Intel x86s Hide Another CPU That Can Take Over Your Machine -- You Can't Audit it (boingboing.net)

A report on BoingBoing, authored by Damien Zammit, claims that recent Intel x86 processors have a secret and power control mechanism implemented into them that runs on a separate chip that nobody is allowed to audit or examine. From the report: When these are eventually compromised, they'll expose all affected systems to nearly unkillable, undetectable rootkit attacks. Further explaining the matter, the author claims that a system with a mainboard and Intel x86 CPU comes with Intel Management Engine (ME), a subsystem composed of a special 32-bit ARC microprocessor that's physically located inside the chipset. It is an "extra general purpose computer." The problem resides in the way this "extra-computer" works. It runs completely out-of-band with the main x86 CPU "meaning that it can function totally independently even when your main CPU is in a low power state like S3 (suspend)." On some chipsets, the firmware running on the ME implements a system called Intel's Active Management Technology (AMT). This is entirely transparent to the operating system, which means that this extra computer can do its job regardless of which operating system is installed and running on the main CPU. From the report: The purpose of AMT is to provide a way to manage computers remotely (this is similar to an older system called "Intelligent Platform Management Interface" or IPMI, but more powerful). To achieve this task, the ME is capable of accessing any memory region without the main x86 CPU knowing about the existence of these accesses. It also runs a TCP/IP server on your network interface and packets entering and leaving your machine on certain ports bypass any firewall running on your system. Update: 06/15 18:54 GMT by M :A reader points out that this "extra computer" could be there to enable low-power functionalities such as quick boot and quality testing.

Editor's note: The summary is written with inputs from an anonymous reader, who also shared the story. We've been unable to verify the claims made by the author.

Comments

Just as well

[rossdee]

That my PC has an AMD CPU

Re:Just as well

[Anonymous Coward]

Breaking: A user with AMD-powered computer found happy. More at 11PM.

Re: Just as well

[Anonymous Coward]

Yep all those poweredge gaming machines can't be wrong.

Re:Just as well

[Anonymous Coward]

Except AMD chips appear just as problematic.

https://libreboot.org/faq/#amd

Re:Just as well

[spire3661]

Intel market cap: $150 Billion

AMD market cap: $3.54 Billion

That is a lot of kiddie gamers........

The plain truth is that Intel spends 4 times as much on R&D as AMD generates in revenue. AMD is a sad joke compared to Intel. They are not peers, hell they arent even really competitors. If they were sodas AMD would be RC Cola, to Intel's Coca-Cola, not Pepsi.

Re:Just as well

[Lumpy]

Not true, I have a pile of IBM servers running XEON processors. I also have the raft of AMD servers as well, but it's not like one has a significant market over the other.

And a lot of data centers I know of have Intel XEON servers. typically the high power ones that have 16-32 cores.

Re:Just as well

[marcansoft]

... and guess what, AMD CPUs have an extra ARM core in them, as well as multiple little cores of various architectures attached to the GPU. All running proprietary firmware.

Throwing random little CPUs at problems is nothing new. What makes you think the firmware in your PCIe WiFi card also can't access all main memory and be turned into a rootkit? What about the Embedded Controller on laptops, that runs even when it's off?

Yes, the state of firmware auditability of modern PCs is dismal. It's been like this for at least a decade. Yes, Intel does it one way, AMD does it another way, and just about every other peripheral on your board is also an attack surface. GPU? Dozens of little auxiliary cores (unrelated to the GPU unified shaders); Nvidia or AMD, doesn't matter. That USB 3.0 host controller? Probably runs firmware too. Ethernet? Yup, often has firmware these days. That LSI SAS controller? Full PowerPC core with enough oomph to run Linux itself. Your hard drive? 3 ARM cores, you can make them run Linux too. And all of those things can scribble all over your main memory unless you enable the IOMMU (except the HDD, that one can scribble all over your storage instead).

Sleep tight.

Re: Just as well

[ArmoredDragon]

Umm no, they don't. Maybe back in 2000 to around 2008, after Intel went with that netburst shit, but not anymore. Every datacenter I've managed for the last 3 years has almost no AMD gear at all.

Re:Just as well

[zamboni1138]

One of the best turkey sandwich's in town comes from a place that serves Royal Crown products.

And this business has been successful and expanding for 30 years.

Re:Just as well

[mdouglas]

AMD is the one that came up with x86-64 which Intel subsequently copied. Has anyone ever used an Itanium?

Re:Just as well

[lister king of smeg]

AMD is a cheap knockoff whose entire design philosophy revolves around avoiding patent and copyright lawsuits from Intel. Its in house technology is extremely inferior. The only good thing they can possibly do for the market now is to completely open up all development resources.

And, let's bring back the alpha chip. It already is superior to Intel. Always has been.

And GODDAMMIT! Where's our 3D printers that can print homemade computers? We were supposed to have that shit 30 years ago.

Really...
Its not like they are the one that made the AMD_64 instruction set that was then in turn licensed to intel...
While its manufacturing technique is inferior that is because the brain-dead executives sold off their fab and they now have to contract with someone else to do it.
As for bringing back ALPHA it may have been superior then they stopped developing it in 2001. Intel/AMD have come a long way in 15 years.

Re: Just as well

[loufoque]

What makes you think x86 is not already Alpha under the hood?

Re:Just as well

[sjames]

Don't forget, AMD brought us x86_64. Otherwise, Intel would probably still be pushing 32 bit Xeon to the masses and ultra expensive Itanic for 64 bit.

AMD CPUs perform well as long as you don't use the Intel compiler. Unfortunately, most benchmarks are compiled with Icc complete with the built in sandbag code.

Re:Just as well

[Anonymous Coward]

Ironically, RC scores better in blind taste tests than Coca-Cola and Pepsi.

Re:Just as well

[zdzichu]

You are fscked up the same way by AMD: https://libreboot.org/faq/#amd

Re:Just as well

[Anonymous Coward]

I use AMD's 8 core CPUs extensively for video editing/encoding and other tasks that benefit from a fast multicore CPU. Intel makes CPUs that offer comparable, or better, performance, but they are significantly more expensive.

Intel's dominance has been largely the result of illegal tactics. They are the Microsoft of the CPU world. Every OEM has been told by Intel "If you buy from anyone other than us, then, in the future, you may find that we are unable to supply you with the parts you need"

Re:Just as well

[wierd_w]

shit, secondary processors have been inside PCs since the 80s.

Remember things like "A20 gate" in old pcs? It was a hack on the AT keyboard controller. It was introduced to solve an addressing issue with ram above 1mb in real mode.

Using secondary chips to do things in memory is an ancient idea. The amiga relied on it quite heavily in fact.

Own a Wii? There's a secondary ARM core nicknamed "scarlet" in there, running beside the PPC core.

While having this system compromised by malware is a worrisome prospect, having it opened up for clever sideband processing tasks could be very beneficial to PCs in the future. Right now it is just a system management interface. In the future, that system could enable all sorts of neat stuff. granted, some of the things it can enable are not pleasant. A great many are, however.

Why the scaremongering? Fear sells eyeballs, and eyeballs make money.

Nothing to see here. Move along.

Re:Just as well

[loonycyborg]

But you need to always remember that more money isn't automatically more work done. In practice access to more money leads to their inefficient use. Also, 4 times as much R&D isn't that much if you take possible inefficiency of spending into account. And market capitalization is very subjective measure.

Re:Just as well

[flink]

AMD is the one that came up with x86-64 which Intel subsequently copied. Has anyone ever used an Itanium?

Someone at HP or Intel must have financed a pretty great bender for our operations team in the early 2000s, because we bought in huge to the HP-UX Superdome on Itanium architecture. All we wanted was a platform to host our Tomcat web farm. We ended up supporting our application on that steaming propriety cow pie for about 5 years before we moved to cheap Intel Linux servers.

Re:Just as well

[SumDog]

AMD still dominates the console market. PS4/XBOX anyone?

They also invented the entire AMD64/EMT64 extension to x86 (ironic since their early venture into the market were Intel clones).

Intel uses a lot of anti-competitive practices to keep AMD from dominating, but I think they intentionally stopped short of killing them off. AMD having the console market makes and easy, "Look, we're not anti-competitive. AMD is still in the market, and they're in every gaming console!"

Re:Just as well

[SumDog]

You realize that Intel bought DEC's entire Alpha architecture and killed it right?

(Parts of that architecture made it into the Pentium Pro and later generations)

Re:Just as well

[mschwanke97402]

AMD64 was a set of completely obvious extensions to the Intel X86 model. Expand the existing 32 bit registers to 64 bit and add 64 bit versions of the existing 32 bit instructions as necessary. Nothing earth shaking or even novel. Intel made the mistake of not releasing their 64 bit earlier, and they easily could have, so AMD gets the bragging rights. There are quite a few articles about the whole deal.

Now the lower level bits and pieces that make it all work down deep, AMD has not done a decent core design on their own in years and years, Intel keeps churning out great new core designs every 2-3 years. That's why Intel outsells AMD by far, except perhaps, at the lower performance/price points. You know, in all those budget PCs and the XBox One and PS4.

Re:Just as well

[SumDog]

SD cards have a 32-bit micro-controller on them. They're used to mark bad sectors and keep writes from being on adjacent memory locations (disturbing memory locations a lot on SD cards can corrupt data). There's a talk out there somewhere, where a researcher reprograms the SD cards on-board processor, while keeping it functioning as an SD card. In theory, you could take a 25GB card, have it report it's 15GB and write a small program to make a copy of all writes to a hidden part of the card for retrial later.

Re:Just as well

[malditaenvidia]

Don't the PS4 and Xbone use AMD processors, ya ditz?

Re:Just as well

[MachineShedFred]

This is such overblown pap - the only way to provision Intel AMT / vPro is to either have physical access to the keyboard during reboot, or to have a certificate signed by a trusted provider specifically for provisioning AMT / vPro if you would like to do it over the network. And no, you can't add in your own self-signed nonsense because the CAs that can do this are in the AMT firmware. If you don't get a cert from Verisign / Comodo / etc., the firmware tells you to stick it up your ass and refuses to provision.

Having done manual provisioning, scripted provisioning, and network provisioning in a technology trial for using vPro on a network with ~55,000 PCs spread across the continent, I can say that Intel thought about this "back door" and made it so that you have to go through some extraordinary work in order to use it. And, even then, unless you paid for full-blown vPro on each and every PC, you get access to basically what you could have done with Wake-on-LAN back in the day, with a few extras. With vPro you can do remote control and remote virtual disk mounts, but doing so causes big flashing red and yellow bars on the border of the screen letting a local user know someone's doing it.

Moreover, Intel has been actively marketing this functionality for over 5 years to big business as a way to cut software costs for costly (and shitty) remote control solutions that don't work when the OS is fucked. To think that this is some super secret clandestine operation is complete horseshit.

What an overblown piece of trash this 'article' is.

Re:Just as well

[wisnoskij]

Sort of a ridiculous stance to take. AMD does pretty well for itself. The choice in Processor of graphics card is well understood to be so close that the deciding factor is how you plan on using the PC. At the end of the day, even without the marketing and monopolistic clout that Intel has AMD has managed to stay competitive enough to survive.

Re:Just as well

[MachineShedFred]

Yeah, because as I look over the Amazon EC2 instance types, I see so many that are backed by AMD CPUs.

No wait, they're 100% Intel Xeon.

Re:Just as well

[hairyfeet]

There is actually quite a lot of us because if you were to do a blind A/B test with an FX-8 versus an i5? You wouldn't be able to tell which is which....but your wallet would know the difference.

My FX-8320E when paired with an R9 280 and 16GB of RAM plays all my games with so much bling that I have gotten killed on several occasions because I was too busy gawking at the pretty to notice the enemy coming up behind me, runs very very cool (on air the highest I have ever hit is 122F with all 8 cores slammed doing A/V work) and the whole system, with an SSD and 3TB HDD? Less than $550 after MIR.

When you add to this the fact that AMD has been opening their docs, just as the FOSS community asked them to do, giving massive amounts of code to the community with Vulkan being just one of many, no DRM chips like TPM, oh and you can get their chips for often less than a third an equivalent Intel chip? Its really not a hard choice to make.

Re:Just as well

[MachineShedFred]

Well, for one thing, Intel purchased the remnants of Digital, so any ALPHA come-back would be under Chipzilla.

Re:Just as well

[MachineShedFred]

That's because the design considerations for a console are very different from a desktop PC.

Price is far more of a factor when you are selling the hardware at a loss, and it's undisputed that AMD products are inexpensive in comparison to Intel.

Re:Just as well

[Archtech]

The plain truth is that Intel spends 4 times as much on R&D as AMD generates in revenue.

The plain truth is that there is no necessary correlation between spending on R&D and useful results. It is an unfortunate modern delusion that spending vast amounts of money is somehow meritorious in itself. You see government officials doing it all the time. "We have spent $50 billion of [your] money on this, so congratulate us on a job well done!"

Re:Just as well

[Archtech]

I have always suspected that Itanium was merely a piece of FUD intended to discourage users from buying Alpha systems - which actually worked, and performed extremely well. (First time I tried out an Alpha running VMS, I ran a standard benchmark. Every time I ran the benchmark I just saw the command prompt come up immediately. Eventually I realised that the benchmark was running to completion faster than the terminal could move its carriage mechanism).

Re:Just as well

[Archtech]

Exactly so. For years I used to wonder which was more important: hardware or software. It was after the Alpha debacle that I came to understand that neither is very important compared to marketing.

Re:Just as well

[r1348]

TPM is platform-independent, my HP laptop has an AMD Kaveri APU and a TPM chip.

Re:Just as well

[dunkelfalke]

One would hear the difference. I used to be an AMD only guy for more than a decade, but then Core2Duo came out and suddenly I was able to have a fast CPU without a fan. And even now I have a passive cooled i5 - same cooler BTW as the Core2Duo from years ago.

Re:Just as well

[sjames]

In practice, they do well with heavy parallel computation, especially when measured on a cost per performance basis. It helps that quad socket designs are cheaper for AMD as well.

Re: Just as well

[johnsmithperson123]

Right up until Dozer (that was 2011, 2012) AMD enjoyed from the early 2000s a moderate to significant advantage in the server market, especially for core count and mixed virtualization. After Dozer... well, the entire company went south.

Re:Just as well

[Anonymous Coward]

Funny that you mention illegal tactics of Intel while ignoring AMDs own illegal activities. Neither company are saints.

Re:Just as well

[Anonymous Coward]

Alpha engineers went to AMD, I think to build the 64 bit processors. Those were great, but Intel kept them out of the market with anti-competitive deals and by rigging benchmarks, it seems.

Re:Just as well

[Qzukk]

These days it seems that scammers just take 4GB cards, reprogram them to report that they're 16GB and just let the thing fail when you fill it up. A lot more money to be made that way than the opposite.

Re:Just as well

[reboot246]

Maybe the NSA has already done that "extraordinary work" you speak of.

Re:Just as well

[viperidaenz]

Unless your hard drive is NVMe, then it can scribble all over your storage and main memory.

Re:Just as well

[TeknoHog]

AMD64 was a set of completely obvious extensions to the Intel X86 model. Expand the existing 32 bit registers to 64 bit and add 64 bit versions of the existing 32 bit instructions as necessary. Nothing earth shaking or even novel.

Ideas are a dime a dozen. It's the actual implementation that makes a difference in the real world. If the idea were so obvious, you'd think that Intel would have been in a much better position to bet on the new idea, with all their resources.

It's interesting that after about 14 years of AMD64, we are still haunted by x86-32 in many places with closed binary-only software. For instance, Skype on Linux was only released as a 32-bit binary, so you had to maintain all these ugly compatibility libraries. I wonder how much of this is due to the AMD origins of the architecture, and the subsequent slowness of the Intel and Microsoft camp to adopt it.

Re:Just as well

[Roman Mamedov]

What makes you think the firmware in your PCIe WiFi card also can't access all main memory

Something which is called an IOMMU.

https://en.wikipedia.org/wiki/...
Memory is protected from malicious devices that are attempting DMA attacks and faulty devices that are attempting errant memory transfers because a device cannot read or write to memory that has not been explicitly allocated (mapped) for it. The memory protection is based on the fact that OS running on the CPU (see figure) exclusively controls both the MMU and the IOMMU. The devices are physically unable to circumvent or corrupt configured memory management tables.

Re:Just as well

[_merlin]

I tried to like Alpha, I really did. But it was impossible to like. The DEC Alpha workstations were horribly unreliable - you often had a third of your workstations out of service at any given time due to power supply or mainboard failures. They used far too much power and ran too hot. And Sun UltraSPARC quickly leapfrogged them in performance. Add to that the annoying ISA and horrible weak memory model that made it really hard to do any concurrency, and no-one wanted to touch it. NetBurst was basically an x86 front-end bolted onto an Alpha back-end, and it became evident very quickly that it was a dead end, just like Alpha itself. Alpha got high clock speeds, but not much else.

Re:Just as well

[dgatwood]

It's fascinating, really. The main reason RC is less popular is that it is available in fewer locations and has less shelf space allocated to it in the locations where it is available. Why is it available in fewer locations, you might ask, and why does it have less shelf space? Because it is less popular.

I don't think the same applies to AMD, though.

Re:Just as well

[Fragnet]

That's a really quite ridiculous assertion.

Re:Just as well

[Fragnet]

Depends what you're encoding. Intel chips with onboard HD graphics have QuickSync for H264 encoding and decoding. I expect it'll go 10 bit soon too. The encoding and decoding performance is quite stunning.

Re:Just as well

[Bengie]

AMD didn't come up with x86-64, a specific person that AMD hired came up with it. And immediately after that person left, AMD created the netburst version of their CPUs. I was reading that with the new AMD Zen, AMD pretty much left everything up to the engineers and had them start over with a clean slate. Only time will tell, but from what I'm reading, it will likely pay off in spades.

Re:Just as well

[yusing]

Hell, Commodore 1541 floppy drives contained their own 6502 for an on-board DOS. Programming the drive was a hot topic for years.

Re:Just as well

[hairyfeet]

FUD the ONLY chips that have the ARM core are the 4 that were based on the consoles, even the AMD page on the subject hasn't been updated since 2013, why? Because they only bought the ARM DRM for the consoles that demanded it and never bothered to do anything else with it.

So its only there if you buy one of the 4 ULV chips based on Jaguar, and even then there is no known software in the wild that can even access it. Its a leftover from their deal with the consoles and the only chips you can buy with it are ones that didn't pass muster to be included in the consoles.

Now that said I've built a couple HTPCs using the Jag and they run just fine, one is running Win 8 (the only place Metro makes sense, a 10 foot UI) and the other is running OpenELEC Linux and both run great, if all you are needing is an ULV HTPC for 1080P video or a media server you can stuff in a closet? Works good for that purpose, but the ARM chip isn't an issue.

Re:Just as well

[Pseudonym]

AMD64 was a set of completely obvious extensions to the Intel X86 model.

