You can now run software like EFIgy or my EFIver.py to see if you are using the latest EFI update from Apple, but that doesn’t necessarily mean that you are using the latest and greatest from Intel. Not for the following models:
File : IM144_0183_B00.scap (iMac14,4) ME version: 9.5.3.1526 Latest : No File : IM151_0211_B00.scap (iMac15,1) ME version: 9.0.6.1492 Latest : No File : IM162_0212_B00.fd (iMac16,2) ME version: 9.1.21.1000 Latest : No File : IM171_0110_B00.fd (iMac17,1) ME version: 11.0.0.1180 Latest : No File : IM181_0151_B00.fd (iMac18,1) ME version: 11.6.14.1219 Latest : No File : IM183_0151_B00.fd (iMac18,x) ME version: 11.6.14.1219 Latest : No File : MBP114_0177_B00.fd (MacBookPro11,4) ME version: 9.1.20.1035 Latest : No File : MP61_0120_B00.scap (MacPro6,1) ME version: 8.1.51.1471 Latest : No
This shows us a limitation of EFIgy and my very own EFIver.py script. One that I would like to address soon. Speaking of which, the latest beta (v3.2) now also runs with Python3 – required for Windows and Linux – but you’ll need PyObjc.
And while I don’t really know if this opens un-patched attack vectors, or if this is Apple’s fault (but Intel?) but I like to keep my Mac safe. As much as I can, and then something like this isn’t really helping me.
Thanks to Plato Mavropoulos for his ME Analyzer!
Pike's Universum 
ME as in the Management Engine horror? I was rather hoping Macs didn’t have that – at least I’ve never heard of a way to interact with it on a Mac.
Correct.
To be really safe you could always disable ME (or parts of it?), as e.g. the intelligence agencies do, by setting the NSA’s “reserve_hap” to 1: http://blog.ptsecurity.com/2017/08/disabling-intel-me.html … don’t know if macOS will boot with such a setup. But if this is possible, I’m thinking about doing this myself.
ME could be disabled successfully using me cleaner but it has been tested only with sandy/ivybridge.
Hi Pike! IF you could unpack and repack after modification of latest ME driver, you could use one tool like iHEX or UEFITool to integrate latest ME FW update which you can find over win-raid.com.
Im talking about scap firmware file which obviously contains ME firmware inside, so we could find a way to unpack, replace ME firmware using uefitool than repack as scap?