That only works for very simple surveillance. It has complete control over your hardware, and it can encode information that it wants to get off of the system in a variety of different ways.
If you want to firewall ports or IP addresses on the machine itself, obviously that doesn't do anything, so what you'd need to do is do it on your router (that you hope doesn't have a similar backdoor that cooperates with ME), first you'd need to know what to block, which is difficult enough, and then you'd have to trust that that information doesn't change.
But event then all it takes is for AWS or CloudFlare or $Foo to collude with Intel to get at your juicy data again, so you really would need to work on a blocked-by-default basis, which is possible, but not really practical, depending on what you're doing.
It really depends on what your threat model is. If your're a high value target to someone with a lot of resources, you're essentially screwed.
It can broadcast information via your speakers, and maybe even your microphone. It can encode data in the timing of your packets as they leave your system. It can encode data in it's power consumption, it can encode data in what it sends to the screen, it can send data out via bluetooth or wifi. There are probably more ways, that I didn't think of off the top of my head.
We have Free Software all the way down to the firmware level. Not widely available, but the potential is there. That is good.
But for computers that we can really trust, we need to go deeper.
Just be mindful of the fact that you've only increased the difficulty of an attack, the vulnerability still exists. I've got a lenovo that regularly sends out dhcp broadcasts, despite no dhcp code being on disk - it could just as easily call home with dns (sending recursive requests to the same ip as the last successful user initiated query). The only way to fix a ring -N rootkit is to remove ring -N.
> sends out dhcp broadcasts, despite no dhcp code being on disk
Woah, that's not just sitting there but actually actively doing stuff while bypassing your kernel. This sounds a lot more scary even though I know nothing about this Lenovo dhcp thing, observing it just makes it a lot more real to me.
No need, everything is compiled from source, no dhcp to be found, and the kernel's network stack shows no traffic - but the switch does. It is no secret that Intel ME does whatever it wants with the ethernet port.
