Intel ME and more

Privacy
1

I recently read about Intel Me and other spy chips, I wanted to know how I can have a computer without that chip, or if an Orange Pi with the Rockchip is worth it, I have not found information if it has it or not, thank you very much

2

I believe the ME can be partially or maybe fully disabled with 11th gen or earlier Intel chips. But this will no longer be possible with 12th gen or newer intel stuff. I might be a generation off in one direction or the other. This information comes from System76 (a Linux-first hardware brand and the makers of Pop!_OS).

Also I think it may be a little bit of hyperbole to call Intel ME “a spy chip”. More accurately it is something with valid use-cases that by nature of what it is and how it works is a theoretical risk with respect to surveillance/privacy/backdoors/and control over your own system.

3 Likes
3

Don’t purchase an Intel computer.

You can set Intel CPUs to High Assurance Platform mode on most devices, which is the undocumented switch designed for use by government agencies like the NSA to “disable” Intel ME, but even in that case there have still been documented security vulnerabilities in Intel ME that were unaffected by HAP mode or any other known forms of disabling IME, because some (boot-related) aspects of it can simply never be disabled inherently.

HAP is the method that the manufacturer you mentioned is using. Some (Purism) go “above and beyond” by using HAP and overwriting the firmware, but that extra step really makes little difference in the attack surface of IME (so this is not a Purism endorsement).

Of course, no CPU will ever be vulnerability-free, that’s an unrealistic expectation anyways.

6 Likes
4

AFAIK, AMD also has an equivalent called Platform Security Processor AKA PSP. So, it’s not practical to avoid Intel and AMD since those are basically every PC chip out there.

I don’t know much about ARM, though. But I don’t think it’s practical to replace my workflow/usage with ARM chip on Linux. So, it doesn’t matter to me. So, if your workflow/usage lets you use ARM, it would be interesting to find out whether it’s actually safer than x86 for this kind of threat.

2 Likes
5

In this case it doesn’t matter which architecture (x86 vs ARM), it matters which manufacturer produces the chips. There are a lot more ARM chip producers out there, and they vary in a variety of ways.

From a libre firmware perspective, it ranges from chips which can run almost entirely free firmware like Rockchip and FreeScale i.MX6 devices, to chips which run entirely proprietary firmware like Qualcomm and Samsung Exynos SoCs. The Raspberry Pi with its Broadcom chipset is unfortunately completely non-free firmware.

From an attack surface perspective, ARM manufacturers are also free to implement firmware components that they do include in any way they see fit. Apple Silicon for example has a ton of subsystems that operate behind the scenes much like Intel ME or AMD PSP, but Apple’s firmware blobs are modular and strictly segregated to prevent them from potentially colluding to create a backdoor:

For example, the blob running inside the keyboard controller has no mechanism to communicate with the blob running on the WiFi card, and thus cannot implement a keylogger surreptitiously; the blob running on the display controller similarly has no way to communicate with the network, and thus can’t implement a secret screen scraper.

Contrast Apple’s approach here with AMD PSP, which has full unrestricted access to the same user memory space that all your applications run in (yikes).

Almost all the highest-performing ARM chips (Apple Silicon, Qualcomm, Exynos) run proprietary firmware like IME, but it’s not a requirement for all ARM chips to be like that.

Maybe. Have you done any research into this? Linux provides excellent ARM software support overall, especially due to devices like the Raspberry Pi.

6 Likes
6

I have 2 Raspberry Pi 4 running as my servers. I ran into some limitations when I tried setting it up as a desktop for my girlfriend. For example, Widevine support in 64-bit browsers, so no Netflix, Prime, etc. It’s fixable by using 32-bit browsers, but it’s not straightforward and not efficient. If I want to use it for work, Android Studio doesn’t have an ARM build, etc.

My brief experience with ARM on Linux was bad. It looks great on the surface, but more like a project device that you can’t really do something serious on it.

1 Like
7

I see folks in r/selfhosted have issues getting some stuff to run in raspberry pis. It’s not 100%.

My only first hand experience is that there’s no Mullvad Browser ARM Linux build, so I have to run arkenfox in my Linux VMs.

1 Like
8

That’s very interesting. I wonder which of these CPU firmwares have network access as this is the main concern when it comes to security issues or potential hidden backdoors.

  • x86
    • Intel ME: yes
    • AMD PSP: ?
  • ARM
    • Apple Silicon: no
    • Qualcomm Snapdragon: ?
    • Samsung Exynos: ?
    • Google Tensor: ?
    • Mediatek Dimensity: ?
    • Raspberry Pi: ? (probably not)
    • Rockchip / Allwinner / Freescale SBCs: ? but open source
  • POWER
1 Like
9

Up until now there hasn’t been any evidence of actual backdoors existing, just speculative nonsense. A real backdoor wouldn’t necessarily be so obvious as the XZ backdoor or god mode bit in the C3 Nehemiah Core and is likely to just be a cpu based vulnerability that can be exploited.

Nation states (NSA, GCHQ etc) have nearly unlimited resources to waste on finding them so that’s likely what they do. I also think these organizations are abundantly knowledgeable about the risks of inserting backdoors. Such as those backdoors being used against themselves and companies in which they’re supposed to protect.

When the argument of backdoors comes up it tends to be from lazy domestic law enforcement agencies looking to expand their powers and bemoan the existence of E2EE - Eg. “Going Dark” and the countless campaigns about child safety in an attempt to pull public heartstrings in their favor.

It’s also worth noting that with ARM there isn’t really a standardized approach like the UEFI specification, so they often have very specific (and not open source) approaches to things.

We really don’t have much besides the Raptor POWER arch, and maybe in the future something that is RISC-V based. Also ARM requires licensing and is patent encumbered. It’s not really any better than x86 in that respect.

3 Likes