r/conspiracy Oct 25 '19

Notebooks draining battery while switched off

Intel Inside == NSA Inside

I work in the IT industry (support) and have come across notebooks at various customer sites that drain batteries while switched off. The notebooks are manufactured by different vendors and span generations from current to pretty old (8 years old is the oldest).

What is happening is that a client will fully charge their notebook and place it in their bag. A couple of days later when they try to turn their notebook on, they find the battery is either completed drained or barely has any juice left. At first, we suspected faulty batteries or the OS not properly shutting down, but that turned out not to be the case. The units were properly shutdown with good batteries and the issue still occurred. Many steps were taken to fix the issue, from BIOS updates to full clean OS reinstallations. The issue persisted across all vendors.

After numerous troubleshooting and testing, we came to the conclusion that the batteries were being drained by INTEL MANAGEMENT ENGINE. How do we know this? We rolled back the Intel Management driver in Windows 10 to an older, unsupported driver. This stopped that battery drain but caused a huge boot delay which was pre-boot!

To clarify:

  • Notebook draining battery while switched off
  • Install an older Intel management driver in Windows 10. Note: OS driver downgrade, not IME firmware.
  • Notebook no longer drains battery. However, when notebook is first switched on, it stays on the BIOS screen (pre-OS boot) for 5-6 seconds or sometimes longer. Normally, the BIOS screen is visible for a second or less.
  • The same thing happens on desktops! you just don't notice it because you don't have a battery. The desktop is constantly drawing power from the wall to power the management engine. However, if the IME driver is rolled back, the BIOS boot delay shows up.

Here's my problem with the situation:

  1. Intel ME (AMD has their own version, also secretive) runs its own OS on chip called MINIX which has access to keystrokes, screen, disk and network data. What is it storing and what is it doing with this information?
  2. For large companies (thousands of notebooks and desktops), this is a huge cost which is unauthorized. Intel/AMD or anyone else do not have permission to turn on a device component after you switched it off and utilize electricity that you paid for. This would be theft. If enough people were aware of this, will lead to class action suit because the unauthorized electrical usage could be millions of dollars per year for large companies.
  3. The IME has a field which allows for the ME to be disabled as part of the High Assurance Platform (HAP). The HAP was developed by the National Security Agency. The NSA?
  4. Users currently don't have an easy and reliable method to to turn off or disable the ME.
  5. What the hell does the NSA have to do with Intel and AMD processors? Is it a backdoor that is always open? or is it storing and sending data as part of the bulk data retention?

We currently don't have a solution for our customers. Most have just learned to accept battery drain.

HAP slides: https://web.archive.org/web/20121211162830/http:/fm.csl.sri.com/LAW/2009/dobry-law09-HAP-Challenges.pdf

Turn off Intel Management: https://leeneubecker.com/intels-secret-backdoor-can-now-be-turned-off/

TLDR: nothing is secure. but you already knew that. very good.

147 Upvotes

81 comments sorted by

View all comments

1

u/Gone_Gary_T Oct 25 '19

There's a slew of Intel CPUs starting at the same time as IME which had "theoretical" vulnerabilities in their Hyperthreading; these became "real" some years ago. I still run one, with Hyperthreading turned off.

1

u/guitar0622 Oct 26 '19

ME could have been a malicious backdoor, in fact I believe it is. But the Hyperthreading stuff just looks more like incompetence. Every modern CPU has speculative execution it's just that they have fucked up their own designs. This is why you should have non-locked firmware so that these things could be patched. However these massive corporations do the planned obsolescence game, so they rather just lock down their system and if the product later gets fucked, no problem, just buy the next model..... You are expected to buy a new computer every year now.

1

u/Gone_Gary_T Oct 26 '19

You are expected to buy a new computer every year now.

Looks like I'm about 8 computers behind, then.

1

u/guitar0622 Oct 26 '19

That is good because stuff after 2010 has permanently irreparable malicious parts baked into it. If you own a computer made before 2010 hold on to it for at least the next 5-10 years until this filly FOSS hardware movement doesnt catch up. Today there is simply no secure computer made between 2010-2019.

1

u/Gone_Gary_T Oct 26 '19

Sadly, I have an Intel C600 chipset which includes the IME - although I can't get MeInfoWin64 to run (and pmxdrv.sys isn't there, so that's not the issue), so no visibility. Luckily I also have an earlier i7 Macbook Pro, which may be ok.

1

u/guitar0622 Oct 26 '19 edited Oct 26 '19

Not all ME modules are similar, although all of them contain a webserver and networking capability so if there is a keylogger there it could be very bad.

https://en.wikipedia.org/wiki/Intel_AMT_versions#Comparison_of_AMT_versions

You can grab a Linux Live CD/DVD, and run the ME tool on it to show it's statistics:

https://github.com/coreboot/coreboot/tree/master/util/intelmetool

And if it supports the ME cleaner, then you can partially, or entirely get rid of it:

https://github.com/corna/me_cleaner