20 ms·

AMD PSB Vendor Locks EPYC CPUs for Enhanced Security at a Cost

342 points by virgulino 6y ago

virgulino 6y ago
TL;DR: Put an Epyc cpu in a Dell once, and it will never work again in any other vendor's motherboard? Is that right?
- threentaway 6y ago
  Yep.
- deleted 6y ago
  [deleted]
- 0zymandiass 6y ago
  It's not necessarily just Dell, they're just the first to use the feature. It also won't necessarily work in other Dell motherboards, just ones using the same key as the first. It's strange Dell would blow the fuses by default, though.
  - felixfurtak 6y ago
    Could even enable some sort of region lock too? Selling CPUs at different prices to different markets for example?
    - soneil 6y ago
      Theoretically. If the OEM shipped region-specific firmware with a region-specific signing key, the CPUs would be region-specific as a side effect.
    - kllrnohj 6y ago
      Not really. AMD is only selling unlocked CPUs, and the "locking" is done the first time it boots in a given motherboard. So crossing regions wouldn't be any more of an issue in the future than it is now, you "just" need to ensure your motherboard and CPU come bundled together. Or you need to ensure you get an "unlocked" CPU, which is what retailers provide via AMD. This will greatly complicate the future second-hand market, though. Buying used Epyc CPUs off of ebay in 5 years will become very sketchy for example.
      - toast0 6y ago
        You could have some crude region locking if SGI US signs with a different key than SGI EU, and US servers will only run on 60hz power supplies and EU servers only run on 50hz (some pinball machines use this to reduce transatlantic resale) it's not hard to measure, but it would need an extra power supply pin and a zero crossing circuit. DC systems would have a different signing key. Japanese systems wouldn't be able to move across their 50/60Hz divide, etc. Used SGI to not pick a real vendor.
        kllrnohj 6y ago
        That only region locks the motherboard. The CPU would only be locked after it has been used in the motherboard, not before, which necessarily means you already have the CPU in question. So there wouldn't be any barrier to CPU movement across regions. As in for your example there isn't anything stopping you from buying a CPU from anyone, including US retailers, and using it in an SGI EU motherboard. The CPU itself isn't locked when new, this signing key locking isn't baked into the CPU at the factory. It happens when you plop it into the socket & fire it up for the first time.
        toast0 6y ago
        > As in for your example there isn't anything stopping you from buying a CPU from anyone. I can't buy a used cpu from an SGI US customer and put it in an SGI EU motherboard. I can buy a new CPU from anyone though, but then I can only sell it in-region.
        kllrnohj 6y ago
        > I can't buy a used cpu from an SGI US customer and put it in an SGI EU motherboard. Correct, but that's less a region thing and more this just poisons all used CPUs. As in you don't even know if an SGI US CPU will work in a different SGI US motherboard. There's no particular reason to assume all SGI US motherboard models will have the same signing key. Within the same model that'd almost certainly be the case, but if it's a different model, especially different chipset, I don't know why they would necessarily strive to keep the key the same across different firmware branches. > I can buy a new CPU from anyone though, but then I can only sell it in-region. Er, why? Nothing about this stops you from re-selling CPUs however you want. Or are you still talking about the used market here?
  - Patrick-STH 6y ago
    HPE and some other vendors do this, not just Dell.
jlawer 6y ago
Its not really vendor locking by design. It locks to a signing key. That key COULD be shared between vendors or even a single vendor could have multiple incompatible keys. It provides a mechanism to prove the entire boot process hasn't been tampered with, but I wish AMD provided a way to run these fused processors in a generic way without the security chain, with it just reporting that there isn't a secure root of trust. However I assume they are afraid of that allowing malicious code to fool deeper parts of the system without the system administrator knowing. So good for security, but bad for e-waste and second hand sales.
- 3np 6y ago
  Wouldn’t it make more sense to blow the motherboard rather than the CPU? A compromised CPU without anything connected is pretty useless at boot. The motherboard is what’s connected to all the good stuff.
  - 0zymandiass 6y ago
    The CPU isn't what's compromised - this is protecting against a compromised motherboard
  - soneil 6y ago
    I think that’s the chicken & egg. If the motherboard was responsible for this, you’re trusting the firmware to validate itself. So this moves the validation a level lower. It’s an interesting problem. The solution is valid, but it’s unfortunately permanent.
    - im3w1l 6y ago
      You could have a small rom firmware validating a larger ugradable firmware.
  - bayindirh 6y ago
    However, the root of trust is embedded to the CPU. So, you can't hammer the CPU on another board for keys. Also, we sometimes lose the CPU rather than the board. As the CPUs become more complex, their probability to fail has risen.
Covzire 6y ago
What problem is this trying to solve? Is there that much of a black market for data center CPUs?
- 0zymandiass 6y ago
  BIOS (UEFI) level rootkits
  - im3w1l 6y ago
    I managed to get that much from the article but I still feel I'm missing a few pieces here. Are UEFI rootkits an actual concern, like are they common in the wild? Why should the responsibility of detecting them rest with the processor? How is this related to the Secure Encrypted Virtualization?
