0

I recently installed Gem for OneNote on my Thinkpad (Windows 10), not sure how familar everyone is with Gem but its an add-in to improve usability for OneNote - the version that comes with the Microsoft office package you pay for. I did some digging and I didn't see any red flags about Gem security stuff before I installed it. I bought the license, installed Gem, and then needed to restart my computer. After restarting, I opened OneNote to continue using using, about a minute into using it a window popped up for me to update/install "Intel Management Engine", the install window just popped up on its own (I didn't go through my software updates in system settings or anything). I stopped and did some searching around on the internet and got mixed review about if the Intel Management Engine was safe or not. I deicide not to go install it, clicked cancel and figured if it was absolutely necessary/safe I would get another pop-up about it. So my questions are:

1. So is "Intel Management Engine" safe?

2. Should I have installed it?

3. Should I now be worried about Gem too?

It just seemed really weird with the timing of adding something new to my laptop. To the best of my knowledge I've never got a pop up window like that for a software or my laptop without prompting it. I don't know a lot about computer security.

2
  • 2
    It depends on what you mean by "safe". IME is the Intel Management Engine, and works at a low level. If someone is using it to attempt to hack you with it would likely be a three letter agency - its not a common vector for malware but it is largely opaque and many people believe it contains back-doors built by intel at the behest of a government agency. IME has mainly legitimate purposes for a corporate wanting to manage your system.
    – davidgo
    Jun 2, 2021 at 20:18
  • Hi! That is what I meant is possibly being used for malware to place on my computer but based on your response and the other comment, I'll go ahead and update it the next time the pop up window comes around! Thank you!
    – Rachel Cyr
    Jun 10, 2021 at 21:05

1 Answer 1

1

First, you cannot install or uninstall Intel Management Engine. It happens to be an integral part of recent Intel processors. And by "recent" I mean one hardly can find an Intel processor old enough not to contain IME.

You can only update IME in your computer (and I am not sure if there are any means to revert an updated version back).

The updates for IME are published by Intel at irregular intervals (generally, when a vulnerability is found). Downstream vendors like Lenovo push these updates to their hardware by the usual update channels.

Chances are, if it was really an update for IME, your IME was in unsafe state (with known vulnerabilities) BEFORE the update and the common wisdom is that after the update you are a bit safer.

(There is a lot of discussion over the 'net if IME is of any use at all, proof-of-concept attacks for particular versions and speculations about if IME is only a big backdoor and nothing else. One important point is, if IME is broken somehow, it invalidates all the protection measures implemented in Windows or any other operating system.

For the ordinary user, these things are pretty much out of scope. You cannot do anything about IME other than updating it when offered an update)


OneNote Gem is as much safe as any other Microsoft product. If you already are using the Office suite, you generally don't change your overal safety profile much by istalling Gem.


I don't think IME and Microsoft GEM are related in any way. They work at pretty much different levels. The most probable reason you got them together is a coincidence.


There is always a considerable chance that a malware may have advertized itself as an update to a legitimate software. From the available data in your question, we cannot say if this is the case.

2
  • Sorry for the late reply but thank you for your explanation! I genuinely have no clue about this stuff. The IME update window has popped up two more times but I have ignored it (I wish I had taken a screen shot of it). The pop up today actually remined me to check if anyone had since answer my question. Is there a simple way for me to valid if it's a legit update? The request for update isn't in my system updates, which based on what you said makes sense. Is there a way for me to check for the update or go ahead and initiate it without just waiting for the box to pop back up?
    – Rachel Cyr
    Jun 10, 2021 at 21:10
  • If it persists and if it is a normal window (not an image in the web browser), it is either legit or your computer is already compromised to the point where nothing short of full reinstall can make it better. So go ahead and allow the update.
    – fraxinus
    Jun 11, 2021 at 7:27

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .