Do consumer computers include components that can connect to the internet when the computer is apparently turned off?

Question

I have seen many claims that devices such as laptop computers contain components that can "connect to the internet" even when the main device is powered off. The implication is that such devices could be backdoored by the NSA or others in order to share private data without the user's knowledge.

One example, which would affect nearly every laptop and desktop computer, is that the Intel Management Engine (a controller chip in Intel processors which, for design reasons, is able to access all data being processed by the computer) updates its own firmware autonomously and can connect to the internet (in order to do so?) even when the computer is powered off.

Here is an example of such a claim, from an answer on Information Security Stack Exchange:

Intel ME features a processor attached to your CPU, which runs closed-source software and which can access all your hardware and main memory. It operates without being visible to your CPU, but can see all your CPU does and control it. It can update itself and connect to the internet even when your computer is turned off. It's pretty damned creepy to me.

Is it true that the Intel Management Engine, and/or similar components in other brands of processor, has the capacity to connect autonomously to the internet when the computer is powered off?

Answer 1

Yes, most modern computer processors include hardware with the capability to fully control all components of the computer (regardless of the power state of the system as a whole), to access all data while the computer is running, and to connect to the internet (in any power state).

However, the remote control aspect of the functionality this hardware provides is not enabled on most devices targeted at the consumer market.

---

Intel Management Engine (and similar systems)

The Intel Management Engine, referenced in the question, is present in almost all Intel chips sold since 2006. It is an independent computing environment, which has access to (and control over) the main processor, the memory, the network interfaces, and other systems.

One of the primary purposes of the ME is security: it verifies the integrity of the firmware running on the processor and on the Trusted Platform Module.

Additionally, the ME enables a remote management system for enterprise use, called AMT (see below). Most consumer devices ship with this functionality disabled in the firmware.

AMD has a similar system called PSP.

---

Remote management (AMT etc)

One of the services provided by the Intel ME is called Intel Active Management Technology. AMT enables "lights-out management", meaning it enables system administrators to remotely control and modify virtually all aspects of the system, including the ability to download and update software and firmware regardless of whether the computer's operating system is running. (Obviously the battery or power supply has to be connected.)

This type of remote management originated in servers, where it originally used a dedicated network interface. However AMT uses the system's normal built-in networking interfaces including ethernet, wifi, and (in rare cases) 3G.

AMT is part of Intel's "vPro" technology, which is found in a wide variety of devices. It is primarily targeted at enterprise users, however it has made its way into may devices available on the consumer market including laptops primarily targeted at business use, as well as high-end gaming hardware.

The AMT system is normally not enabled on computers targeted at the consumer market; however the hardware is still there and the Intel Management Engine is still active because it provides other functionality too (see above).

---

Security

It is important to note that the one of the main purposes of the Intel Management Engine and similar technology is to increase security.
Because it verifies the integrity of the firmware running on the processor and other vital system components, it ensures that this firmware has not been modified or replaced with potentially malicious versions. (Or any other modifications – it simply ensures that only the original firmware can be used.)

However, the Management Engine itself is not entirely immune to compromise.
In the past researchers have been able to remotely compromise the system and gain control of machines without physical access to them.

Another concern (more relevant to high-risk users such as non-US governments and political dissidents) is that technically there is no reason why the Management Engine (or similar components in other chips) couldn't contain backdoors allowing government agencies the same access and control over the system.
Intel is a US company (though a significant part of their engineering is based in Israel), and they could be required by US government to implement hidden backdoors.
Since it is impossible to audit the firmware, no proof either way is possible as to whether backdoors exist or whether the risk is purely theoretical.

This Hackaday article is informative, if somewhat hysterical, look at the features and security risks of the Management Engine. (Thanks to @William-remote for sharing it in a comment on his answer below.)

---

Further references

See Intel's page on AMT.

In the past Intel provided an anti-theft service to enterprise and consumer markets, whereby the ME would regularly check ion with Intel servers and disable the computer if it had been reported stolen. Intel have now discontinued this service.

An HP document on the use of AMT (thanks to Igor Skochinsky for sharing in his answer below).

There is a generic set of standards for a functionality similar to AMT, called IPMI.

---

I hadn't expected to answer this question myself, but having done some research I felt I was in a position to do so.

Thanks to everyone who has contributed with additional information. I will continue to incorporate any new information I find into this answer.

Answer 2

Let me answer the actual question:

Is it true that the Intel Management Engine, and/or similar components in other brands of processor, can connect autonomously to the internet when the computer is powered off?

In case of ME, the answer is "maybe, in some cases, but usually no". First, there is a question of what specific kind of ME you have. There are two main categories: "consumer" (1.5MB) and "enterprise" (5MB). Only the latter implements the AMT functionality for remote management. Also, there must be an Intel Ethernet chip on board connected directly to the ME (which is not always the case).

Then there is the "connect autonomously to the internet" statement. The ME does have its own MAC and IP address (separate from the host) which allows it to communicate with the management PC but it does not really "connect to internet" on its own. Usually it only replies to the management requests during provisioning.

Now, for a few years, Intel had a version of ME for mobile chipsets (used e.g. in laptops) which had an option of using the 3G wireless connection. If the ME was provisioned and configured by the user or their IT department and enrolled in the Intel's Anti-Theft program, it would periodically try to check in with Intel's servers (possibly via 3G) to see if the device was reported as stolen. In such case, it would display a message on boot and lock the PC so it could not be used, or shut down automatically after a short time. AFAIK, Intel no longer produces such chipsets and the 3G connection is not supported in the current ME versions. Anti-Theft feature has been discontinued as well.