Struggling with remote control: how to disable Intel ME

Alexander Antipov

Intel ME technology (or AMT, Active Management Technology) is one of the most mysterious and powerful elements of modern x86 platforms. The tool was originally created as a solution for remote administration. However, it has such powerful functionality and is so beyond the control of users of Intel-based devices that many of them would like to disable this technology, which is not so easy to do.

At the Positive Hack Days VI forum held in Moscow on May 17 and 18, Positive Technologies researchers Maxim Goryachy and Mark Yermolov presented several techniques for disabling Intel ME, accompanying the report with a video demonstration of the process.

What is it and why should it be turned off?

Intel subsystem management engine(ME) is an additional "hidden" processor that is present in all devices based on Intel chipsets (not only in PCs and laptops, but also in servers). The ME runtime never "sleeps" and works even when the computer is turned off (if there is a standby voltage), and also has access to random access memory, network interface, USB controller and integrated graphics adapter.

Despite such extensive opportunities, there are questions about the level of security of ME - previously, researchers have already found serious vulnerabilities and attack vectors. In addition, the subsystem contains potentially dangerous functions - remote control, NFC, hidden service partition (hidden service partition). The ME subsystem interfaces are undocumented and the implementation is closed.

All these reasons lead to the fact that many consider ME technology as a "hardware bookmark". The situation is aggravated by the fact that, on the one hand, the user of the device does not have the ability to disable this functionality, and on the other hand, the equipment manufacturer may make errors in the ME configuration.

The good news is that there are still ways to disable ME.

Intel ME Shutdown Techniques

Positive Technologies researchers Maxim Goryachy and Mark Yermolov presented a report on the shutdown of Intel ME during the Positive Hack Days VI forum in Moscow. Experts have described several techniques for disabling this subsystem:

1. ME initialization failure based;
2. Through the ME firmware update mechanism;
3. Undocumented commands
4. An undocumented mechanism intended for hardware developers is Manufacture Mode.

The researchers found that hardware platform developers often forget to turn off Manufacture Mode, which allows the latter method to be used on a large number of computers at no additional cost in "real time" mode.

Most of the disable methods use built-in ME mechanisms designed for vendors of Intel-based devices. All of them are described in detail in the presentation, which is published on GitHub. The link provides a demo video of the ME shutdown (it is also below):

Nevertheless, a reasonable question arises: "Does ME really stop working in its entirety when using its built-in shutdown mechanisms?" As proof of the fact that the ME is disabled, the researchers give the following argument: ME operates in two memory usage modes: SRAM only (embedded in ME) and SRAM + UMA. The UMA is the part of the host memory that is used as swapped memory. After the DRAM controller is initialized by the host, the ME always switches to SRAM + UMA mode.

Thus, if ME is really turned off, then when ME access to UMA memory is disabled at the hardware level at an arbitrary moment (via the VCm channel), hardware failures will not occur in ME due to the lack of data and code that were forced out into UMA memory (Such hardware failures lead to an emergency power outage from the main hardware components of the platform). On the other hand, the use of these methods makes it possible to carry out DoS attacks on AMT technology if it is used for remote control.

Hello everyone Today we will talk about a program from the great about the mighty Intel company, sometimes it seems to me that this is the best iron manufacturer, but maybe it is? The name of the Intel Security Assist program already suggests that it is something related to security, and since it is Intel, it MAYBE worth the program. Intel Security Assist may appear on the computer on its own, as additional application to drivers. Windows itself can install it through the update center. I also found info that this program is put together with Intel Me (unfortunately I don't know what it is).

It means that I also found information on the Internet that Intel Security Assist is a security component and is of little use for a purely home PC. In principle, everything is correct, if you parse the name of the Intel Security Assist program, it turns out that this is an Intel security assistant. Here is something like this

Look guys, I found this interesting picture on the Internet:

You will probably ask, well, what's wrong with that, what kind of value did I find here? And I'll tell you what! You see there is a letter M, well, such a little red icon, you see? Well, guys, this is the McAfee logo, this is something like a program that checks the security on your computer. That is, she looks to see if you have an antivirus and something else looks there, I don’t remember exactly, I just know that this program is not very useful. Although what I described here, it refers to some McAfee program, but I don’t remember which one, the fact is that there are several of them! In any case, I can already conclude that if you remove Intel Security Assist from the computer, then in 98% of cases nothing will happen, the computer will continue to function as before

For example, do you know what the Intel Management Engine Components program is? Not? Well, it doesn’t matter, however, when installing this application, it will still be installed, see how much software, there is also Intel Security Assist:

This is all a type of additional software, it is needed for some kind of advanced features, but in practice we often simply don’t use such software.

I also found this picture, here something is written in English:

But what did they want to tell us? I don’t know English, so I got into the Google translator, and there I translated everything and this is what is written there:

So, here everything is more or less clearly stated that Intel Security Assist can help with updates to protect your device. But damn it, it also says here that Intel would like to somehow collect information about our device, well, here we mean a computer, a laptop, and if it collects all this information, then it will be able to turn on the service! Oh, damn it, what is it and what did Intel want to tell us about its program? Hey, Intel, you're not telling us something here, you know what, come on goodbye ..

I also know this, I remember vaguely, but in general I somehow bought Intel processor about two years ago, the Pentium G3220 model, well, in the box with the process there was also a piece of paper where something was written about McAfee. Everything was in English, and the paper was black and white. In short, I think that McAfee is something like some kind of security product from Intel, and the company quietly promotes it, so calmly and without straining the user

How to remove Intel Security Assist from the computer completely? Look, press the Win + R buttons on the keyboard, then write the following command in the window:

Then a window will open with a list of all the programs sitting on your computer, here you need to find Intel Security Assist, select the program and then click on Delete:

This is shown at the top how to do it in Windows 10, but here it is shown almost the same, but already in Windows 7:

And in the first and second cases, you can also in that window, well, where is the list of software, then click on the Intel Security Assist program right click and select Delete. All the guys, I wrote everything, good luck to you and I look forward to visiting you again

22.04.2017

Probably none of the computer users or mobile systems Needless to say, today on the same Internet network, access to many services, services or sites requires a login and password. But you can't remember all of them. And keep the data on the computer in the form of the same text file, and even in unencrypted form, is a very dangerous business. One solution to this problem is the Intel Security True Key program. It was developed jointly by Intel and MacAfee. So why do many users who have tried it in practice try to get rid of this application?

True Key: what is this program?

The True Key application is positioned as a reliable utility that allows you to store logins, passwords and any other user registration data not on personal computer or laptop, and remote server.

In addition, it is worth paying attention to one more side of the True Key application. What kind of program it is in terms of security of access to secret data is easy to understand if you look at the capabilities of its security system. confidential information. Naturally, there is full encryption of information, the ability to synchronize between multiple accounts, setting a trusted device for logging in, etc.

What is the True Key program for: security issues

In terms of protecting data from unauthorized use, the application offers not only standard methods. So, for example, in addition to encryption and establishing secure communication channels, the program allows you to identify the user by fingerprint or even by matching facial features.

Thus, protection seems to be provided on the very high level. However, registration data is not saved on the local terminal, but, as already mentioned, on a remote server, which increases the user's chances that his information will not be stolen.

However, not all so simple. Now another look at the True Key app. What kind of program it is, it is already a little clear, let's move on, so to speak, to the commercial side. The fact is that the application itself is, as it were, shareware. Why "as if"? Only because the free version only supports maintenance of no more than 15 passwords. If there are more, you will have to fork out for a premium account, which will cost about 20 US dollars.

Why does it need to be removed?

Now the most main question: "Why are some users trying to get rid of such a seemingly necessary and advanced application?" (how to uninstall the True Key program with several methods will be discussed a little later).

Here, according to many users and experts, the problem is that the application developers obviously went too far with advertising, and some authorization methods look very inconvenient. In addition, the program gets on some computers spontaneously. This happens either if the computer has the Intel Driver Update Utilities, or by installing other applications as affiliate program, or in the form of a virus masquerading as an official utility. In the latter case, the user receives a browser hijacker that makes it difficult to search, changes start pages that adds ads, redirects it to commercial or dubious sites, and steals personal information. And this option has nothing to do with the official app.

Standard procedure

So, let's see how to remove the True Key program by yourself. simple method using OS tools. Let's make a reservation right away: the application is cross-platform, and in different systems the technique may vary, so here are the removal methods for Windows.

Let's say a number of questions arose before the user: "What is this - True Key?" and "How do I uninstall the program?" We will assume that he has already figured out the first one. We need to find the answer to the second.

The solution to the problem is standard for all Windows systems. To uninstall the application, use the Programs and Features section in the Control Panel, where you just need to find the program itself and perform a standard uninstall. But that's not all.

After that, you need to enter the system registry editor (regedit in the Run console), search by name and delete all keys corresponding to the application. But this way you can remove and not at all what is required.

