corna/me_cleaner on Hacker News

No, I actually uploaded the firmware images here: https://github.com/corna/me_cleaner/issues/233

comment by chasil · 2024-12-26 · in When power cycling your (x86) server isn't enough to recover it

…for other purposes (such as recent versions of ME handling suspend-related power management) [0] https://github.com/corna/me_cleaner/wiki/HAP-AltMeDisable-bi... [1] https://en.m.wikipedia.org/wiki/AMD_Platform_Security_Proces... [2]…

comment by DaSHacka · 2024-12-25 · in When power cycling your (x86) server isn't enough to recover it

Buy HW that can be flashed with coreboot? And while it won't (completely) remove SMM, https://github.com/corna/me_cleaner might get rid of some stuff. I think that's more about getting rid of spyware and ring -1 security bugs than…

comment by jabl · 2024-09-20 · in Real-time Linux is officially part of the kernel

…There have also been efforts to delete just part of IME from the flash. A couple links: https://github.com/corna/me_cleaner https://doc.coreboot.org/northbridge/intel/sandybridge/me_cl... On X200-era systems, however, you can remove IME…

comment by neilv · 2024-05-07 · in TOTP Authenticator for PalmOS

It can be de-blobbed though [1]. At least this will "de-risk" it as part of the boot process ? [1]: https://github.com/corna/me_cleaner

comment by awsation · 2023-06-02 · in System76's coreboot open firmware manages to disable Intel ME for Raptor Lake

…By setting a bit in the flash configuration, assumed to be added for the US High Assurance program: https://github.com/corna/me_cleaner/wiki/HAP-AltMeDisable-bi... , https://www.ptsecurity.com/ww-en/analytics/disabling-intel-m... . This is…

comment by bri3d · 2023-06-02 · in System76's coreboot open firmware manages to disable Intel ME for Raptor Lake

…in them. The maintainers of the me_cleaner script likely have the clearest view of what is known. https://github.com/corna/me_cleaner

comment by chasil · 2023-05-30 · in Modern CPUs have a backstage cast

…to run old hardware is worth it for me. Below are the bios images that I was able to produce: https://github.com/corna/me_cleaner/issues/233

comment by chasil · 2023-03-11 · in Why I Use Old Hardware

…of worms and can only be fully disabled by modifying the firmware image, see tools like me_cleaner. https://github.com/corna/me_cleaner

comment by arsome · 2023-02-08 · in Ask HN: How to know if laptop enrolled in Intel Management Engine?

…Intel ME Region Read Access is enabled Both are useful for MEBx/IME to be cleaned out or disabled. https://github.com/corna/me_cleaner/wiki/Internal-flashing-w... https://github.com/corna/me_cleaner/wiki/Internal-flashing-w...

comment by egberts1 · 2022-12-30 · in Poll: What's the best laptop for Linux these days?

…within the booted bios without much hassle. Looking for the link... Found it on Bing of all places! https://github.com/corna/me_cleaner/issues/233

comment by chasil · 2022-10-26 · in Disabling the Intel Management Engine

…of maybe moving to one of them, but ME Cleaner doesn't seem to have Coffee/Comet Lake covered yet. https://github.com/corna/me_cleaner/wiki/me_cleaner-status

comment by etiam · 2022-05-02 · in Lenovo ThinkPad P1 Gen3 Review – with Linux

…https://github.com/rootkovska/x86_harmful/blob/master/x86_ha... https://github.com/corna/me_cleaner/blob/master/me_cleaner.p...

comment by Terry_Roll · 2022-01-16 · in Lenovo vendor locking Ryzen CPUs with AMD PSB

…be running a broken BIOS. Intel includes no such option, but on the other hand there is stuff like https://github.com/corna/me_cleaner/ . In the absense of any detailed information about how AMD'S PSP disable option actually works, I guess…

comment by boring_twenties · 2022-01-06 · in AMD Ryzen 6000 Series Mobile CPUs Feature Microsoft's Pluton Security

https://github.com/corna/me_cleaner works reasonably well for me - at least on motherboards with removable BIOS chips.

comment by quantumofalpha · 2021-06-08 · in Two Hidden Instructions Discovered in Intel CPUs Enable Microcode Modification

…in removing the ARC firmware code from two different HP desktops (I attached both BIOS images): https://github.com/corna/me_cleaner/issues/233 These PCs are quite inexpensive. I run OpenBSD with hardened Chrome on one of them, for all of…

comment by chasil · 2021-03-09 · in I want a computer that I own

> How is it possible to secure these nested trees of computers-in-computers? https://github.com/corna/me_cleaner Or, buy hardware from vendors who neutralize ME according to the link.

comment by fsflover · 2021-02-16 · in Security features of the Intel/Windows platform secure boot process

cough https://github.com/corna/me_cleaner cough

comment by fsflover · 2020-12-07 · in Apple Preps Next Mac Chips with Aim to Outclass Highest-End PCs

…/libreboot.org/faq.html#amd-platform-security-process... 2. https://libreboot.org/faq.html#intelme 3. https://github.com/corna/me_cleaner

comment by turblety · 2020-12-04 · in System76 – Pangolin

You can overwrite most of it: https://github.com/corna/me_cleaner . AFAIK such overwriting will fix the bug in your link (and this is exactly what Purism is doing).

comment by fsflover · 2020-11-09 · in Spy agency ducks questions about 'back doors' in tech products

…using Libreboot because the latter gets rid of the (very early versions of) the ME completely. [1] https://github.com/corna/me_cleaner

comment by boring_twenties · 2020-08-13 · in NSA Owns Everything (2015)

Yes, they seem to be very similar. https://github.com/corna/me_cleaner/wiki/HAP-AltMeDisable-bi...

comment by wmf · 2020-08-08 · in 20GB leak of Intel data: whole Git repositories, dev tools, backdoor mentions

…sharing that. Sounds like what puri.sm are doing with their Librem ranges, with me-cleaner [1]. 1. https://github.com/corna/me_cleaner

comment by turblety · 2020-06-22 · in ARM Mac Impact on Intel

…here are all the constituent projects: https://coreboot.org/ https://github.com/osresearch/heads/ https://github.com/corna/me_cleaner https://github.com/nitrokey A good talk if you prefer video: https://media.ccc.de/v/33c3-8314-bootstraping…

comment by bubblethink · 2020-01-08 · in NitroPad: Secure Laptop with Tamper Detection

…and Dell sell machines with the option of disabling the ME entirely, if one is super-paranoid. [1] https://github.com/corna/me_cleaner [2] https://system76.com/laptops [3] https://puri.sm/learn/intel-me/

comment by elagost · 2019-11-15 · in Exploiting Intel’s Management Engine

…Longer answer: You cannot fully disable the ME (the system won't boot) but you can use me_cleaner https://github.com/corna/me_cleaner to remove parts of the ME firmware that you don't want. "However, ... flashing back the modified [ME…

comment by wmf · 2019-05-05 · in Flashrom – flash BIOS/EFI/coreboot/firmware/optionROM and expansion cards

…last year. I cleaned two different HP desktops at that time, and uploaded the modified BIOS here: https://github.com/corna/me_cleaner/issues/233 These still suffer from Meltdown and the remediation does exact a performance penalty, but…

comment by chasil · 2019-03-31 · in Intel VISA Exploit Gives Access to Computer’s Entire Data, Researchers Show

These are the boards that I patched: https://github.com/corna/me_cleaner/issues/233

comment by chasil · 2019-01-23 · in Why I use old hardware

…for new machines. For pre-Nehalem ones, you can disable it fully. You may be interested in this: https://github.com/corna/me_cleaner

comment by bubblethink · 2018-11-18 · in Intel Management Engine JTAG Proof of Concept

Here are some easy ways to prevent UEFI from tampering with your drive: Disable UEFI. https://github.com/corna/me_cleaner Disable the ACPI hooks that register the kernel with UEFI. http://heim.ifi.uio.no/~knuto/kernel/4.14/admin-guide/kerne…

comment by sounds · 2018-09-28 · in LoJax: First UEFI rootkit found in the wild, courtesy of the Sednit group

…effectively disabling it during the normal operation, which is what me_cleaner tries to accomplish. https://github.com/corna/me_cleaner EDIT: Also, the ME is inside the PCH, so I'm not really sure why you're making a distinction there.

