-5

I received the following popup today for the first time having used this computer continuously since it was configured about 8 months ago:

enter image description here

From the statement that "status as of last system boot" it appears Intel is being notified of my "status" every time I boot my computer, basically some component of the OS, I presume, is acting as spyware and transmitting information about what applications I do or do not have installed to Intel.

Since I have never seen this message this spyware component must be new, possibly a Windows "update" of some kind.

Does anyone know:

  • What is the spyware process doing this?

  • What information is being sent to Intel?

  • Is the information being sent directly to Intel, or is Microsoft collecting the information off the computer, sending it to Intel, then relaying Intel's ad to me?

This is a Windows 8 Pro box.

7
  • 4
    it appears Intel is being notified of my "status" every time I boot my computer. Uhh, what?! How do you figure? Nobody is sending anything to Intel. Feb 1, 2016 at 21:05
  • 1
    You are not even enrolled in the service. Do better research next time on the software in question. You could have clicked on the "more information" before you submitted this question.
    – Ramhound
    Feb 1, 2016 at 21:18
  • @DavidSchwartz It says quote "Status as of last system boot". That would imply a software component checked if I was "enrolled". Since I have never gotten this message before, this component must be newly installed on my computer. Feb 1, 2016 at 22:03
  • 1
    @TylerDurden Yes, that's right. A software component check if your system was enrolled and discovered that you weren't because there was no enrollment record stored on your machine. Feb 1, 2016 at 22:04
  • 1
    The first rule of Intel® AT is: You do not talk about Intel® AT.
    – Tetsujin
    Feb 2, 2016 at 9:44

3 Answers 3

11

What is the spyware process doing this?

You are not infected with spyware. The program in question is 100% legitimate.

What information is being sent to Intel?

Your device is not enrolled. So your device is sending absolutely no data to Intel currently. What information would be sent if you were enrolled would be enough information to locate the device. Apple and Android devices have similar features.

The information being sent directly to Intel, or is Microsoft collecting the information off the computer, sending it to Intel, then relaying Intel's ad to me?

If your device was enrolled, then it would be sent to Intel, Microsoft has absolutely nothing to do with this program. It sounds like you want this program not to run on your system. You should uninstall it in that case.

Intel AMT includes hardware-based remote management, security, power-management, and remote-configuration features. These features allow an IT technician to access an AMT featured PC remotely. Intel AMT relies on a hardware-based out-of-band (OOB) communication channel that operates below the OS level, the channel is independent of the state of the OS (present, missing, corrupted, down). The communication channel is also independent of the PC's power state, the presence of a management agent, and the state of many hardware components (such as hard disk drives and memory).

Quote Source

Your current settings allow this prompt to happen. You are not currently sending, absolutely no data to any company, that is configurable within Windows or a third-party application. In other words, Microsoft nor Intel, is currently spying on you.

Intel® Anti-Theft Technology

4
  • I have enough reputation so I just made this a wiki.
    – Ramhound
    Feb 1, 2016 at 21:15
  • @Tyler "I consider this spyware because it investigates my machine and sends data about my machine to Intel" Except, it doesn't do that, are you not reading what these answers are telling you? Or do you have some other piece of information you could share that shows it IS doing what you think it is? Feb 1, 2016 at 22:23
  • @TylerDurden - So uninstall it? Of course the program, per your current configuration, it does not collect any data nor transmit any data.
    – Ramhound
    Feb 1, 2016 at 22:46
  • 2
    @TylerDurden If you truly believe data is being sent, log your traffic on an upstream network device (e.g. your router). That will tell you, definitively, whether anything is sent at all and, if so, what is being sent. Anything less is pure FUD. However, do note that even if you discover traffic you should analyse what the traffic is before jumping to conclusions and panicking - there are perfectly legitimate update checks, etc., that send no identifying data at all. Make sure it's more than those, too.
    – Bob
    Feb 1, 2016 at 23:06
4

If I write a program that runs on your computer, it can report to you all kinds of things that happen on your computer. It does not follow that this information is being report to me. Your question is based on completely false reasoning.

3

Working from Ramhound's answer I have discovered the culprit. It is something called the Intel(R) Management Engine, which is just a rebranding of its old Active Management Technology. The difference is that AMT was previously an optional component on Intel-based systems, but Intel is trying to make IME mandatory. Currently, it appears you may be able to disable it, by disabling or removing the IME "driver", which is not actually a driver at all, but is application code running at a privileged level below the operating system.

This is a software feature implemented as a driver on Intel-based motherboards which allows Intel to back door into computers running the software to install new drivers, microcode and as of today, apparently, send ads to users.

Obviously, it is a huge security risk, and as I found out various hackers and "security researchers" are already publishing various vulnerabilities it has and how to use to hack any box running it remotely. To answer my own questions:

What is the spyware process doing this?

Intel Management Engine Interface

What information is being sent to Intel?

Unknown. Intel considers the types of information it transfers into and out of a box running the software to be secret and proprietary. At a bare minimum it includes a list of all the drivers the box is running, the motherboard type and version and configuration and the CPU ID. The data Intel sends to and from the box is encrypted, so it is not possible for a (non-hacker) to know what is being exfiltrated from their box.

Is the information being sent directly to Intel, or is Microsoft 
collecting the information off the computer, sending it to Intel, then
relaying Intel's ad to me?

The information, including the content of the ad, is being directly sent to and from Intel.

5
  • I think everyone made it very clear that the program just detects that there is no activation key on the computer, and therefore determines that you are not enrolled. The "Status as of Last Boot" means that if you enroll, you will have to restart for it to detect it, as it checks on startup. I'm not sure why you're convinced that intel is sending you spyware, but you should listen to what other people have to say. If you type "ipconfig /all" in the command prompt, the program reports to you, not microsoft. It's no different here.
    – z7r1k3
    Feb 2, 2016 at 3:12
  • 1
    @Spencer4134 Whether I am enrolled or not is completely irrelevant. The mere fact that Intel is sending ads to my computer and obviously collecting information from it before doing so (otherwise how it would even know if I was "enrolled") is my concern. I don't understand why people in this thread are like, "Don't worry you are not 'enrolled' so Intel is not spying on you" How crazy is that. YES THEY ARE. DOH. I linked a 40 page presentation on what IME does, did you even read that? Feb 2, 2016 at 11:18
  • Please remember that this is a professional environment and that employers can see everything you say. And let's just agree to disagree on this matter, then. @Tyler
    – z7r1k3
    Feb 2, 2016 at 16:25
  • 1
    @Spencer4134 What are you trying to insinuate? My question is pretty clear: I want to find who is exfiltrating data off my computer and what is being exfiltrated. I think that is a pretty fair question. The fact that you don't mind there being a gigantic back door into YOUR computer, doesn't invalidate the legitimacy of my question. Feb 2, 2016 at 19:12
  • I wasn't referring to your question. I was referring to the comment "YES THEY ARE. DOH." that's all.
    – z7r1k3
    Feb 2, 2016 at 20:28

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .