Hello everyone,

Introduction

Questions

Yes, this needs to be enabled at ME FW and in BIOS as well. As long as ME FW is healthy, the ME FW can be updated to latest version while you enable the AMT settings.

As for updating "AMT version" I can't answer that, only know you can update ME FW to latest/enable AMT
I checked BIOS, and AMT is enabled by default, so I assume it's already enabled at ME FW too but I can't confirm without a dump of ME FW from this model (it's not included in Asus partial BIOS "upgrade" files online)

You can't upgrade to ME 9 with a Q77 chipset. AMT ist part of the Intel ME, and the ME itself is part of the 'bios'. Since Intel ME is designed for a specific chipset generation, it can't be upgraded to a later version.

ME 8 and ME 9/9.1 are no longer supported. There were some more fixes for ME 9, but latest version is 06/18 (INTEL-SA-00141), for ME 8 it's 10/17 (INTEL-SA-00086).

Depends if you want to expose your PC to the internet?

Intel® Active Management Technology (Intel® AMT) and Intel® Converged Security and Management Engine (Intel® CSME) Security Updates
Intel® Product Security Center Advisories

Thanks a lot for your answers both of you. And thanks Fernando for having passed by :)

@Lost_N_BIOS: You meant even if ASUS is not providing updates for its Q77-based motherboards, that we are unable to upgrade manually to the latest ME engine version supported for this chipset? (In this case ME8).

After searching on my side upgrading the AMT version is not possible, I need to tick to the latest major version supported. This is due to the fact that the ME egine is using Huffman tables stored directly in the hardware to obfuscate things. So, without new hardwares, bits will be missing and latest ME egine won't work. (cf. Wikipedia)

@lfb6 Actually, it will be connected to the internet, but ONLY the VMs running on the hypervisor. The local management subnet won't be connected and will be carefully firewalled. From all the security issues reported from INTEL-SA-00086 to INTEL-SA0016X, it appears we need to be on the same network to exploit them. I was a bit reluctant in having the AMT engine running taking into account all these vulnerabilities happen at a level so low in the HW stack, but after reading the CVE descriptions on the MITRE website, I'm "a bit" relieved now.

This system will be used mainly for development purposes (macOS/Windows dev VMs) and in order to know AMT / vPro tech better and get a first hand on. In the future, if I see things don't go well, I'll disable the AMT and plug my own IPMI.

@wget You should be able to update to latest ME8 (8.1.72.3002) with help of the update- program of the firmware- tools (fwupdlcl[64].exe/efi), both can found in this thread.

Concerning security- Raspberry kernels are afaik heavily customized linux kernels, thereby not kept up to date as a normal linux kernel or at least with a relevant delay. Your project is quite intereseting/ impressing, but it uses kernel images from 2017. You'd possibly have the same amount of security flaws in these old kernels as in an old AMT- version...

For AMT I'd recommend MeshCommander- you probably know it already. It's easier to configure than the Intel tools.

@lfb6 Thanks for the link to the ME update.

At the end I saw that the motherboard available next to my city has been sold and others available are only located way outside EU and their price have sky-rocked recently. So I'm giving up on the idea of testing AMT.

Wrt. the Raspberry Pi, the RPi kernels are completely up to date, especially as I'm using Arch Linux ARM whose team is really reactive. I'm even using the linux kernel from upstream with some proprietary modules and am not using distros like NOOBS or the well known Raspbian.

Wrt. the DIY IMPI project I linked above, I'll be only taking inspiration from there just for the electronic wiring stuff. I won't use the 2017 packages obviously and will do it myself on Arch, so the security will reach 100% :)

Thanks any way for you time based on this topic :)