I read some stuff about intels ME and got interested because of its huge potential security threat to basically (more or less) every intel system since 2008. And I came across the great work of @igor-skochinsky who did a pretty good presentation about the things he discovered.
There is no possibility to disable the ME in a trustworthy way nor can one just replace it with a custom image. There are attempts to delete as much of it as possible without running into countermeasures (https://github.com/corna/me_cleaner). So solving this problem on a machine itself is kind of difficult, but what if it dealt with outside the machine?
Since I think about building my own secure router (maybe using some BSD like NetBSD, OpenBSD, etc.) as entry point to my local network, I started to wonder if I could protect every potentially threatened intel machine in my local network with a home-made router that contains no hardware from intel or maybe even AMD(they using something called PSP) ?
Futher I was wondering wheather it would improve the security of the router concerning intels ME when using a NIC via PCI in the router because its said to the interface of ME it is only available over the primary NIC? That would be the NIC of the motherboard, right?
And finally would it be sufficient when the router have some kind of a whitelist of the MAC and IP addresses which are explicitly allowed, since its said to that the ME has its own MAC and IP address? I mean I could just add the adresses of every device of the local network to the whitlist and then every attempt for communication to or form the ME would not longer be possible?
So the idea is basically some kind of desktop computer which is hardened as much as possbile but without going nuts.Every idea or tip how to fullfill that goal is appreciated.
My first question, I hope it is ok.