5 ms·

It will be interesting if Apple does announce a move to ARM for (at least some of) their macbook range. Not surprising though, as Intel has refused to remove th

It will be interesting if Apple does announce a move to ARM for (at least some of) their macbook range. Not surprising though, as Intel has refused to remove the vulnerable backdoor [1] (Intel Management Engine) from all their new chips, companies like Google and Apple want more security and privacy for their platforms. While ARM is not perfect, it does allow companies like Apple more control over the secretive firmware that boots these chips. 1. https://libreboot.org/faq.html#intelme https://libreboot.org/faq.html#intelme

fierarul 6y ago
For a 3rd party this changes nothing: the master key is still under the control of some corporation. Both AMD and ARM have something similar to Intel's ME. Let's not pretend this is by accident.
- turblety 6y ago
  AMD does have a similar backdoor, called the PSP [1]. Both Intel ME and PSP are second chips that run separate from your main CPU, and can turn on/control/intercept the main CPU without the owners knowledge. ARM does not have this technology. The closest thing is TrustZone [2], which is a different process zoning/ring restriction, and can be completely turned off, depending on the manufacturer. Alternatively, if you want to write your own TrustZone (for example on a RockChip CPU), you are free to write it and use it. You can not run any firmware on an Intel or AMD chip that has not been signed by Intel ir AMD. All signed Intel firmware contains the Intel ME backdoor. 1. https://libreboot.org/faq.html#amd-platform-security-processor-psp https://libreboot.org/faq.html#amd-platform-security-process... 2. https://en.wikipedia.org/wiki/Trusted_execution_environment https://en.wikipedia.org/wiki/Trusted_execution_environment
  - _kbh_ 6y ago
    The PSP is slightly different though as it not remotely accessible. It does sit in a similar position to the ME (can interact with the computer outside of the main x86 cores) but yes not listen on a external interface. Interestingly enough the PSP actually uses the ARM TrustZone extensions to implement some of its security.
    - lorenzhs 6y ago
      AMD's DMTF DASH is absolutely remotely accessible, that is its main purpose. See, for example, https://developer.amd.com/tools-for-dmtf-dash/ https://developer.amd.com/tools-for-dmtf-dash/ (AMD's developer site is currently down, but there's an archived copy at http://archive.is/HHEwh http://archive.is/HHEwh) which states "DASH is a web services based standard for secure out-of-band and remote management of desktops and mobile systems. Client systems that support out-of-band management help IT administrators perform tasks independent of the power state of the machine or the state of the operating system. Examples of out-of-band management tasks include: 1) Securely starting up a system remotely, even if it is currently powered off; 2) Viewing asset inventory information for a system that is powered off; 3) Retrieving health information about system components even if the OS is unavailable." All of these things require remote access.
      - _kbh_ 6y ago
        DMTF DASH does look to be remote out of band management of AMD computers but I cannot find a connection to the PSP itself. I suspect it may run on the PSP but nothing I have seen so far has shown that the PSP is externally accessible or implements DMTF DASH functionality.
        lorenzhs 6y ago
        AMD's implementation of DMTF DASH is called SimFire, and Intel's is called AMT. They both implement the same standard. I don't see where else it run if not on the PSP if it works even when the machine is (supposedly) switched off? And even if it were not to run on the PSP, does that matter? It's still an opaque binary that runs below your OS. There's an older subthread on this at https://news.ycombinator.com/item?id=16081422 https://news.ycombinator.com/item?id=16081422 which also laments the lack of documentation on this.
        _kbh_ 6y ago
        its actually more interesting imo if it _doesn't_ run on the PSP; because that means that there is another processor that runs at a lower level than the x86 cores that can interact with the host and listens externally. After doing a bit of reading DMTF DASH appears to be implemented in the NIC from Broadcom or Realtek and uses the PCIE interface with the chipset from the NIC.
mbreese 6y ago
I would be very surprised if the presence of the Intel ME had an impact on any CPU move Apple makes.
- turblety 6y ago
  I think it's highly likely they considered it. One of Apple's main marketing pieces is security/privacy. It's important as they push into the health and payment marketplaces (for things like the iWatch and contactless payments). It would make sense they want complete control over their hardware stack end to end. You can even see this in the Apple Secure Enclave on mobile, which was made possible due to their ability to customise their own ARM chips.
- leeoniya 6y ago
  remember that time Jobs flat out said no to Flash on iOS due to security? that was when flash was the dominant tech for delivering multimedia.
  - harpratap 6y ago
    I believe he said no to flash because it was a battery hogging tech and would have rendered early smartphones basically useless as portable devices.
quadhome 6y ago
Apple's x86 chips run a custom gutted ME. To reduce that attack surface, Mac computers run a custom ME firmware from which the majority of components have been removed. … The primary use of the ME is audio and video copyright protection on Mac computers that have only Intel-based graphics. https://support.apple.com/en-au/guide/security/seced055bcf6/web https://support.apple.com/en-au/guide/security/seced055bcf6/...
- turblety 6y ago
  Interesting, thanks for sharing that. Sounds like what puri.sm are doing with their Librem ranges, with me-cleaner [1]. 1. https://github.com/corna/me_cleaner https://github.com/corna/me_cleaner

fierarul 6y ago

For a 3rd party this changes nothing: the master key is still under the control of some corporation. Both AMD and ARM have something similar to Intel's ME. Let's not pretend this is by accident.

