View source for Intel Management Engine

{{Short description|Autonomous computer subsystem}}
{{Use mdy dates|date=October 2025}}
[[File:Priv rings.svg|thumb|[[Privilege ring]]s for the [[X86|x86]] architecture. The ME is colloquially categorized as ring −3, below [[System Management Mode]] (ring −2) and the [[Hypervisor|hypervisor]] (ring −1), all running at a higher privilege level than the kernel (ring 0).]]

{{Update section|date=March 2026|reason=It has been renamed as of ~9 years ago to intel csme. I cite my sources in the "It was renamed 2017 to intel csme" discussion post}}

The '''Intel Management Engine''' ('''ME'''), ,<ref name="intelamt">{{cite web |url=https://software.intel.com/en-us/articles/getting-started-with-intel-active-management-technology-amt |title=Getting Started with Intel Active Management Technology (Intel AMT) |first=Joseph E. |last=Oster |date=September 3, 2019 |access-date=September 22, 2020 |publisher=Intel |archive-date=August 5, 2016 |archive-url=https://web.archive.org/web/20160805025427/https://software.intel.com/en-us/articles/getting-started-with-intel-active-management-technology-amt |url-status=live }}</ref><ref name="intel-amt-me">{{cite web|url=https://software.intel.com/en-us/blogs/2011/12/14/intelr-amt-and-the-intelr-me|title=Intel AMT and the Intel ME|publisher=Intel|archive-url=https://web.archive.org/web/20190221093441/https://software.intel.com/en-us/blogs/2011/12/14/intelr-amt-and-the-intelr-me/|url-status=usurped|archive-date=February 21, 2019}}</ref> is an autonomous subsystem that has been incorporated in virtually all of [[Company:Intel|Intel]]'s [[Central processing unit|processor]] [[Engineering:Chipset|chipset]]s since 2008.<ref name="intelamt" /><ref>{{cite web |title=Frequently Asked Questions for the Intel Management Engine Verification Utility |url=https://www.intel.com/content/www/us/en/support/articles/000005974/software/chipset-software.html |quote=Built into many Intel Chipset–based platforms is a small, low-power computer subsystem called the Intel Management Engine (Intel ME). |access-date=November 7, 2017 |archive-date=November 8, 2017 |archive-url=https://web.archive.org/web/20171108093924/https://www.intel.com/content/www/us/en/support/articles/000005974/software/chipset-software.html |url-status=live }}</ref><ref name="eff1">{{cite web |last1=Portnoy |first1=Erica |last2=Eckersley |first2=Peter |date=May 8, 2017 |title=Intel's Management Engine is a security hazard, and users need a way to disable it |url=https://www.eff.org/deeplinks/2017/05/intels-management-engine-security-hazard-and-users-need-way-disable-it |publisher=Electronic Frontier Foundation |access-date=February 21, 2020 |archive-date=May 8, 2017 |archive-url=https://web.archive.org/web/20170508201112/https://www.eff.org/deeplinks/2017/05/intels-management-engine-security-hazard-and-users-need-way-disable-it |url-status=live }}</ref> It is located in the Platform Controller Hub of modern Intel motherboards.

The Intel Management Engine always runs as long as the motherboard is receiving power, even when the computer is turned off. This issue can be mitigated with the deployment of a hardware device which is able to disconnect all connections to mains power as well as all internal forms of energy storage. The [[Organization:Electronic Frontier Foundation|Electronic Frontier Foundation]] and some security researchers have voiced concern that the Management Engine is a [[Backdoor (computing)|backdoor]].

Intel's main competitor, [[Engineering:AMD|AMD]], has incorporated the equivalent AMD Secure Technology (formally called Platform Security Processor) in virtually all of its post-2013 CPUs.

==Difference from Intel AMT==
The Management Engine is often confused with [[Engineering:Intel Active Management Technology|Intel AMT]] (Intel Active Management Technology). AMT runs on the ME, but is only available on processors with vPro. AMT gives device owners remote administration of their computer,<ref name="techrepublicME">{{cite web |website=[[TechRepublic]] |last=Wallen |first=Jack |date=July 1, 2016 |title=Is the Intel Management Engine a backdoor? |url=https://www.techrepublic.com/article/is-the-intel-management-engine-a-backdoor/ |access-date=November 7, 2017 |archive-date=July 2, 2016 |archive-url=https://web.archive.org/web/20160702143913/https://www.techrepublic.com/article/is-the-intel-management-engine-a-backdoor/ |url-status=live }}</ref> such as powering it on or off, and reinstalling the operating system.

However, the ME itself has been built into all Intel chipsets since 2008, not only those with AMT. While AMT can be unprovisioned by the owner, there is no official, documented way to disable the ME.

==Design==
The subsystem primarily consists of proprietary firmware running on a separate microprocessor that performs tasks during boot-up, while the computer is running, and while it is asleep.<ref>{{cite web |title=Frequently Asked Questions for the Intel Management Engine Verification Utility |url=https://www.intel.com/content/www/us/en/support/articles/000005974/software/chipset-software.html |quote=The Intel ME performs various tasks while the system is in sleep, during the boot process, and when your system is running. |access-date=November 7, 2017 |archive-date=November 8, 2017 |archive-url=https://web.archive.org/web/20171108093924/https://www.intel.com/content/www/us/en/support/articles/000005974/software/chipset-software.html |url-status=live }}</ref> As long as the chipset or [[System on a chip|SoC]] is supplied with power (via battery or power supply), it continues to run even when the system is turned off.<ref>{{Cite web|url=https://www.blackhat.com/eu-17/briefings/schedule/#how-to-hack-a-turned-off-computer-or-running-unsigned-code-in-intel-management-engine-8668|title=Black Hat Europe 2017|website=BlackHat.com|access-date=November 23, 2017|archive-date=August 19, 2020|archive-url=https://web.archive.org/web/20200819151748/https://www.blackhat.com/eu-17/briefings/schedule/#how-to-hack-a-turned-off-computer-or-running-unsigned-code-in-intel-management-engine-8668|url-status=live}}</ref> Intel claims the ME is required to provide full performance.<ref>{{cite web |title=Frequently Asked Questions for the Intel Management Engine Verification Utility |url=https://www.intel.com/content/www/us/en/support/articles/000005974/software/chipset-software.html |quote=This subsystem must function correctly to get the most performance and capability from your PC. |access-date=November 7, 2017 |archive-date=November 8, 2017 |archive-url=https://web.archive.org/web/20171108093924/https://www.intel.com/content/www/us/en/support/articles/000005974/software/chipset-software.html |url-status=live }}</ref> Its exact workings<ref>{{Cite web|url=https://www.howtogeek.com/334013/intel-management-engine-explained-the-tiny-computer-inside-your-cpu/|title=Intel Management Engine, Explained: The Tiny Computer Inside Your CPU|first=Chris|last=Hoffman|website=How-To Geek|date=November 22, 2017|access-date=November 28, 2017|archive-date=September 12, 2020|archive-url=https://web.archive.org/web/20200912034912/https://www.howtogeek.com/334013/intel-management-engine-explained-the-tiny-computer-inside-your-cpu/|url-status=live}}</ref> are largely undocumented<ref>{{Cite web|url=https://www.eff.org/deeplinks/2017/05/intels-management-engine-security-hazard-and-users-need-way-disable-it|title=Intel's Management Engine is a security hazard, and users need a way to disable it|first=Erica Portnoy and Peter|last=Eckersley|date=May 8, 2017|website=Electronic Frontier Foundation|access-date=November 7, 2017|archive-date=May 8, 2017|archive-url=https://web.archive.org/web/20170508201112/https://www.eff.org/deeplinks/2017/05/intels-management-engine-security-hazard-and-users-need-way-disable-it|url-status=live}}</ref> and its code is [[Obfuscation|obfuscated]] using confidential [[Huffman coding|Huffman tables]] stored directly in hardware, so the firmware does not contain the information necessary to decode its contents.<ref name="auto1">{{Cite web|url=http://io.netgarage.org/me/|title=Intel ME huffman dictionaries - Unhuffme v2.4|website=IO.NetGarage.org|access-date=November 28, 2017|archive-date=August 1, 2020|archive-url=https://web.archive.org/web/20200801200306/http://io.netgarage.org/me/|url-status=live}}</ref>

===Hardware===
Starting with ME&nbsp;11 (introduced in [[Skylake (microarchitecture)|Skylake]] CPUs), it is based on the [[Engineering:Intel Quark|Intel Quark]] x86-based [[32-bit|32-bit]] CPU and runs the [[Software:MINIX 3|MINIX 3]] operating system.<ref name="ptsecurity1" /> The ME firmware is stored in a partition of the SPI BIOS Flash, using the Embedded Flash File System (EFFS).<ref name="is" /> Previous versions were based on an [[ARC (processor)|ARC core]], with the Management Engine running the [[Software:ThreadX|ThreadX]] RTOS. Versions 1.x to 5.x of the ME used the ARCTangent-A4 (32-bit only instructions) whereas versions 6.x to 8.x used the newer ARCompact (mixed 32- and [[16-bit|16-bit]] [[Instruction set architecture|instruction set architecture]]). Starting with ME 7.1, the ARC processor could also execute signed Java applets.

The ME has its own MAC and IP address for the [[Out-of-band management|out-of-band management]] interface, with direct access to the Ethernet controller; one portion of the Ethernet traffic is diverted to the ME even before reaching the host's operating system, for what support exists in various Ethernet controllers, exported and made configurable via [[Engineering:Management Component Transport Protocol|Management Component Transport Protocol]] (MCTP).<ref>{{cite web | url = http://www.intel.com/content/dam/www/public/us/en/documents/datasheets/i210-ethernet-controller-datasheet.pdf | title = Intel Ethernet Controller I210 Datasheet |date= 2013 | access-date = November 9, 2013 | publisher = [[Company:Intel|Intel]] | pages = 1, 15, 52, 621&ndash;776 | archive-date = July 18, 2013 | archive-url = https://web.archive.org/web/20130718122728/http://www.intel.com/content/dam/www/public/us/en/documents/datasheets/i210-ethernet-controller-datasheet.pdf | url-status = live }}</ref><ref>{{cite web | url = http://www.intel.com/content/dam/www/public/us/en/documents/product-briefs/ethernet-x540-brief.pdf | title = Intel Ethernet Controller X540 Product Brief |date= 2012 | access-date = February 26, 2014 | publisher = [[Company:Intel|Intel]] | archive-date = September 14, 2012 | archive-url = https://web.archive.org/web/20120914090919/http://www.intel.com/content/dam/www/public/us/en/documents/product-briefs/ethernet-x540-brief.pdf | url-status = live }}</ref> The ME also communicates with the host via PCI interface.<ref name="is">Igor Skochinsky (Hex-Rays) [http://2012.ruxconbreakpoint.com/assets/Uploads/bpx/Breakpoint%202012%20Skochinsky.pdf Rootkit in your laptop] {{Webarchive|url=https://web.archive.org/web/20250417195545/https://2012.ruxconbreakpoint.com/assets/Uploads/bpx/Breakpoint%202012%20Skochinsky.pdf |date=April 17, 2025 }}, Ruxcon Breakpoint 2012</ref> Under Linux, communication between the host and the ME is done via {{mono|/dev/mei}} or {{mono|/dev/mei0}}.<ref name="meilnx">{{cite web|url=https://www.kernel.org/doc/Documentation/misc-devices/mei/mei.txt |title=Archived copy |access-date=February 25, 2014 |url-status=dead |archive-url=https://web.archive.org/web/20141101045709/https://www.kernel.org/doc/Documentation/misc-devices/mei/mei.txt |archive-date=November 1, 2014 }}</ref><ref name="meilnx2">{{Cite web|url=https://www.kernel.org/doc/html/latest/driver-api/mei/mei.html|title=Introduction — The Linux Kernel documentation|website=Kernel.org|access-date=April 8, 2020|archive-date=November 11, 2019|archive-url=https://web.archive.org/web/20191111031730/https://www.kernel.org/doc/html/latest/driver-api/mei/mei.html|url-status=live}}</ref>

Until the release of [[Engineering:Nehalem (microarchitecture)|Nehalem]] processors, the ME was usually embedded into the motherboard's northbridge, following the Memory Controller Hub (MCH) layout.<ref name="quest">{{cite web |url=http://invisiblethingslab.com/resources/misc09/Quest%20To%20The%20Core%20%28public%29.pdf |title=A Quest to the Core |first=Joanna |last=Rutkowska |website=Invisiblethingslab.com |access-date=May 25, 2016 |archive-date=July 20, 2013 |archive-url=https://web.archive.org/web/20130720201844/http://invisiblethingslab.com/resources/misc09/Quest%20To%20The%20Core%20%28public%29.pdf |url-status=live }}</ref> With the newer Intel architectures (Intel 5 Series onwards), the ME is integrated into the Platform Controller Hub (PCH).<ref>{{cite web|url=http://www.intel.com/content/dam/www/public/us/en/documents/datasheets/celeron-mobile-p4000-u3000-datasheet.pdf |title=Archived copy |access-date=February 26, 2014 |url-status=dead |archive-url=https://web.archive.org/web/20140211075753/http://www.intel.com/content/dam/www/public/us/en/documents/datasheets/celeron-mobile-p4000-u3000-datasheet.pdf |archive-date=February 11, 2014 }}</ref><ref>{{cite web |url=http://users.nik.uni-obuda.hu/sima/letoltes/magyar/SZA2011_osz/nappali/Platforms-3_E_2011_12_14.ppt |format=PDF |title=Platforms II |website=Users.nik.uni-obuda.hu |access-date=May 25, 2016 |archive-date=March 4, 2016 |archive-url=https://web.archive.org/web/20160304030647/http://users.nik.uni-obuda.hu/sima/letoltes/magyar/SZA2011_osz/nappali/Platforms-3_E_2011_12_14.ppt |url-status=dead }}</ref>

===Firmware===
By Intel's current terminology as of 2017, ME is one of several firmware sets for the Converged Security and Manageability Engine (CSME).<!-- Need to be updated, as the latest document(#635338 v1.0 P.#6) described.  ME means the HW, SPS is the firmware name on ME and ME contains NM and SiEn --> Prior to AMT version 11, CSME was called Intel Management Engine BIOS Extension (Intel MEBx).<ref name="intelamt" />

* Management Engine (ME) – mainstream chipsets<ref name="supermicrosps">{{cite web |url=https://www.supermicro.com/manuals/superserver/4U/MNL-1765.pdf |title=FatTwin F618R3-FT+ F618R3-FTPT+ User's Manual |quote=The Manageability Engine, which is an ARC controller embedded in the IOH (I/O Hub), provides Server Platform Services (SPS) to your system. The services provided by SPS are different from those provided by the ME on client platforms. |publisher=Super Micro |access-date=November 26, 2017 |archive-date=December 1, 2017 |archive-url=https://web.archive.org/web/20171201030618/https://www.supermicro.com/manuals/superserver/4U/MNL-1765.pdf |url-status=live }}</ref>
* Server Platform Services (SPS) – server chipsets and [[System on a chip|SoC]]s<ref name="supermicrosps" /><ref name="intelsps">{{cite web |url=https://www.intel.com/content/www/us/en/processors/xeon/xeon-e3-1200-v6-family-brief.html |title=Intel Xeon Processor E3-1200 v6 Product Family Product Brief |quote=Intel Server Platform Services (Intel SPS): Designed for managing rack-mount servers, Intel Server Platform Services provides a suite of tools to control and monitor power, thermal, and resource utilization. |publisher=Intel |access-date=November 26, 2017 |archive-date=April 5, 2017 |archive-url=https://web.archive.org/web/20170405161532/https://www.intel.com/content/www/us/en/processors/xeon/xeon-e3-1200-v6-family-brief.html |url-status=live }}</ref><ref name="xeondsps">{{cite web|url=https://www.intel.com/content/dam/www/public/us/en/documents/platform-briefs/xeon-processor-d-platform-brief.pdf|title=Intel Xeon Processor D-1500 Product Family|publisher=Intel|access-date=November 26, 2017|archive-date=February 26, 2017|archive-url=https://web.archive.org/web/20170226094541/https://www.intel.com/content/dam/www/public/us/en/documents/platform-briefs/xeon-processor-d-platform-brief.pdf|url-status=live}}</ref>
* Trusted Execution Engine (TXE) – tablet/embedded/low power<ref name="delltxe">{{cite web|url=https://www.dell.com/support/home/us/en/19/drivers/driversdetails?driverId=K9HM7|title=Intel Trusted Execution Engine Driver|quote=This package provides the drivers for the Intel Trusted Execution Engine and is supported on Dell Venue 11 Pro 5130 Tablet|publisher=Dell|access-date=November 26, 2017|archive-date=December 1, 2017|archive-url=https://web.archive.org/web/20171201041002/https://www.dell.com/support/home/us/en/19/drivers/driversdetails?driverId=K9HM7|url-status=live}}</ref><ref name="inteltxe">{{cite web|url=https://downloadcenter.intel.com/download/24892/Intel-Trusted-Execution-Engine-Driver-for-Intel-NUC-Kit-NUC5CPYH-NUC5PPYH-NUC5PGYH|title=Intel Trusted Execution Engine Driver for Intel NUC Kit NUC5CPYH, NUC5PPYH, NUC5PGYH|publisher=Intel|quote=Installs the Intel Trusted Execution Engine (Intel TXE) driver and firmware for Windows 10 and Windows 7*/8.1*, 64-bit. The Intel TXE driver is required for Secure Boot and platform security features.|access-date=November 26, 2017|archive-date=December 1, 2017|archive-url=https://web.archive.org/web/20171201033640/https://downloadcenter.intel.com/download/24892/Intel-Trusted-Execution-Engine-Driver-for-Intel-NUC-Kit-NUC5CPYH-NUC5PPYH-NUC5PGYH|url-status=live}}</ref>

It was also found that the ME firmware version 11 runs [[Software:MINIX 3|MINIX 3]].<ref name="ptsecurity1"/><ref>{{Cite web |url=https://www.troopers.de/downloads/troopers17/TR17_ME11_Static.pdf |title=Positive Technologies Blog:The Way of the Static Analysis |access-date=November 23, 2017 |archive-date=November 11, 2020 |archive-url=https://web.archive.org/web/20201111181458/https://www.troopers.de/downloads/troopers17/TR17_ME11_Static.pdf |url-status=live }}</ref> Management of the ME modules for provisioning inside the UEFI is done via a tool called Intel Flash Image Tool (FITC).

====Modules====
* Active Management Technology (AMT)<ref name="intel-amt-me" />
* Intel Boot Guard (IBG)<ref name="intel-ppt">{{cite web|url=https://www.intel.com/content/dam/www/public/us/en/documents/white-papers/security-technologies-4th-gen-core-retail-paper.pdf|title=Intel Hardware-based Security Technologies for Intelligent Retail Devices|publisher=Intel|access-date=November 26, 2017|archive-date=April 18, 2015|archive-url=https://web.archive.org/web/20150418141006/https://www.intel.com/content/dam/www/public/us/en/documents/white-papers/security-technologies-4th-gen-core-retail-paper.pdf|url-status=live}}</ref> and Secure Boot<ref name="inteltxe" />
* Quiet System Technology (QST), formerly known as Advanced Fan Speed Control (AFSC), which provides support for acoustically optimized fan speed control, and monitoring of temperature, voltage, current and fan speed sensors that are provided in the chipset, CPU and other devices present on the motherboard. Communication with the QST firmware subsystem is documented and available through the official [[Software development kit|software development kit]] (SDK).<ref>{{cite web | url = https://software.intel.com/sites/default/files/af/73/Intel_QST_Programmers_Reference_Manual.pdf | title = Intel Quiet System Technology 2.0: Programmer's Reference Manual | date = February 2010 | access-date = August 25, 2014 | publisher = [[Company:Intel|Intel]] | archive-date = August 26, 2014 | archive-url = https://web.archive.org/web/20140826115508/https://software.intel.com/sites/default/files/af/73/Intel_QST_Programmers_Reference_Manual.pdf | url-status = live }}</ref>
* Protected Audio Video Path, enforces HDCP<ref name="auto1" /><ref>{{Cite web |url=https://proprivacy.com/privacy-news/intel-management-engine |title=The Intel Management Engine – a Privacy Nightmare |website=ProPrivacy.com |access-date=June 8, 2020 |archive-date=August 1, 2020 |archive-url=https://web.archive.org/web/20200801192149/https://proprivacy.com/privacy-news/intel-management-engine |url-status=live }}</ref>
* Intel Anti-Theft Technology (AT), discontinued in 2015<ref>{{Cite web|url=https://www.tomshardware.com/reviews/vpro-anti-theft-small-business-advantage,3259.html|title=Intel vPro In 2012, Small Business Advantage, And Anti-Theft Tech.|first=Patrick Kennedy 21|last=September 2012|website=Tom's Hardware|date=September 21, 2012|access-date=September 10, 2020|archive-date=September 30, 2020|archive-url=https://web.archive.org/web/20200930092341/https://www.tomshardware.com/reviews/vpro-anti-theft-small-business-advantage,3259.html|url-status=live}}</ref><ref>{{Cite web|url=https://service.mcafee.com/webcenter/portal/oracle/webcenter/page/scopedMD/s55728c97_466d_4ddb_952d_05484ea932c6/Page29.jspx?wc.contextURL=%2Fspaces%2Fcp&articleId=TS101986&leftWidth=0%25&showFooter=false&showHeader=false&rightWidth=0%25&centerWidth=100%25&_afrLoop=383304777056094#!@@?showFooter=false&_afrLoop=383304777056094&articleId=TS101986&leftWidth=0%2525&showHeader=false&wc.contextURL=%252Fspaces%252Fcp&rightWidth=0%2525&centerWidth=100%2525&_adf.ctrl-state=o56hl18tm_9|title=McAfee KB - End of Life for McAfee/Intel Anti-Theft (TS101986)|website=service.mcafee.com|access-date=September 10, 2020|archive-date=August 1, 2020|archive-url=https://web.archive.org/web/20200801222002/https://service.mcafee.com/webcenter/portal/oracle/webcenter/page/scopedMD/s55728c97_466d_4ddb_952d_05484ea932c6/Page29.jspx?wc.contextURL=%2Fspaces%2Fcp&articleId=TS101986&leftWidth=0%25&showFooter=false&showHeader=false&rightWidth=0%25&centerWidth=100%25&_afrLoop=383304777056094#!@@?showFooter=false&_afrLoop=383304777056094&articleId=TS101986&leftWidth=0%2525&showHeader=false&wc.contextURL=%252Fspaces%252Fcp&rightWidth=0%2525&centerWidth=100%2525&_adf.ctrl-state=o56hl18tm_9|url-status=dead}}</ref>
* [[Serial over LAN]] (SOL)<ref name="intel-sol">{{cite web|url=https://software.intel.com/en-us/articles/using-intel-amt-serial-over-lan-to-the-fullest|title=Using Intel AMT serial-over-LAN to the fullest|publisher=Intel|access-date=November 26, 2017|archive-date=January 25, 2009|archive-url=https://web.archive.org/web/20090125052233/https://software.intel.com/en-us/articles/using-intel-amt-serial-over-lan-to-the-fullest|url-status=live}}</ref>
* Intel Platform Trust Technology (PTT), a firmware-based [[Software:Trusted Platform Module|Trusted Platform Module]] (TPM)<ref name="intel-ppt" /><ref>{{Cite web|date=May 8, 2019|title=How To Enable BitLocker With Intel PTT and No TPM For Better Security|url=https://www.legitreviews.com/how-to-enable-bitlocker-with-intel-ptt-and-no-tpm-for-better-security_211713|access-date=September 8, 2020|website=Legit Reviews|archive-date=May 22, 2025|archive-url=https://web.archive.org/web/20250522232819/https://www.legitreviews.com/how-to-enable-bitlocker-with-intel-ptt-and-no-tpm-for-better-security_211713|url-status=live}}</ref>
* Near Field Communication, a middleware for NFC readers and vendors to access NFC cards and provide secure element access, found in later MEI versions.<ref>{{cite web|url=https://www.kernel.org/doc/html/latest/driver-api/mei/nfc.html|title=MEI NFC|access-date=December 23, 2020|archive-date=May 8, 2025|archive-url=https://web.archive.org/web/20250508043453/https://www.kernel.org/doc/html/latest/driver-api/mei/nfc.html|url-status=live}}</ref>

==The intricacies of working with Intel ME==
It should also be noted that the ME region requires special cleaning and subsequent initialisation. 
For example, after replacing the platform hub on the motherboard.
Usually, this requires an SPI programmer. 
There are known successful cases of this operation being performed.<ref name="biosdoctor">{{cite web|url=https://bios-doctor.com/topic/55/acer-sf314-511-53-clean-me-region |title=Acer SF314-511-53 clean ME region|website=bios-doctor.com |date=May 12, 2025|access-date=November 23, 2025}}</ref>

==Security vulnerabilities==
Several weaknesses have been found in the ME. On May 1, 2017, Intel confirmed a Remote Elevation of Privilege bug (SA-00075) in its Management Technology.<ref name="intelmay">{{cite web |url=https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00075.html |title=Intel Active Management Technology, Intel Small Business Technology, and Intel Standard Manageability Escalation of Privilege |website=Intel.com |date=March 17, 2020 |access-date=September 22, 2020 |archive-date=June 16, 2025 |archive-url=https://web.archive.org/web/20250616101354/https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00075.html |url-status=live }}</ref> Every Intel platform with provisioned Intel Standard Manageability, Active Management Technology, or Small Business Technology, from Nehalem in 2008 to Kaby Lake in 2017 has a remotely exploitable security hole in the ME.<ref>{{cite web |author=Charlie Demerjian |url=https://semiaccurate.com/2017/05/01/remote-security-exploit-2008-intel-platforms/ |title=Remote security exploit in all 2008+ Intel platforms |work=Semiaccurate |date=May 1, 2017 |access-date=May 7, 2017 |archive-date=May 1, 2017 |archive-url=https://web.archive.org/web/20170501160809/https://semiaccurate.com/2017/05/01/remote-security-exploit-2008-intel-platforms/ |url-status=live }}</ref><ref name="reg-2017-05-01">{{cite web |url=https://www.theregister.co.uk/2017/05/01/intel_amt_me_vulnerability/ |title=Red alert! Intel patches remote execution hole that's been hidden in chips since 2010 |website=TheRegister.co.uk |access-date=May 7, 2017 |archive-date=May 1, 2017 |archive-url=https://web.archive.org/web/20170501221603/https://www.theregister.co.uk/2017/05/01/intel_amt_me_vulnerability/ |url-status=live }}</ref> Several ways to disable the ME without authorization that could allow ME's functions to be sabotaged have been found.<ref name="ptsecurity1" /><ref>{{cite web |last1=Alaoui |first1=Youness |date=October 19, 2017 |title=Deep dive into Intel Management Engine disablement |url=https://puri.sm/posts/deep-dive-into-intel-me-disablement/ |access-date=November 9, 2017 |archive-date=October 19, 2017 |archive-url=https://web.archive.org/web/20171019213210/https://puri.sm/posts/deep-dive-into-intel-me-disablement/ |url-status=live }}</ref><ref>{{cite web |last1=Alaoui |first1=Youness |date=March 9, 2017 |title=Neutralizing the Intel Management Engine on Librem Laptops |url=https://puri.sm/posts/neutralizing-intel-management-engine-on-librem-laptops/ |access-date=November 9, 2017 |archive-date=March 9, 2017 |archive-url=https://web.archive.org/web/20170309204405/https://puri.sm/posts/neutralizing-intel-management-engine-on-librem-laptops/ |url-status=live }}</ref> Additional major security flaws in the ME  affecting a very large number of computers incorporating ME, Trusted Execution Engine (TXE), and Server Platform Services (SPS) firmware, from Skylake in 2015 to [[Coffee Lake]] in 2017, were confirmed by Intel on November 20, 2017 (SA-00086).<ref name="extreme1">{{cite web|url=https://www.extremetech.com/computing/259426-intel-patches-major-flaws-intel-management-engine|title=Intel Patches Major Flaws in the Intel Management Engine|date=November 22, 2017 |publisher=Extreme Tech|access-date=November 22, 2017|archive-date=November 22, 2017|archive-url=https://web.archive.org/web/20171122190314/https://www.extremetech.com/computing/259426-intel-patches-major-flaws-intel-management-engine|url-status=live}}</ref><ref>{{cite web |last=Claburn |first=Thomas |date=November 20, 2017 |title=Intel finds critical holes in secret Management Engine hidden in tons of desktop, server chipsets |website=The Register |url=https://www.theregister.com/2017/11/20/intel_flags_firmware_flaws/ |access-date=June 5, 2020 |archive-date=June 5, 2020 |archive-url=https://web.archive.org/web/20200605095036/https://www.theregister.com/2017/11/20/intel_flags_firmware_flaws/ |url-status=live }}</ref> Unlike SA-00075, this bug is even present if AMT is absent, not provisioned or if the ME was "disabled" by any of the known unofficial methods.<ref name="auto2">{{Cite web|url=https://www.theregister.com/2017/12/06/intel_management_engine_pwned_by_buffer_overflow/|title=Intel Management Engine pwned by buffer overflow|website=TheRegister.com|access-date=September 10, 2020|archive-date=June 10, 2025|archive-url=https://web.archive.org/web/20250610141300/https://www.theregister.com/2017/12/06/intel_management_engine_pwned_by_buffer_overflow/|url-status=live}}</ref> In July 2018, another set of vulnerabilities was disclosed (SA-00112).<ref name="SA-00112">{{Cite web|url=https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00112.html|title=INTEL-SA-00112|website=Intel|access-date=July 23, 2018|archive-date=September 12, 2020|archive-url=https://web.archive.org/web/20200912230003/https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00112.html|url-status=live}}</ref> In September 2018, yet another vulnerability was published (SA-00125).<ref>{{Cite web|url=https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00125.html|title=INTEL-SA-00125|website=Intel|access-date=September 15, 2018|archive-date=September 12, 2020|archive-url=https://web.archive.org/web/20200912235018/https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00125.html|url-status=live}}</ref>

==={{anchor|Ring -3}}Ring −3 rootkit===
A [[Protection ring|ring]]&nbsp;−3 rootkit was demonstrated by Invisible Things Lab for the Q35 chipset; it does not work for the later Q45 chipset as Intel implemented additional protections.<ref>{{cite web |url=http://invisiblethingslab.com/press/itl-press-2009-03.pdf |title=Invisible Things Lab to present two new technical presentations disclosing system-level vulnerabilities affecting modern PC hardware at its core |website=Invisiblethingslab.com |access-date=May 25, 2016 |archive-url=https://web.archive.org/web/20160412045958/http://invisiblethingslab.com/press/itl-press-2009-03.pdf |archive-date=April 12, 2016 |url-status=dead }}</ref> The exploit worked by remapping the normally protected memory region (top 16&nbsp;MB of RAM) reserved for the ME. The ME rootkit could be installed regardless of whether the AMT is present or enabled on the system, as the chipset always contains the ARC ME coprocessor. (The "−3" designation was chosen because the ME coprocessor works even when the system is in the [[Sleep mode|S3 state]]. Thus, it was considered a layer below the [[System Management Mode]] rootkits.<ref name="quest" />) For the vulnerable Q35 chipset, a keystroke logger ME-based rootkit was demonstrated by Patrick Stewin.<ref>{{cite web |url=http://www.stewin.org/slides/pstewin-SPRING6-EvaluatingRing-3Rootkits.pdf |title=FG Security in telecommunications : Evaluating "Ring-3" Rootkits |website=Stewin.org |access-date=May 25, 2016 |archive-url=https://web.archive.org/web/20160304033404/http://www.stewin.org/slides/pstewin-SPRING6-EvaluatingRing-3Rootkits.pdf |archive-date=March 4, 2016 |url-status=dead }}</ref><ref>{{cite web |url=http://stewin.org/slides/44con_2013-dedicated_hw_malware-stewin_bystrov.pdf |title=Persistent, Stealthy Remote-controlled Dedicated Hardware Malware |website=Stewin.org |access-date=May 25, 2016 |archive-url=https://web.archive.org/web/20160303222145/http://stewin.org/slides/44con_2013-dedicated_hw_malware-stewin_bystrov.pdf |archive-date=March 3, 2016 |url-status=dead }}</ref>

===Zero-touch provisioning===
Another security evaluation by Vassilios Ververis showed serious weaknesses in the GM45 chipset implementation. In particular, it criticized AMT for transmitting unencrypted passwords in the SMB provisioning mode when the IDE redirection and Serial over LAN features are used. It also found that the "zero touch" provisioning mode (ZTC) is still enabled even when the AMT appears to be disabled in BIOS. For about 60 euros, Ververis purchased from [[Company:GoDaddy|GoDaddy]] a certificate that is accepted by the ME firmware and allows remote [[Zero-touch provisioning|"zero touch" provisioning]] of (possibly unsuspecting) machines, which broadcast their HELLO packets to would-be configuration servers.<ref>{{cite web |url=http://web.it.kth.se/~maguire/DEGREE-PROJECT-REPORTS/100402-Vassilios_Ververis-with-cover.pdf |title=Security Evaluation of Intel's Active Management Technology |website=Web.it.kth.se |access-date=May 25, 2016 |archive-date=November 26, 2013 |archive-url=https://web.archive.org/web/20131126153026/http://web.it.kth.se/~maguire/DEGREE-PROJECT-REPORTS/100402-Vassilios_Ververis-with-cover.pdf |url-status=live }}</ref>

===SA-00075 (a.k.a. Silent Bob is Silent)===
In May 2017, Intel confirmed that many computers with AMT have had an unpatched critical privilege escalation vulnerability (CVE-2017-5689).<ref name="intelmay" /><ref name="reg-2017-05-01" /><ref>{{cite web |url=https://www.cve.mitre.org/cgi-bin/cvename.cgi?name=2017-5689 |title=CVE - CVE-2017-5689 |website=Cve.mitre.org |access-date=May 7, 2017 |archive-url=https://web.archive.org/web/20170505125225/http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=2017-5689 |archive-date=May 5, 2017 |url-status=dead }}</ref><ref>{{cite web |url=https://www.darknet.org.uk/2016/06/intel-hidden-management-engine-x86-security-risk/ |title=Intel Hidden Management Engine - x86 Security Risk? |publisher=Darknet |date=June 16, 2016 |access-date=May 7, 2017 |archive-date=May 20, 2025 |archive-url=https://web.archive.org/web/20250520135058/https://www.darknet.org.uk/2016/06/intel-hidden-management-engine-x86-security-risk/ |url-status=live }}</ref><ref>{{cite web |last=Garrett |first=Matthew |url=https://mjg59.dreamwidth.org/48429.html |title=Intel's remote AMT vulnerablity{{sic|hide=y}} |website=mjg59.dreamwidth.org |date=May 1, 2017 |access-date=May 7, 2017 |archive-date=April 22, 2025 |archive-url=https://web.archive.org/web/20250422214520/https://mjg59.dreamwidth.org/48429.html |url-status=live }}</ref> The vulnerability was nicknamed "Silent Bob is Silent" by the researchers who had reported it to Intel.<ref name="ssh-com">{{cite web|url=https://www.ssh.com/vulnerability/intel-amt/|title=2017-05-05 ALERT! Intel AMT EXPLOIT OUT! IT'S BAD! DISABLE AMT NOW!|website=Ssh.com|access-date=November 25, 2017|archive-date=March 5, 2018|archive-url=https://web.archive.org/web/20180305001456/https://www.ssh.com/vulnerability/intel-amt/|url-status=dead}}</ref> It affects numerous laptops, desktops and servers sold by [[Company:Dell|Dell]], [[Company:Fujitsu|Fujitsu]], [[Company:Hewlett-Packard|Hewlett-Packard]] (later [[Company:Hewlett Packard Enterprise|Hewlett Packard Enterprise]] and [[Company:HP Inc.|HP Inc.]]), Intel, [[Company:Lenovo|Lenovo]], and possibly others.<ref name="ssh-com" /><ref>{{cite web |author=Dan Goodin |url=https://arstechnica.com/security/2017/05/the-hijacking-flaw-that-lurked-in-intel-chips-is-worse-than-anyone-thought/ |title=The Hijacking Flaw That Lurked in Intel Chips Is Worse than Anyone Thought |publisher=Ars Technica |date=May 6, 2017 |access-date=May 8, 2017 |archive-date=May 20, 2017 |archive-url=https://web.archive.org/web/20170520152820/https://arstechnica.com/security/2017/05/the-hijacking-flaw-that-lurked-in-intel-chips-is-worse-than-anyone-thought/ |url-status=live }}</ref><ref>{{cite web |url=http://en.community.dell.com/support-forums/laptop/f/3518/t/20011662 |title=General: BIOS updates due to Intel AMT IME vulnerability - General Hardware - Laptop - Dell Community |website=En.Community.Dell.com |date=May 2, 2017 |access-date=May 7, 2017 |archive-date=May 11, 2017 |archive-url=https://web.archive.org/web/20170511075221/http://en.community.dell.com/support-forums/laptop/f/3518/t/20011662 |url-status=dead }}</ref><ref>{{cite web |url=http://support.ts.fujitsu.com/content/Intel_Firmware.asp |title=Advisory note: Intel Firmware vulnerability – Fujitsu Technical Support pages from Fujitsu Fujitsu Continental Europe, Middle East, Africa & India |publisher=Support.ts.fujitsu.com |date=May 1, 2017 |access-date=May 8, 2017 |archive-date=March 11, 2021 |archive-url=https://web.archive.org/web/20210311202534/https://support.ts.fujitsu.com/content/Intel_Firmware.asp |url-status=live }}</ref><ref>{{cite web |url=http://h22208.www2.hpe.com/eginfolib/securityalerts/CVE-2017-5689-Intel/CVE-2017-5689.html |title=HPE &#124; HPE CS700 2.0 for VMware |website=H22208.www2.hpe.com |date=May 1, 2017 |access-date=May 7, 2017 |archive-date=May 8, 2017 |archive-url=https://web.archive.org/web/20170508041543/http://h22208.www2.hpe.com/eginfolib/securityalerts/CVE-2017-5689-Intel/CVE-2017-5689.html |url-status=dead }}</ref><ref>{{cite web |url=https://communities.intel.com/thread/114071 |title=Intel Security Advisory regarding escalation o... &#124;Intel Communities |website=Communities.Intel.com |date=May 4, 2017 |access-date=May 7, 2017 |archive-date=November 26, 2018 |archive-url=https://web.archive.org/web/20181126151814/https://communities.intel.com/thread/114071 |url-status=dead }}</ref><ref>{{cite web |url=https://support.lenovo.com/us/en/product_security/LEN-14963 |title=Intel Active Management Technology, Intel Small Business Technology, and Intel Standard Manageability Remote Privilege Escalation |website=Support.lenovo.com |access-date=May 7, 2017 |archive-date=April 18, 2025 |archive-url=https://web.archive.org/web/20250418050541/https://support.lenovo.com/us/en/product_security/LEN-14963 |url-status=live }}</ref> Those researchers claimed that the bug affects systems made in 2010 or later.<ref>{{cite web
|url=https://www.embedi.com/news/mythbusters-cve-2017-5689 
|archive-url=https://web.archive.org/web/20180817215423/https://embedi.com/news/mythbusters-cve-2017-5689
|archive-date=August 17, 2018
|title=MythBusters: CVE-2017-5689 
|website=Embedi.com 
|date=May 2, 2017
}}</ref> Other reports claimed the bug also affects systems made as long ago as 2008.<ref name="reg-2017-05-01" /><ref>{{cite web |first=Charlie |last=Demerjian |url=https://semiaccurate.com/2017/05/01/remote-security-exploit-2008-intel-platforms/ |title=Remote security exploit in all 2008+ Intel platforms |website=SemiAccurate.com |date=May 1, 2017 |access-date=May 7, 2017 |archive-date=May 1, 2017 |archive-url=https://web.archive.org/web/20170501160809/https://semiaccurate.com/2017/05/01/remote-security-exploit-2008-intel-platforms/ |url-status=live }}</ref> The vulnerability was described as giving remote attackers:

{{Blockquote|text="full control of affected machines, including the ability to read and modify everything. It can be used to install persistent malware (possibly in firmware), and read and modify any data." |author=Tatu Ylönen|source=''ssh.com''<ref name="ssh-com" />}}

===PLATINUM===
In June 2017, the PLATINUM cybercrime group became notable for exploiting the [[Serial over LAN|serial over LAN (SOL)]] capabilities of AMT to perform data exfiltration of stolen documents.<ref>{{cite web|url=https://arstechnica.com/security/2017/06/sneaky-hackers-use-intel-management-tools-to-bypass-windows-firewall/|title=Sneaky hackers use Intel management tools to bypass Windows firewall|date=June 9, 2017|access-date=June 10, 2017|archive-date=June 21, 2017|archive-url=https://web.archive.org/web/20170621003933/https://arstechnica.com/security/2017/06/sneaky-hackers-use-intel-management-tools-to-bypass-windows-firewall/|url-status=live}}</ref><ref>{{cite web|url=https://www.zdnet.com/article/windows-firewall-dodged-by-hot-patching-spies-using-intel-amt-says-microsoft/|title=Windows firewall dodged by 'hot-patching' spies using Intel AMT, says Microsoft - ZDNet|first=Liam|last=Tung|website=[[ZDNet]]|access-date=June 10, 2017|archive-date=March 11, 2025|archive-url=https://web.archive.org/web/20250311193933/https://www.zdnet.com/article/windows-firewall-dodged-by-hot-patching-spies-using-intel-amt-says-microsoft/|url-status=live}}</ref><ref name="microsoft.com">{{cite web|url=https://blogs.technet.microsoft.com/mmpc/2017/06/07/platinum-continues-to-evolve-find-ways-to-maintain-invisibility/|title=PLATINUM continues to evolve, find ways to maintain invisibility|date=June 7, 2017|access-date=June 10, 2017|archive-date=December 3, 2017|archive-url=https://web.archive.org/web/20171203160129/https://blogs.technet.microsoft.com/mmpc/2017/06/07/platinum-continues-to-evolve-find-ways-to-maintain-invisibility/|url-status=live}}</ref><ref>{{cite web|url=https://www.bleepingcomputer.com/news/security/malware-uses-obscure-intel-cpu-feature-to-steal-data-and-avoid-firewalls/|title=Malware Uses Obscure Intel CPU Feature to Steal Data and Avoid Firewalls|access-date=June 10, 2017|archive-date=March 29, 2025|archive-url=https://web.archive.org/web/20250329180411/https://www.bleepingcomputer.com/news/security/malware-uses-obscure-intel-cpu-feature-to-steal-data-and-avoid-firewalls/|url-status=live}}</ref><ref>{{cite web|url=https://www.itnews.com.au/news/hackers-abuse-low-level-management-feature-for-invisible-backdoor-464499|title=Hackers abuse low-level management feature for invisible backdoor|website=iTnews|access-date=June 10, 2017|archive-date=February 25, 2025|archive-url=https://web.archive.org/web/20250225131248/https://www.itnews.com.au/news/hackers-abuse-low-level-management-feature-for-invisible-backdoor-464499|url-status=live}}</ref><ref>{{cite web|url=https://www.theregister.co.uk/AMP/2017/06/08/vxers_exploit_intels_amt_for_malwareoverlan/|title=Vxers exploit Intel's Active Management for malware-over-LAN • The Register|website=TheRegister.co.uk|access-date=June 10, 2017|archive-date=January 3, 2020|archive-url=https://web.archive.org/web/20200103152347/https://www.theregister.co.uk/AMP/2017/06/08/vxers_exploit_intels_amt_for_malwareoverlan/|url-status=live}}</ref><ref>{{cite web|url=https://www.heise.de/security/meldung/Intel-Fernwartung-AMT-bei-Angriffen-auf-PCs-genutzt-3739441.html|title=Intel-Fernwartung AMT bei Angriffen auf PCs genutzt|first=heise|last=Security|website=Security|date=June 9, 2017|access-date=June 10, 2017|archive-date=December 23, 2022|archive-url=https://web.archive.org/web/20221223003619/https://www.heise.de/security/meldung/Intel-Fernwartung-AMT-bei-Angriffen-auf-PCs-genutzt-3739441.html|url-status=live}}</ref><ref>{{cite web|url=https://channel9.msdn.com/Shows/Windows-Security-Blog/PLATINUM-activity-group-file-transfer-method-using-Intel-AMT-SOL|title=PLATINUM activity group file-transfer method using Intel AMT SOL|website=Channel 9|access-date=June 10, 2017|archive-date=November 6, 2021|archive-url=https://web.archive.org/web/20211106164113/https://channel9.msdn.com/Shows/Windows-Security-Blog/PLATINUM-activity-group-file-transfer-method-using-Intel-AMT-SOL|url-status=live}}</ref> SOL is disabled by default and must be enabled to exploit this vulnerability.<ref>{{Cite web|url=https://www.bleepingcomputer.com/news/security/malware-uses-obscure-intel-cpu-feature-to-steal-data-and-avoid-firewalls/|title=Malware Uses Obscure Intel CPU Feature to Steal Data and Avoid Firewalls|website=BleepingComputer|access-date=November 25, 2017|archive-date=March 29, 2025|archive-url=https://web.archive.org/web/20250329180411/https://www.bleepingcomputer.com/news/security/malware-uses-obscure-intel-cpu-feature-to-steal-data-and-avoid-firewalls/|url-status=live}}</ref>

===SA-00086===
Some months after the previous bugs, and subsequent warnings from the EFF,<ref name="eff1" /> security firm Positive Technologies claimed to have developed a working [[Exploit (computer security)|exploit]].<ref>{{Cite web|url=https://www.blackhat.com/eu-17/briefings/schedule/#how-to-hack-a-turned-off-computer-or-running-unsigned-code-in-intel-management-engine-8668|title=Black Hat Europe 2017|website=BlackHat.com|access-date=November 23, 2017|archive-date=August 19, 2020|archive-url=https://web.archive.org/web/20200819151748/https://www.blackhat.com/eu-17/briefings/schedule/#how-to-hack-a-turned-off-computer-or-running-unsigned-code-in-intel-management-engine-8668|url-status=live}}</ref> On November 20, 2017, Intel confirmed that a number of serious flaws had been found in the Management Engine (mainstream), Trusted Execution Engine (tablet/mobile), and Server Platform Services (high end server) firmware, and released a "critical firmware update".<ref name="intel2">{{cite web|url=https://www.intel.com/content/www/us/en/support/articles/000025619/software.html|title=Intel Management Engine Critical Firmware Update (Intel SA-00086)|publisher=Intel|access-date=November 22, 2017|archive-date=April 27, 2025|archive-url=https://web.archive.org/web/20250427215719/https://www.intel.com/content/www/us/en/support/articles/000025619/software.html|url-status=live}}</ref><ref name="wired1">{{cite magazine|url=https://www.wired.com/story/intel-management-engine-vulnerabilities-pcs-servers-iot/|title=Intel Chip Flaws Leave Millions of Devices Exposed|magazine=Wired|last1=Newman|first1=Lily Hay|access-date=November 22, 2017|archive-date=March 5, 2025|archive-url=https://web.archive.org/web/20250305232732/https://www.wired.com/story/intel-management-engine-vulnerabilities-pcs-servers-iot/|url-status=live}}</ref> Essentially, every Intel-based computer for the last several years, including most desktops and servers, were found to be vulnerable to having their security compromised, although all the potential routes of exploitation were not entirely known.<ref name="wired1" /> It is not possible to patch the problems from the operating system, and a firmware (UEFI, BIOS) update to the motherboard is required, which was anticipated to take quite some time for the many individual manufacturers to accomplish, if it ever would be for many systems.<ref name="extreme1" />

====Affected systems====

Source:<ref name=intel2 />

* [[Engineering:Intel Atom|Intel Atom]] – C3000 family
* Intel Atom – Apollo Lake E3900 series
* Intel Celeron – N and J series
* [[Engineering:Intel Core|Intel Core]] (i3, i5, i7, i9) – 1st, 2nd, 3rd, 4th, 5th, 6th, 7th, and 8th generation
* Intel Pentium – Apollo Lake
* Intel Xeon – E3-1200 v5 and v6 product family
* Intel Xeon – Scalable family
* Intel Xeon – W family

====Mitigation====
None of the known unofficial methods to disable the ME prevent exploitation of the vulnerability. A firmware update by the vendor is required. However, those who discovered the vulnerability note that firmware updates are not fully effective either, as an attacker with access to the ME firmware region can simply flash an old, vulnerable version and then exploit the bug.<ref name="auto2" />

===SA-00112===
In July 2018, Intel announced that three vulnerabilities ({{CVE|2018-3628|2018-3629|2018-3632}}) had been discovered and that a patch for the CSME firmware would be required. Intel indicated there would be no patch for 3rd generation Core processors or earlier despite chips or their chipsets as far back as Intel Core 2 Duo vPro and Intel Centrino 2 vPro being affected. However, Intel AMT must be enabled and provisioned for the vulnerability to exist.<ref name="SA-00112" /><ref>{{Cite web|url=https://www.intel.com/content/www/ca/en/support/articles/000029388/software/chipset-software.html|title=Intel Active Management Technology 9.x/10.x/11.x Security Review...|website=Intel}}</ref>

==Assertions that ME is a backdoor==
Critics like the [[Organization:Electronic Frontier Foundation|Electronic Frontier Foundation]] (EFF), [[Libreboot]] developers, and security expert Damien Zammit accused the ME of being a [[Backdoor (computing)|backdoor]] and a privacy concern.<ref name="eff1" /><ref name="softpediaME">{{Cite web |url=https://news.softpedia.com/news/intel-x86-cpus-come-with-a-secret-backdoor-that-nobody-can-touch-or-disable-505347.shtml |title=Intel x86 CPUs Come with a Secret Backdoor That Nobody Can Touch or Disable |first=Catalin |last=Cimpanu |website=softpedia |date=June 17, 2016 |access-date=September 10, 2020 |archive-date=February 25, 2025 |archive-url=https://web.archive.org/web/20250225125238/https://news.softpedia.com/news/intel-x86-cpus-come-with-a-secret-backdoor-that-nobody-can-touch-or-disable-505347.shtml |url-status=live }}</ref> Zammit stresses that the ME has full access to memory (without the owner-controlled CPU cores having any knowledge), and has full access to the TCP/IP stack and can send and receive network packets independently of the operating system, thus bypassing its firewall.<ref name="techrepublicME" />

