When it comes to Intel Management Engine, I actually think it's not a threat if you neutralize it. I mean to just set the HAP bit on it. Because if that isn't enough then that means all computers in the world which use Intel CPU can be accessed by NSA but if NSA had this much power then it seems obvious that they aren't using it and why wouldn't they use it?
There's a github project to neutralize/disbale Intel ME: https://github.com/corna/me_cleaner Disable is overwriting intel ME as much as possible with zeros, leaving only a little remaining to be able to boot the computer. The newer the intel chips are, the less likely it is to be able to disable it. But all chip sets can be neutralized which means to set the HAP bit which is an official feature. In theory we can't actually trust the HAP bit to really disable intel ME permanently. It's more like asking Intel to do what they have promised because it's proprietary. But I think it really does permanently disable it because otherwise NSA would be abusing this power.
That's why I think the newer laptop models are better because it's probably not necessary to disable, it's enough to just neutralize withthe HAP bit. And with a newer modern laptop they can have open source Embedded Controller firmware which is better than proprietary Embedded Controller firmware.
I'm interested to hear what you think as well.
I think that a lot of the IntelME stuff is what people would typically call a conspiracy theory, not like a theory of a conspiracy, but rather where the conspiracy is largely invented for the purpose of being scared or angry, or for attention from others who get scared or angry. Obviously not all of it is, and there are people who do research it, but the videos about it that you usually see on YouTube, most of them are like this.
The thing is that intelME isn't like a government conspiracy where there isn't much if any tangible evidence for it, IntelME is physically installed on millions upon millions of Intel PCs around the world, so it's very easy to test the myths and claims by sacrificing some of these Intel computers. The fact though that most of the people making claims seem to not want to do that, suggests that they don't think it's as big a problem as they say it is. There are few people who have tested it though, a notable example from 34C3 where they found that it's actually much more boring. Honestly the idea that people say it cracks Wifi passwords, or exchanges data home with a server, all this stuff people claim can be easily tested, even analyzing the network packets from a PC to see if it actually phones home when it's off (can do that by probing an Ethernet cable and capturing the signals externally. The reason I claim the IntelME stiff is a conspiracy is because most of the people making the claims resist investigation, the same way that Flat earth theories and Lizard people theories resist investigation. My example of probing the network cable? Yeah I proposed that to someone already and they claimed IntelME would know the Ethernet is being probed, when I inquired how I was given many nonsensical claims, from microphone listening to talking to IntelME on another computer skewing the results, can't make this shit up.
So to summarize, a lot of the claims are unsubstantiated claims, which could be easily proven or disproven due to easy access to IntelME based systems, but isn't because the people making the claims can't be bothered, and to top it all off many of them simply make arguments to resist investigation of IntelME in the first place, just like classical bad-faith conspiracy theories, and actual investigations like the one shown as 34C3 are swept under the rug. I don't think IntelME doesn't have issues or that it isn't a security risk, it is like any firmware, but the sensationalized claims made about it regularly online don't hold water, and the people making them should be called out for perpetrating conspiracy theories without merit. I'd leave some links to them but I don't know if that's allowed here, could be considered harassment.
Good suggestion about analyzing network packets. I don't know anything about how to do that except there are tools like wireshark which can help but I still have no knowledge on doing that. And I think you would need to make a script to monitor it for you because it would probably only (talking theoretically now) phone home very quickly on rare occasions, it wouldn't be continous. So your script would have to be able to detect these short and rare anomalies. I don't know anything about how to do any of this though but I will add it to my todo list down the road.
Another problem is you might need to get the NSA's attention first and make yourself a target. You also need to make sure there is no other way for them to spy on you, so they are left with only using intel me as their last resort.
So because I don't know anything about analyzing network packets I can't say if you're right but it does seem convincing. And it would be great for security in general as well, not only for investigating intel ME. I will definitely learn more about this later.
You'd probably need to monitor the computer's network for a long time to get a detection, also something important is that if you're on a System with AMT disabled/not present, you won't ever get any, since those IntelME versions come without any network stack whatsoever.
In fact that's one of the primary reasons why I haven't tried it yet, almost none of the Intel computers I own even have the Intel AMT component enabled in the IntelME firmware, meaning they just won't do it, like ever. The only one I have which supports AMT is an old Laptop with a slow AF intel Centrino, it's so slow that it struggles with XFCE alone and no other apps running, I don't know if I could use this computer long enough to get any readings from it because it's just too slow to do anything really.
If you want to try it out I'd suggest building a copy of IntelMEtool and testing your Intel Machines to see if they have AMT enabled or present before trying yourself.