turblety 6y ago
AMD does have a similar backdoor, called the PSP [1]. Both Intel ME and PSP are second chips that run separate from your main CPU, and can turn on/control/intercept the main CPU without the owners knowledge. ARM does not have this technology. The closest thing is TrustZone [2], which is a different process zoning/ring restriction, and can be completely turned off, depending on the manufacturer. Alternatively, if you want to write your own TrustZone (for example on a RockChip CPU), you are free to write it and use it. You can not run any firmware on an Intel or AMD chip that has not been signed by Intel ir AMD. All signed Intel firmware contains the Intel ME backdoor. 1. https://libreboot.org/faq.html#amd-platform-security-processor-psp https://libreboot.org/faq.html#amd-platform-security-process... 2. https://en.wikipedia.org/wiki/Trusted_execution_environment https://en.wikipedia.org/wiki/Trusted_execution_environment
- _kbh_ 6y ago
  The PSP is slightly different though as it not remotely accessible. It does sit in a similar position to the ME (can interact with the computer outside of the main x86 cores) but yes not listen on a external interface. Interestingly enough the PSP actually uses the ARM TrustZone extensions to implement some of its security.
  - lorenzhs 6y ago
    AMD's DMTF DASH is absolutely remotely accessible, that is its main purpose. See, for example, https://developer.amd.com/tools-for-dmtf-dash/ https://developer.amd.com/tools-for-dmtf-dash/ (AMD's developer site is currently down, but there's an archived copy at http://archive.is/HHEwh http://archive.is/HHEwh) which states "DASH is a web services based standard for secure out-of-band and remote management of desktops and mobile systems. Client systems that support out-of-band management help IT administrators perform tasks independent of the power state of the machine or the state of the operating system. Examples of out-of-band management tasks include: 1) Securely starting up a system remotely, even if it is currently powered off; 2) Viewing asset inventory information for a system that is powered off; 3) Retrieving health information about system components even if the OS is unavailable." All of these things require remote access.
    - _kbh_ 6y ago
      DMTF DASH does look to be remote out of band management of AMD computers but I cannot find a connection to the PSP itself. I suspect it may run on the PSP but nothing I have seen so far has shown that the PSP is externally accessible or implements DMTF DASH functionality.
      - lorenzhs 6y ago
        AMD's implementation of DMTF DASH is called SimFire, and Intel's is called AMT. They both implement the same standard. I don't see where else it run if not on the PSP if it works even when the machine is (supposedly) switched off? And even if it were not to run on the PSP, does that matter? It's still an opaque binary that runs below your OS. There's an older subthread on this at https://news.ycombinator.com/item?id=16081422 https://news.ycombinator.com/item?id=16081422 which also laments the lack of documentation on this.
        _kbh_ 6y ago
        its actually more interesting imo if it _doesn't_ run on the PSP; because that means that there is another processor that runs at a lower level than the x86 cores that can interact with the host and listens externally. After doing a bit of reading DMTF DASH appears to be implemented in the NIC from Broadcom or Realtek and uses the PCIE interface with the chipset from the NIC.

mbreese 6y ago

I would be very surprised if the presence of the Intel ME had an impact on any CPU move Apple makes.

turblety 6y ago
I think it's highly likely they considered it. One of Apple's main marketing pieces is security/privacy. It's important as they push into the health and payment marketplaces (for things like the iWatch and contactless payments). It would make sense they want complete control over their hardware stack end to end. You can even see this in the Apple Secure Enclave on mobile, which was made possible due to their ability to customise their own ARM chips.
leeoniya 6y ago
remember that time Jobs flat out said no to Flash on iOS due to security? that was when flash was the dominant tech for delivering multimedia.
- harpratap 6y ago
  I believe he said no to flash because it was a battery hogging tech and would have rendered early smartphones basically useless as portable devices.

quadhome 6y ago

Apple's x86 chips run a custom gutted ME. To reduce that attack surface, Mac computers run a custom ME firmware from which the majority of components have been removed. … The primary use of the ME is audio and video copyright protection on Mac computers that have only Intel-based graphics. https://support.apple.com/en-au/guide/security/seced055bcf6/web https://support.apple.com/en-au/guide/security/seced055bcf6/...

turblety 6y ago
Interesting, thanks for sharing that. Sounds like what puri.sm are doing with their Librem ranges, with me-cleaner [1]. 1. https://github.com/corna/me_cleaner https://github.com/corna/me_cleaner