When it comes to Intel Management Engine, I actually think it’s not a threat if you neutralize it. I mean to just set the HAP bit on it. Because if that isn’t enough then that means all computers in the world which use Intel CPU can be accessed by NSA but if NSA had this much power then it seems obvious that they aren’t using it and why wouldn’t they use it?
There’s a github project to neutralize/disbale Intel ME: https://github.com/corna/me_cleaner Disable is overwriting intel ME as much as possible with zeros, leaving only a little remaining to be able to boot the computer. The newer the intel chips are, the less likely it is to be able to disable it. But all chip sets can be neutralized which means to set the HAP bit which is an official feature. In theory we can’t actually trust the HAP bit to really disable intel ME permanently. It’s more like asking Intel to do what they have promised because it’s proprietary. But I think it really does permanently disable it because otherwise NSA would be abusing this power.
That’s why I think the newer laptop models are better because it’s probably not necessary to disable, it’s enough to just neutralize withthe HAP bit. And with a newer modern laptop they can have open source Embedded Controller firmware which is better than proprietary Embedded Controller firmware.
I’m interested to hear what you think as well.
You’d probably need to monitor the computer’s network for a long time to get a detection, also something important is that if you’re on a System with AMT disabled/not present, you won’t ever get any, since those IntelME versions come without any network stack whatsoever.
In fact that’s one of the primary reasons why I haven’t tried it yet, almost none of the Intel computers I own even have the Intel AMT component enabled in the IntelME firmware, meaning they just won’t do it, like ever. The only one I have which supports AMT is an old Laptop with a slow AF intel Centrino, it’s so slow that it struggles with XFCE alone and no other apps running, I don’t know if I could use this computer long enough to get any readings from it because it’s just too slow to do anything really.
If you want to try it out I’d suggest building a copy of IntelMEtool and testing your Intel Machines to see if they have AMT enabled or present before trying yourself.