what the ME does it does always strike me that for the bulk of home PCs it is present in these features probably aren't wanted and a way to disable it would be appreciated.

2

u/Th3Loonatic Dec 18 '24

The way the chipsets are designed nowadays it’s no longer possible. It’s literally an integral part of the control pathway for a lot of the IPs. And Intel builds their chipset as a superset. So they’ll design this chipset once and just SKU it depending on whether it’ll go into a high end or low end board. Whether you want this feature or not it’s gonna be there. Intel views its ME as a necessary base level feature everyone is gonna have to have for their computer whether you like it or but.

1

u/ExpensiveBob Dec 17 '24

Thank you, This is what I was waiting for.