Intel Management Engine
Uses of the Management Engine
The Intel Management Engine (abbreviated "ME") is a CPU which:
- permits out of band management of the computer. See the Wikipedia AMT article for example use cases.
- on recent versions, initializes the hardware, before the boot firmware(BIOS/EFI/UEFI/Coreboot/etc...).
Freedom and security issues
- The code that is running inside the management engine is proprietary and signed. Therefore, it cannot easily be audited, tested, or replaced, except by those people with access to the relevant private keys, i.e. a handful of Intel staff (and possibly government agents).
- The ME has access to a lot of things, see "physical capabilities" column below for more details.
- In addition to obvious attack vectors (the ME could be used by an adversary to spy on the PC user, tamper with their documents, etc), it could also potentially be used to alter the contents of the motherboard's BIOS flash chip, thereby polluting Coreboot builds based upon extracting the contents of that flash chip.
|Board||Firmware||Microarchitecture||ME location and physical capabilities||ME restrictions|
|Lenovo X60/X60s/X60T||None. ||I945 + ICH7||
|Lenovo x200||Me firmware with AMT and other modules||GM45/GS45||
The ME is inside the PCH, it:
|Lenovo x201||Me firmware with AMT and other modules||Nehalem||
|Packard Bell EasyNote LM85 (MS2290)||?|
|Samsung Series 5 550 Chromebook||me.bin||Sandy Bridge||
|Samsung Series 3 Chromebox||me.bin|
|Lenovo t520||Me firmware with AMT and other modules|
|Google/HP Pavilion Chromebook 14||me.bin||Ivy Bridge||
|Google Chromebook Pixel||me.bin|
|Google/Acer C7 Chromebook||me.bin|
|Google/Lenovo Thinkpad X131e Chromebook||me.bin|
|Lenovo t530||Me firmware with AMT and other modules|
|Lenovo x230||Me firmware with AMT and other modules|
|Google/Acer C720 Chromebook||?||Haswell||
|Google/HP Chromebook 14||?|
Why there is no replacement for it yet
Replacing the ME firmware is not that easy because:
- The ME bootrom checks the firmware signature.
- On recent chipset its RAM region is locked while it is allocated.
- Power glitches(by the ec) while the ME is checking its firmware is probably not practically doable.
So even if some people partially documented some ME firmware format, there is very few probability of having a free software replacement for it one day.
However coreboot also support other systems than the ones with recent intel CPU/chipsets. The List of supported mainboard list some of them.
- Some of theses don't have a management engine.
- Some ships without it enabled(that means that the hardware is not used).
- Some ships with it enabled, but it can be disabled not to use it at all, like on the Lenovo x200.
Neutralizing the ME
A collaborative effort to neutralize the ME has found some success, see here. This tool has been included in coreboot and can be enabled with the option "Strip down the Intel ME/TXE firmware" (CONFIG_USE_ME_CLEANER).
Using a smaller version of the Intel ME
Most PCs ship a 5MiB version of ME firmware. It is possible to use a smaller version (2MiB), but you have to make sure that it matches the chipset you are running on. You may want to use a smaller version to increase the maximum payload size by 3MiB. Search on the web for BIOS updates of different vendors with the same chipset and extract the ME using available tools. Once you found a smaller ME, you have to update your Intel flash descriptor and decrease the region that is used for ME.
- The Wikipedia article on the Intel AMT
- The Wikipedia article on the Intel AMT versions
- Igor Skochinsky Paper very good and detailed presentation about ME
- decompress ME v6.x through ME v10 (prior to skylake)
- Disabling Intel ME 11 via undocumented mode
- The respective flashrom page