I sometimes think that AMD's genius isn't what they added, but what they dropped by design. If it had been up to Intel, x86-64 would have a 64-bit "real mode", an even more complicated TSS, and yet another incompatible segmentation type.

Re:Just as well

[Narcocide]

Except you're wrong because that "60%" you're talking about is those very same aforementioned illegally sabotaged benchmarks. In reality its 5-10% at most for any actually fair empirical or relevant real-world test.

Re:Just as well

[Narcocide]

Spoken like someone who has agonized and studied every 3rd party benchmark ever posted to tomshardware or phoronix but never once tried to recreate one himself using something other than the Intel compiler.

Re:Just as well

[Narcocide]

Yea, not only those but a rather large majority of the previous few generations of consoles primarily feature AMD/ATi hardware. I believe ATi video cards also held a significant marketshare of OEM PC installations before losing some contract with Dell to Intel.

Re:Just as well

[Narcocide]

Ah yes, back in the days when your sound card was a bonus feature of your disk drive...

Re:Just as well

[inode_buddha]

Um, no. Compaq bought DEC, and was in turn bought out by HP. WTF did anyone get the idea that intel bought alpha???

Re:Just as well

[ChrisMaple]

AMD is losing a half billion dollars a year. It's a miracle their creditors don't shut them down.

Re:Just as well

[cm5oom]

Why do people keep bringing up amd64 as if that some how invalidates the hundreds if not thousands of things intel as done over the last 50 years. Other than amd64 what has amd done in the last 10 years, a big fat nothing that's what. Who brought us the core duo, the core 2 duo, the core 2 quad, nehalem, sandy bridge, need I go on? The fact that everybody uses that one thing amd did over a decade ago to defend them should be a big flashing warning sign that the company is not very relevant in todays market. Stop living in the past.

Re:Just as well

[Dorianny]

AMD is a cheap knockoff whose entire design philosophy revolves around avoiding patent and copyright lawsuits from Intel. Its in house technology is extremely inferior. The only good thing they can possibly do for the market now is to completely open up all development resources.

And, let's bring back the alpha chip. It already is superior to Intel. Always has been.

And GODDAMMIT! Where's our 3D printers that can print homemade computers? We were supposed to have that shit 30 years ago.

Really... Its not like they are the one that made the AMD_64 instruction set that was then in turn licensed to intel... While its manufacturing technique is inferior that is because the brain-dead executives sold off their fab and they now have to contract with someone else to do it. As for bringing back ALPHA it may have been superior then they stopped developing it in 2001. Intel/AMD have come a long way in 15 years.

AMD had some very large maturing-bonds repayments coming up at the time. Effectively frozen out of the debt-market and without Investors willing to inject new capital AMD had to choose between selling assets or declaring bankruptcy. Selling and leasing back non-liquid assets is used often by companies that need money but are shut out of the debt-markets because of over-leverage or other issues with with the business. It is essentially a secure loan backed by collateral

Re:Just as well

[marcansoft]

The ARM has nothing to do with game consoles. The PS4 and the Xbox One don't even use the ARM for their secure boot/DRM, they use something else (the PS4 uses the SAMU which is an LM32 derivative core inside the GPU portion, and I think the Xbox One uses more custom stuff). Read this libreboot page; the ARM is required to boot any modern AMD chip. Or this if you want a reference from AMD from last year. The PSP is very much alive and well and required to boot modern AMD chips.

Re:Just as well

[Anonymous Coward]

NetBurst was basically an x86 front-end bolted onto an Alpha back-end

I'm calling bullshit on this assertion. Willamette, the first NetBurst CPU, was released in 2000. The Alpha intellectual property wasn't sold to Intel until 2001. Now, it's true that Alpha became Compaq's property in 1998, but considering the lead time required from initial design to tape out to production, I simply cannot believe that NetBurst had an Alpha back-end.

Re:Just as well

[Cederic]

While true, it's also true that without doing any R&D you tend to find yourself short on new products.

Give me $5bn on R&D and I promise I'll give you a more valuable new product opportunity than if you give me $5m

I don't promise I'll give you a positive ROI ;)

Re:Just as well

[Anonymous Coward]

There is (or was, not sure if it has been relaxed) a rule that the DOD requires at least two sources for any component. Kill off your competitor, and suddenly you can't bid on any DOD contracts.

If I recall correctly, that was how AMD got a license to the x86 patents in the first place. Intel needed a competitor that could be a second source to be allowed to bid on DOD contracts.

Re:Just as well

[AmiMoJo]

If you are going to that level of paranoia though you can't trust anything on your computer. We know that the NSA intercepts hardware being shipped to customers and tampers with it, so you can't trust your BIOS, your GPU firmware, the CPU microcode, the HDD firmware...

Re:Just as well

[Archtech]

Working at DEC in 1992-3, I never saw anything like that. The Alpha computers I used were exactly like their VAX predecessors except that they ran a whole lot faster. No unreliability, no overheating. Perhaps your experience was running Ultrix, which was always an unhappy compromise - like all proprietary version of Unix.

My assessment, as a 20-year DEC employee, was that Alpha was perhaps the greatest hardware achievement the company ever brought off.

Re:Just as well

[_merlin]

That's quite a bit earlier than my experience with them - I only dealt with Alpha workstations (not servers), running Ultrix (not VMS), and towards the end of their run. It's possible they'd gone downhill by then.

Re:Just as well

[TheRaven64]

That's not an entirely fair comparison, as Intel is in a lot more markets than AMD. If the world decided to stop buying x86 processors tomorrow, then AMD would be completely sunk (or, close to, depending on how well their ARMv8 chips sell), whereas Intel would just shut down a few divisions. The majority of Intel's R&D spend is on process technology. This is why they're usually a generation ahead of their competition on fabs. AMD, in contrast, outsources the production and so this R&D money shows up as an expense on their balance sheet and is shared with other companies that fab chips in the same foundries as AMD.

Re:Just as well

[nhat11]

As mentioned in other ./ posters here, AMT is an advertised feature and AMD have some extra chips too. This is some tin foiled hat article

Re:Just as well

[dwye]

It has less shelf space because they don't pay the stores enough to get more shelf space.

As to them beating Pepsi or Coke in taste tests, whose tests? Pepsi;s tests showed them beating Coke at the same time that Coke's tests showed Coke was preferred by people drinking more than a small cup at a time. This rather implies that test design is as important as the wording on political polls in determining the outcomes, that it, _very_ important.

Re:Just as well

[allo]

what have the romans ever done for us?

Re:Just as well

[cm5oom]

That was kind of my point. I mean what has intel done for the pc platform? I'm just here shilling for a company that's never done anything to make x86 better mean while amd did that one thing a decade ago that everybody won't shut up about.

Re:Just as well

[Junta]

They were pretty much that way back in the day, but around the time of Netburst they came into their own. Intel course corrected to a good architecture as of Nehalem and AMD went down a very wrong path in Bulldozer, relegating them to the current state of affairs.

Re:Just as well

[thegarbz]

I think it may have a lot more to do with the "if it ain't broken don't fix it" crowd. I mean there's a lot of software that really doesn't gain any benefit from being re-compiled as 64bit, and then what came first the ugly compatibility library or the software using it? That answer is obvious and when the compatibility libraries are there, why bother?

Re:Just as well

[TeknoHog]

I sometimes think that AMD's genius isn't what they added, but what they dropped by design. If it had been up to Intel, x86-64 would have a 64-bit "real mode", an even more complicated TSS, and yet another incompatible segmentation type.

This. AMD64 feels cleaner in some sense, though I'm not qualified to comment on the details of memory management. For example, consider the x32 initiative that was floated around the Linux community in the past few years: using the AMD64 ISA with only 32-bit pointers. The idea was that it would speed up a lot of software, and the 4 GB limit per process would not hurt most users. To me this seemed like a step backwards: just as we finally got a nice flat memory space, these guys want to go back to something like segmentation or PAE for a small performance increase.

Re:Just as well

[TeknoHog]

One would hear the difference. I used to be an AMD only guy for more than a decade, but then Core2Duo came out and suddenly I was able to have a fast CPU without a fan. And even now I have a passive cooled i5 - same cooler BTW as the Core2Duo from years ago.

I also had a passive cooled C2D, T7200 to be precise. For a lot of workloads, it was much faster than the Ci5 in my newer laptop. Unfortunately, I needed a better motherboard and more than 3 GB of memory, none of which were available with the suitable chipset and socket.

Intel clearly has the lead in power efficiency, so I generally prefer it for mobile/fanless uses. AMD for everything else -- besides the pricing, they have much less artificial market segmentation.

Re:Just as well

[MachineShedFred]

Ok good - they can provision AMT and vPro on your PC. They still can't remote observe without you knowing about it, because of big flashing yellow and red bars on the sides of the screen. Or, if you're using a non-Intel GPU, it just doesn't work.

The only possible way to get this to remotely execute code is to mount a bootable ISO as an optical disk, force a reboot to it, and have your ISO do things. But that's an incredibly convoluted (and obvious) way to "exploiting" a system when there's 100 easier ways through known software flaws. And, completely useless if you've done something very mundane, like encrypt the disk.

In order to use vPro as an attack vector, you'd have to stack up a ridiculous amount of flaws and attacks, that it's just not worth the time and effort.

Re:Just as well

[StuffMaster]

Intel's dominance was due to illegal tactics when netburst was their thing. Since Core 2, and especially since Nehalem, they've been tops in per-core performance. Then AMD pulled a Netburst and created Bulldozer and haven't been even close to competitive.

I know they don't have the resources to compete equally, but I'd really like AMD to be a contender again.

Re:Just as well

[Coren22]

If you feel this is true, link to a single benchmark that doesn't use the intel compiler, and shows an AMD chip outperforming the i7-5960x. Otherwise, you are just blowing smoke.

https://www.spec.org/cgi-bin/o...

Feel free to point out any AMD processors that beat out the i7-5960X at 394.

Re:Just as well

[Coren22]

Yeah, TPM is a hardware encryption chip, it could be used for DRM, but mostly it is used to store the hard disk encryption keys so you can boot Windows without having to type in a decryption password.

Re:Just as well

[MobyTurbo]

Like most Intel features AMD has the same thing in their chips, PSP they call it. "platform security processor", it peforms exactly the same function as IME, and happens to also use a seperate CPU just like Intel does for it.

Re:Just as well

[cm5oom]

Thank you for being a prime example of what I'm talking about.

Re:Just as well

[NotAPK]

You're absolutely right, we can't.

But do not be surprised that some people want to talk about it. And certainly do not be surprised when foreign nations decide not to buy US hardware and software. I'm not saying Chinese hardware is any more innocent, that's not the point I'm making, the decision that the NSA made (was anyone consulted?) to subvert the security of every PC on the planet will have repercussions. And this will have significant impact on the IT economy of the US.

As an individual wanting to use a trusted computing platform, for my own computing needs and those of my small business, I now have to look far and wide for hardware I can trust. Personally I'm keeping a close eye on the Russian effort to shrug off x86 dependence.

Re:Just as well

[andrew71]

Almost a century has passed - at least that's what it feels like - and still we don't seem to have learned that the drive was called 154I (with a final capital "i") :-)

Re: Just as well

[KenHansen]

They are the Microsoft of the CPU world.

Most companies would love to become 'the Microsoft' of their industry.

Every OEM has been told by Intel "If you buy from anyone other than us, then, in the future, you may find that we are unable to supply you with the parts you need"

Those bastards! Publicly admitting to treating loyal customers that exclusively use only their parts better service! BTW, "every OEM" I am aware of has offerings that use both AMD and Intel CPUs.

Re: Just as well

[KenHansen]

Ironically, RC scores better in blind taste tests than Coca-Cola and Pepsi.

But honestly, how big is the blind soda drinker market?

Re:Just as well

[mschwanke97402]

Intel actually did have x64 in-house. They decided there was no need for it and sat on it. They were right in that regard too. There was little, to no, actual 64 bit software to run on the AMD64 processors. Server stuff, OK, but nothing on the desktop. The old chicken/egg conundrum. Recall that the original Windows XP 64 bit was really Server 2003 64 bit in consumer clothing. A real hot mess that was.

Anyway, even though it was more of a marketing ploy at the time, AMD deserves credit for moving the market along a bit, my point was that they didn't really invent anything earth-shattering. Everyone in the business knew what x64 would look like it was just the waiting to see it realized that was hard.

Re:Just as well

[mschwanke97402]

Obvious as in we'd all been there, done that several times when we moved from 8 bit to 16 bit to 32 bit. In order to maintain the Intel ISA compatibility going forward you are constrained to doing things a certain way. It is fairly obvious. Remember that when you parse it all down to basics, AMD is a licensee of Intel, as in, they have paid for the right to copy Intel's processor architecture.

As I said earlier, when it comes to implementing that architecture, down at the microcode and pipeline level things are different. That's where it isn't at all obvious and innovation and hard work can really matter. Ten years ago AMD was eating Intel's lunch because their micro-architecture was so much better.. I do give them credit where it is due.

Nowadays, AMD's cores aren't nearly as good as Intel's. Intel outspends AMD by far, year in and year out, on their R&D. AMD does cost less and that is a good reason to choose them for some purposes. I will continue to choose Intel when performance, heat and power consumption concern me.

Re:Just as well

[djl4570]

Compac sold the Alpha IP to Intel in June 2001. HP announced the acquisition of Compaq in September of 2001.
http://www.zdnet.com/article/a...

Nefarious Headline for Practical Feature

[Anonymous Coward]

This is key to enabling low-power functionality in Intel CPUs - think quick boot and quality testing. It doesn't have any surveillance or other purposes.

Re:Nefarious Headline for Practical Feature

[BlackPignouf]

Sure, and there's no way it could be used by three letter agencies, ever.

Re:Nefarious Headline for Practical Feature

[NotInHere]

I think the critical part is that intel doesn't let anyone write code for that chip, basically making it a black box.

BUT I think its better to have it in the hands of Intel than, say, Microsoft.

Re:Nefarious Headline for Practical Feature

[LynnwoodRooster]

Why do that when you can just get the OS vendors to give you backdoors and control? That way you can access everyone, not just the few that have this extra hardware feature...

Re:Nefarious Headline for Practical Feature

[Yvan256]

You really think AMD will mess around with Intel's CPU?

Re:Nefarious Headline for Practical Feature

[fph il quozientatore]

You probably made a typo -- the keys for "just the few" and "all of them" are close-by on the keyboard, after all.

Re:Nefarious Headline for Practical Feature

[BronsCon]

On one hand, I think this whole thing is overblown. On the other hand, playing devil's advocate, the TLAs can't access a machine that is powered down; this potentially allows them to turn it on remotely.

Re:Nefarious Headline for Practical Feature

[almechist]

This is key to enabling low-power functionality in Intel CPUs - think quick boot and quality testing. It doesn't have any surveillance or other purposes.

None that you know of. The point of the article is that there has been no way to be sure about what's really in there and what isn't. The code appears to have been deliberately obfuscated by Intel at a hardware level. It's true that this subsystem is not new and has been known about for years, but I gather the point of the article is not to announce its existence, rather he wants to say that he has figured out some (but not all) of the subsystem's functionality that was previously hidden, and he wants to eventually replace the whole thing with open source equivalents so that people will know for certain that there are indeed no Three Letter Agency backdoors. I think. I really only skimmed the article.

Re:Nefarious Headline for Practical Feature

[skids]

I'm sure it can be used, just like the rest of the hardware "can be used."

But these things in one form or another have been around for over two decades and everyone who has ever set up real server hardware from scratch knows they're there and their existence has never been a secret. (The closed-source code they run, on the other hand...) It's not even "news" that chipset manufacturers have started to integrate these systems directly into CPUs.

The earliest one of these I remember was called iLOM on a Sun Systems but I'm sure they predate that. Just LOM and ILO are other names I've seen.

Once desktops started to need active runtime heat management, many of them got a "systems management" co-processor that helped with thermal/power control.

Personally I'd be just as worried about whatever firmware is running on the ethernet card these days... which is to say, not very, because there's not much to be done about it, unless you have the reason and time to invest in completely open hardware from top to bottom and the willingness to live within the limitations that might entail. So while I would normally suggest the mildly paranoid just not use the onboard ethernet ports, I can't say I really trust ethernet cards, either.

Also since there are so many gaping holes just staring me in the face in commercial OSes when it comes to (software) VPN and WPA drivers, I figure it'll be a long, long time before I can get around to finessing things down to the metal, if ever.

Re:Nefarious Headline for Practical Feature

[guruevi]

There are already many platforms (even some workstation/desktop class) that have IPMI or similar remote support. There are similar constructs in the "standard" ACPI (after all, Microsoft made it). If you could hack those chips, yes, you could run whatever you wanted on them and it's a real threat. This is not a feature that Intel is 'hiding', it's actually advertising the feature.

Re:Nefarious Headline for Practical Feature

[bws111]

They have been around a lot longer than that. Mainframes have had 'service elements' and 'support processors' for at least 40 years. And those things can do a heck of a lot more than the Intel AMT stuff. Like alter/display ANY register or ANY storage.

Re:Nefarious Headline for Practical Feature

[ausekilis]

Just wait for Facebook or Google to take advantage of it.

Re:Nefarious Headline for Practical Feature

[LynnwoodRooster]

So all PCs use Intel processors? And all Intel processors made in the last 15 years have this feature?

Re:Nefarious Headline for Practical Feature

[slew]

On one hand, I think this whole thing is overblown. On the other hand, playing devil's advocate, the TLAs can't access a machine that is powered down; this potentially allows them to turn it on remotely.

There are many levels of "powered-down". Many enterprise PC have had wake-on-lan and pxe-boot for a while. Often these are simply controlled via bios settings (which we know are completely secure against TLAs)...

Quick shut the barn doors, the horses have escaped!

Re:Nefarious Headline for Practical Feature

[lgw]

Everything has secondary processors, has forever. What's interesting is that this secondary processor has a TCP stack for remote management - an actual feature lots of people use. I don't know if AMDs are the same, but it wouldn't surprise me.

Re:Nefarious Headline for Practical Feature

[BronsCon]

This guy gets it.

This whole story is about as non-story as it gets.

Re:Nefarious Headline for Practical Feature

[SeattleLawGuy]

Why do that when you can just get the OS vendors to give you backdoors and control? That way you can access everyone, not just the few that have this extra hardware feature...

Some three-letter agencies (US and foreign) have better access to (or can make less detectable modification of) hardware manufacture than to O/S code. Think how complicated the logistical operation would be to make sure you had a really secure computer.

Re:Nefarious Headline for Practical Feature

[AmiMoJo]

Just to put in perspective how much of a non story this is, since the late 90s Intel CPUs have allowed their microcode to be updated by the BIOS or the OS. The CPU itself can be reprogrammed in an undetectable way to betray you.

So can a dozen or more other parts of the computer. Your hard drive/SSD is a prime target. We have seen proof of concept malware running on a GPU.

Re:Nefarious Headline for Practical Feature

[swalve]

No. http://www.tomshardware.com/re... Also, we've known about this for like a decade.

Re:Nefarious Headline for Practical Feature

[fph il quozientatore]

All Intel processors made in the last 10 years have it: https://libreboot.org/faq/#int... All AMD processors made in the last 3 years have it: https://libreboot.org/faq/#amd I am not sure about ARMs, but they also have something called "security engine", and I can find very little info about them on the internet.

This isn't New

[Anonymous Coward]

PCs have been shipping with IME for several years now. Has this person been living under a rock?

Re:This isn't New

[rickb928]

Agreed, I had been using IME for long time. This is not new. In fact, it's so old I expect that if it were compromised, those exploits are in their 3rd generation by now. The one where sovereign hackers usurp the previously installed tools and the fight is for the C&C net.

And I suspect it has been tried, repeatedly. By everyone of note.

Re:This isn't New

[GameboyRMH]

I'd be surprised if the spooks don't have an exploit for it for targeted use, but as you point out, nothing has been found in the wild for all these years, so the cost/benefit is obviously not good enough for your average blackhat. Software-only APTs are good enough and don't rely on proprietary hardware features.

There was a conspiracy theory going around when it was new that the IME included a GSM modem (and presumably a hidden SIM card tied to a subscription paid for by the Illuminati) and could be used for out-of-band remote control of your computer.

Re:This isn't New

[Rockoon]

PCs have been shipping with IME for several years now. Has this person been living under a rock?

..and its still not audited. Have you been living under a rock?

Don't Blame Me

[T.E.D.]

...I voted AMD.

Re:Don't Blame Me

[CajunArson]

Don't worry, they have their own cloned version of the same thing.

Incidentally, most ARM smartphone chips also include similar functionality, but apparently it's only a big deal when a desktop PC has "OMG NSA" parts and not the audio/video recording device with wireless tracking capabilities that the same paranoid idiots carry around with them everywhere they go.

Re:Don't Blame Me

[Yvan256]

I voted VIA.

Re:Don't Blame Me

[Yvan256]

Also turn off Javascript.

And CSS.

Re:Don't Blame Me

[Narcocide]

You're forgiven, but just this once.

No need to verify story

[ranton]

Editor's note: The summary is written with inputs from an anonymous reader, who also shared the story. We've been unable to verify the claims made by the author.

Everyone is used to getting their news from social media anyway, so why bother verifying the claims before posting it as news?

Re:No need to verify story

[ceoyoyo]

This is a discussion site not the New York Times. It's perfectly acceptable to post a rumor or unverified claim. It's good that they identified it as such... usually the Slashdot editor just clicks publish on whatever swill caught his eye in the submissions.

Re:No need to verify story

[thegarbz]

Editor's note: The summary is written with inputs from an anonymous reader, who also shared the story. We've been unable to verify the claims made by the author.

Everyone is used to getting their news from social media anyway, so why bother verifying the claims before posting it as news?

I'd like to go the other way, why are we adding an "unverified" disclaimer to something that has been known about for many years? Intel aren't hiding anything. The existence of this miraculous CPU is documented on their website and it's function is accessible using their provided tools. Heck AMD do it too they just happen to call it PSP instead of IME. The only thing they are hiding is what's in their firmware which everyone has done for a long long time.

Comment removed

[account_deleted]

Comment removed based on user account deletion

Old news

[psergiu]

https://libreboot.org/faq/#int...

https://libreboot.org/faq/#amd

Both Intel and AMD had this for years - read above links ...

Re:Old news

[dissy]

The ME [Intel Management Engine] also has network access with its own MAC address through an Intel Gigabit Ethernet Controller.

How would I not notice this in my router or edge device logs?

Mainly only by not looking.

That may sound stupid at first glance, but the fact Intel AMT articles keep popping up a decade later written as some form of surprise that the feature exists seems to prove most people don't bother looking.

ME/AMT utilizes HTTPS by default on port 16993, can support HTTP by default on port 16992, and VNC protocol on I believe it's default port (I've never had to specify an alternate port in the VNC client to connect)

Also of note is that older ME versions don't let you upload your own SSL certificate for HTTPS, and although I may be wrong but I'm fairly sure VNC by default is not encrypted either.

This means someone in your posistion of control over the core and edge network would both see this traffic if looking, and potentially be able to setup a MITM to obtain the ME/AMT login credentials fairly easily depending on your desktop admins setup.

Normally LAN to LAN traffic over a proper switched network is relatively safe, seeing that an ARP storm to a switch for redirecting LAN traffic would ALSO be noticed by you the network admin, and ideally has been proactively prevented as well.

For desktop admins and/or network admins without this knowledge or skill however, if the LAN doesn't prevent or log/notify about such things, ideally the ME/AMT hasn't been enabled either.

Only those with a tiny amount of knowledge (just enough to be dangerous) are likely to shoot themselves in the foot with a horribly insecure setup.

Re:Old news

[meadow]

reading the first link it says:

... it has a network interface that is demonstrably insecure ...

Obviously no one is going to expose an AMT port through a firewall without taking precautions. That article sounds a little disingenuous to me as though they deliberately want to slam AMT technology.

I've always looked at AMT as a sort of built in Cyclades serial console server and the main feature I actually like about it is in fact the Serial Over LAN (SOL) feature. Every technology has risks but I think that this article might be deliberately alarmist.

Re:Old news

[mrchaotica]

Somebody needs to hack Intel and AMD and release their private keys and source code.

Re:Old news

[meadow]

The other thing is that you actually want and need to set a static address for the AMT interface for obvious reasons: If you use either Manageability Commander Tool or the web interface, you need to know where to connect to. It won't even let you activate the interface without setting a secure password (strong password policy is enforced and cannot be bypassed).

On my home systems I don't expose the AMT interface to the outside via my router, but if I were at a company I would have a special, secure log-in machine to access from outside to which the AMT systems would be exposed internally.

Re:Old news

[skids]

Normally LAN to LAN traffic over a proper switched network is relatively safe, seeing that an ARP storm to a switch for redirecting LAN traffic would ALSO be noticed by you the network admin, and ideally has been proactively prevented as well.

Storms maybe, but just try to secure a server core where the systems guys want to just keep moving VMs from hypervisor to hypervisor from even just plain old arp spoofing, and I'll see you a year or so later crawling out of the dot1Qaw rabbit hole looking for a career change to something that involves staring calmly at growing plant life.

Re:Old news

[skids]

Sure, but it totally does not make life easy for network security, let me tell you.

Re:Old news

[skids]

Sorry, cut-pasto, dot1Qbg. Though my understanding is a lot of places these days throw that in the trash and just fire up a bunch of GRE tunnels.

Yawn

[Simon Rowe]

Looks to be a regurgitation of Joanna's paper http://blog.invisiblethings.or...

What the fuck?

[110010001000]

This has been known for years and is present on Intel and AMD. What year is this?

Re:What the fuck?

[Yvan256]

And we're safe anyway. It's really easy to know what's dangerous or not on the Internet since the creation of the evil bit.

"Trusted"

[Fwipp]

From the article:

We have no physical separation between the components that we can trust and the untrusted ME components, so we can't even cut them off the mainboard anymore.

Why do you trust the main CPU, if you don't trust the ME chip?

Re:"Trusted"

[ras]

Why do you trust the main CPU, if you don't trust the ME chip?

Because hardware designers making the odd mistake is just normal. I've spent a fair portion of my life papering over their mistakes, always successfully. But to fuck things up beyond redemption; that requires a computer programmer - just ask the patients treated by Therac 25.

Re:"Trusted"

[The Finn]

Just like RMS has with his Loongson laptop, right?

This was mentioned a long time ago

[dayton967]

This was mentioned along time ago with the VPro Chips having a cellular modem built in.
https://www.popularresistance....

Out of band management

[kimvette]

This is for out of band management so devices can be monitored and restarted remotely (think: enterprise environments). Nothing to get wrinkles in your tin hat over. :)

Re:Out of band management

[Carewolf]

This is for out of band management so devices can be monitored and restarted remotely (think: enterprise environments). Nothing to get wrinkles in your tin hat over. :)

Yes, it is only for monitoring and controlling your computer remotely. Nothing to see here, nothing to worry about, move along please..

Illegal?

[DoofusOfDeath]

If it's really there and Intel has hidden it, I wonder if they could be successfully prosecuted for conspiracy to commit unauthorized computer access.

Re:Illegal?

[Richard_at_work]

Only if you can prove they are using it without your authorisation. It simply existing is not enough.

Re:Illegal?

[DoofusOfDeath]

Only if you can prove they are using it without your authorisation. It simply existing is not enough.

IANAL, but I wonder if "Conspiracy with intent to ..." would be a crime in this case.

Re:Illegal?

[Richard_at_work]

Prove the conspiracy, and prove the intent - Intel has a huge amount of resources setup around this for enterprise systems management, so you have a massive uphill (almost a vertical cliff one might say) battle to climb in order to prove any malicious intent here.

Just because you dont like it, doesnt mean anything illegal is being done.

Re:Illegal?

[DoofusOfDeath]

Just because you dont like it, doesnt mean anything illegal is being done.

I agree entirely. My questions were premised on the assumption that Intel was being sneaky about the existence of this mechanism. I'm new to this topic, so I really don't know if that premise holds.

Re:Illegal?

[Richard_at_work]

But you still have to prove conspiracy - who did they conspire with and where is the evidence that they conspired together on this? Mens Rea wasn't even in my mind.

Now who clearly doesn't know what they are talking about?

Here's the thing

[H3lldr0p]

I don't like the idea of a computer inside my computer I don't have any control over.

I find the article a little on the high side of paranoia, however. Yes, it is possible to have unnamed people from unnamed places get in and get data from your system. The article does go out of it's way to point out that this isn't very likely. The firmware running the second CPU is heavily encrypted and hash-checked at runtime. Making it unlikely to be broken until the heat-death of the universe or we finally figure out the P=NP thing.

Conversely, I'd like to know what's going on under the cover Intel. If this is in the stuff I bought, I figure I have a legal right to be able to access it and run an audit on it. Without having to go through you. Conflict of interest and right of first sale and a few more things spring to mind as to why that's not a something I'd want to do.

Re:Here's the thing

[Obfuscant]

I don't like the idea of a computer inside my computer I don't have any control over.

Then you are destined for a life of unhappiness. Most of the I/O processing in your "computer" is done by dedicated computers that you have no control over. The video card, the network card, the IEEE1394 or USB.b The disk drives. Even the audio. Things that have DMA so they an access memory without the CPU knowing about it...

You may look at the device and see a part number that you can look up, but dollars to donuts that the part is programmable in some way that makes it be what it is. FPGA, perhaps. Or just a microprocessor with firmware in EEPROM.

I figure I have a legal right to be able to access it and run an audit on it.

If they make it so you can "audit" it (whatever that means) then they've made it accessible to bad guys, too.

Conflict of interest and right of first sale and a few more things spring to mind as to why that's not a something I'd want to do.

How do you imagine that this "unauditable" CPU is hindering you from reselling the computer? I'm really fascinated to hear the reasoning behind that.

Re:Here's the thing

[Nemyst]

Why are you assuming you have control over your current computer? Your CPU/GPU/whatever isn't any more open than that "CPU in a CPU". Your motherboard isn't open either. There's absolutely no reason why you'd trust one but not the other, considering they come from the same designer and the same fabs.

Re:Here's the thing

[The Finn]

Of course mask ROM (or its modern equivalent) is still used. All the embedded microcontrollers in CPUs, chipsets, and IO controllers at least have bootloaders if not default firmware.

Love and use AMT

[meadow]

I love AMT. AMT is definitely one feature of the Dell Optiplex small form-factor systems that I like to use for my headless home servers. Its like having a built-in Cyclades serial console server. For running headless systems its almost essential.

The only thing I don't like about it is that you need to have Windows installed to be able to update it as part of the updates released by Dell.

Re: Love and use AMT

[ArmoredDragon]

I use AMT a lot as well, and have for years. My main question here is: How the fuck is this even remotely news material? Furthermore, why is it presented as some sort of conspiracy? Intel advertises this as a feature and never made any attempt to hide it. AMT is also off by default, by the way.

The only Intel feature I'm at all concerned about is SGX, which by design can't be audited, and has nothing to do with anything mentioned in TFS.

Re: Love and use AMT

[meadow]

I use AMT a lot as well, and have for years. My main question here is: How the fuck is this even remotely news material? Furthermore, why is it presented as some sort of conspiracy? Intel advertises this as a feature and never made any attempt to hide it. AMT is also off by default, by the way.

The only Intel feature I'm at all concerned about is SGX, which by design can't be audited, and has nothing to do with anything mentioned in TFS.

I agree. Seems like shitty "news" curating on the part of /.

Re: Love and use AMT

[meadow]

Maybe the next /. story will be how all mobile devices have a secret, hidden OS called the bootloader that can be compromised by three-letter agencies...

Re: Love and use AMT

[dfsmith]

Did you know that some doors—maybe even your door—can be opened by using a MASTER KEY! This, and other secret conspiracies, at 11...

true

[dissy]

Editor's note: The summary is written with inputs from an anonymous reader, who also shared the story. We've been unable to verify the claims made by the author.

Uh, the claims are quite true. I've been using these features at work for about a decade to perform remote OS installs and HD re-imaging at remote locations, where the on-site staff only pop in a new blank HD.

All Core i7 CPUs have this in them standard, and many i5's too especially at the higher end.

[PDF] Datasheet on the MEBX management engine:
http://download.intel.com/supp...

[PDF] How to enable and use the AMT active management engine:
http://www.intel.com/content/d...

And here is the SCS software used on another computer to control an AMT enabled computer:
http://www.intel.com/content/w...

RealVNC works with an AMT enabled computer out of the box too and with all the normal features you would expect like remote keyboard/video/mouse control, redirected drives, etc. But isn't a free program.

Other VNC clients seem to be hit or miss but even when they work you only get remote KVM, you'd have to use the built-in AMT web server to configure drive redirection and issue power on/off/reboot commands.
There is a similarly limited VNC client included in the SCS software link above, and a second web browser window will let you do the rest, even if slightly clunky, but still for free.

Re:true

[sinij]

If AMT is enabled by default, why don't we see widespread compromises?

Re:true

[dissy]

Because it is not enabled by default.

You need to know how to get to the configuration menu, then enable the engine, then assign it a method to access the network (either static IP on a unique MAC, or to piggyback on the host OS's MAC), and set a password.

Only then are the ports opened for the HTTPS interface on port 16993 to continue the rest of the setup or use AMT.

On boot (where you normally can hit Delete or a function key to enter bios setup), hold down control-p to get to the ME setup menu.
Assuming you aren't at work or something and using your own computer, you'll see it is disabled.

Re:true

[kheldan]

This is all true. You can disable the ME coprocessor in BIOS settings. You also aren't required to install the ME driver in your (Windows) OS in order for Windows to function.

Could the ME coprocessor/firmware be compromised by an attacker? Maybe. But it can all be disabled. It's firmware could also be hacked out of the BIOS entirely without compromising the operation of the rest of the system.

The ME is mainly for remote administration/management of corporate systems. It allows access to the machine remotely even in the event of a hardware failure, like the HDD failing completely. It can bring the system out of a completely powered-off state, so long as the box is still connected to the mains and the switch in the back is still 'on'. But so far as I know it's not necessary for the rest of the computer to operate.

Re:true

[rahvin112]

You forgot the part where you write Intel a big fat check to use the feature. Intel charges big bucks for vPro software and these features are part of vPro and you can't enable them without the vPro software. IIRC it's all tied to a digital signature that Intel controls and you can't even look at it without giving Intel money.

Intel is making a pretty chunk of change on their enterprise management software that uses features built into their CPU's which are normally disabled. Intel is going to keep building more and more enterprise big brother abilities into their hardware and charging big money for the software to use it. It's proved a rather lucrative addition to their hardware business.

Re:true

[hyades1]

A cynic might suggest that their self-proclaimed inability to verify the claims of the author is a pretty bold statement about their level of competence.

Re:true

[dissy]

You forgot the part where you write Intel a big fat check to use the feature. Intel charges big bucks for vPro software and these features are part of vPro and you can't enable them without the vPro software. IIRC it's all tied to a digital signature that Intel controls and you can't even look at it without giving Intel money.

I didn't forget it, because that isn't true.

The control software is free. I didn't pay for my web browser, VNC client, or the intel SCS client (I even have you the download link)

The firmware is already included in any vPro CPU, you turn it on by holding control-p at boot.

I've even played with this feature at home on my own hardware before deploying it at work. Other than having purchased the computer/CPU, there is no further cost.

I'm not sure where you got your information from but it is certainly incorrect.

Re:true

[AbRASiON]

With RealVNC - can I remote into a machine which is still at the bios / boot stage?

Re:true

[dissy]

With RealVNC - can I remote into a machine which is still at the bios / boot stage?

Yup, AMT can provide remote access when the system is in any of its sleep states from s0 (fully on) down to s5 (powered off), so long as the system is plugged in and has power available.

You will see the whole BIOS bootup sequence, including seeing and able to send the usual interrupt keys like del or F9 or whatever to get to BIOS setup.

I've had some older HP workstations be a little funky between the BIOS setup and the OS taking using the GPU. Generally I'll see a screen flash and get disconnected, after which VNC reconnects immediately and all is well again.
Newer HPs we have haven't done this that I recall, nor have the Dells or my home built franken-pc so guessing it's a fixed bug with older AMT versions?

In fact one of the main purposes of ME is to change the power state, meaning you can turn the main system on or off or reboot it just from there.

That's how I re-image a remote system after a hard drive failure.

I have someone on-site power off the system and replace the hard drive with a new one, then let me know.
I then connect to the remote system via ME/AMT and setup a dvd-rom redirect to an ISO image on my PC, start the AMT VNC server and connect to it from my PC, lock the remote systems keyboard so anyone local can't over-type me, and then instruct the remote system to power on.

Then during boot if the remote system gets stupid and tries to boot from the new blank HD and stops, I can issue a reboot command and use the F11 boot menu from the BIOS to point it to the DVD drive. Usually that part just works though (like I said, all related to the older HPs)

Once the linux image boots and runs clonezilla, it's just an [enter]-[yes]-[yes] away from writing the backup image back to the new HD.

You can of course point to an OS install media instead and do that manually, I just tend to try and avoid that for installers using a mouse, since over remote links that can suck pretty bad. Over LAN it seems nice and responsive however.

Once done I do a normal "shutdown -h now", disable the DVD drive redirect, and power the system back on. Once I see the windows loading screen I'll disconnect VNC and shut down the VNC server in the AMT, and logout of the https interface.

Since I let AMT piggyback on the host MAC and IP, it basically intercepts any tcp ports it is using instead of passing that info up the stack to the OS.
I don't leave VNC running in the AMT just in case the host OS needs to run a VNC server on the default port for any reason - plus nothing good can really come from leaving it running when not needed.

ME uses https over port 16993, which isn't likely to be used on the OS (or if so, too bad for that app I guess)
If you already have RealVNC and a Core i7 at home to play with, boot the i7 and hit control-p where you normally would hit delete or a function key, and you'll be in the ME setup menu.
You can enable both ME and AMT (they are separate sub-systems) and play around.

We have technology to validate such claims.

[jellomizer]

Place the PC in a faraday cage. Record any radio transmission that is large enough to cross distance.
Have a PC (lets go with Non-Intel) hooked up and set up to be a point to point network connection. Monitor all traffic being sent from the PC.
Put barebones (say really old version of Linux on it)

If something is unexpected then we have a theory to work on. Otherwise is is just some nut trying to get us to use AMD or something.

Re:We have technology to validate such claims.

[thegarbz]

Easier answer, just read Intel's documentation. It's all there. It's no great secret. It's a remote admin tool and is documented as such.

As for AMD, their only thing special about them is they are using a different acronym "PSP" for their version of pretty much the same thing. If you're paranoid the only thing you can use is a pre 2012 AMD chip or a pre 2009 Intel chip.

Re:We have technology to validate such claims.

[jellomizer]

Umm no.
You put Windows XP and hook it up to a private network and see what sort of internet requests it is trying to contact and what ports it has open on the system.
The issue with a "Hidden CPU" in the CPU would be that it would be listening for a connection or communicating out.
Being that software isn't written to interact with a "Hidden CPU" there isn't much software vulnerability going on unless there is a way to communicate out.

Re:We have technology to validate such claims.

[trek00]

This method would not discover a dlink-like backdoor, a backdoor that needs to be activated with a specific procedure and do nothing in other cases.

Yawn,

[Obfuscant]

I've used this kind of thing on Dell servers for, umm, a decade or so? It means I can have headless high-density boxes (four independent systems in a 2U rackmount, e.g.) in my computing center and when a user wedges one of them I can reboot it remotely. I can look at system status, see failed components, and do all kinds of things that I couldn't otherwise do at all. "The system is wedged" is very unsatisfying as a diagnosis. Being able to run a remote console that shows that the swap has gone to 0 and the system is busy killing things tells me right away that someone is using all the memory is great. And then telling the iDrac to "reset the system" ... priceless.

It may use the same physical interface, but it has its own address, and it can be disabled if someone is ultra-paranoid about it.

Re:Yawn,

[mlts]

It makes life easy for monitoring as well. Some box loses its network connection, getting a console just means going to the iDRAC/iLO web port, logging on, seeing what is going on, and getting the NIC unstuck. It also is nice to load an ISO and install the machine from scratch if the box is a one-off and not worth making a PXE boot mechanism for what it is doing. Or, just boot the ISO stashed as a virtual CD, point it to a kickstarter file, and call it done.

Poorly written FUD

[Anonymous Coward]

The author's claims that the ME lacks the ability to be audited and that backdoors cannot be removed are patently false.

- The ME is as many have pointed out an ARC processor. There are known disassemblers for ARC and there are few custom instructions (read: beyond standard ISA) - two that I'm aware of.
- The bootrom verifies the flashrom and provides some minimal cryptography and verification related routines. This is a mask ROM, not updatable. The flashrom is overwritten when you flash the bios, hence the main OS and binaries (threadx btw) are overwritten. This would remove any backdoor.
- The ME region of the BIOS is a FAT16 filesystem.
- The ME binaries are unencrypted, PE executables and contain signature verification sections to prevent unauthorized code from loading.
- The only encrypted contents of the filesystem are data files that the binaries use.

Now all this being said, there is a way to load additional modules from the main CPU's operating system through HECI (north bridge interface), however this again requires cryptographic signing.

Source: Former Intel engineer. Additionally none of these are details that cannot be pieced together from Intel published documents and 5 minutes with a hex editor/disassembler.

Re:Poorly written FUD

[cfalcon]

Ok, I want to go through this with a tinfoil hat.

> This is a mask ROM, not updatable
So the mask ROM could check for a certain value at a certain offset in the flashrom. If the value is present, it could inject the backdoor code and/or do some exploit thing. How many people can verify the boot ROM is valid and free from a backdoor?

> The flashrom is overwritten when you flash the bios ... This would remove any backdoor.

This could inject any backdoor as well.

Basically, when tech people are talking about this stuff, there's three broad categories of adversaries:

An external hacker who has written exploit code. Checking the signatures of files should prevent this attack, exactly as you say.

A design that trusts anyone who can claim convincingly enough to be a vendor. If the private key gets reverse engineered, leaked, or guessed, than any of that flash rom could be written by the external hacker, above. We don't see these attacks, but the danger is that some of these designs ONLY trust the vendor- they aren't a "two key" system that requires the user AND the vendor to both consent.

An actively compromised manufacturer. With privacy revelations and state level actors in this arena, having any part not able to be verified by everyone makes it a giant target. In these cases, there could be a backdoor (if offset X = Y, then do Z), or something more subtle. Any state level actor discovered actively compromising Intel would start an economic war, at the very least. Why isn't that code inspectable? What IP is in that code that keeping it on lockdown is worth risking the prosperity of the whole of the Earth?

These conversations are often strange because someone like you will be discussing practical real world threats and their mitigations, such as code signing, while a couple posts down someone will be convinced that the NSA is trying to steal their dickpics and compromised every firmware in the world to make that happen. But the tinfoil hat comments do refer to a valid type of attacker, and while the risk is low of such an attack, the cost would truly be immense.

Re:Poorly written FUD

[Mathinker]

Did Intel happen to pay for one or more independent reviews of the security of this setup? Has Intel published the results of these reviews?

Until then, I'll more or less assume that its security is still in question, thank you. (That doesn't mean I won't use it, of course. All kinds of insecure systems are useful).

And even with such reviews, it would probably be prudent to assume that the signing keys have been compromised, at at least the nation-state level.

How to disable it?

[TheDarkMaster]

And how to ensure it stays disabled?

Re:How to disable it?

[boondaburrah]

You can't. If you have a modern intel CPU, the chip will detect that ME is disabled and shutdown the computer after 30 minutes.

Re:How to disable it?

[AHuxley]

Buy another brand of computer thats well understood and has every chip looked at and the OS is open.
If a site, country, brand or network is interesting, expect other nations security services to be all over any such offered hardware options or adding extra access option during private sector shipment.
Why would any nation or brand risk having a computer system that can be turned on, accessed, logs altered and turned off as part of the normal network hardware as imported?

It's not new, most servers had this years ago...

[Fallon]

This is not new & lots of others sell similar functionality Dell DRAC, HP ILO... Those usually have dedicated Ethernet ports, but generally function the same way. I've been helping our workstation guys roll out Intell vPro for remote administration of laptops & workstations. It operates in a powered down state & can do 802.1x authention to the network while the OS is powered down. So ya, there is definately an out of band processor there that can wake the system up & do remote control type stuff. It's a feature Intel is selling & marketing.

Can't comment on the ability of it to do arbitrary memory reads & what not, but that isn't suprising in thoery. It's much less scary than the article is making it out to be, although it is another attack surface to concerned with just like RDP or SSH.

TROLOLOLOLO!!!!

[Thud457]

This is the same FUD from Hack-a-day from last Janumanary

DUPE ALL THE THINGS!
Anononymous poster, check!
Be sure to mine the +5 comments from old stories for cheap karma!

Wow! This is SUPER SECRET! (Not)

[kevmeister]

IME and AMT have been well documented for years. The Wikipedia article has been around since at least 2007 and was flagged by an editor as reading like an Intel ad. It fully describes the basic design and functionality of the system and only varies from the article in that AMT has now been incorporated into the chipset and is no longer a separate chip.

Even that its network connection is independent of the CPU and any filtering is described.

I have been aware of AMT since it was discussed as a way to do an psueudo-console connection on modern systems that lack a serial port in FreeBSD kernel debugging discussions. I suspect that Linux discussions also show how to do this as IT IS NOT SECRET!

I'm not really comfortable about it, but it is very useful, has been designed with security in mind and should be very difficult to suborn, and Intel considers it a feature that is advertised, so IS NOT A SECRET!

Decades old news

[Anonymous Coward]

Out of band management processors are nothing new. Neither are the myriad other special purpose chips in a system that can be exploited as general purpose processors, some less predictably than others.

"No surveillance or other purposes" -- really?

[l2718]

If the only goal was simply to provide low-power functionality, the coprocessor would be fully controlled by the operating system (ultimately, by the owner of the machine).

In fact, the main goal is to provide remote administration capabilities (what they call Intel Active Management Technology). In other words, the idea is to allow a remote administrator to take over the machine in a way that is independent of and invisible to the main operating system and processor. This serves a legitimate purpose in an "enterprise" environment (one person administers a large number of diverse machines) -- for example it allows taking back control of a cracked machine, or recovering critical data from memory after OS crashes. However, this feature is not useful for a privately administered single-user machine.

Finally, by definition a remote administration feature is a back door. This one is incredibly dangerous: a rootkit running on the coprocessor is entirely invisible to the operating system, has its own independent network access, and can monitor the disk, the memory and all other peripherals. In principle the remote management features must be activated via the System BIOS and you can set a password there, but really your only measure of safety against this back door is your trust that there are no bugs in Intel's code.

Why isn't Intel allowing you to replace the firmware? Because it's hard to ensure that the owner of the machine is the one initiating the firmware replacement. The real troubling point is that Intel isn't allowing you to disable this feature with a hardware switch. Hardware switches (jumpers on the motherboard) are a way of controlling the system available only to the physical owner of the machine. Having a hardware switch would satisfy both the enterprise and security-concious customers.

Re:"No surveillance or other purposes" -- really?

