Some of my designs replaced TCP/IP with alternative stack. A gateway device that spoke both could translate and do security work. The traffic would only go to designated parts of memory. So, traffic going to ME would never reach it or would come in via format it doesnt understand.

I was thinking last year about building one with new hardware given all the hardware/firmware vulnerabilities showing up. I have it on back burner fof now.

Doesn't ME have DMA access (even bypassing VT-d) to all memory?

I always combine strong architecture with obfuscation. In this case, my design attempts to address the risk in these ways:

1. It needs a communication channel. My guard denies it that.

2. It will create or receive packets using standard format that existing channels support. Using obfuscated formats before traffic hits the guard means its packets will just be dropped.

3. It can still be programmed to just attack the system somehow. Now, we're in realm of targeted, sophisticated attacks more likely to be noticed. That's already an improvement to status quo.

I still think someone should try paying either company's semi-custom division to make one without a ME. Add an extra must-have feature that accelerates common workloads, esp web cache or database, to generate further sales. If they refuse to remove it, then that would be really admitying something if they accepted other modifications for money.

I was wondering the same. My understanding was that it ran at a level much lower than could be introspected with regular(non-proprietary)tooling.