5 ms·

Seeing this reminded me of something that happened a few weeks ago. I went to a conference where someone very high up in Intel came out to give a presentation w

by kop316 10y ago

Seeing this reminded me of something that happened a few weeks ago. I went to a conference where someone very high up in Intel came out to give a presentation what they were doing for security. A few things stuck out to me: - They said they work very hard to work with Linux to make sure their stuff is compatible. - The person also specifically called out that they work with BIOS vendors (and called out Coreboot by name, implying they work with them) - They added that they intend to make sure all of the features are on every chip, and it included the Intel ME. When the talk was over, the first question someone asked was: "Is there any backdoor on your chips?" After a bit of laughter, the presenter said of course there was not and (understandably) got offended by the question. I specifically asked why they don't allow people to completely disable the Intel ME, and I did not get a concrete answer. Seeing the _remotely_ exploitable Intel firmware vulnerability makes me not think that question was so funny. I really hope Intel is held responsible for this.

jacquesm 10y ago
> I really hope Intel is held responsible for this. Watch the stockprice at the opening bell and you'll know if they are being held responsible.
- rphlx 10y ago
  Like it or not, IMO there is little reason to expect this to have a material effect on the stock price, as it is not a product recall, and it probably will not seriously impact Intel's competitive position (given its main competitor is doing something similar).
  - Natsu 10y ago
    Sadly, I think that was his point...
    - jacquesm 10y ago
      Yep. Of course us tech people would like to see Intel punished for ME but the market really won't care and that's the only thing that would push Intel off this path.
      - Natsu 10y ago
        No doubt. It doesn't take long to find my own HN comments long before this story openly speculating that if the IME wasn't intentionally a backdoor, it had been made into one. I also wonder how the timelines of IME match up with respect to the Clipper chip controversy as well, for that matter.
  - imglorp 10y ago
    We did see some effects when the world started avoiding US cloud providers and network gear vendors. This time there's kinda nowhere to go. https://fcw.com/articles/2013/08/07/price-of-nsa-surveillance.aspx https://fcw.com/articles/2013/08/07/price-of-nsa-surveillanc... https://www.theguardian.com/books/2014/may/12/glenn-greenwald-nsa-tampers-us-internet-routers-snowden https://www.theguardian.com/books/2014/may/12/glenn-greenwal...
  - jacquesm 10y ago
    +0.5% after opening. So the market apparently doesn't care one bit about this. And as long as the mainstream press doesn't care about issues like these that will probably remain so.
discordance 10y ago
Who was the presenter from Intel?
- chb 10y ago
  Or, perhaps less pointedly, what conference was it?
marcosdumay 10y ago
> They added that they intend to make sure all of the features are on every chip Interesting that useful stuff like ECC RAM isn't treated like that.
- derefr 10y ago
  ECC RAM is a bit of a hard case in that the memory controller needs a slightly different wire protocol for ECC vs. non-ECC DIMMs. "Back in the old days", this was one of the justifications for having a northbridge separate from the CPU. Now, in the name of efficiency, it's all on-chip, making ECC a processor feature rather than a motherboard feature. That being said, it'd certainly be possible to fix this: just ask RAM manufacturers to make their non-ECC memory have the same pin out as ECC memory, with the ECC pins just stubbed to always report that everything is okay. Then all processors could just include the ECC version of the memory controller.
  - throwaway2048 10y ago
    This is not accurate, all (modern) AMD processors can work with both ECC and non-ECC ram, and ECC and non-ECC can even fit into the same ram sockets (the keying is different however, but a board can be compatible with both)
    - anoother 10y ago
      > the keying is different I don't think it is. DDR3 UDIMMs, EUDIMMs, RDIMMs and LRDIMMs all use the same physical format.
  - wtallis 10y ago
    All processors do included the ECC version of the memory controller. Perhaps you're thinking of registered memory, which isn't supported by consumer-grade processors or the workstation/low-end server processors that use the same sockets?
  - rphlx 10y ago
    While not exactly what you were suggesting, DDR4 ECC DIMMs and SO-DIMMS are already "pin compatible" with non-ECC modules. So it is straightforward to design a CPU and motherboard that support both, with a control bit in the IMC allowing the BIOS to enable/disable ECC checking (and the extra ECC byte lanes) iff ECC modules are installed (and that's what AMD did with Ryzen). It is fair to say that Intel blocks ECC on its desktop i7 parts for non-technical/business reasons (i.e. so they can sell a higher-profit E3 Xeon if you want DRAM data integrity beyond what non-ECC memory can provide).
nickpsecurity 10y ago
We in high-assurance security knew they backdoored it when they were in the Trusted Computing Group with closed-door meetings with the NSA for tech suiting their needs. Microsoft, too. They wanted to say security was purpose but we were pretty sure some backdoors and DRM would be in order in exchange for some payout. Also resulted in some special "high-assurance platform" tech that wasn't high-assurance (unlike pre-existing products), had to stay secret, was supplied by NSA, and would be in products people trust secrets to. Products running stuff like RHEL and VMWare. Oh yeah, that sounds legit as hell... Then, I see Intel offer vPro/AMT with a networked, DMA'd microcontroller that listens for remote requests when the system is powered off and can bypass all security without host monitoring. Told everyone that would listen "There's the backdoor. They even said it publicly with different words but it's definitely rigged with a "un-avoidable flaw" with remote access. Or 0-days in rushed, complex firmware." Some security people here argued endlessly on some threads over whether the rand instruction was weakened for NSA on a chip with publicly-advertised, remote access to internal state. I mostly threw my hands up on the topic recommending PPC and SPARC most of the time with their Open Firmware if not custom stuff. Do embedded boards for management since they're cheap and can be isolated.

