5 ms·

Intel CPUs had the various "management" features for over a decade. Does anyone actually use them though?

by 0xbear 9y ago

yuhong 9y ago
What is fun is the confusion between DASH and PSP.
sambe 9y ago
So did AMD CPUs: "For years AMD’s processors for business PCs supported additional security technologies (collectively known as AMD Secure Processor and Platform Security Processor before that) enabled by the ARM TrustZone platform with the ARM Cortex-A5 core. AMD’s previous-gen PRO-series APUs included Secure Boot, Content Protection, per-Application security, fTPM 2.0, and support for Microsoft Device Guard, Windows Hello, fingerprint security, data protection and so on." I honestly don't know who uses them. I've not seen it in finance or health. Government?
- tremon 9y ago
  TrustZone is not a "management" feature in the sense that Intel AMT is; it is a security feature that can prevent/obscure certain hardware access (basically Ring 0 for peripherals), but does not allow for out-of-band machine access like AMT (although in-band machine access, with the firmware circumventing the user OS is a possibility).
  - julian_1 9y ago
    Trustzone is ARM's hardware access control. But I suspect AMD's PSP which incorporates an on-die ARM core rather than just implement the Trustzone ip, is doing a lot more. Reportedly it can manage DMA actions itself independently of the amd64 core.
- bryanbuckley 9y ago
  Seems like a catch-22 of adoption. Not worth the effort to develop on unless it is ubiquitous enough? I'm sure there will be growing (security) pains as well. Also not sure exactly how AMD allows development for the PSP (specific vendor keys?).
TwoBit 9y ago
They wouldn't be selling them unless somebody was buying them.
- beagle3 9y ago
  They wouldn't be selling them if the customers had a choice. But the customers don't.
  - qb45 9y ago
    You have a choice. You need to specifically buy a Q-series chipset to get working AMT. I presume that's a sign some enterprises are buying it or Intel wouldn't bother with Q-series. Another story is that the difference between Q and non-Q may be nothing more than firmware and some ROM bits ;)
    - beagle3 9y ago
      But ME is everywhere.
      - qb45 9y ago
        ME is not a "management feature", it's a general purpose auxiliary CPU used to implement management features and also "consumer features" like DRM. Whether you like it or not, ME is not relevant to the fact that yes, the AMT was developed because some customers actually use it.
        beagle3 9y ago
        That very well may be, but you are the only one talking about AMT, and I still can't get a CPU without an undocumented privileged CPU thrown in. If I had a choice, I would not get ME
        qb45 9y ago
        The whole thread started with somebody asking whether Intel management features are of any use: https://news.ycombinator.com/item?id=14668965 https://news.ycombinator.com/item?id=14668965 To which you responded that Intel wouldn't be selling them if customers had a choice to which I responded that they absolutely would.
amiga-workbench 9y ago
Only as a backdoor.
- mtgx 9y ago
  Let's be fair. It's not used only as a backdoor. There are a few enterprise use-cases for it, too. So, I would say it's mostly used as a backdoor.
  - jeltz 9y ago
    But does anyone actually use them for that? In the server space people do not and instead use management cards from the server manufacturer, but I have never worked with desktop IT in an enterprise setting. My guess is that enterprise workstations is the intended audience for the IME.
mschuster91 9y ago
I've seen IME (or its more featured server companion iLO) in both servers and workstations for out-of-band remote management. It's really nice from a corporate admin view - you can always make sure machines have latest updates installed, reinstall them when users mess stuff up... and you don't depend on the machine being powered on or a working OS!
baq 9y ago
of course, anyone who has to manage more than a dozen boxen for employees of his $CORP. enterprise computer management is a sanctioned backdoor just as employers are allowed to read your corporate email.
- geezerjay 9y ago
  Exactly. Those boxes were bought and paid for by the corporation. They are the company's property, and they have the right to access them whenever they want. It's a shame that those backdoors then find their way into consumer products, but it's silly to assume that a corporation doesn't have the right to access their own equipment.
  - PedroBatista 9y ago
    No they don't.
    - noir_lord 9y ago
      Except legally they do and morally it's debatable. I have no expectation of privacy on a work machine as the company has to protect its IT systems and assets. However I do have in my case since it's a Linux desktop with encrypted disks to which I have the password alone in a company full of Windows machines with an outsourced IT department who couldn't support Linux if I asked.

