mei-amt-check VS chipsec

There's two different components here. The first is the Management Engine. Unless this laptop is extremely old, it has one, and it's running. Depending on age, you may be able to prevent it from booting while still allowing the rest of the system to run, but probably not. The second is Intel's Advanced Management Technology (AMT). This is only available on systems with VPro badging, which generally means higher-end business laptops. AMT is much less widely used than you might think, so it's probably not enrolled anywhere. You can confirm whether AMT has been provisioned with https://github.com/mjg59/mei-amt-check, and as long as you have the system firmware password you should be able to reset the ME regardless.

Paul Asadoorian https://twitter.com/securityweekly https://eclypsium.com/2022/07/26/firmware-security-realizations-part-1-secure-boot-and-dbx/ https://github.com/mjg59/mei-amt-check https://github.com/chipsec/chipsec.git https://github.com/intel/INTEL-SA-00075-Linux-Detection-And-Mitigation-Tools https://github.com/ptresearch/mmdetect https://github.com/corna/me_cleaner/

Just to add, if I run https://github.com/mjg59/mei-amt-check

Here is the thread about ARM https://github.com/chipsec/chipsec/issues/461

using Chipsec utility. It requires installing Python 3, runs on any OS. Commands must be executed in elevated terminal / command prompt (or with sudo if using on non-Windows).

[CHIPSEC GitHub] https://github.com/chipsec/chipsec

Paul Asadoorian https://twitter.com/securityweekly https://eclypsium.com/2022/07/26/firmware-security-realizations-part-1-secure-boot-and-dbx/ https://github.com/mjg59/mei-amt-check https://github.com/chipsec/chipsec.git https://github.com/intel/INTEL-SA-00075-Linux-Detection-And-Mitigation-Tools https://github.com/ptresearch/mmdetect https://github.com/corna/me_cleaner/

https://github.com/chipsec/chipsec

It's not out of band and therefore vulnerable to massively clever malware, but it's still useful.

As an aside, if you want to sorta see how vunlerable your UEFI is, you can run Chipsec to find out. It has a specific test for all the write-enable bits and stuff.

If you are like me and don't have the option, you need to modify the option through EFI shell. Download UEFI Tool, IFR extractor, RU.efi, and UEFI Shell, and your bios.bin/biosfd . On HP laptops, you can obtain it through the third option "Copy" . You can find the platform ID in the bios.