    - 0zymandiass 6y ago
      There have been a couple in the wild, but they aren't super common. They've become a bigger concern with UEFI since it has a massive attack surface compared to legacy BIOS. For a processor sitting in AWS / Azure, they want guarantees, and they're the ones EPYCs are designed for. The responsibility has to rest with the processor, since it's the only thing executing code prior to UEFI. What it's doing is validating that UEFI was cryptographically signed with the correct key prior to running any UEFI code. When it's first used, it is saving the key for the vendors UEFI implementation and won't allow it to proceed if the root signature ever changes (think something similar to root certs for HTTPS). It's only relevant to Secure Encrypted Virtualization insofar as they are both implemented inside the PSP which is a separate ARM core that runs at a higher privilege level than the x86 cores (and is the core that actually initializes the x86 cores). This is how all phones have worked for many years, but apparently it's now becoming a thing in servers too.
      - im3w1l 6y ago
        Oh the UEFI code is run by the main processor.. somehow I had always assumed it was running on some micro-processor on the mobo.
userbinator 6y ago
I am beyond sick of this "security" justification being used for everything. At the end of the day, the only thing really being secured are the greedy vendor's profits.
- intc 6y ago
  And this doesn't solve the issue with PSP either. So not much actual progress with security. We need CPUs which do not contain black boxes and allow us to use open source (auditable) firmware (UEFI BIOS).
- canofbars 6y ago
  There are some realistic benefits. If my phone gets stolen, there is no way for it to be wiped and reused without my input. And if it makes it back to me, it is extremely unlikely that it has been loaded with malware which will send off my data when I log in again. But yes, its really shitty how the downsides end up with the loss of user control and ewaste. Especially when it is possible to design something that is secure and that the user controls.
  - swiley 6y ago
    Really? What phone do you have? A decent number of the recent iPhones have a bootloader exploit now. So there’s no security, just a lot of bitchy software.
    - canofbars 6y ago
      Mine is newer than that exploit so no. But also a flaw in the implementation doesn't invalidate the reason for implementing it in the first place. Anti theft features on android and ios have likely saved hundreds of thousands of phones from being stolen, if not millions.
      - MegaThorx 6y ago
        But how often does a server gets stolen from a data center? It surely makes sense for phones as it makes less profitable to steal them (as you could only sell parts of the phone and even that can be blocked). Maybe even for laptops but not for desktops and servers.
tyingq 6y ago
This will be an interesting mess on eBay.
the_pwner224 6y ago
The title as submitted to HN is super clickbaity. Overall this doesn't seem 'bad', aside from some questionable defaults that other commenters said about it being enabled by default.
- judge2020 6y ago
  It really should copy the article: > AMD PSB Vendor Locks EPYC CPUs for Enhanced Security at a Cost
  - fiberoptick 6y ago
    Should be corrected to "Vendor-Locks", as well.
Zenst 6y ago
This may well be a case of the vendor does this, they get a better price as removes all aspects of reselling the CPU's on and the whole grey market risk - https://en.wikipedia.org/wiki/Grey_market https://en.wikipedia.org/wiki/Grey_market Large vendor, such details may mean a few dollars saving on the CPU's and that will add up. For many it won't be an issue, more a gotcha for the second hand market upon those thinking they can buy and part it out. So down the line, this is going to make some second hand CPU's a real gotcha unless these chips have identifiable visible marking.
brokencode 6y ago
Is there any way to “fix” the processor afterwards? Maybe send it to AMD to be reset? If I’m buying a multi thousand dollar processor, I’d feel better if I could reuse it in other systems if needed.
- soneil 6y ago
  If they’re setting OTP on the die, all AMD could offer would be a warranty replacement at best. There’s no etching new fuses into a packaged die.
  - p1mrx 6y ago
    They could blow the key to an "insecure" state, and then have a jumper on the motherboard to allow insecure booting.
    - soneil 6y ago
      That’s about the only way I see out of this, yeah. No fuses blown is obviously a specific state (works as expected everywhere). All-fuses blown needs to be a specific state too (say the trustroot is dead and it’s now “just a cpu”). You couldn’t just fail to that state (it’d be inappropriate for its primary use-case), as long as there’s some way to get there.
  - argb 6y ago
    It could be done with some kind of JTAG mod-chip, but this depends on what kind of JTAG security they've implemented. If you want to know where to start, search GitHub for 'KaveriPI', if you unpack AMD BIOSDBG.EXE you can find a complete list of processor registers. This is all from 2015 but the PSP is documented in there. There's also a Microsoft Access database which has all the JTAG registers, but I don't have the time to decode the meaning of the fields... It is likely that things have changed since then but it still might be enough for a start. Should the JTAG interface be protected then some kind of laser(?) fault injection might be required to open it up. I guest some of the eFuse bits can be overwritten, maybe there's a combination which can remove the lock. An innovative recycling company could work on making a jig to automate this somehow... Some PSP JTAG stuff here (publicly available material from GitHub in 2015, fair use applies): 41469,3529,164000,164999,"SMU_PSP_efuse_ovr_tried",,1,0,0,0,50,"0000",0, 41470,3529,164000,164999,"SMU_PSP_FRA_pass_ld_err",,1,1,1,0,50,"0001",0, 41471,3529,164000,164999,"SMU_PSP_FRA_pass_ld_cor",,1,2,2,0,50,"0002",0, 41472,3529,164000,164999,"SMU_PSP_efuse_pdmb_aes_dis",,1,3,3,0,50,"0003",0, 41473,3529,164000,164999,"SMU_PSP_efuse_pcpu_dis",,1,4,4,0,50,"0004",0, 41474,3529,164000,164999,"SMU_PSP_efuse_ccp_cyph_dis",,1,5,5,0,50,"0005",0, 41475,3529,164000,164999,"SMU_PSP_efuse_FRA_en",,1,6,6,0,50,"0006",0, 41477,3529,164000,164999,"SMU_PSP_efuse_proto",,1,7,7,0,50,"0007",0, 41478,3529,164000,164999,"SMU_PSP_efuse_secure",,1,8,8,0,50,"0008",0, 41552,2352,164000,164999,"SMU_PSP_hard_resetb",,1,31,31,0,50,"101F",0, 41553,2352,164000,164999,"SMU_PSP_early_resetb",,1,30,30,0,50,"101E",0, 41554,2352,164000,164999,"SMU_PSP_slv_mbus2_reset",,1,29,29,0,50,"101D",0, 41555,2352,164000,164999,"PSP_SCAN_MODE_STICKY",,1,28,28,0,50,"101C",0, 41568,2352,164000,164999,"PSP_AEB_307_PCPU_RST_DLY_TDR_en_pclk",,1,15,15,0,50,"100F",0, 41569,2352,164000,164999,"PSP_AEB_304_PCPU_FORCE_rst_en_pclk",,1,14,14,0,50,"100E",0, 41579,2352,164000,164999,"PSP_Resetn",,1,8,8,0,50,"1008",0, 43605,555,164000,164999,"PSP_ENABLE_SPARE",,0,1,1,0,50,"0001",0, 43642,555,164000,164999,"PSP_SPARE",,0,7,14,0,50,"0007",0,
non-entity 6y ago
I get why its done, but all this locking down of modern systems is making me rapidly lose interest in computing.
wu_187 6y ago
Honestly I see this as a net positive. It increases the security of the server, which is good for everyone. The secondary market will adjust accordingly, probably by selling the processor/motherboard/barebones server together. The only issue I can see is that there is no way to distinguish a locked processor from an unlocked one.
- saagarjha 6y ago
  > The secondary market will adjust accordingly, probably by selling the processor/motherboard/barebones server together. You do understand that this can be fairly annoying, yes?
- probably_wrong 6y ago
  > It increases the security of the server, which is good for everyone That is exactly the point: it isn't good for everyone. In particular, it is suspicious that a move in the name of security just so happens to negatively affect the secondary market. A market that by definition doesn't net AMD any money. If AMD had released this exact same feature and said "we are doing this because the second-hand market is bad for our sales", regulators would immediately jump at them for anti-competitive behavior. And the fact that there is no option to disable this check at all makes it even more suspicious. It is possible that the benefits outweigh the downsides. But I wouldn't give them a pass that easily.
gigatexal 6y ago
Some enterprising enthusiasts will find a way around this i hope
- userbinator 6y ago
  Hopefully the keys get leaked someday, as often eventually happens with such DRM-ish schemes.
fiberoptick 6y ago
Does this defend against any additional attack surface that wasn't already defended by the UEFI Secure Boot standard?
- wmf 6y ago
  Yes, UEFI Secure Boot defends against OS/bootloader malware while this defends against flashing malware into the UEFI firmware itself.
  - arpa 6y ago
    Wait so if i flash malware into the firmware, i should also have a spare fresh EPYC CPU i could install?
    - SaltySolomon 6y ago
      The keys for trusted compute, memory encryption and such are saved inside the CPU, so if you change the CPU you also loose all those keys.
    - jacoblambda 6y ago
      Yes, I think that would be a valid way to bypass the protection. With physical access you can bypass just about any protection given enough money and time. In a data centre context, the damage you can do is rapidly minimised by rapidly increasing the amount of capital and time required to access more of the DC. The more important change is that without this feature, malware could theoretically install itself into the firmware without requiring physical access. Now it should be just about impossible to break the chain of trust without a person physically tampering with the machine. Note: I should mention that I think this is such a massive double edged sword (maybe double edged shield is a better term). This lets you build a threat model that accounts for everything up to physical access. This however also has such a massive opportunity to be an incredibly anti-consumer feature that I fear to see how it will be used. I wish they would have required a physical switch to enable/disable the feature. I do however understand how adding such a feature could complicate its implementation quite a bit.
walrus01 6y ago
I'm not as sketched out about this as if it were single socket workstation ryzen/threadripper CPUs. In the market from $1000 to $6000 workstation desktops where enthusiasts and people with specific requirements (or just 10, 15, 20 years of experience building x86-64 PCs themselves) would want to build their own desktop from individual components ordered off Newegg. I doubt more than a single digit percentage of 'serious' dual socket (64-128+ core) rackmount server customers are going to be buying their own barebones motherboards and CPUs and assembling it themselves. They're going to buy it from a Dell, HP or a Supermicro integrator or similar. If you're buying a $12,000+ server with 128 cores and 512GB to 4TB+ of RAM and some fast NVME storage it's highly unlikely you're putting it together yourself. Any massive hosting/cloud scale operations that want to DIY their own EPYC systems from pieces will be doing it through a Taiwanese integrator, such as those that supply the ecosystem components for open compute platform server motherboards. And as such they'll also not encounter any technical issues or procurement issues with this. At the point where you have two $3000 CPUs on a motherboard that costs $1200, the full firmware/motherboard/CPU integration and qualification process is very different than putting a $399 ryzen into a $300 board.
- soneil 6y ago
  Not yet. We will in 5 years time when their resale value meets our budgets. I work in a rather budget-constrained lab environment. “Beg, borrow, steal” is the order of the day. Just today I was pricing out pre-loved Gen8 HPs. In 5 years time I could be exactly the hypothetical the article outlines. This isn’t today’s problem - it’s a problem we’re creating today. We’ll hit it when your examples start retiring them and my example are eager to recycle them.
  - walrus01 6y ago
    Yes - and no, I know lots of people including myself who have things like older dual socket Dell R710 as home test hypervisor servers. Also a very tiny percentage of people will bother to ever upgrade the CPUs on them. For home lab stuff... When people buy a $200 used Dell R610 off ebay with two 8-core CPUs they most likely expect to use it in the exact same CPU configuration. Maybe add RAM. And probably use their own choice of SATA 6Gbps SSD in the drive trays instead of whatever old, possibly unreliable used spinning drives might come with it. I have a 4U, quad socket Dell R910 with 32 total cores and 256GB of RAM that I got for $350. I'm absolutely not going to go messing around with replacing the CPUs on it with something I've purchased from ebay. When it's too old or slow, or I'm tired of having a 500W electrical load in my garage, I'll replace it with another thing that's come off a 3-4 year lease cycle.
ohazi 6y ago
The "this is for security" argument would make sense if they only locked CPUs that were sold by the vendor together with the motherboard, or if they had an action that an administrator could affirmatively take to lock the CPU. But automatically, permanently "poisoning" any CPU that's inserted into the socket after a single boot? That sounds like it's being done for economic reasons. They want to turn the used CPU market into a sketchball market for lemons so that everyone is so scared that they only buy board+CPU combos directly from the vendor rather than trying to save a few pennies here and there.
- caf 6y ago
  I don't know, when you think about what makes easier (cheaper) for the vendor, this way they just have to assemble the CPUs into the motherboards and ship the systems like they always have. I can't see that the market for enterprise system is heavily affected by grey market CPUs. Their customers are by and large buying these systems built & configured, and racking them up as they come. It'd be nice if there was a jumper you could set on the motherboard to stop it claiming a CPU though (maybe there even is?).
- dastx 6y ago
  My understanding was that you can put this in any other motherboard with the same signing key. Presuming the intent her is that every single machine would have to have a different signing key. If this was the case, then yes, security seems to be the reason. However, and I may have misunderstood this so please do correct me if I have, based on the article, it seems for certain vendors, they share the same signing key with multiple machines (presuming whole lines), in which case this certainly seems to be about vendor lock-in from the vendor side.
justinclift 6y ago
If I put a cpu in a server (Dell, HP, whatever), and that CPU then doesn't function in other equipment, than that cpu is broken. That's not an exaggeration in any way. So, the server maker then owes me a new cpu (of the same model obviously) that does work. It'll be interesting to see the legal fallout from this, as purposely breaking customer owned gear is not going to end well.
- snuxoll 6y ago
  While shitty, if this required pre-programmed OEM CPU’s it would be one thing - but knowing I could put a several thousand dollar boxed CPU into a branded motherboard and have it perpetually locked to that OEM is horrible. Quite frankly this should be an optional security feature I can flip off with a physical switch on the board - go show an alert on the BMC for all I care, but as is this is total bullshit.
- TwoBit 6y ago
  AMD created this feature, so why not complain to them?
  - jacoblambda 6y ago
    While reaching out directly to the company is definitely a strong way to express disagreement, I almost guarantee that someone from AMD PR will be reading through comments on tech community posts like these. Expressing discontent in an open forum can catalyse a much larger reaction that PR depts will pay much more attention to compared to a few angry emails or twitter DMs.
- alisonkisk 6y ago
  No one owes you anything if the CPU functions exactly as advertised. If you don't want a platform-secured CPU, don't buy one.
