125

I have seen many claims that devices such as laptop computers contain components that can "connect to the internet" even when the main device is powered off. The implication is that such devices could be backdoored by the NSA or others in order to share private data without the user's knowledge.

One example, which would affect nearly every laptop and desktop computer, is that the Intel Management Engine (a controller chip in Intel processors which, for design reasons, is able to access all data being processed by the computer) updates its own firmware autonomously and can connect to the internet (in order to do so?) even when the computer is powered off.

Here is an example of such a claim, from an answer on Information Security Stack Exchange:

Intel ME features a processor attached to your CPU, which runs closed-source software and which can access all your hardware and main memory. It operates without being visible to your CPU, but can see all your CPU does and control it. It can update itself and connect to the internet even when your computer is turned off. It's pretty damned creepy to me.

Is it true that the Intel Management Engine, and/or similar components in other brands of processor, has the capacity to connect autonomously to the internet when the computer is powered off?

  • 8
    The general (rather than Intel-specific) term for this feature is lights-out management and it's been common for some time in motherboard designs intended for use in server farms. It's supposed to be under the control of the legitimate sysadmin, but even if there are no intentional backdoors, the vendors' track record in avoiding exploitable bugs has been quite poor. – zwol Jun 6 '16 at 22:53
  • 6
    Yes, and this feature is used for Wake-on-LAN to remotely turn on your computer which is useful for remote desktop control. – Keavon Jun 6 '16 at 23:17
  • 4
    Here are some of the reasons I made the changes I did: (1) When the claim is non-specific (all sorts of computing devices), it becomes unfalsifiable. No-one can reasonably say "No, there is no such device." (2) You didn't give examples of such claims. The only claim you gave was specific to Intel ME. (3) We have had questions like this before (e.g. about mobile phones) and it degenerates into "What does 'turned off' mean?" e.g. A machine with "Wake-On-LAN" isn't really turned off. For devices as complicated as a phones and laptops, there are a range of levels of "off". – Oddthinking Jun 7 '16 at 1:44
  • 2
    (4) I used some of my own knowledge of lights-out management to know the technology has been around for years as an expensive add-on for servers on racks, but that doesn't address the concern being expressed that your consumer laptop might, unbeknownst to you, have such technology built in. Asking the general question may invite answers that address a strawman. – Oddthinking Jun 7 '16 at 1:49
  • 2
    I don't really want to argue the "what is off" point any further, but I just came across this. So we could say per the ACPI definitions that it's in the G2 state. – Caesar Jun 7 '16 at 4:19
110

Yes, most modern computer processors include hardware with the capability to fully control all components of the computer (regardless of the power state of the system as a whole), to access all data while the computer is running, and to connect to the internet (in any power state).

However, the remote control aspect of the functionality this hardware provides is not enabled on most devices targeted at the consumer market.


Intel Management Engine (and similar systems)

The Intel Management Engine, referenced in the question, is present in almost all Intel chips sold since 2006. It is an independent computing environment, which has access to (and control over) the main processor, the memory, the network interfaces, and other systems.

One of the primary purposes of the ME is security: it verifies the integrity of the firmware running on the processor and on the Trusted Platform Module.

Additionally, the ME enables a remote management system for enterprise use, called AMT (see below). Most consumer devices ship with this functionality disabled in the firmware.

AMD has a similar system called PSP.


Remote management (AMT etc)

One of the services provided by the Intel ME is called Intel Active Management Technology. AMT enables "lights-out management", meaning it enables system administrators to remotely control and modify virtually all aspects of the system, including the ability to download and update software and firmware regardless of whether the computer's operating system is running. (Obviously the battery or power supply has to be connected.)

This type of remote management originated in servers, where it originally used a dedicated network interface. However AMT uses the system's normal built-in networking interfaces including ethernet, wifi, and (in rare cases) 3G.

AMT is part of Intel's "vPro" technology, which is found in a wide variety of devices. It is primarily targeted at enterprise users, however it has made its way into may devices available on the consumer market including laptops primarily targeted at business use, as well as high-end gaming hardware.

The AMT system is normally not enabled on computers targeted at the consumer market; however the hardware is still there and the Intel Management Engine is still active because it provides other functionality too (see above).


Security

It is important to note that the one of the main purposes of the Intel Management Engine and similar technology is to increase security.
Because it verifies the integrity of the firmware running on the processor and other vital system components, it ensures that this firmware has not been modified or replaced with potentially malicious versions. (Or any other modifications – it simply ensures that only the original firmware can be used.)

However, the Management Engine itself is not entirely immune to compromise.
In the past researchers have been able to remotely compromise the system and gain control of machines without physical access to them.

Another concern (more relevant to high-risk users such as non-US governments and political dissidents) is that technically there is no reason why the Management Engine (or similar components in other chips) couldn't contain backdoors allowing government agencies the same access and control over the system.
Intel is a US company (though a significant part of their engineering is based in Israel), and they could be required by US government to implement hidden backdoors.
Since it is impossible to audit the firmware, no proof either way is possible as to whether backdoors exist or whether the risk is purely theoretical.

This Hackaday article is informative, if somewhat hysterical, look at the features and security risks of the Management Engine. (Thanks to @William-remote for sharing it in a comment on his answer below.)


Further references

See Intel's page on AMT.

In the past Intel provided an anti-theft service to enterprise and consumer markets, whereby the ME would regularly check ion with Intel servers and disable the computer if it had been reported stolen. Intel have now discontinued this service.

An HP document on the use of AMT (thanks to Igor Skochinsky for sharing in his answer below).

There is a generic set of standards for a functionality similar to AMT, called IPMI.


I hadn't expected to answer this question myself, but having done some research I felt I was in a position to do so.

Thanks to everyone who has contributed with additional information. I will continue to incorporate any new information I find into this answer.

  • 7
    Note, I will not accept my own answer yet: Hopefully someone else will be able to provide a more general response which incorporates information on technologies other than Intel. However, this answer does show that such remote access in a powered-down state is fully possible. – Caesar Jun 6 '16 at 19:04
  • 13
    The Intel page you linked to actually has a footnote for the KVM (i.e. remote operator access) which implies (to me at least) that tech is only available on a small subset of their CPUs that are targeted to an enterprise market. I.E. I've not seen anything yet which implies that KVM functionality is available in any ol' Intel processor you might be using. – bloopletech Jun 7 '16 at 1:30
  • 3
    No, supposedly prior to Win 8, when a computer shuts down, it set WOL capability on the card to be able to wake from S5 - total off - state. Win 8 and above supposedly don't set the card for this, but - who knows. – Blackbeagle Jun 7 '16 at 2:12
  • 11
    -1 for not answering the question. It, at the time of my vote, very clearly starts with Do consumer computers... References provided in the answer do not seem to apply to consumer products. – AndrejaKo Jun 7 '16 at 5:23
  • 6
    @Caesar I disagree with your interpretation, because same systems are user in non-consumer applications like those described on the Intel's page you linked to. In my opinion, the fact that this is targeting consumer systems instead of industrial has not been sufficiently proven. – AndrejaKo Jun 7 '16 at 5:39
11

Let me answer the actual question:

Is it true that the Intel Management Engine, and/or similar components in other brands of processor, can connect autonomously to the internet when the computer is powered off?

In case of ME, the answer is "maybe, in some cases, but usually no". First, there is a question of what specific kind of ME you have. There are two main categories: "consumer" (1.5MB) and "enterprise" (5MB). Only the latter implements the AMT functionality for remote management. Also, there must be an Intel Ethernet chip on board connected directly to the ME (which is not always the case).

Then there is the "connect autonomously to the internet" statement. The ME does have its own MAC and IP address (separate from the host) which allows it to communicate with the management PC but it does not really "connect to internet" on its own. Usually it only replies to the management requests during provisioning.

Now, for a few years, Intel had a version of ME for mobile chipsets (used e.g. in laptops) which had an option of using the 3G wireless connection. If the ME was provisioned and configured by the user or their IT department and enrolled in the Intel's Anti-Theft program, it would periodically try to check in with Intel's servers (possibly via 3G) to see if the device was reported as stolen. In such case, it would display a message on boot and lock the PC so it could not be used, or shut down automatically after a short time. AFAIK, Intel no longer produces such chipsets and the 3G connection is not supported in the current ME versions. Anti-Theft feature has been discontinued as well.

  • 1
    Thanks for the answer, which contains some interesting information. However, I should like to make a clear differentiation between the hardware having the capability to connect to the internet in the manner asked about, and the software (or rather firmware) actually enabling the use of this functionality. Both are certainly interesting and relevant, but the question was primarily about the former - if for no reason other than that it is almost impossible to independantly verify any claims made by the manufacturer regarding the latter. – Caesar Jun 9 '16 at 15:34
  • I hope you don't mind if I update my own answer to include some of the information you provide! :-) – Caesar Jun 9 '16 at 15:36

You must log in to answer this question.

protected by Jamiec Jun 7 '16 at 15:48

Thank you for your interest in this question. Because it has attracted low-quality or spam answers that had to be removed, posting an answer now requires 10 reputation on this site (the association bonus does not count).

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged .