6 ms·

I'll give a try. Someone else can correct me later. These guys have used a JTAG f debugging dongle to access the Intel management engine. They can now read ever

I'll give a try. Someone else can correct me later. These guys have used a JTAG f debugging dongle to access the Intel management engine. They can now read every bit of code. Which means that secrets stored within the code including keys and bugs are available to them and anyone who can replicate their work. Since the management engine is in nearly all of Intel chips, we're screwed. AMD have something similar so no help there.

dm319 9y ago
Is this seen in ARM?
- milcron 9y ago
  Some of them have ARM TrustZone. I'm pretty sure that i.MX6 chips are relatively clean. Modern chips are becoming less so.
_0ffh 9y ago
"AMD have something similar so no help there" It's probably worse for AMD. For Intel now at least we'll probably get the ability to securely disable everything below ring -1.
- vog 9y ago
  It's such a pity that there is no real competition in that area. (Unless you go the totally different architectures such as ARM or RISC-V.) AMD had the chance to differentiate from Intel here, instead they blindly immitate the same customer-hostile stunt.
  - microcolonel 9y ago
    I don't want to get too deep into imagination, but the details of the ME/PSP story make it seem like an outside force of some sort is compelling them to add this stuff to their platforms.
    - vog 9y ago
      It's indeed nice to imagine that the people behind Intel are relieved that somebody finally found the kill-switch they left behind in the monster they had to create. And the AMD people now thinking hard how they can leak hints to their kill-switch in an inconspicuous way, too. But that's indeed imagination. Unforunately, we don't (yet) know much about their motivations.
      - tzahola 9y ago
        I love this Intel redemption arc!
      - my123 9y ago
        ME is used for market segmentation too, from locking hyperthreading to overclocking capablities. (they used to sell product update keys for some Pentium CPUs that were processed by an applet on the ME...)
    - fragmede 9y ago
      The invisible hand of the market is sufficient to explain it, no nefarious conspiracy necessary. For servers far away in a data-center, there needs to be some sort of "oh shit" access for when the OS dies, and this is implemented in high-end servers as separate second computer inside the server with its own ethernet port (ILOM), however the extra hardware costs more to manufacture. Intel decided it wanted a piece of that pie, and in an effort to improve margins, and sell more CPUs, Intel thought: "what if we offer the same feature, but use less hardware?" and made it part of their chipset. As a feature that businesses actually want, and they buy CPUs in the 10,000's/year, compared to maybe 1/year I might buy for personal use. AMD implemented similar in order to keep up and remain competitive in the market. Intel desktop chipsets aren't wholly different from their server chipsets, and they share some internals. Intel also realized that, since they already paid for development of the technology that it would be useful for administrators of a computer lab to be able to have remote admin access, and made it a requisite part of all systems. Again, AMD implemented the same to keep up. It could also be part of an NSA plot (it is part of their mission, after all), but "the market" where individuals don't count as much as corporate buyers, is sufficient to explain the situation.
  - vim_wannabe 9y ago
    Any clue as to why they chose not to differentiate? Is it too costly to build a separate non-remote CPU for non-enterprise? Does it provide some useful functionality for regular consumers? The answer is probably they do not think there's a market for it, but still makes me wonder.
    - lowry 9y ago
      Enterprise motherboards had IPMI forever. None complained until laymen found out the same thing sits inside -their- computers.
      - dsr_ 9y ago
        IPMI is supposed to be a tiny computer that listens for authorized network requests to turn on the main machine, reboot it, and connect a serial session to the console so you have a hope of recovering access when somebody has screwed up the main networking configuration. Loads of us (sysadmins) complained that IPMI (DRAC, LOM...) had frequent security issues, wasn't running open-source code that we could inspect, and kept growing new features without any sense of responsibility. We were especially irked when a dedicated IPMI ethernet port got shared with a micro switch to a normal system ethernet port, and it was not possible to turn that behavior off. Don't say we didn't complain. Say that we were not successful in having motherboard manufacturers implement the features we want in a secure and controllable manner.
  - Taek 9y ago
    There's a good reason that there isn't any real competition. Hardware design is extremely difficult, and extremely labor intensive. amd64 has an overwhelming number of op-codes, and competitively implementing all of them is a multi-billion dollar project. If you want to compete with Intel or AMD in the CPU market, you are talking tens of billions in NRE before you ever have something that is remotely competitive. And then you have to do it all over when we switch from 14nm to 7nm, and then again when we go from 7nm to 3nm. If you want more competition, you have to level the playing field by banning most of the op-codes. But even then you still have crazy amounts of pipelining and other optimizations which are nontrivial to figure out and very expensive to implement. Intel is in a great position.
  - efreak 9y ago
    ARM has TrustZone, though I have no idea what that's capable of or how it differs from ME/AMT/PSP/etc or how prevalent it is.
  - rdtsc 9y ago
    Wonder what POWER processors have?
- marcosdumay 9y ago
  Not that fast. Being able to read the data does not mean you can write something different back.

dm319 9y ago

Is this seen in ARM?

milcron 9y ago
Some of them have ARM TrustZone. I'm pretty sure that i.MX6 chips are relatively clean. Modern chips are becoming less so.