[Nemyst]

Hardware switches (jumpers on the motherboard) are a way of controlling the system available only to the physical owner of the machine. Having a hardware switch would satisfy both the enterprise and security-concious customers.

Would it though? What's to stop whatever nefarious agent who's managed to obtain a sensitive laptop from disabling the switch? I know that they can just avoid connecting to any network and that'd also prevent remote access, but if they disable the entire EC, they can legitimately use the full computer without any further hurdles.

Re:"No surveillance or other purposes" -- really?

[sjames]

Older schemes where the BMC couldn't access the system memory were safer. One safety feature would be to replace memory access with specific interfaces (serial and a general access port used by SMM) and their own independent network interface (allowing effective vlan isolation with no need for the honor system). To complete the picture, the BMC could emulate a USB device connected on the MB to an actual USB chip. At least that way they would need to compromise 2 firmware images to get anywhere.

Re:"No surveillance or other purposes" -- really?

[Immerman]

Nothing. If a nefarious actor gains physical access to a machine, it's security is basically gone regardless. However, that's extremely rare, and unlikely to be a vector for either malware or mass surveillance. It's just too labor-intensive. A hardware switch at least makes sure that someone needs physical access to enable the attack vector especially if it physically disables the functionality in question (e.g. completely cuts power to the "stealth coprocessor", or at least it's data bus).

Re:"No surveillance or other purposes" -- really?

[AmiMoJo]

The down side to that is you can't implement Secure Boot. Secure Boot allows you to verify that the OS hasn't been tampered with before it is booted, mitigating many rootkits.

It's a trade-off. Which security feature is more useful?

Re:"No surveillance or other purposes" -- really?

[sjames]

You can still verify the OS, you just can't verify the BIOS. That's more than enough for most use cases. The only time it isn't adequate is when someone like MS wants to retain authority over your hardware (mostly so you can't load a driver that copies out decrypted media) or in cloak and dagger scenarios.

Personally, I wouldn't want a machine with Secure Boot that I couldn't disable in the configuration. YMMV

I definitely do not want a setup where someone might re-flash my BIOS from half way around the world and doesn't even have to reboot to do it.

Unplug your computer

[fustakrakich]

To be extra safe, remove the BIOS battery (it was an old habit of mine to remove the distributor rotor to keep my car from being stolen).

I think this is oversold as a risk

[cfalcon]

I'm of the opinion that management features need to get data from the motherboard, and each mobo manufacturer would have to be complicit for this potential attack to affect everything (assuming a bug or backdoor exists). *IF* there's a backdoor in the ME, and *IF* all (or at least YOUR) motherboard manufacturers are complicit, even *THEN* a good external firewall would stop most conceivable attacks.

It really is unfortunate that it is so clouded with mystery and seemingly waiting for a clever enough exploit.

If you are concerned a little, ensure that AMT is disabled.
If you are concerned a little more, consider grabbing an AMD next time. While AMD has similar things, Intel seems like it is both more featured and a larger attack surface, so an AMD exploit might be absent or would take longer to surface.
If you are concerned moderately, ensure that external sources can never successfully send a packet to your PC, by use of an external firewall that is trusted.
If you are concerned a lot, exclusively use open source products from before the mandatory inclusion of the ME. Have one to act as your firewall / router (maybe running OpenBSD or Trisquel), and another to do productivity on. You'll be limited on the power of the chip, of course.

Frankly, I think it is wise to distrust the ME a little bit. Especially because, as part of Intel chips, it is going to be in so many places- it is a lot of faith to put in untested code. But for the ME to be able to hurt or help you, the motherboard has to support its features, and there are a lot of motherboards, a lot of BIOSes- it is still a pretty diverse setup, and many don't support AMT at all.

Disable?

[ugen]

So, how do I turn the damn thing off? (I suspect the answer to be "can not", but anyone that knows otherwise - let me know)
I do, however, notice that there are no open listening ports on my current Intel computer, when scanned externally. Is this thing always on? What conditions enable it (so that I'd know to avoid those)?

Don't tell them about the mouse or keyboard

[WillAffleckUW]

those have executable memory space too, just like the printers

look, if you have a camera, it's hackable

if you have a video card, it has memory and chips that can be used by someone else

face it, you're being spied on, and the Gestapo loves that

What I want to know is...

[JoeDuncan]

...why didn't our ancient alien overlords stop the NSA from doing this?

Re:What I want to know is...

[hyades1]

Who do you think created the NSA?

Re:What I want to know is...

[dfsmith]

The Illuminati Council of Atlantis voted them down in a poll alleged to be rigged by Lee Harvey Oswald just before Princess Diana was about to publish the real moon landing photographs.

Re:What I want to know is...

[JoeDuncan]

Damnit, not AGAIN!

Vernor Vinge called it: Ubiquitous Law Enforcement

[LionKimbro]

Vernor Vinge drew up some diagrams of what this would look like, whereabouts 2005: http://vrinimi.org/front9uns.j...

Coreboot has been trying to work around this stuff

[LaughingRadish]

The Coreboot people have been trying to work out how to deal with this stuff for a long time. See https://www.coreboot.org/Intel.... They're trying to work out how to disable it, but progress is not that good.

This is quite surprising

[Gumbercules!!]

I have to say, I am actually pretty surprised by this news. I had no idea boingboing was even still going...

Re:This is quite surprising

[bloodhawk]

gather by the lack of technical knowledge of the author about a common feature he thinks is somehow secret and hidden it really would be better off dead.

Secret WTF?

[bloodhawk]

Secret? ummm welcome to a decade ago. The only thing secret about this appears to be the authors lack of knowledge about technology from the last decade. This has been a common selling point for a long time with its various iterations to allow management of machines regardless of OS and/or health of said OS so that you can fix shit remotely.

bye Intel, hello AMD

[slashmydots]

When I looked up what ME was when it was invented it basically said it can do stuff while your computer is off. I thought "well that's exploitable and besides that, very suspicious." Now fast forward and people finally caught on. If this hits the news media that a computer can be permanently hackable and even while in sleep mode, every last consumer is rushing out to get AMD-based systems. Corporations will too! They don't want their data secretly stolen past their OS's anti-malware suites. Intel might as well have mailed a check for 5 billion dollars over to AMD and after the BS in their pricing lately and monopoly abuse and dishonest product naming, they deserve it.

Tiny drill bit

[joboss]

I've had this really tiny drill bit for ages and I've been wanting to find a use for it. Thanks to Intel I now at last can do something with it.

how is this news or claims?

[avgapon]

How is this "news" or "claims" if the Intel AMT / ME documentation described this from the very start?

The remote management stuff

[mumma3k]

Is any of this enabled by default? Does it have to be manually activated in BIOS? None of my systems repsond on those ports. Ofcourse it's enabled for NSA already, but for us ordinary people?

Know your environment for better control it

[info6568]

I have been reading many different types of justifications on the security of the CPU makers (whatever be the brand). However we can't overestimate the fact that we are humans and that anybody can make mistakes, in particular with so complex artifacts as CPUs. These hidden parts and their security mechanisms can have bugs (yesterday, today or tomorrow). And also, they are not designed only to work with previous and current scenarios, but with the unknown future ones that are completely unexpected.

Thinking on this issue I checked quickly what CPUs have the Cisco Firewalls (just to check a famous brand), and notice that they have different ones depending on the appliance model, from the AMD Geode to some Intel Xeon variants, so there are possibilities even on security appliances for this to be exploited.

The problem with this hidden CPU approach is that they can bypass the computer built security without the operating system noticing it, with potentially dangerous consequences. And we are updating our software regularly but the most of the people is not aware of the updating on the underlying things (if they can be updated). The lack of knowledge in this respect is a dangerous thing.

But what can be done?

A very few are careful enough on checking the internal hardware specifications on the networking devices, the ones could protect any not so well controlled hidden device inside our network. So, it is really important to learn more about what we really have and if it is possible to combine "different" layers of appliances. For example, not to rely only on Intel or only on AMD for both servers and security appliances, or even to combine x64 and x32 with ARM, MIPS or other type of CPUs. This way, if there is a breach because some architectural failure, the next layer won't suffer the same fate because it is different (not necessarily because it is better). This combination of suppliers is something it is already being recommended for antivirus on enterprise environments (don't trust only in one supplier).

On the other case, when knowing extra ports and other elements that nobody is actively controlling within our network, will be possible to understand better that maybe that "extra" traffic has a hardware and not a software origin.

Our modern environments are rich and powerful, but this richness doesn't come for free. We need to understand it and control it correctly.

https://communities.cisco.com/...

Joanna Rutkowska presentation on this topic

[Mojo66]

Joanna has been researching this for a while, this is her presentation at 32c3.

I for one welcome

[gzuckier]

our new Intel Management Engine overlords.

Why the fuss?

[NoWhereMan]

I fail to see why this is such a big deal. This type of approach has been used for years. I am most familiar with the Oracle ILOM but IBM, HP, and others do something similar. I guess when they do it on a chip basis people treat it differently than when they do it on a system. When I first started working with computers, the machines would use multiple boards to implement the cpu. Now people act as if the world has been recreated because we have System-in-a-chip technology. While I recognize the progress and agree that things have improved, the approach is still the same when you think in terms of functional units.

Ummm...

[martinfb]

Highly unlikely.

Holy cow!

[KenHansen]

Including computers capable of out-of-band communication and control of the local machine has been a staple of server design for DECADES - corporate desktops have included this facility for years as well. This is nothing more than yet another server technology migrating to end-user desktops. It is fascinating that the article describes this as 'secret' yet includes links to public pages on intel's website that document this over 8 years ago.