Theoretically, if you type on a keyboard connected to a powered-down computer, the Intel ME can send those keypresses off to servers unknown. The Intel ME is still on, even when your computer is off. The Intel ME is connected to the network interface, and it’s connected to storage. This was the Intel Management Engine, a small system that was connected to every peripheral in a computer. Over the years, a few more bits of hardware were added to CPUs. The idea behind this system was to allow for provisioning of laptops in corporate environments. Then came Active Management Technology, a set of embedded processors for Ethernet controllers. If the TPM could be trusted, the entire computer could be trusted.

These small crypto chips formed the root of ‘trust’ on a computer. These chips and software first appeared in the early 2000s as Trusted Platform Modules. Intel’s Management Engine is only a small part of a collection of tools, hardware, and software hidden deep inside some the latest Intel CPUs. This is the exploit that forces Intel and OEMs to consider the security implications of the Intel Management Engine. The cat is out of the bag, though, and this is the exploit we’ve all been expecting. This is only a local attack, one that requires physical access to a machine. Last week, researchers and presented an exploit at BlackHat Europe allowing for arbitrary code execution on the Intel ME platform.

In short, if you were designing a piece of hardware to spy on everyone using an Intel-branded computer, you would come up with something like the Intel Managment Engine.

Parts of this spy chip were included in the silicon at the behest of the NSA. It’s always on, even when the rest of your computer is off, and with the right software, you can wake it up over a network connection. This microcontroller is connected to everything, and can shuttle data between your hard drive and your network adapter. Over the last decade, Intel has been including a tiny little microcontroller inside their CPUs.

Management engine