The IME, like Computrace which is similarly awful[1], is intended to be used for enterprise management. It's nice for someone in IT to be able to remotely wipe a company laptop that was left in an airport, but there's absolutely no reason why consumer devices should be burdened with these backdoors.

AMD has something called the PSP which essentially serves the same purposes of the IME which is also undocumented and cannot be disabled.

[1] https://securelist.com/absolute-computrace-revisited/58278/

> there's absolutely no reason why consumer devices should be burdened with these backdoors

Intel's advantage is built and defended on economies of scale. Making a hundred million of one thing [1] is more profitable than making 50 million of two things. Particularly if enterprises' demand for IME is stronger than consumers' demand for non-IME chips (assuming no strong externalities, e.g. NSA corruption).

I think the Intel Management Engine is crap. But there's a comprehensible reason it's there.

[1] https://www.ft.com/content/beff6e56-53ed-11e4-80db-00144feab...

Intel doesn't have to ship IME-less chips. All it has to do is provide a way for users[1] to disable features that compromise their security but Intel doesn't, for whatever reason.

[1] I'm aware that a "High Assurance Program" bit exists that disables most functions of the IME but you can't expect the average consumer (or even the majority of technically-inclined consumers) to own an SPI flash programmer and to be willing and able to use one on their motherboard. Furthermore, researchers believe that setting this bit would cause any computer with the Verified Boot fuses set (i.e. pretty much any recent laptop) to fail to boot[2].

[2] https://github.com/corna/me_cleaner/issues/53#issuecomment-3...

Economies of scale doesn't explain why there isn't an option to disable the IME.

> there's absolutely no reason why consumer devices should be burdened with these backdoors.

Beyond the obvious economy of scale argument, why don’t consumers want that? I thought things like Apple’s remote lock/wipe feature were selling points for anyonel concerned with theft.

(As an aside, it doesn’t feel accurate to term this a backdoor without evidence that it’s being used without the owner’s consent)

The article mentions they've already found a remotely exploitable security hole. Backdoor or not, nobody wants that.

We would all be fine with IME if we had access to it, could define the keys, and enable/disable features of it. Locking users out of their own hardware is not acceptable. I'm the only one that should be able to remote lock/wipe my phone. It should not be possible for Apple. They shouldn't have the keys. It's my phone. Even if I did trust Apple, I don't trust the government.

Look, I’d also like this to be open and documented but hyperbole isn’t helping that. If it’s undocumented, say that rather than pretending anyone is locked out of their own hardware — nobody has lost the use of their device due to IME. Similarly, calling it a backdoor and implying that the NSA is behind it without any proof is only going to reflect badly on the person making those claims.

The other thing to remember for effective advocacy is thinking about what normal people experience. If you say Apple shouldn’t have the keys, you’re also saying the average person has to be good at key management; most people are happy to outsource that. Conflating the issues of mass surveillance with control over your own hardware is great if your goal is confusion but I don’t see it producing results.

Whether it is actually being used is irrelevant. Security is about confidence that unauthorized access is impossible, not about whether unauthorized is happening right now. An unlocked door is not secure against unauthorized entry merely because noone has opened it yet, what makes it insecure is the fact that anyone who wants to can walk through it whenever they want.

It is not even relevant whether the door was left unlocked intentionally. An unlocked door is a security problem, whether it was put in place intentionally or due to negligence.

That’s not what we’re talking about, though, is it? Unless the claim is that vendors are shipping IME enabled with secret credentials it’s not a backdoor.

A backdoor does not necessarily have to be in the form of a door, a wall made from cardboard will do just fine as a backdoor.

Putting a complex piece of software that you cannot disable, that is potentially reachable from the network, and that won't be updated into every machine is the software-equivalent of building a safe with a cardboard wall: Even if it's not intended as a backdoor, it still has to be treated as a de-facto backdoor for security planning purposes, and whoever uses cardboard to construct a safe wall is to blame.

Also, you do not judge security based on what has already happened nor on what you can prove to be insecure. The default assumption is that things are insecure, unless you can demonstrate that there are good reasons to believe that it's not--just as everywhere else in reliability engineering. A bridge is not assumed to be safe to use until it collapses or is demonstrated to be unsafe--a bridge is assumed to be unsafe to use until it is demonstrated that to the best of our current understanding of how to build reliable bridges, there is no reason to expect failure. A bridge where the builder makes a secret out of how the bridge was built is never considered safe.

Imagine your pc vendor shipped windows with remote desktop enabled, you can't disable it, and you can't see if there are any local accounts in the group, and also they could be administrators, and also it was far worse than even that, because the computer doesn't have to be on or connected to a lan. imagine if dell shipped with logmein and wol but it was permanent. how are these not security vulnerabilities?

They're backdoors because they allow for remote access[1] and we (as in the users who ostensibly "own" our own devices) can't turn them off without going through great difficulty.

Please read the piece linked above on Computrace. I am not very familiar with the inner workings of Find My Mac and other AppleID-associated features but I'm going to go out on a limb and say that those features 1. don't involve injecting code into system processes in the exact same manner as a BIOS-level rootkit and 2. aren't preactivated without the owner's knowledge or consent so the attack surface they create is likely much smaller than that of something like Computrace.

Also, if you like, please elaborate on why the economy of scale argument is "obvious".

[1] https://arstechnica.com/information-technology/2017/05/intel...

Edit: Management coprocessors are also rightly called backdoors because they operate below ring 0 meaning that if we cannot trust them (and we can't because they are largely black boxes to us) then we cannot trust our systems as a whole.

Management and security. It started as just management, and then it added security as demand for that service grew. There are very real needs that it fills, though it doesn't need to sacrifice end-user control:

Management: Imagine you manage and support 10,000 desktops and laptops. Remote access is essential (otherwise you'd effectively pay something like 2/3 of your support staff to cover time spent walking around), but typical remote access depends on an available processor, memory, OS, etc. For the many cases where those components aren't all available (something failed, OS is being updated, need to disable a component to diagnose it, etc.), you need out-of-band remote access, such as what Intel ME provides. It's a high-value service for corporate IT.

Security: You need an out-of-band machine to perform crypto functions, to protect the crypto functions against in-band attacks (e.g., in the OS, BIOS, applications ...). The out-of-band machine can then be used to verify the integrity of BIOS, OS, and other important things. It's also useful for DRM. If you're in corporate IT, you suddenly have a way to provide reasonable security guarantees across your 10,000 computers, a huge step forward.

If you are in corporate IT, or if you're a vendor wanting to enforce, protect, or hide your media or other proprietary bits, end-user control is undesirable. Obviously, that could be optional for owners of the computers who have other needs, but somehow it never works out that way ...

EDIT If you really want to learn about it, save your time and go to the source:

Platform Embedded Security Technology Revealed: Safeguarding the Future of Computing with Intel Embedded Security and Management Engine by Xiaoyu Ruan, a security researcher with the Platform Engineering Group at Intel

The purpose is in the name, it's used for management. When Intel sells you their expensive management solution for your enterprise deployment of machines with Intel CPUs, this is one of the technologies that is used.

Neither AMD nor modern ARM chips are much better in this regard, both have some form of management system (AMD has a "Secure Processor" based on ARM's TrustZone, and ARM has TrustZone).

Naive questions: How does that work?

If $comercial_seller buys $chip_vendor expensive management solution does then have "legal backdoor" access to any device it sells?

What's the "chain of command" for accessing the IMEs of this world?

Configured in BIOS menus by smaller shops, or preconfigured from the factory for the specific machines that enterprise customers are buying in bulk. (Enterprise accounts with Dell, HP, etc. can also get their corporate image preloaded at the factory to avoid any onsite provisioning).

https://software.intel.com/en-us/articles/remote-configurati...