Therefore, after a standard removal, it is better to use the CCleaner utility or something similar, which will find all obsolete or unused keys and remove them without user intervention.

Using narrowly focused utilities

Another solution would be to use programs like iObit Uninstaller. Its interface is somewhat reminiscent of the Windows Programs and Features section, so finding a program in the list is not difficult.

In this case, the standard uninstaller will be launched first, after which it will search for residual files and registry keys. All this garbage will also need to be removed, and with the use of the line for destroying files on the hard drive. If for some reason the application does not appear in the list, it can be removed using the Forced Uninstall module with a preliminary search.

What if it's a virus?

Finally, a few more words about the True Key application. What kind of program in the original is already clear. But if, after installation, there are assumptions about a virus with the above symptoms, you should first use not the one that is installed in the system, but some third-party portable utility, and if the threat is not detected, apply the listed steps for manual removal.

Note: in all cases, first in the "Task Manager" you need to forcibly end all processes associated with the program, remove the application module from startup, and it is advisable to remove it with the system booting into safe mode(required only for cases of detection of viral infection).

McAfee offers comprehensive solutions for antivirus protection and a secure online experience. Download antivirus programs and protection programs spyware McAfee to protect yourself from the latest web threats

List of programs

McAfee Endpoint Security
Enterprise antivirus with all the features you need: Threat Prevention, Firewall, Web Control and Adaptive Threat Protection

McAfee LiveSafe
Comprehensive antivirus, cross-platform solution to protect all your devices on Windows, Mac OS, Android and iOS platforms. Includes firewall, web protection, password manager, parental control and secure cloud storage

McAfee Total Protection
Comprehensive real-time protection: antivirus, antispyware, antispam, firewall and parental controls, as well as automatic cloud backup and encrypted data storage

McAfee AntiVirus Plus
Basic protection against viruses and Internet threats. Antivirus and antispyware, two-way firewall, web protection with SiteAdvisor, permanent deletion data and system cleanup

McAfee Internet Security
Comprehensive antivirus solution. most complete and effective protection from viruses and Internet threats, computer optimization and online backup 1 GB

McAfee Security Scan Plus
Free scanner that checks the system for updated anti-virus protection, firewall, web protection. The utility also allows you to detect malicious threats in active processes

McAfee Stinger
Free, installation-free utility to detect and remove known viruses, worms and trojans from your computer

McAfee Real Protect
Proactive zero-day threat protection that uses real-time behavioral detection technology to control suspicious system activity

McAfee WebAdvisor
Free plug-in from Intel Security for Firefox browsers, Google Chrome and Internet Explorer, which provides protection against malicious, phishing and fraudulent sites and malicious downloads

True Key
Intel Security's True Key Password Manager offers support for Windows, Mac, Android, iOS platforms and multiple multi-factor authentication methods to maximize the security of your passwords

McAfee SiteAdvisor Live
McAfee SiteAdvisor Live web antivirus provides protection against malicious sites and phishing, safe web search, web link checking e-mail and online chats

McAfee Rootkit Remover
A stand-alone utility designed to detect and remove rootkit complex and related threats. McAfee's anti-rootkit can currently detect and remove the ZeroAccess and TDSS rootkit families

McAfee Mobile Security for Android
Free antivirus for android, antispam, antitheft with remote control via SMS and web portal, secure mobile web surfing and protection WiFi connections, cloud backup for smartphone or tablet

McAfee Mobile Security for iOS
Application to protect iOS devices from viruses and Internet threats with features Reserve copy and theft protection

McAfee Mobile Innovations for Android
McAfee Mobile Innovations is an all-in-one security app for Android devices. Key features: Smart perimeter, secure QR scanner and secure data storage

McAfee GetSusp
Free McAfee utility GetSusp is designed to find unnoticed antivirus protection malware. Detection is made through a combination of heuristic technology and an online database safe files McAfee

McAfee FreeScan
A convenient and free product for checking your computer for viruses without installing any software

McAfee FakeAlert Stinger
A special version of Stinger that uses the Super Scan mode to detect fake antiviruses and restore the system after being exposed to them

McAfee Rootkit Detective
A free utility for detecting and removing hidden malicious modules (rootkits) running in the system

McAfee On-Demand VirusScan
Antivirus scanner on demand. Free version McAfee antivirus VirusScan, which allows you to check and cure your computer of viruses, worms, Trojans and other malware

McAfee Virus Pattern Updates
V2 DAT and V3 DAT virus database files designed to update products installed on servers and workstations that are not connected to the Internet.