Intel Hid a Secret Computer Inside Your PC — And You Can't Turn It Off – Transcript

00:00Right now, if your computer is plugged into the wall, there is a second computer inside it. Not your processor, not Windows, a separate little computer with its own processor, its own memory, and its own operating system.

00:16It wakes up before your PC does. On many machines, it can keep running after you shut your PC down. And on almost every Intel computer built since 2008, you cannot fully remove it.

00:30You [snorts] never installed it. You never agreed to it. Most people who own one have never even heard its name. In 2017, a computer science professor in Amsterdam found out that his software had been running inside this hidden computer on millions of machines for about 2 years. Nobody told him. He read about it in the news.

00:52That same year, researchers found a way into this hidden computer by typing nothing at all into a password box. And buried deep in its code, they found a secret switch. It was labeled with the name of a program run by the National Security Agency.

01:10Intel says this hidden computer is there to help you, to keep your PC secure, to let company tech departments fix broken machines from miles away. And to be fair, a lot of that is true. But by the end of this story, you'll understand why Google tried to tear it out of its own servers, why one of the most famous professors in computing wrote an open letter to Intel's CEO, and

01:35why to this day nobody outside Intel knows everything this little computer can do. Before we start, a quick question. Did you know this thing was inside your PC? Just type yes or no in the comments. I'm genuinely curious how many people have never heard of it because most people haven't, and that's exactly how it was designed.

01:59Its name is the Intel Management Engine. Engineers just call it the ME. It doesn't live in your main processor, it lives in a chip on the motherboard called the Platform Controller Hub.

02:12That's the chip that handles almost all the traffic between your processor and everything else. Your USB ports, your network card, your drives. Think about that location for a second. If you wanted to put a guard somewhere in a computer, you'd put him right there, at the front door, where every message passes through.

02:32Inside that chip sits a tiny processor of its own. For years, it was a small chip design called Arc running a compact operating system called ThreadX. Later, Intel swapped it for one of its own x86 cores. We'll come back to that swap because it's where this story gets strange.

02:53The ME has its own memory. It quietly reserves a slice of your system's RAM for itself, and your operating system is not allowed to look inside it. Its software, called firmware, sits on the same little flash chip that holds your BIOS, and that firmware is locked with Intel's digital signature. If the signature doesn't match, the ME won't run it.

03:17Now, here's the part that surprises people the most. The ME doesn't need your PC to be on. As long as the machine has standby power, depending on the model and how it was set up, parts of it can stay awake while your screen is dark and your fans are silent. On business machines with the full remote features turned on, it can even talk to the network while the PC is switched off.

03:42And some version of this engine has been built into virtually every Intel chipset since 2008. Not just expensive business PCs, home desktops, laptops, the machine your kids did their homework on.

03:56Here's the easiest way to picture it. Imagine you buy a house. You get the keys, you move in, it's yours. Then one day you find out there's a small apartment in the basement. Somebody lives down there. He has a key to every room in your house. He can open the front door. He can read the mail before it reaches you.

04:17>> The builder says he's the maintenance man, and he's there for your own good. Maybe that's true, but you were never given a key to his apartment. You're not allowed to see inside, and you can't evict him.

04:31That's the Intel Management Engine. So, how did a little maintenance man end up living in hundreds of millions of computers? To answer that, we have to go back to the mid-2000s, to a problem that cost big companies a fortune every single year.

04:49Picture a big company in 2005, a bank, an insurance firm, a government office, 10,000 beige PCs spread across five buildings. Every morning, some of those PCs won't start. A bad Windows update, a virus, a frozen hard drive. And every time, somebody from the tech department has to physically walk over to that desk.

05:13Multiply that by 10,000 machines, and you're talking about an army of technicians and a mountain of wasted hours. Intel saw a business opportunity. What if the tech guy never had to leave his chair?

05:28What if he could reach into any PC in the building, even a dead one, even one that was switched off, and fix it from his own desk? That idea became Intel Active Management Technology, or AMT.

05:44The first version appeared around 2005, built into one of Intel's network chips. A year later, in 2006, Intel moved it into the main chipset on the motherboard and wrapped it in a shiny new brand name aimed at businesses, vPro.

06:00The pitch was simple. With AMT, an administrator could power a machine on remotely, restart it, boot it from a recovery disk sitting on a server across the building, check what hardware was inside. Later versions even let him see the screen and use the keyboard and mouse, all before Windows had loaded. To pull that off, AMT couldn't depend on Windows. Windows might be broken. That was the whole point. So, it needed its

06:27own little brain running its own software with its own connection to the network. That little brain was the management engine. And for corporate tech departments, it was fantastic. AMT really did save companies money. It really did make machines easier to fix.

06:44Nobody in this story is a cartoon villain. But then, Intel made a quiet decision that changed everything. The management engine stopped being just a business feature. Starting around 2008, Intel began building it into virtually all of its chipsets, not only the business models, all of them.

07:05Why would a home user need a remote control system built for company tech departments? The answer is that the ME had become much more than remote control. Intel started using it as the foundation for a whole stack of jobs. It helps bring the computer up when you press the power button. It handles parts of Intel's security features. And starting with Intel's four series chipsets in 2008, it ran something

07:31called protected audio-video path. That's copy protection used to keep premium video from being recorded while it plays. In other words, the maintenance man wasn't only there to fix things anymore.

07:44He was also standing guard over the movies you watch. The full remote control features stayed mostly in business machines, and they had to be switched on, but the engine underneath them was now everywhere. And for a few years, almost nobody outside Intel paid attention.

08:02That changed in the summer of 2009 in Las Vegas when two security researchers walked on stage and showed the world a level of the computer that most people didn't know existed.

08:15To understand why that talk mattered, you need one simple idea. Security people describe a computer as a set of rings. Picture a castle with walls inside walls. >> The outer ring, ring three, is where your normal programs live. Your web browser, your games, your spreadsheets.

08:35They're the townspeople. They can't touch anything important without asking permission. Further in is ring zero. That's the heart of the operating system, the kernel. It's the castle guard. It decides what every program is allowed to do. When a virus breaks into ring zero, it's a disaster because now the guard works for the enemy.

09:00Over the years, researchers found even deeper levels below that. A level for software that runs whole virtual machines, which people nicknamed ring minus one. Then a special processor mode used by the motherboard firmware, nicknamed ring minus two.

09:18And in 2009, two researchers from a Polish security firm called Invisible Things Lab, Alexander Tereshkin and Rafal Wojtczuk, stood on stage at the Black Hat conference in Las Vegas.