THE HIDDEN COMPUTER IN YOUR WINDOWS MACHINE! And you don’t have the password! And AI just may have the real backdoor no one is talking about. — The Second Computer Intel Put in Your PC Never Needed Your Permission to Boot The second computer inside an Intel machine starts before the one you bought and continues after you shut it off. It lives in the Platform Controller Hub on the motherboard. From there it holds its own processor, a reserved slice of system memory, and a firmware image signed by Intel. When the board has power the engine can stay active even if the main system has been powered down. Active Management Technology and the later vPro brand began as a tool for corporate administrators who needed to reach a machine across a network, push a recovery image, or view a screen before the operating system loaded. By 2008 the same subsystem was present in consumer systems as well, where it handled early power sequencing and certain protected media paths. In July 2009 Alexander Tereshkin and Rafał Wojtczuk of Invisible Things Lab stood at Black Hat and showed that code running on that chipset processor could be reached and redirected. They called the resulting environment Ring −3. User programs sit at Ring 3. The operating-system kernel sits at Ring 0. A hypervisor can sit at Ring −1 and System Management Mode at Ring −2. The Management Engine sits outside those rings entirely, with direct memory access and a dedicated path to the network interface that does not depend on the host operating system. A rootkit placed there survives a full operating-system reinstall and is invisible to tools that look only at the main processor. After the Nehalem generation the firmware could no longer be simply erased. If the engine does not find a valid signed image the machine shuts itself down after thirty minutes. The timer was probably intended to support Intel’s anti-theft features; it also prevents ordinary removal. Nicola Corna’s me_cleaner tool, built on earlier reverse-engineering by Igor Skochinsky, strips most of the modules while leaving the early bring-up code that resets the watchdog. The resulting image must still be flashed with an external programmer. On many later platforms Boot Guard blocks even that route. In May 2017 researchers at Embedi found that the Active Management Technology login on versions 6 through 11.6 accepted a blank password hash. The comparison failed open. An attacker who could reach the management interface gained keyboard and mouse control, could change BIOS settings, and could run programs, all without a valid credential. The bug had been present since 2010. Intel issued a patch; the window between discovery and deployment varied by manufacturer. Later the same year Dmitry Sklyarov and colleagues at Positive Technologies examined Skylake-era firmware and found strings that belonged to MINIX 3. Andrew Tanenbaum had written MINIX as a teaching microkernel. He had spoken with Intel engineers years earlier about reducing its memory footprint and adding compile-time switches. After that conversation there was silence. Tanenbaum learned of the deployment from news reports in 2017 and wrote an open letter to then-CEO Brian Krzanich. He noted that the Berkeley license placed no obligation on Intel to tell him, and that he would have appreciated the courtesy. He also observed that a company of Intel’s size could have written its own code; the microkernel’s small size and modular structure had apparently been the practical attractions. The same Positive Technologies researchers later located an undocumented configuration bit labeled for the High Assurance Platform program. 1 of 2