4 ms·

The scariest line to me: > Intel doesn't publicly disclose the existence of Intel VISA and is extremely secretive about it So all of my data and everything I

by bo1024 8y ago

The scariest line to me: > Intel doesn't publicly disclose the existence of Intel VISA and is extremely secretive about it So all of my data and everything I do on my computer is flowing through this every day, and nobody knows what it is or what it does....

arcanus 8y ago
Does this mean AMD is inherently more secure?
- chasil 8y ago
  AMD has an equivalent of the Intel ME that was called the "Platform Security Processor" and is now known as the "Secure Processor." Flaws have been found in it. They are probably not as bad as Intel. Leaving the VISA environment accessible to ME is something that I hope AMD would never entertain out of a wealth of caution for their customers.
  - richardwhiuk 8y ago
    > They are probably not as bad as Intel. Not sure there's any evidence this is likely to be true - except for the fact Intel processors are widely deployed.
    - chasil 8y ago
      AMD did not suffer from Meltdown. We would hope that their architectural restraint would extend to their SP.
  - _emacsomancer_ 8y ago
    > Flaws have been found in it. They are probably not as bad as Intel. It's slightly ambiguous whether you mean 'the flaws in AMD IME-near-equivalent are not as bad as the flaws in the IME' or 'AMD's IME-near-equivalent is not as bad as the IME'. On the 2nd interpretation, it seems that AMD's 'ME' is likely not as powerful/mature as Intel's ME. On the other hand, on certain machines the IME can be disabled or largely neutralised, while I know of no such possibility for AMD.
    - chasil 8y ago
      Intel ME just moved away from ARC processors to an internally-developed 486. The maturity of both platforms is opaque, varying, and the only reasonable feature that most consumers would want is an off switch.
- sufiyan 8y ago
  Test portions (debug architecture) are necessary for all chips. It is otherwise impossible to make sure what you have actually works as you intend.
lima 8y ago
It's just a tiny piece of Intel's architecture. There's a ton of other components that your data also flows through that are equally undocumented.
kacamak 8y ago
You never heard of intel IME or amd PSP? It's a mips microprocessor inside your cpu, completely undocumented and has access to the memory, peripherals, network interface etc.
- chasil 8y ago
  The older Intel version was actually on the ARC architecture, which was embedded in the north bridge: https://en.m.wikipedia.org/wiki/ARC_(processor) https://en.m.wikipedia.org/wiki/ARC_(processor) Later versions of the Intel ME switched to an internally-designed 80486.
- nickpsecurity 8y ago
  "completely undocumented and has access to the memory, peripherals, network interface etc. " They were documented in the sense Intel publicly advertised them for years under AMT and vPro as enterprise features. That's why all the discussions on HN about whether Intel had backdoors or weakened randomness were funny. While people were "countering misinformation" here, Intel was publicly advertising backdoors in their chips to ease the management burden. I mean, I guess you could call them front doors with the publicity. The sneaky part was how they started including them in all chips without a way to (a) buy chips without them or (b) know for sure you could turn them off. I immediately suspected NSA paying them off given most of this started in Trusted Computing Group activities which included classified sessions with NSA. They were always a stakeholder in that stuff. AMD did it, too. Our only hope for x86 now is the Chinese company that's sharing AMD's chips. They might make a chip with no U.S. backdoors: only Chinese backdoors. If you're worried about local government but not I.P. theft, then the Chinese backdoors won't be any threat to you. Problem solved if the computers get here with no interdiction. Gotta do shell games.
  - otakucode 8y ago
    I am not surprised that their inclusion was sneaky. I recall when Intel attempted to market TPM for the first time. The reaction was swift and very negative. Slashdot was not in favor of 'security' through including security holes and relying upon obscurity of the information on how to exploit the holes being the single point of failure. It was closer to when the government was trying to mandate key escrow and Clipper chips than now and back then they had to walk it back and not release it with a high profile. Back then the most common worry focused on was that this would be used for hardware-based DRM in service of the entertainment industry.
chiefalchemist 8y ago
Nobody? I'd say Intel knows. And more than likely NSA knows. That's worse than nobody.

by bo1024 8y ago

arcanus 8y ago

Does this mean AMD is inherently more secure?

chasil 8y ago
AMD has an equivalent of the Intel ME that was called the "Platform Security Processor" and is now known as the "Secure Processor." Flaws have been found in it. They are probably not as bad as Intel. Leaving the VISA environment accessible to ME is something that I hope AMD would never entertain out of a wealth of caution for their customers.
- richardwhiuk 8y ago
  > They are probably not as bad as Intel. Not sure there's any evidence this is likely to be true - except for the fact Intel processors are widely deployed.
  - chasil 8y ago
    AMD did not suffer from Meltdown. We would hope that their architectural restraint would extend to their SP.
- _emacsomancer_ 8y ago
  > Flaws have been found in it. They are probably not as bad as Intel. It's slightly ambiguous whether you mean 'the flaws in AMD IME-near-equivalent are not as bad as the flaws in the IME' or 'AMD's IME-near-equivalent is not as bad as the IME'. On the 2nd interpretation, it seems that AMD's 'ME' is likely not as powerful/mature as Intel's ME. On the other hand, on certain machines the IME can be disabled or largely neutralised, while I know of no such possibility for AMD.
  - chasil 8y ago
    Intel ME just moved away from ARC processors to an internally-developed 486. The maturity of both platforms is opaque, varying, and the only reasonable feature that most consumers would want is an off switch.
sufiyan 8y ago
Test portions (debug architecture) are necessary for all chips. It is otherwise impossible to make sure what you have actually works as you intend.

lima 8y ago

It's just a tiny piece of Intel's architecture. There's a ton of other components that your data also flows through that are equally undocumented.

kacamak 8y ago

You never heard of intel IME or amd PSP? It's a mips microprocessor inside your cpu, completely undocumented and has access to the memory, peripherals, network interface etc.

chasil 8y ago
The older Intel version was actually on the ARC architecture, which was embedded in the north bridge: https://en.m.wikipedia.org/wiki/ARC_(processor) https://en.m.wikipedia.org/wiki/ARC_(processor) Later versions of the Intel ME switched to an internally-designed 80486.
nickpsecurity 8y ago
"completely undocumented and has access to the memory, peripherals, network interface etc. " They were documented in the sense Intel publicly advertised them for years under AMT and vPro as enterprise features. That's why all the discussions on HN about whether Intel had backdoors or weakened randomness were funny. While people were "countering misinformation" here, Intel was publicly advertising backdoors in their chips to ease the management burden. I mean, I guess you could call them front doors with the publicity. The sneaky part was how they started including them in all chips without a way to (a) buy chips without them or (b) know for sure you could turn them off. I immediately suspected NSA paying them off given most of this started in Trusted Computing Group activities which included classified sessions with NSA. They were always a stakeholder in that stuff. AMD did it, too. Our only hope for x86 now is the Chinese company that's sharing AMD's chips. They might make a chip with no U.S. backdoors: only Chinese backdoors. If you're worried about local government but not I.P. theft, then the Chinese backdoors won't be any threat to you. Problem solved if the computers get here with no interdiction. Gotta do shell games.
- otakucode 8y ago
  I am not surprised that their inclusion was sneaky. I recall when Intel attempted to market TPM for the first time. The reaction was swift and very negative. Slashdot was not in favor of 'security' through including security holes and relying upon obscurity of the information on how to exploit the holes being the single point of failure. It was closer to when the government was trying to mandate key escrow and Clipper chips than now and back then they had to walk it back and not release it with a high profile. Back then the most common worry focused on was that this would be used for hardware-based DRM in service of the entertainment industry.

chiefalchemist 8y ago

Nobody? I'd say Intel knows. And more than likely NSA knows. That's worse than nobody.