4 ms·

So far AMD has ignored fixing this pretty much because "only privacy nerds" care about it. Well, some of those privacy and security nerds happen to work for com

by mtgx 9y ago

So far AMD has ignored fixing this pretty much because "only privacy nerds" care about it. Well, some of those privacy and security nerds happen to work for companies like Google and even have influence over those companies' hardware purchases. So now AMD has just lost a big chuck of potential Google business, and who knows what kind of other potential contracts, because it continues to ignore this issue instead of actually showing some leadership on it. Maybe it's time for AMD to actually differentiate from Intel on this issue?

paulmd 9y ago
Devil's advocate: if large customers care, AMD can easily give them a "special" microcode image with it disabled. Intel does the same thing with the "High-Assurance Platform" for the intelligence community, which is effectively a ME killswitch. However, these fixes are generally not offered to the public even when they already exist (again, see: Intel HAP). The rules of the game are different when you're one of the Super 7 instead of just some random pleb. And increasingly those guys are no longer interested in leaving this threat vector open, which says something.
- bogomipz 9y ago
  >" Intel does the same thing with the "High-Assurance Platform" for the intelligence community, which is effectively a ME killswitch." Do you have any links or documentation you could share regarding these exceptions? Thanks.
  - GranPC 9y ago
    Here you go: http://blog.ptsecurity.com/2017/08/disabling-intel-me.html http://blog.ptsecurity.com/2017/08/disabling-intel-me.html
    - PuffinBlue 9y ago
      To see the Int community have a special mode to disable ME simply confirms that the ME is exploited, if any further proof was needed.
  - gmantastic 9y ago
    This article discusses Intel Management Engine and a company offering laptops with it disabled: https://www.theregister.co.uk/2017/10/21/purism_cleanses_laptops_of_intel_management_engine/ https://www.theregister.co.uk/2017/10/21/purism_cleanses_lap...
- Chaebixi 9y ago
  >> Well, some of those privacy and security nerds happen to work for companies like Google and even have influence over those companies' hardware purchases. >> So now AMD has just lost a big chuck of potential Google business... > Devil's advocate: if large customers care, AMD can easily give them a "special" microcode image with it disabled... > However, these fixes are generally not offered to the public even when they already exist (again, see: Intel HAP)... Google could take the "don't be evil" motto one step further: they could require CPU vendor give them publicly available microcode that disables these "features." Basically, they could use their market clout to put the PC market in the right direction.
eeZah7Ux 9y ago
> "only privacy nerds" There's nothing weird in caring about security. Data in tech companies and banks is worth hundreds of millions. Attackers are therefore willing to pay millions for a ME 0-day.
- squarefoot 9y ago
  What I find shocking is that nobody among the big names who should be conscious about security seem to give a rats ass about that. If I was say a high profile banker and someone told me that all my computers contained code that could be used to spy on me, my data, my business and my personal life, that would drive me crazy.
  - eeZah7Ux 9y ago
    The high profile banker knows that computer security can be a money sinkhole. Unfortunately there's no clear and measurable relation between how much you spend on security and the benefits you get.
cwyers 9y ago
Google servers and home users have very, very different privacy and security needs. The bottom line is that the biggest threat vector on most home machines is the user. Securing a PC against threats when the user installs a browser extension for coupon printing and blasts through UAC prompts without reading them is very, very different than securing a server farm.
- comex 9y ago
  There's also the factor that some people, at least, would like to secure PCs from the user, particularly in the case of DRM video (which has an implementation in Intel ME). There's no real equivalent for Google servers.
dreamcompiler 9y ago
Maybe it's time to bag the stupid X86 instruction set entirely and move to a 64-bit chip that has a sane instruction set and that embraces loyalty to the end user all the way down to the metal.

by mtgx 9y ago

paulmd 9y ago

Devil's advocate: if large customers care, AMD can easily give them a "special" microcode image with it disabled. Intel does the same thing with the "High-Assurance Platform" for the intelligence community, which is effectively a ME killswitch. However, these fixes are generally not offered to the public even when they already exist (again, see: Intel HAP). The rules of the game are different when you're one of the Super 7 instead of just some random pleb. And increasingly those guys are no longer interested in leaving this threat vector open, which says something.

bogomipz 9y ago
>" Intel does the same thing with the "High-Assurance Platform" for the intelligence community, which is effectively a ME killswitch." Do you have any links or documentation you could share regarding these exceptions? Thanks.
- GranPC 9y ago
  Here you go: http://blog.ptsecurity.com/2017/08/disabling-intel-me.html http://blog.ptsecurity.com/2017/08/disabling-intel-me.html
  - PuffinBlue 9y ago
    To see the Int community have a special mode to disable ME simply confirms that the ME is exploited, if any further proof was needed.
- gmantastic 9y ago
  This article discusses Intel Management Engine and a company offering laptops with it disabled: https://www.theregister.co.uk/2017/10/21/purism_cleanses_laptops_of_intel_management_engine/ https://www.theregister.co.uk/2017/10/21/purism_cleanses_lap...
Chaebixi 9y ago
>> Well, some of those privacy and security nerds happen to work for companies like Google and even have influence over those companies' hardware purchases. >> So now AMD has just lost a big chuck of potential Google business... > Devil's advocate: if large customers care, AMD can easily give them a "special" microcode image with it disabled... > However, these fixes are generally not offered to the public even when they already exist (again, see: Intel HAP)... Google could take the "don't be evil" motto one step further: they could require CPU vendor give them publicly available microcode that disables these "features." Basically, they could use their market clout to put the PC market in the right direction.

eeZah7Ux 9y ago

> "only privacy nerds" There's nothing weird in caring about security. Data in tech companies and banks is worth hundreds of millions. Attackers are therefore willing to pay millions for a ME 0-day.

squarefoot 9y ago
What I find shocking is that nobody among the big names who should be conscious about security seem to give a rats ass about that. If I was say a high profile banker and someone told me that all my computers contained code that could be used to spy on me, my data, my business and my personal life, that would drive me crazy.
- eeZah7Ux 9y ago
  The high profile banker knows that computer security can be a money sinkhole. Unfortunately there's no clear and measurable relation between how much you spend on security and the benefits you get.

cwyers 9y ago

Google servers and home users have very, very different privacy and security needs. The bottom line is that the biggest threat vector on most home machines is the user. Securing a PC against threats when the user installs a browser extension for coupon printing and blasts through UAC prompts without reading them is very, very different than securing a server farm.

comex 9y ago
There's also the factor that some people, at least, would like to secure PCs from the user, particularly in the case of DRM video (which has an implementation in Intel ME). There's no real equivalent for Google servers.

dreamcompiler 9y ago

Maybe it's time to bag the stupid X86 instruction set entirely and move to a 64-bit chip that has a sane instruction set and that embraces loyalty to the end user all the way down to the metal.