comment by monocasa · 2018-08-17 · in Arm Announces Client CPU Roadmap For Laptops

https://github.com/corna/me_cleaner/wiki/External-flashing

comment by _emacsomancer_ · 2018-07-22 · in Intel patches new ME vulnerabilities

…all ME components that are not absolutely required to operate the CPU. I have never tried it. https://github.com/corna/me_cleaner

comment by chasil · 2018-07-22 · in Intel patches new ME vulnerabilities

…as I understand: * In general you cannot. * You can try to remove ME with non-official tools like https://github.com/corna/me_cleaner * Some vendors ship specific laptops with ME disabled ( https://fossbytes.com/laptops-intel-me-chip-disabl…

comment by nh2 · 2018-07-22 · in Intel patches new ME vulnerabilities

…then you've got bigger concerns than someone hacking your ME (starting with, say, your OS). [1] https://github.com/corna/me_cleaner/issues/111#issuecomment-...

comment by kogepathic · 2017-12-27 · in How to hack a turned-off computer, or running unsigned code in Intel ME [pdf]

…more details. Ultimately, the network-enabled bits that keep getting exploited are removed. [1]: https://github.com/corna/me_cleaner

comment by zamalek · 2017-11-30 · in System76 ME Firmware Updates Plan

…ME firmware completely removed, and on newer systems, for 30 minutes before a watchdog triggers: https://github.com/corna/me_cleaner

comment by TD-Linux · 2017-11-21 · in An in-depth security review of the Intel Management Engine

…sounds like the iPhone situation: upgrade to a newer iOS and lose the ability to jailbreak. [1] https://github.com/corna/me_cleaner/wiki/HAP-AltMeDisable-bi...

comment by mysterypie · 2017-11-20 · in An in-depth security review of the Intel Management Engine

…ips it can be controlled from hard coded, can it be blocked via simple firewall rules? EG tool: https://github.com/corna/me_cleaner List? https://github.com/ransom1538/intel_me_cleaners/

comment by ransom1538 · 2017-11-10 · in “We have obtained fully functional JTAG for Intel CSME via USB DCI”

…be possible to completely remove the remaining few hundred kB of Intel ME code remaining. [1]: https://github.com/corna/me_cleaner

comment by cyphar · 2017-11-10 · in “We have obtained fully functional JTAG for Intel CSME via USB DCI”

…keys is the last thing you'll think of if a decades-old business is going up in flames. [1]: https://github.com/corna/me_cleaner [2]: https://github.com/corna/me_cleaner/wiki/Intel-Boot-Guard

comment by cyphar · 2017-11-07 · in MINIX: Intel's hidden in-chip operating system

https://github.com/corna/me_cleaner/wiki/How-to-apply-me_cle...

comment by deno · 2017-11-07 · in MINIX: Intel's hidden in-chip operating system

…option 2 months ago. [1] http://blog.ptsecurity.com/2017/08/disabling-intel-me.html [2] https://github.com/corna/me_cleaner/commit/ced3b46ba2ccd7460...

comment by batat · 2017-11-06 · in MINIX – The most popular OS in the world, thanks to Intel

https://github.com/corna/me_cleaner

comment by jjawssd · 2017-11-06 · in MINIX – The most popular OS in the world, thanks to Intel

…flashing from userspace, but it is doable if you buy a $5 flash programmer and a Raspberry PI. [1]: https://github.com/corna/me_cleaner [2]: https://github.com/corna/me_cleaner/wiki/HAP-AltMeDisable-bi...

comment by cyphar · 2017-10-13 · in Intel ME: The Way of Static Analysis

…org/wiki/Intel_Active_Management_Techno... [2]: https://www.coreboot.org/Intel_Management_Engine [3]: https://github.com/corna/me_cleaner

comment by cyphar · 2017-10-13 · in Intel ME: The Way of Static Analysis

…with the Verified Boot fuses set (i.e. pretty much any recent laptop) to fail to boot[2]. [2] https://github.com/corna/me_cleaner/issues/53#issuecomment-3...

comment by platinumrad · 2017-10-10 · in Disabling the Intel Management Engine

I think they already did: https://github.com/corna/me_cleaner/wiki/Intel-Boot-Guard

comment by laurentdc · 2017-10-10 · in Disabling the Intel Management Engine

I found the relevant flags: --soft-disable-only and --soft-disable https://github.com/corna/me_cleaner/commit/d5705b62f802fdf1c...

comment by sounds · 2017-09-20 · in How to hack a turned-off computer, or running unsigned code in Intel ME

You can do this fairly easily with me_cleaner[1] which also does a lot of other disarming of ME. [1]: https://github.com/corna/me_cleaner

comment by cyphar · 2017-09-20 · in How to hack a turned-off computer, or running unsigned code in Intel ME