Intel CPUs had the various "management" features for over a decade. Does anyone actually use them though?

by 0xbear 9y ago

Intel CPUs had the various "management" features for over a decade. Does anyone actually use them though?

yuhong 9y ago

What is fun is the confusion between DASH and PSP.

sambe 9y ago

So did AMD CPUs: "For years AMD’s processors for business PCs supported additional security technologies (collectively known as AMD Secure Processor and Platform Security Processor before that) enabled by the ARM TrustZone platform with the ARM Cortex-A5 core. AMD’s previous-gen PRO-series APUs included Secure Boot, Content Protection, per-Application security, fTPM 2.0, and support for Microsoft Device Guard, Windows Hello, fingerprint security, data protection and so on." I honestly don't know who uses them. I've not seen it in finance or health. Government?

tremon 9y ago
TrustZone is not a "management" feature in the sense that Intel AMT is; it is a security feature that can prevent/obscure certain hardware access (basically Ring 0 for peripherals), but does not allow for out-of-band machine access like AMT (although in-band machine access, with the firmware circumventing the user OS is a possibility).
- julian_1 9y ago
  Trustzone is ARM's hardware access control. But I suspect AMD's PSP which incorporates an on-die ARM core rather than just implement the Trustzone ip, is doing a lot more. Reportedly it can manage DMA actions itself independently of the amd64 core.
bryanbuckley 9y ago
Seems like a catch-22 of adoption. Not worth the effort to develop on unless it is ubiquitous enough? I'm sure there will be growing (security) pains as well. Also not sure exactly how AMD allows development for the PSP (specific vendor keys?).

TwoBit 9y ago

They wouldn't be selling them unless somebody was buying them.

beagle3 9y ago
They wouldn't be selling them if the customers had a choice. But the customers don't.
- qb45 9y ago
  You have a choice. You need to specifically buy a Q-series chipset to get working AMT. I presume that's a sign some enterprises are buying it or Intel wouldn't bother with Q-series. Another story is that the difference between Q and non-Q may be nothing more than firmware and some ROM bits ;)
  - beagle3 9y ago
    But ME is everywhere.
    - qb45 9y ago
      ME is not a "management feature", it's a general purpose auxiliary CPU used to implement management features and also "consumer features" like DRM. Whether you like it or not, ME is not relevant to the fact that yes, the AMT was developed because some customers actually use it.
      - beagle3 9y ago
        That very well may be, but you are the only one talking about AMT, and I still can't get a CPU without an undocumented privileged CPU thrown in. If I had a choice, I would not get ME
        qb45 9y ago
        The whole thread started with somebody asking whether Intel management features are of any use: https://news.ycombinator.com/item?id=14668965 https://news.ycombinator.com/item?id=14668965 To which you responded that Intel wouldn't be selling them if customers had a choice to which I responded that they absolutely would.

amiga-workbench 9y ago

Only as a backdoor.

mtgx 9y ago
Let's be fair. It's not used only as a backdoor. There are a few enterprise use-cases for it, too. So, I would say it's mostly used as a backdoor.
- jeltz 9y ago
  But does anyone actually use them for that? In the server space people do not and instead use management cards from the server manufacturer, but I have never worked with desktop IT in an enterprise setting. My guess is that enterprise workstations is the intended audience for the IME.

mschuster91 9y ago

I've seen IME (or its more featured server companion iLO) in both servers and workstations for out-of-band remote management. It's really nice from a corporate admin view - you can always make sure machines have latest updates installed, reinstall them when users mess stuff up... and you don't depend on the machine being powered on or a working OS!

baq 9y ago

of course, anyone who has to manage more than a dozen boxen for employees of his $CORP. enterprise computer management is a sanctioned backdoor just as employers are allowed to read your corporate email.

geezerjay 9y ago
Exactly. Those boxes were bought and paid for by the corporation. They are the company's property, and they have the right to access them whenever they want. It's a shame that those backdoors then find their way into consumer products, but it's silly to assume that a corporation doesn't have the right to access their own equipment.
- PedroBatista 9y ago
  No they don't.
  - noir_lord 9y ago
    Except legally they do and morally it's debatable. I have no expectation of privacy on a work machine as the company has to protect its IT systems and assets. However I do have in my case since it's a Linux desktop with encrypted disks to which I have the password alone in a company full of Windows machines with an outsourced IT department who couldn't support Linux if I asked.