I did it. I neutralized Intel ME on desktop PC.

submitted by LarrySwinger2 from i.ibb.co

sorted by:
top
newinsightfulfun
you are viewing a single comment's thread.

view the rest of the comments →

[–]solder0 5 insightful - 3 fun5 insightful - 2 fun6 insightful - 3 fun -  (7 children)

Nice! Too bad I have an AMD machine, but we'll see what can be done in the future. Wireshark isn't turning up any bad news, so that's good. I'm going to ditch x86 in the future and go with a POWER10 CPU with an FPGA along side instead.

[–]LarrySwinger2[S] 1 insightful - 1 fun1 insightful - 0 fun2 insightful - 1 fun -  (6 children)

ME and PSP run on a separate chip and things like Wireshark won't detect it phoning home. In fact, nothing will, it's a black box. Although running Wireshark still sounds like a good idea to monitor whether or not your OS is compromised. POWER10 sounds exciting. Hopefully it'll be affordable.

[–]solder0 1 insightful - 1 fun1 insightful - 0 fun2 insightful - 1 fun -  (5 children)

Err, gonna need a HARD SOURCE on that one, otherwise it's FUD by default.

[–]LarrySwinger2[S] 2 insightful - 1 fun2 insightful - 0 fun3 insightful - 1 fun -  (4 children)

Nothing's FUD by default; you need to show that the claims are false. Here's a source:

it can directly access the network interface using a dedicated link for out-of-band communication, thus even if you monitor traffic with a tool like Wireshark or tcpdump you might not necessarily see the data packet sent by Intel ME.

[–]solder0 1 insightful - 1 fun1 insightful - 0 fun2 insightful - 1 fun -  (3 children)

I was looking for something on amd's psp.

[–]LarrySwinger2[S] 2 insightful - 1 fun2 insightful - 0 fun3 insightful - 1 fun -  (2 children)

It's the same situation: software on your OS won't detect it because it runs on a separate chip. Here's a source.

[–]solder0 1 insightful - 1 fun1 insightful - 0 fun2 insightful - 1 fun -  (1 child)

Mmm...alright, I'll buy it. It is true that what you can't get at the OS level, you can get at the router level, since that's a critical bottleneck in a network. I'll be sure to get a router that functions transparently, and a very good packet sniffer. It's not a sunk cost mindset or anything, all I can do is adopt a mitigation strategy...and they do work.

[–]LarrySwinger2[S] 1 insightful - 1 fun1 insightful - 0 fun2 insightful - 1 fun -  (0 children)

That'd be great. Please share your results when you do this. MicroTik was recommended for this for its advanced sniffing features. You could also use a switch, mirror the port, and run Wireshark on a secondary computer.

You can also disable the fTPM-Trustlet from the BIOS. The setting is called something like "disable PSP" but it only disable runtime services, not the PSP itself.