_0ffh 9y ago

"AMD have something similar so no help there" It's probably worse for AMD. For Intel now at least we'll probably get the ability to securely disable everything below ring -1.

vog 9y ago
It's such a pity that there is no real competition in that area. (Unless you go the totally different architectures such as ARM or RISC-V.) AMD had the chance to differentiate from Intel here, instead they blindly immitate the same customer-hostile stunt.
- microcolonel 9y ago
  I don't want to get too deep into imagination, but the details of the ME/PSP story make it seem like an outside force of some sort is compelling them to add this stuff to their platforms.
  - vog 9y ago
    It's indeed nice to imagine that the people behind Intel are relieved that somebody finally found the kill-switch they left behind in the monster they had to create. And the AMD people now thinking hard how they can leak hints to their kill-switch in an inconspicuous way, too. But that's indeed imagination. Unforunately, we don't (yet) know much about their motivations.
    - tzahola 9y ago
      I love this Intel redemption arc!
    - my123 9y ago
      ME is used for market segmentation too, from locking hyperthreading to overclocking capablities. (they used to sell product update keys for some Pentium CPUs that were processed by an applet on the ME...)
  - fragmede 9y ago
    The invisible hand of the market is sufficient to explain it, no nefarious conspiracy necessary. For servers far away in a data-center, there needs to be some sort of "oh shit" access for when the OS dies, and this is implemented in high-end servers as separate second computer inside the server with its own ethernet port (ILOM), however the extra hardware costs more to manufacture. Intel decided it wanted a piece of that pie, and in an effort to improve margins, and sell more CPUs, Intel thought: "what if we offer the same feature, but use less hardware?" and made it part of their chipset. As a feature that businesses actually want, and they buy CPUs in the 10,000's/year, compared to maybe 1/year I might buy for personal use. AMD implemented similar in order to keep up and remain competitive in the market. Intel desktop chipsets aren't wholly different from their server chipsets, and they share some internals. Intel also realized that, since they already paid for development of the technology that it would be useful for administrators of a computer lab to be able to have remote admin access, and made it a requisite part of all systems. Again, AMD implemented the same to keep up. It could also be part of an NSA plot (it is part of their mission, after all), but "the market" where individuals don't count as much as corporate buyers, is sufficient to explain the situation.
- vim_wannabe 9y ago
  Any clue as to why they chose not to differentiate? Is it too costly to build a separate non-remote CPU for non-enterprise? Does it provide some useful functionality for regular consumers? The answer is probably they do not think there's a market for it, but still makes me wonder.
  - lowry 9y ago
    Enterprise motherboards had IPMI forever. None complained until laymen found out the same thing sits inside -their- computers.
    - dsr_ 9y ago
      IPMI is supposed to be a tiny computer that listens for authorized network requests to turn on the main machine, reboot it, and connect a serial session to the console so you have a hope of recovering access when somebody has screwed up the main networking configuration. Loads of us (sysadmins) complained that IPMI (DRAC, LOM...) had frequent security issues, wasn't running open-source code that we could inspect, and kept growing new features without any sense of responsibility. We were especially irked when a dedicated IPMI ethernet port got shared with a micro switch to a normal system ethernet port, and it was not possible to turn that behavior off. Don't say we didn't complain. Say that we were not successful in having motherboard manufacturers implement the features we want in a secure and controllable manner.
- Taek 9y ago
  There's a good reason that there isn't any real competition. Hardware design is extremely difficult, and extremely labor intensive. amd64 has an overwhelming number of op-codes, and competitively implementing all of them is a multi-billion dollar project. If you want to compete with Intel or AMD in the CPU market, you are talking tens of billions in NRE before you ever have something that is remotely competitive. And then you have to do it all over when we switch from 14nm to 7nm, and then again when we go from 7nm to 3nm. If you want more competition, you have to level the playing field by banning most of the op-codes. But even then you still have crazy amounts of pipelining and other optimizations which are nontrivial to figure out and very expensive to implement. Intel is in a great position.
- efreak 9y ago
  ARM has TrustZone, though I have no idea what that's capable of or how it differs from ME/AMT/PSP/etc or how prevalent it is.
- rdtsc 9y ago
  Wonder what POWER processors have?
marcosdumay 9y ago
Not that fast. Being able to read the data does not mean you can write something different back.