Intel responded by saying, "Intel does not put backdoors in its products, nor do our products give Intel control or access to computing systems without the explicit permission of the end user."<ref name="techrepublicME" /> and "Intel does not and will not design backdoors for access into its products. Recent reports claiming otherwise are misinformed and blatantly false. Intel does not participate in any efforts to decrease the security of its technology."<ref name="register_can_disable" />

==Disabling the ME==
It is normally not possible for the end-user to disable the ME and there is no officially supported method to disable it, but some undocumented methods to do so were discovered.<ref name="extreme1"/>  The ME's security architecture is designed to prevent disabling. Intel considers disabling the ME to be a security vulnerability, as a malware could abuse it to make the computer lose some of the functionality that the typical user expects, such as the ability to play media with [[Engineering:Digital rights management|DRM]], specifically DRM media that is using HDCP.<ref>{{cite web|url=https://www.phoronix.com/news/HDCP-2.2-For-i915-DRM|title=HDCP 2.2 Content Protection Being Worked On For The i915 DRM Driver|access-date=January 17, 2023|archive-date=April 14, 2025|archive-url=https://web.archive.org/web/20250414214540/https://www.phoronix.com/news/HDCP-2.2-For-i915-DRM|url-status=live}}</ref><ref>{{cite web|url=https://www.phoronix.com/news/HDCP-2.2-Intel-Linux-Driver|title=HDCP 2.2 Support Updated For The Intel DRM Linux Driver|access-date=January 17, 2023|archive-date=May 8, 2025|archive-url=https://web.archive.org/web/20250508040824/https://www.phoronix.com/news/HDCP-2.2-Intel-Linux-Driver|url-status=live}}</ref> On the other hand, it is also possible for malicious actors to use the ME to remotely compromise a system.

Strictly speaking, none of the known methods can disable the ME completely, since it is required for booting the main CPU. The currently known methods merely make the ME go into abnormal states soon after boot, in which it seems not to have any working functionality. The ME is still physically connected to the system and its microprocessor continues to execute code. Some manufacturers like [[Company:Purism|Purism]] and [[Company:System76|System76]] disable the Intel Management Engine.<ref>{{cite web|url=https://puri.sm/faq/what-is-intel-management-engine-and-what-are-concerns-with-it-regarding-librem-laptops/|title=What is Intel Management Engine and what are concerns with it regarding Librem laptops?|date=September 27, 2018|access-date=January 17, 2023|archive-date=June 17, 2025|archive-url=https://web.archive.org/web/20250617080947/https://puri.sm/faq/what-is-intel-management-engine-and-what-are-concerns-with-it-regarding-librem-laptops/|url-status=live}}</ref><ref>{{cite web|url=https://blog.system76.com/post/major-updates-for-system76-open-firmware-june-2023|title=Major Updates for System76 Open Firmware!|date=June 2, 2023|access-date=September 28, 2023|archive-date=April 4, 2025|archive-url=https://web.archive.org/web/20250404115648/https://blog.system76.com/post/major-updates-for-system76-open-firmware-june-2023/|url-status=live}}</ref>

===Undocumented methods===

====Firmware neutralization====
In 2016, the <code>me_cleaner</code> project found that the ME's integrity verification is broken. The ME is supposed to detect that it has been tampered with and, if this is the case, shut down the PC forcibly 30 minutes after system start.<ref>{{Cite web|url=https://github.com/corna/me_cleaner|title=corna/me_cleaner|date=September 10, 2020|via=GitHub|access-date=November 27, 2017|archive-date=September 6, 2020|archive-url=https://web.archive.org/web/20200906120501/https://github.com/corna/me_cleaner|url-status=live}}</ref> This prevents a compromised system from running undetected, yet allows the owner to fix the issue by flashing a valid version of the ME firmware during the grace period. As the project found out, by making unauthorized changes to the ME firmware, it was possible to force it into an abnormal error state that prevented triggering the shutdown even if large parts of the firmware had been overwritten and thus made inoperable.

===="High Assurance Platform" mode====
In August 2017, Positive Technologies published a method to disable the ME via an [[Undocumented feature|undocumented built-in mode]]. As Intel has confirmed<ref>{{Cite news|first=Catalin|last=Cimpanu|url=https://www.bleepingcomputer.com/news/hardware/researchers-find-a-way-to-disable-much-hated-intel-me-component-courtesy-of-the-nsa/|date=August 28, 2017|title=Researchers Find a Way to Disable Much-Hated Intel ME Component Courtesy of the NSA|work=[[Bleeping Computer]]|access-date=November 27, 2017|archive-date=September 12, 2020|archive-url=https://web.archive.org/web/20200912034926/https://www.bleepingcomputer.com/news/hardware/researchers-find-a-way-to-disable-much-hated-intel-me-component-courtesy-of-the-nsa/|url-status=live}}</ref> the ME contains a switch to enable government authorities such as the [[Organization:National Security Agency|NSA]] to make the ME go into High-Assurance Platform (HAP) mode after boot. This mode disables most of ME's functions,<ref name="register_can_disable">{{Cite news|first=Thomas|last=Claburn|date=August 29, 2017|url=https://www.theregister.com/2017/08/29/intel_management_engine_can_be_disabled/|title=Intel ME controller chip has secret kill switch|work=The Register|access-date=September 10, 2020|archive-date=March 19, 2025|archive-url=https://web.archive.org/web/20250319221246/https://www.theregister.com/2017/08/29/intel_management_engine_can_be_disabled/|url-status=live}}</ref><ref name="ptsecurity1">{{Cite web |last1=Ermolov |first1=Mark |last2=Goryachy |first2=Maxim |date=2017-08-28 |title=Disabling Intel ME 11 via undocumented mode |url=http://blog.ptsecurity.com/2017/08/disabling-intel-me.html?m=1 |url-status=dead |archive-url=https://web.archive.org/web/20201201175708/http://blog.ptsecurity.com/2017/08/disabling-intel-me.html?m=1 |archive-date=December 1, 2020 |website=Positive Technologies}}</ref> and was intended to be available only in machines produced for specific purchasers like the US government; however, most machines sold on the retail market can be made to activate the switch.<ref name="ptsecurity1" /><ref>{{Cite web|url=https://github.com/corna/me_cleaner|title=corna/me_cleaner|website=GitHub|date=March 19, 2022|access-date=November 27, 2017|archive-date=September 6, 2020|archive-url=https://web.archive.org/web/20200906120501/https://github.com/corna/me_cleaner|url-status=live}}</ref> Manipulation of the HAP bit was quickly incorporated into the <code>me_cleaner</code> project.<ref>{{Cite web|url=https://github.com/corna/me_cleaner/commit/ced3b46ba2ccd74602b892f9594763ef34671652|title=Set the HAP bit (ME >= 11) or the AltMeDisable bit (ME < 11) · corna/me_cleaner@ced3b46|website=GitHub|access-date=December 5, 2017|archive-date=September 4, 2017|archive-url=https://web.archive.org/web/20170904124609/https://github.com/corna/me_cleaner/commit/ced3b46ba2ccd74602b892f9594763ef34671652|url-status=live}}</ref>

===Commercial ME disablement===
{{Primary sources|date=May 2023}}
From late 2017 on, several laptop vendors announced their intentions to ship laptops with the Intel ME disabled or let the end-users disable it manually:
* Minifree Ltd has provided [[Libreboot]] pre-loaded laptops with Intel ME either not present or disabled since at least 2015.<ref>{{Cite web |title=Libreboot T400 laptop now FSF-certified to respect your freedom — Free Software Foundation — Working together for free software |url=https://www.fsf.org/news/libreboot-t400-laptop-now-fsf-certified-to-respect-your-freedom |access-date=April 30, 2023 |website=www.fsf.org |archive-date=April 16, 2025 |archive-url=https://web.archive.org/web/20250416052434/https://www.fsf.org/news/libreboot-t400-laptop-now-fsf-certified-to-respect-your-freedom |url-status=live }}</ref><ref>{{Cite web |last=Bärwaldt |first=Erik |title=Liberated » Linux Magazine |url=http://www.linux-magazine.com/Issues/2018/210/Free-Firmware-with-Libreboot |access-date=April 30, 2023 |website=Linux Magazine |language=en-US |archive-date=August 22, 2021 |archive-url=https://web.archive.org/web/20210822203232/https://www.linux-magazine.com/Issues/2018/210/Free-Firmware-with-Libreboot |url-status=live }}</ref><ref>{{Cite web |last=Biggs |first=John |date=August 11, 2017 |title=The Minifree Libreboot T400 is free as in freedom |url=https://techcrunch.com/2017/08/11/the-minifree-libreboot-t400-is-free-as-in-freedom/ |access-date=April 30, 2023 |website=TechCrunch |language=en-US |archive-date=April 14, 2025 |archive-url=https://web.archive.org/web/20250414205613/https://techcrunch.com/2017/08/11/the-minifree-libreboot-t400-is-free-as-in-freedom/ |url-status=live }}</ref>
* [[Company:Purism|Purism]] previously petitioned Intel to sell processors without the ME, or release its source code, calling it "a threat to users' digital rights".<ref>{{Cite web|url=https://puri.sm/posts/petition-for-intel-to-release-an-me-less-cpu-design/|title=Petition for Intel to Release an ME-Less CPU Design|date=June 16, 2016|archive-url=https://web.archive.org/web/20160616070449/https://puri.sm/posts/petition-for-intel-to-release-an-me-less-cpu-design/|archive-date=June 16, 2016}}</ref> In March 2017, Purism announced that it had neutralized the ME by erasing the majority of the ME code from the flash memory.<ref>{{Cite web|url=https://puri.sm/posts/neutralizing-intel-management-engine-on-librem-laptops/|title=Neutralizing the Intel Management Engine on Librem Laptops|last=Alaoui|first=Youness|date=March 9, 2017|website=puri.sm|language=en-US|access-date=December 13, 2017|archive-date=March 9, 2017|archive-url=https://web.archive.org/web/20170309204405/https://puri.sm/posts/neutralizing-intel-management-engine-on-librem-laptops/|url-status=live}}</ref> It further announced in October 2017<ref>{{Cite web|url=https://puri.sm/posts/purism-librem-laptops-completely-disable-intel-management-engine/|title=Purism Librem Laptops Completely Disable Intel's Management Engine|date=October 19, 2017|access-date=December 5, 2017|archive-date=September 24, 2020|archive-url=https://web.archive.org/web/20200924023203/https://puri.sm/posts/purism-librem-laptops-completely-disable-intel-management-engine/|url-status=live}}</ref> that new batches of their [[Engineering:Librem|Librem]] line of laptops running [[Software:PureOS|PureOS]] will ship with the ME neutralized, and additionally disable most ME operation via the HAP bit. Updates for existing Librem laptops were also announced.
* In November, [[Company:System76|System76]] announced their plan to disable the ME on their new and recent machines which ship with [[Software:Pop! OS|Pop! OS]] via the HAP bit.<ref>{{Cite web|url=https://blog.system76.com/post/168050597573/system76-me-firmware-updates-plan|title=System76 ME Firmware Updates Plan|website=System76 Blog|access-date=September 10, 2020|archive-date=August 15, 2020|archive-url=https://web.archive.org/web/20200815170940/https://blog.system76.com/post/168050597573/system76-me-firmware-updates-plan|url-status=dead}}</ref>
* In December, [[Company:Dell|Dell]] began showing certain laptops on its website that offered the "Systems Management" option "Intel vPro - ME Inoperable, Custom Order" for an additional fee. Dell has not announced or publicly explained the methods used. In response to press requests, Dell stated that those systems had been offered for quite a while, but not for the general public, and had found their way to the website only inadvertently.<ref name="extremedell">{{Cite web|url=https://www.extremetech.com/computing/260219-dell-sells-pcs-without-intel-management-engine-tradeoffs|title=Dell Sells PCs without Intel's Management Engine, but with Tradeoffs|website=ExtremeTech.com|date=December 11, 2017 |access-date=December 12, 2017|archive-date=September 20, 2020|archive-url=https://web.archive.org/web/20200920051627/https://www.extremetech.com/computing/260219-dell-sells-pcs-without-intel-management-engine-tradeoffs|url-status=live}}</ref> The laptops are available only by custom order and only to military, government and intelligence agencies.<ref>{{Cite web|url=https://www.heise.de/newsticker/meldung/Dell-schaltet-Intel-Management-Engine-in-Spezial-Notebooks-ab-3909860.html|title=Dell schaltet Intel Management Engine in Spezial-Notebooks ab|trans-title=Dell switches off Intel Management Engine in special notebooks|first=heise|last=online|website=heise online|date=December 6, 2017|lang=de|access-date=December 7, 2017|archive-date=June 17, 2020|archive-url=https://web.archive.org/web/20200617205456/https://www.heise.de/newsticker/meldung/Dell-schaltet-Intel-Management-Engine-in-Spezial-Notebooks-ab-3909860.html|url-status=live}}</ref> They are specifically designed for covert operations, such as providing a very robust case and a "stealth" operating mode kill switch that disables display, LED lights, speaker, fan and any wireless technology.<ref>{{Cite web|url=https://www.dell.com/support/manuals/us/en/04/latitude-14-5414-laptop/5414_om/stealth-mode?guid=guid-3655713b-6a1b-46a8-ba69-eaa3c324b3cd&lang=en-us|title=Dell Latitude 14 Rugged — 5414 Series Owner's Manual|website=Dell.com|access-date=September 10, 2020|archive-date=August 9, 2020|archive-url=https://web.archive.org/web/20200809044609/https://www.dell.com/support/manuals/us/en/04/latitude-14-5414-laptop/5414_om/stealth-mode?guid=guid-3655713b-6a1b-46a8-ba69-eaa3c324b3cd&lang=en-us|url-status=live}}</ref>
*In March 2018, [[Company:Tuxedo Computers|Tuxedo Computers]], a German company which specializes in PCs which run [[Software:Linux|Linux kernel-based operating systems]], announced an option in the BIOS of their system to disable ME.<ref>{{Cite web |title=TUXEDO disables Intel's Management Engine |url=https://www.tuxedocomputers.com/en/Infos/News/TUXEDO-disables-Intels-Management-Engine.tuxedo |date=2018-03-14 |publisher=Tuxedo Computers}}</ref>

===Effectiveness against vulnerabilities===
Neither of the two methods to disable the ME discovered so far turned out to be an effective countermeasure against the SA-00086 vulnerability.<ref name="auto2" />

==Reactions==

===By Google===
{{As of|2017|post=,}} Google was attempting to eliminate [[Proprietary software|proprietary]] firmware from its servers and found that the ME was a hurdle to that.<ref name="extreme1" />

===By AMD processor vendors===
Shortly after SA-00086 was patched, vendors for AMD processor mainboards started shipping BIOS updates that allow disabling the [[AMD Platform Security Processor]],<ref>{{Cite web|url=https://www.phoronix.com/scan.php?page=news_item&px=AMD-PSP-Disable-Option|title=AMD Reportedly Allows Disabling PSP Secure Processor With Latest AGESA - Phoronix|date=December 7, 2017|website=Phoronix.com|access-date=April 16, 2019|archive-date=September 21, 2009|archive-url=https://web.archive.org/web/20090921053923/https://www.phoronix.com/scan.php?page=news_item&px=AMD-PSP-Disable-Option|url-status=live}}</ref> a subsystem with a similar function as the ME.

==See also==
* [[AMD Platform Security Processor]]
* ARM TrustZone
* Intel AMT versions
* Intel vPro
* [[Meltdown (security vulnerability)]]
* Microsoft Pluton
* [[Next-Generation Secure Computing Base]]
* [[Software:Samsung Knox|Samsung Knox]]
* [[Spectre (security vulnerability)]]
* [[Trusted Computing]]
* [[Engineering:Trusted Execution Technology|Trusted Execution Technology]]
* [[Software:Trusted Platform Module|Trusted Platform Module]]

==References==
{{Reflist}}

==External links==
* [https://downloadcenter.intel.com/download/27150 Intel® Converged Security and Management Engine Version Detection Tool (Intel® CSMEVDT) (Intel-SA-00086 security vulnerability detection tool)] from Intel Download Center
* [https://i.blackhat.com/USA-19/Wednesday/us-19-Hasarfaty-Behind-The-Scenes-Of-Intel-Security-And-Manageability-Engine.pdf Behind the Scenes of Intel Security and Manageability Engine]{{dash}} A presentation by Intel security researchers presented in Black Hat USA 2019
{{Intel technology}}
{{Firmware and booting}}

[[Category:BIOS]]
[[Category:Computer security]]
[[Category:Intel]]
[[Category:Remote administration software]]

{{Sourceattribution|Intel Management Engine}}