7

I saw that some of the Lenovo laptops have "vPro" processors, which enable special management features:

http://www.intel.com/content/www/us/en/architecture-and-technology/vpro/vpro-technology-general.html

Most of these features sound like software features, not CPU features, how exactly does this integrate? Is it compatible with Linux/Ubuntu management features? Is this the "Trusted computing" thing the free software folks were against some time ago?

1
  • I can strongly recommend not to go for the vPRO options in Intel hardware, as this poses a security risk. If you did not need this before, you will most certainly not need this at all. It is meant for remote management. Google "intel ME exploit" if you want to read more.
    – OpenGears
    Nov 7, 2022 at 8:30

2 Answers 2

3

Intel vPro is a collection of computer hardware technologies that enable management features such as remote access to the PC, including monitoring, maintenance, and management independent of the state of the operating system or power state of the PC, and security features.Intel

And since its not OS dependent, it should be compatible with Linux. For more info see Intel Setup and Configuration Service 7.2: Designed for Linux

4
  • 1
    How in the world does it monitor/manage remotely regardless of the power state or OS? Wouldn't this be a security hole, for most consumers?
    – NoBugs
    Oct 7, 2013 at 4:55
  • 2
    Intel AMT is the set of management and security features built into vPro PCs that makes it easier for a sys-admin to monitor, maintain, secure, and service PCs.
    – Mitch
    Oct 7, 2013 at 5:54
  • So is it that different from wake-on-LAN?
    – NoBugs
    Oct 7, 2013 at 15:10
  • 2
    It goes beyond that. See en.wikipedia.org/wiki/Intel_Active_Management_Technology and en.wikipedia.org/wiki/HP_Integrated_Lights-Out It's not designed as a surveillance technology, but rather as business solution for monitoring and managing your servers. For instance if your server reboots and is stuck at the GRUB screen you can open the management page in your browser and do your troubleshooting, while the host system itself and its services are unavailable.
    – LiveWireBT
    Oct 7, 2013 at 15:42
2

Intel's vPro is basically a hardware capability of their CPUs and currently only marketed towards business customers. It's tied in with a lot of advanced management features. A CPU that is vPro capable still needs a TPM module (and probably more components see the Wikipedia article) to make up a vPro compliant computer platform which can be called a "trusted system". As a business customer, if you trust the manufacturer, the advertised features sound like a good thing to have.

Because additional hardware always increases the manufacturing costs and therefore adds to the product price, TPM modules cannot be found in computers meant to be sold at your electronics discounter these days. Consumer hardware may not even feature ports or sockets to upgrade to a TPM module, these may be found in enthusiast and business class hardware, but you may study the technical documentation or service and maintenance documents to be sure (at least Lenovo and HP still publish them along side the glossy marketing bullshit bingo documents). As of today, most computer systems that come with a TPM module need to have it activated, because it's initially deactivated. This may change with future iterations of Windows, where Microsoft is planning to require manufacturers that computers running Windows have to have an activated and armed TPM 2.0 module. It's currently not clear if this will happen in 2014, 2015 or later.

On a personal note: Back in 2006, I found it rather painful to see certain people being still strongly against TCPA, while the consortium was already renamed to TCG after numerous renamings. These people didn't know what they where against, but they where the first to buy "HD ready" TVs, HDMI cables and Bluray/HD-DVD players.

4
  • So theoretically, with vPro/TPM enabled the manufacturer, or anyone with leaked key could get access to all of the pc?
    – NoBugs
    Oct 7, 2013 at 4:57
  • I'm not an expert on that topic. I have never tinkered with TPM and the like myself. All I can say is: If you don't trust the manufacturers or their implementation, then you should use another encryption software or configure the software to use only software crypto routines.
    – LiveWireBT
    Oct 7, 2013 at 5:42
  • You mean you can turn the feature off in bios/uefi menu?
    – NoBugs
    Oct 7, 2013 at 15:05
  • As far as I know TPM modules in current laptops and desktops can be disabled, yes.
    – LiveWireBT
    Oct 7, 2013 at 15:29

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .