What does HackerNews think of me_cleaner?
Tool for partial deblobbing of Intel ME/TXE firmware images
Not quite correct; the OpenSPARC T1 and T2 were publicly released and available by 2008.
https://www.oracle.com/servers/technologies/opensparc.html
"Large parts of this process are handled by vendor-supplied mystery firmware blobs, which may as well be boxes with “???” written in them.
The maintainers of the me_cleaner script likely have the clearest view of what is known.
https://virtualizationreview.com/articles/2020/01/13/configu...
Intel ME is its own can of worms and can only be fully disabled by modifying the firmware image, see tools like me_cleaner.
In the past few years AMD has started including a BIOS option to disable it. However, I have never seen a convincing explanation of how exactly that option works. The only thing I know is that Linux complains about it at boot on my B450M (from 2019):
Aug 30 23:52:07 kobold kernel: [ 4.811829] ccp 0000:07:00.1: ccp: unable to access the device: you might be running a broken BIOS.
Aug 30 23:52:07 kobold kernel: [ 4.811831] ccp 0000:07:00.1: psp: unable to access the device: you might be running a broken BIOS.
Intel includes no such option, but on the other hand there is stuff like https://github.com/corna/me_cleaner/. In the absense of any detailed information about how AMD'S PSP disable option actually works, I guess I would trust this a little more. However it requires getting your hands dirty, attaching a programmer directly to the chip (on the motherboard), and is not without risk.https://github.com/corna/me_cleaner
Or, buy hardware from vendors who neutralize ME according to the link.
It's arguably worse, since we have some known ways to reduce the scope of the Intel ME backdoor [3].
But realistically, if you care about security and privacy, both Intel and AMD chips are unusable.
1. https://libreboot.org/faq.html#amd-platform-security-process...
You might be thinking of me_cleaner[1], which removes most but not all of the ME blobs. This is unrelated to Libreboot though, it works on newer systems and is not needed when using Libreboot because the latter gets rid of the (very early versions of) the ME completely.
They don't need to. That is precisely the point. The entire software stack is open source and reproducible (except a few KBs of Intel ME). As a press release, the linked post is brief. If you wish to read more on the technical aspects, here are all the constituent projects:
https://github.com/osresearch/heads/
https://github.com/corna/me_cleaner
A good talk if you prefer video: https://media.ccc.de/v/33c3-8314-bootstraping_a_slightly_mor...
I personally run Coreboot on my Thinkpad with the ME "disabled" (essentially just broken and stuck in a constant bring-up state), and System76[2], Purism[3], and Dell sell machines with the option of disabling the ME entirely, if one is super-paranoid.
[1] https://github.com/corna/me_cleaner
Longer answer: You cannot fully disable the ME (the system won't boot) but you can use me_cleaner https://github.com/corna/me_cleaner to remove parts of the ME firmware that you don't want. "However, ... flashing back the modified [ME firmware] is usually not trivial, as the Intel ME firmware region is often non-writable from the OS (and it's not a safe option anyways), requiring the use of an external SPI programmer."
Disable UEFI. https://github.com/corna/me_cleaner
Disable the ACPI hooks that register the kernel with UEFI. http://heim.ifi.uio.no/~knuto/kernel/4.14/admin-guide/kernel...
Use full disk encryption - unlike Microsoft Bitlocker which left backdoors for LoJack, linux vulnerabilities are publicized and you can update as soon as the patch appears on the internet.
Switch to a filesystem that the UEFI malware does not understand. Or move fields and magic numbers around in an existing filesystem to create a "custom" filesystem.
Or a combination of all of the above.
> However, while Intel ME can't be turned off completely, it is still possible to modify its firmware up to a point where Intel ME is active only during the boot process, effectively disabling it during the normal operation, which is what me_cleaner tries to accomplish.
https://github.com/corna/me_cleaner
EDIT: Also, the ME is inside the PCH, so I'm not really sure why you're making a distinction there.
* In general you cannot.
* You can try to remove ME with non-official tools like https://github.com/corna/me_cleaner
* Some vendors ship specific laptops with ME disabled (https://fossbytes.com/laptops-intel-me-chip-disabled/)
* For servers or desktops, you can plug in a separate PCI network adapter instead of using the one on the mainboard (please correct me if this is wrong or confirm it as I'm unsure about it). That would at least disconnect the ME from the network by default. But anybody could still walk up to your machine, plug a cable into the mainboard ethernet port and own you at the deepest level.
EG tool: https://github.com/corna/me_cleaner
But yes, I hope that with this it'll be possible to completely remove the remaining few hundred kB of Intel ME code remaining.
But I wouldn't hold my breath that they'll release the keys -- why would they? Releasing keys is the last thing you'll think of if a decades-old business is going up in flames.
[1]: https://github.com/corna/me_cleaner [2]: https://github.com/corna/me_cleaner/wiki/Intel-Boot-Guard
But all of that is missing the point that there is a way to disable it[1], with the HAP or AltMeDisable bits[2]. It's believed they were added for the US government to be able to disable Intel ME (after hardware initialisation). It's not easy (you have to reflash the firmware) because most vendor firmware doesn't allow "internal" flashing from userspace, but it is doable if you buy a $5 flash programmer and a Raspberry PI.
[1]: https://github.com/corna/me_cleaner [2]: https://github.com/corna/me_cleaner/wiki/HAP-AltMeDisable-bi...
Now, whether that feature should be part of every consumer CPU is a valid question and concern -- one that nobody has the answer to. Likely the reason for this is that modern versions of ME also do hardware initialisation[2], so it would make sense for Intel to not require manufacturers to rewrite all of that code for their consumer machines. There have been exploits in Intel ME in the past, which are quite concerning (and the fact it's proprietary is obviously a concern, given how many privileges it has over the system).
You can neuter Intel ME on old machines (pre-BootGuard) using me_cleaner[3], but it requires attaching a flash programmer to your motherboard. If you have coreboot you can do it from userspace.
[1]: https://en.wikipedia.org/wiki/Intel_Active_Management_Techno... [2]: https://www.coreboot.org/Intel_Management_Engine [3]: https://github.com/corna/me_cleaner
[Remove Intel ME](https://github.com/corna/me_cleaner) to the largest extent possible. I don't know of equivalent tools for AMD, though, which also has similar systems in place.
https://github.com/corna/me_cleaner
https://hardenedlinux.github.io/firmware/2016/11/17/neutrali...
To be 100% clear, I haven't tried either.
Even this "neutralized ME" still boots before the main x86 CPU, and still runs even when the machine is off (if it's plugged in or has a laptop battery). And this "neutralized ME" still has an unknown binary that runs, it's just that the LibreBoot.org folks have found a way to strip it down to the bone without breaking the digital signatures.
https://github.com/corna/me_cleaner
(This posting is just Librem laptops releasing the me_cleaner for their hardware, a good thing, but not any new news.)