by kop316 10y ago

jacquesm 10y ago

> I really hope Intel is held responsible for this. Watch the stockprice at the opening bell and you'll know if they are being held responsible.

rphlx 10y ago
Like it or not, IMO there is little reason to expect this to have a material effect on the stock price, as it is not a product recall, and it probably will not seriously impact Intel's competitive position (given its main competitor is doing something similar).
- Natsu 10y ago
  Sadly, I think that was his point...
  - jacquesm 10y ago
    Yep. Of course us tech people would like to see Intel punished for ME but the market really won't care and that's the only thing that would push Intel off this path.
    - Natsu 10y ago
      No doubt. It doesn't take long to find my own HN comments long before this story openly speculating that if the IME wasn't intentionally a backdoor, it had been made into one. I also wonder how the timelines of IME match up with respect to the Clipper chip controversy as well, for that matter.
- imglorp 10y ago
  We did see some effects when the world started avoiding US cloud providers and network gear vendors. This time there's kinda nowhere to go. https://fcw.com/articles/2013/08/07/price-of-nsa-surveillance.aspx https://fcw.com/articles/2013/08/07/price-of-nsa-surveillanc... https://www.theguardian.com/books/2014/may/12/glenn-greenwald-nsa-tampers-us-internet-routers-snowden https://www.theguardian.com/books/2014/may/12/glenn-greenwal...
- jacquesm 10y ago
  +0.5% after opening. So the market apparently doesn't care one bit about this. And as long as the mainstream press doesn't care about issues like these that will probably remain so.

discordance 10y ago

Who was the presenter from Intel?

chb 10y ago
Or, perhaps less pointedly, what conference was it?

marcosdumay 10y ago

> They added that they intend to make sure all of the features are on every chip Interesting that useful stuff like ECC RAM isn't treated like that.

derefr 10y ago
ECC RAM is a bit of a hard case in that the memory controller needs a slightly different wire protocol for ECC vs. non-ECC DIMMs. "Back in the old days", this was one of the justifications for having a northbridge separate from the CPU. Now, in the name of efficiency, it's all on-chip, making ECC a processor feature rather than a motherboard feature. That being said, it'd certainly be possible to fix this: just ask RAM manufacturers to make their non-ECC memory have the same pin out as ECC memory, with the ECC pins just stubbed to always report that everything is okay. Then all processors could just include the ECC version of the memory controller.
- throwaway2048 10y ago
  This is not accurate, all (modern) AMD processors can work with both ECC and non-ECC ram, and ECC and non-ECC can even fit into the same ram sockets (the keying is different however, but a board can be compatible with both)
  - anoother 10y ago
    > the keying is different I don't think it is. DDR3 UDIMMs, EUDIMMs, RDIMMs and LRDIMMs all use the same physical format.
- wtallis 10y ago
  All processors do included the ECC version of the memory controller. Perhaps you're thinking of registered memory, which isn't supported by consumer-grade processors or the workstation/low-end server processors that use the same sockets?
- rphlx 10y ago
  While not exactly what you were suggesting, DDR4 ECC DIMMs and SO-DIMMS are already "pin compatible" with non-ECC modules. So it is straightforward to design a CPU and motherboard that support both, with a control bit in the IMC allowing the BIOS to enable/disable ECC checking (and the extra ECC byte lanes) iff ECC modules are installed (and that's what AMD did with Ryzen). It is fair to say that Intel blocks ECC on its desktop i7 parts for non-technical/business reasons (i.e. so they can sell a higher-profit E3 Xeon if you want DRAM data integrity beyond what non-ECC memory can provide).

nickpsecurity 10y ago

We in high-assurance security knew they backdoored it when they were in the Trusted Computing Group with closed-door meetings with the NSA for tech suiting their needs. Microsoft, too. They wanted to say security was purpose but we were pretty sure some backdoors and DRM would be in order in exchange for some payout. Also resulted in some special "high-assurance platform" tech that wasn't high-assurance (unlike pre-existing products), had to stay secret, was supplied by NSA, and would be in products people trust secrets to. Products running stuff like RHEL and VMWare. Oh yeah, that sounds legit as hell... Then, I see Intel offer vPro/AMT with a networked, DMA'd microcontroller that listens for remote requests when the system is powered off and can bypass all security without host monitoring. Told everyone that would listen "There's the backdoor. They even said it publicly with different words but it's definitely rigged with a "un-avoidable flaw" with remote access. Or 0-days in rushed, complex firmware." Some security people here argued endlessly on some threads over whether the rand instruction was weakened for NSA on a chip with publicly-advertised, remote access to internal state. I mostly threw my hands up on the topic recommending PPC and SPARC most of the time with their Open Firmware if not custom stuff. Do embedded boards for management since they're cheap and can be isolated.