  - erik_seaberg 6y ago
    Nobody advertises irreparable damage. This testing lab found out the hard way and then had to follow up with the vendors to get an explanation.
jhallenworld 6y ago
I thought this type of system would provide a way to revert to factory defaults with a side effect of erasing all keys. So the processor would no longer be secure, but would at least still boot. Maybe this clearing can be done through the BIOS/UEFI on the original Dell system.
bubblethink 6y ago
How many exploits/breaches in the wild due to open s3 bucket, default admin passwd to database, poorly written webshit code, plaintext password, etc. ? And how many prevented by secure boot, boot guard, memory encryption, ME, PSP etc. ? Other than obvious money reasons for Dell, people seem to be vastly overestimating their threat models. And even for the secure chain of trust, there are ways to do so where the owner has the key, not the vendor. See heads for example.
- sedatk 6y ago
  Or, those scenarios just don't make the news as frequent as script kiddie stuff. We only learned about what NSA has been up to because Snowden happened.
  - bubblethink 6y ago
    This is the opposite lesson to take away from Snowden's revelations. You want more user control, not less.
    - sedatk 6y ago
      I agree. I’m just saying that news may not be the best indicator of how common an attack vector is.
  - young_unixer 6y ago
    If I want to protect against the NSA I'm worried about them using Intel ME, AMD PSP and other black boxes to hack me. I don't worry that much about them sneaking into my data center or house and physically changing my hardware. The security you lose from having a black box in your CPU is much greater than the security you win by virtue of being (theoretically) protected against unsigned bootloaders and rogue hardware.
    - sedatk 6y ago
      I merely provided NSA as an example of how advanced attack vectors might go unnoticed for decades.
dayjobpork 6y ago
This is bullshit. Unless it clearly says at boot 'continuing will permanently prevent your CPU from being used in a non Dell computer y/n?' they are asking for a lawsuit for damaging hardware
- dayjobpork 6y ago
  In fact Australian Consumer Law flat out holds them liable for costs due to problems a seller could have reasonably foreseen
  - elmo2you 6y ago
    Do consumer laws apply to businesses in Australia? Because afaik, in the EU regretfully a lot of laws that protect consumers against abuse from vendors, do not apply to B2B/enterprise transactions. On the other hand, there have been people who have warned about the dangers of CPU vendors putting Management Engines in their products, which are outside of the control of end users (by design). One of those concerns was the ability to rig sales or even kill off second hand markets markets all together. Apparently, this have already become a reality now. I'm not surprised it's sold as security feature, just as terrorism and child pornography have been magic words in other fields. But at the end of the day, vendors stand to substantially increase their control on sales and with it their profits, with features that may only be significant in edge cases. That smells a lot like an antitrust issue to me. That all vendors are likely try to move in this same direction, as an opportunity to make more profit, doesn't make it any less devious. All the more reason for antitrust investigators to start looking into this.
    - shakna 6y ago
      > Do consumer laws apply to businesses in Australia? Because afaik, in the EU regretfully a lot of laws that protect consumers against abuse from vendors, do not apply to B2B/enterprise transactions. Yes. Consumer protections apply to everyone. Within Australia, those protections are considered the "bare minimum" that must be implemented by every business, across the board. Certain industries have other protections they must implement atop of those.
pjmlp 6y ago
So where are all the AMD fans "will never buy either Intel nor NVidia" now?
- userbinator 6y ago
  Intel has ME, AMD has PSP. Intel has Boot Guard, AMD has this. Either one may have seemed the better choice at one point in time, but it's clear they're really going down the same path.
yk 6y ago
I can think of two scenarios where this security feature is helpful. First, somebody breaks into a server room, replaces the motherboard with a compromised one, and notices mid replacement that they forgot a processor. (Since the processor locks during first boot, it is of no use if the supply chain is compromised before the first boot. On the other hand, I would imagine somebody willing to break into a data center to replace a motherboard would also be willing to do all kinds of other shenanigans, like bringing another processor.) The second scenario is, somebody thinks about buying a used instead of an new processor.
- skinner927 6y ago
  Bingo. It’s a money grab. It’s actually easier to swap a mobo with a cpu and heatsink that’s already seated.
- mmis1000 6y ago
  Well, the security key of VM is stored in the CPU, so you can't replace CPU unless you can enter the console, copy the data out and re-encrypt it with key from another CPU. While if you can do this, you don't need to replace mother board/CPU anyway because you already pwned them and copy/modify the data whatever you want.
  - Dylan16807 6y ago
    > Well, the security key of VM is stored in the CPU What security key? Do you mean the memory encryption key? We're talking about a powered off machine, so that's irrelevant.
    - SaltySolomon 6y ago
      Memory and Virtual Machines
      - Dylan16807 6y ago
        Please explain better. The article talks about virtual machines as a subset of memory encryption. It also specifically says "ephemeral keys". Not ones that would be preserved across a shutdown. What is encrypted on a powered-off server that the CPU knows the key to?
rasz 6y ago
This sounds reasonable. I mean to bypass this lock our criminal would have to ... replace the CPU and continue attack like nothing happened. Totally infeasible, inconceivable even! proving this was introduced for safety and not Vendor_lock-in!!!1
- deleted 6y ago
  [deleted]
mikedilger 6y ago
This would be better if there were a physical-only method to factory reset the CPU, instead of blowing fuses.
jmnicolas 6y ago
I didn't read the article. I felt like the author had an assignment to make it a certain length and is filling it with useless sentences.
zwaps 6y ago
Sorry to be blunt, but am I correct that this is a measure against tampering with servers by Chinese intelligence during the customs process? In that case, are the CPUs themselves signed or could they be replaced after modifying the motherboard? Because otherwise it's really hard why the website would claim that every end user would be enthused about these lock-ins. Sort of weird statement.
- caf 6y ago
  No, it's about stopping BIOS-level rootkits from being installed when someone remotely compromises the machine.
  - rasz 6y ago
    No, its about shutting down secondary server hardware market.
intricatedetail 6y ago
It should be illegal to lock devices like that. Pure corporate greed. It is sad that as soon as AMD restored its glory they gone for a cheap cash grab. It should be easy to tell that device is running unsigned boot loader without blocking it (e.g. a jumper on the motherboard). If attacker is able to switch a jumper, then you have bigger problems than a boot loader. Community should nip this in the bud and out AMD.
- tifadg1 6y ago
  Did you even read the article? AMD is shipping everything unlocked, it's the OEMs that can choose to active this feature. Certainly it's a debate whether such feature should exist in the first place, but presumably OEMs are the driving force behind this, so they see a need.
  - intricatedetail 6y ago
    AMD has created this "feature" out of greed.
  - tgsovlerkhgsel 6y ago
    This is the work of AMD together with the OEMs. AMD wins because it destroys the secondary market, driving up the prices they can charge for new CPUs. The OEMs win because once you've put your CPUs into Dell servers, you can't just buy different servers and move your CPUs over (e.g. to reuse CPUs from servers that broke in other ways or were decomissioned for other reasons), so you have a higher hurdle when switching to a competitor. Payment from AMD could also be involved, because I think AMD has more to win here. You as a CPU buyer, or a buyer of services that cost more if CPUs cost more (aka everything), lose, as does the environment.
- bserge 6y ago
  How soon can we expect them to just use soldered BGA chips on desktops and servers? Works really well for laptops - motherboard fried? Just throw that CPU, GPU, RAM and VRAM away, and buy a new one! You're not rich enough to pay for its repair, are you? Justified by thinness for consumers and security for corporate. What a terrible practice.
kaspar030 6y ago
I felt a great disturbance in the Force, as if millions of voices suddenly cried out in terror and were suddenly silenced. I fear something terrible has happened.
nottorp 6y ago
I don't understand what this secures, with the exception of Dell's profit. If it locks the CPU to a certain manufacturer, all an attacker has to do is get an identical new system and swap the CPUs. Besides, what matters is the data on the storage. Is it encrypted with keys stored on the CPU? If it's not, how does this help?
- stingraycharles 6y ago
  I may be wrong, but as far as I understand the most likely scenario it protects against is a tampered bootloader. Someone could inject malware in there and then the whole chain of trust of secure computing breaks.
  - nottorp 6y ago
    Ok, that makes sense. What does not make sense is that it's not optional.
tgsovlerkhgsel 6y ago
If this was about actual security, not destroying the secondary market, the obvious solution for this would be providing a way to "factory reset" the CPU using a pin that is normally physically disconnected. An attacker that breaks into your datacenter to physically reset the CPU could also swap it, so once you have physical access, the security argument doesn't hold. OEMs/recyclers could simply plug each CPU into a testing/resetting jig that has this connected, or mainboards could have a jumper for it. Disgusting. Edit: I wonder if this will enable a new category of ransomware. "Pay us (half the current value of your CPUs) to get your firmware signed with the key that we just locked all the CPUs in your fleet to".
ksec 6y ago
If you dont provide this, Enterprise Vendor wont be buying AMD CPU, and AMD lose. ( They desperately need those EPYC Sales ) If they do, lots of people, whether they will buy it or not, will complain and make a big fuss about it. If they are going with Vendor lock they might as well go back to Intel. Looks like AMD just cant Win.
_kbh_ 6y ago
I honestly don't see why the CPUs couldn't from the factory contain a public key from AMD, and from there AMD issues certificates to firmware vendors to sign their firmware with. This would allow the CPU to 'verify' the certificate chain of the firmware that is being used without locking it to a specific vendor. This decreases security a little because the leakage of a single signing certificate means you can malicious firmware on any device but it seems like its much more consumer friendly.
argb 6y ago
These kind of DRM-like 'security' features starting being implemented first with phones and consoles and then has spread throughout the entire industry like a cancer. Many of the features of the AMD PSP could be implemented as hardwired logic, no need for a CPU for that. And thus no chance of malware being able to run undiscovered. It's like Orwellian doublespeak, in fact the Platform Security Processor might well be making the entire system less secure. Because we cannot inspect the content of the eFuse ROM how do we know if a state level adversary has placed code in there to weaken the system security? Note: On the nVidia Tegra platform the eFuse ROM can contain executable code to patch the boot-up process, as Nintendo has done with the Switch console. It's likely that AMD has such similar functionality. So the PSP could be cracked, and then CPUs can be eFused with malware before shipping the server, and nobody would know that there's an easily exploitable vulnerability now present. I guess one of the real purposes of the PSP is to protect AMD's security and prevent the user from unlocking disabled cores, boosting clock frequencies, retrieving HDCP keys, etc. on both CPUs and GPUs. So it's partly to prevent the owner from doing what they want with the hardware.
- argb 6y ago
  AMD should realize they are tarnishing their own brand reputation with the inclusion of the PSP and the recent CPU lockdown. Even though it's a server CPU that's affected by the lockdown, stories like this are definitely not well received by the enthusiast and gamer communities and draw attention to such anti-features like the PSP. Knowing that there's a special processor inside the CPU specifically designed to prevent you from unlocking cores, etc. would NOT be good PR for AMD at all. I am using a Ryzen system right now and I regret buying it, I wish I went with Intel instead. At least the management engine has been cracked, unlike AMD's AFAIK. It's about time we looked into a legal response to this behavior, just as with John Deere farm equipment, it will likely not stop unless fines are imposed or some kind of consumer boycott occurs. Regarding the CPU lockdown, even Intel wouldn't do such a thing. Surely isn't it anti-competitive to lock the CPU to a specific system in this way? What would the EU think about this regarding e-waste and recycling? And I believe in Australia the ACCC would crack down very hard on such shenanigans?
  - 6y ago
dboreham 6y ago
"Vendor-Locks" perhaps?
bubblethink 6y ago
Amidst all the hype for firmware security, one point missing in these discussions is how many points of failure these guys have added. 1) Intel/AMD for ME/PSP 2) Dell for bios signing keys 3) MS for secureboot keys 4) American Megatrends, Phoenix, etc., companies that people don't even know exist, who actually write the bios code. If the threat model is nation state attacks, there is plenty of surface area here in the circus.
the8472 6y ago
Why does this require to blow fuses? Just store a secret into the CPU that can only be unset if the same secret is provided again. It could be totally reversible, as long as you know the secret, that way the lock could be removed when decommissioning the system. With a tiny bit more fancy crypto one could also generate per-system unlock keys so that a vendor doesn't have to reveal his master lock or something like that. Unlocking bootloaders is a solved problem on android. Why introduce a worse solution that creates vendor lock-in?
- teddyh 6y ago
  > Why introduce a worse solution that creates vendor lock-in? Obviously in order to create vendor lock-in.
mleonhard 6y ago
Manufacturers push the term "gray market" to imply that resold goods are somehow bad and people who sell them are participating in something like an illegal black market. Reselling equipment is a normal part of doing business. There's nothing gray about it. There is no separate market for new products that have been bought from manufacturers and resold. It's just one market. We don't need to refer to something that doesn't exist, so we don't need a special term for it. The term "gray market" is linguistic manipulation to benefit manufacturers at the expense of customers, society, and the environment. Let's stop using the term. For products that have been used, we have a "second-hand market".
- speleding 6y ago
  In Europe there is indeed a market for new products that have been bought from manufacturers and resold right away, that's what's called a grey market. This happens because suppliers tend to use different pricing in countries with a different purchasing power, in order to extract more consumer surplus. It's not uncommon that if you buy the cheapest product in a webshop in Northern Europe you will find it has a Polish user manual when it arrives. It's not illegal to do that (although suppliers would probably like it to be). The same happens with servers, just compare USD and EUR prices on the Dell website.
  - hvidgaard 6y ago
    It should not be considered a grey market. But it should be considered illegal to grossly vary prices inside the EU region. It's an extremely anti consumer practice and all it does is, as you say, extract more money from the consumers.
    - speleding 6y ago
      There actually are rules that say you cannot charge different prices depending on the location of the buyer, but suppliers trivially manage to circumvent that by making a tiny change and giving it a different SKU. Although I understand the sentiment, I'm not sure I would like additional legislation to try to prevent that. Even if you do manage to make that water tight the end result will probably mean higher prices for the consumers in countries with low purchasing power.
AstralStorm 6y ago
One time programmable fuses are rather terrible. I'd rather have an old UV resettable fuse that would also clear the key space. Or perhaps a set of contacts to reset the fuse, like a jumper or lands that should be connected with a pencil.
hlandau 6y ago
So this basically seems like the AMD equivalent of Intel Boot Guard, except that the keyfusing seems to be done on the CPU, not the PCH. What I'm hearing here is that Dell, HP, etc. are designing their firmware to keyfuse any unfused CPU it sees to their firmware automatically, silently, and without any prompting whatsoever. And that AMD apparently has no problem with this. In no way, shape or form is this a reasonable design. A boot prompt before basically quasi-destroying (for many purposes) a CPU would be the only reasonable thing to do. "This operation is irreversible and will render the CPU unusable in other machines", etc. I'm wondering if Dell etc. could be sued for this. >Outside of x86, IBM POWER10 is making a push for enhanced security, so the will need to have a silicon root of trust to enable their security feature set. If this were true, this would make POWER10 dead-on-arrival in terms of being something Raptor is willing to ship. Comments made by Raptor don't suggest this and suggest they will be able to ship POWER10 eventually, so it doesn't seem likely. Keyfusing is an excessively brittle technology, can't support key rollover (you're stuck with one key forever, or at best can change it only a couple of times, depending on the size of OTP), and is basically unusable for owner controlled (not vendor controlled) secure boot.
- clinta 6y ago
  Having such a prompt doesn't really alleviate any of the concerns in this article. I still have to worry about that when buying a second hand CPU, except now I'm even less sure, because sure the CPU came out of a Dell, but maybe the owner never fused it.
  - R0b0t1 6y ago
    If the CPU doesn't perform as advertised you can always return it. The only hope here may be putting enough pressure on Dell and whoever else to make their components worthless on the second hand market. I've been involved in more than one purchasing decision where the ability to resell the parts was factored into the sticker price.
    - Godel_unicode 6y ago
      > If the CPU doesn't perform as advertised you can always return it. For second-hand CPUs? Not likely.
devit 6y ago
That seems absurd, why not just clear the secure area (or make it inaccessible until cleared) if the processor detects a different firmware instead of not booting? Looks like they might be doing this intentionally to get some sort of financial gain: perhaps the plan is that this would lead to less used AMD chips being resold and thus more AMD chips bought from AMD itself and more profit for AMD? Even then, why would Dell play along? Is AMD contractually forcing them to create a firmware that locks the chips? What about the massive liability of customers demanding refunds or suing them because the Dell firmware irreparably damaged their CPUs?
oneplane 6y ago
This is just waiting to be abused. No software or firmware (or even silicon!) is 100% secure; if at any point someone figures out a way to flip a fuse (maybe something like creating a short by overloading two adjacent fuses or abusing reads via power supply gliching) and then make the CPU unusable for everyone... Hell, next step might be ransomware that fuses your CPU and unless you pay them they will reboot them so you can't use them any more until you buy their signing key.
parliament32 6y ago
I'm looking forward to the malware/ransomware that permanently locks CPUs to an attacker-signed BIOS.
virgulino 6y ago
The article was updated with new info from HPE: "HPE does not use the same security technique that Dell is using for a BIOS hardware root of trust. HPE does not burn, fuse, or permanently store our public key into AMD processors which ship with our products. HPE uses a unique approach to authenticate our BIOS and BMC firmware: HPE fuses our hardware – or silicon – root of trust into our own BMC silicon to ensure only authenticated firmware is executed. Thus, while we implement a hardware root of trust for our BIOS and BMC firmware, the processors that ship with our servers are not locked to our platforms. (Source: HPE)"

342 points by virgulino 6y ago

virgulino 6y ago

TL;DR: Put an Epyc cpu in a Dell once, and it will never work again in any other vendor's motherboard? Is that right?

threentaway 6y ago
Yep.
deleted 6y ago
[deleted]
0zymandiass 6y ago
It's not necessarily just Dell, they're just the first to use the feature. It also won't necessarily work in other Dell motherboards, just ones using the same key as the first. It's strange Dell would blow the fuses by default, though.
- felixfurtak 6y ago
  Could even enable some sort of region lock too? Selling CPUs at different prices to different markets for example?
  - soneil 6y ago
    Theoretically. If the OEM shipped region-specific firmware with a region-specific signing key, the CPUs would be region-specific as a side effect.
  - kllrnohj 6y ago
    Not really. AMD is only selling unlocked CPUs, and the "locking" is done the first time it boots in a given motherboard. So crossing regions wouldn't be any more of an issue in the future than it is now, you "just" need to ensure your motherboard and CPU come bundled together. Or you need to ensure you get an "unlocked" CPU, which is what retailers provide via AMD. This will greatly complicate the future second-hand market, though. Buying used Epyc CPUs off of ebay in 5 years will become very sketchy for example.
    - toast0 6y ago
      You could have some crude region locking if SGI US signs with a different key than SGI EU, and US servers will only run on 60hz power supplies and EU servers only run on 50hz (some pinball machines use this to reduce transatlantic resale) it's not hard to measure, but it would need an extra power supply pin and a zero crossing circuit. DC systems would have a different signing key. Japanese systems wouldn't be able to move across their 50/60Hz divide, etc. Used SGI to not pick a real vendor.
      - kllrnohj 6y ago
        That only region locks the motherboard. The CPU would only be locked after it has been used in the motherboard, not before, which necessarily means you already have the CPU in question. So there wouldn't be any barrier to CPU movement across regions. As in for your example there isn't anything stopping you from buying a CPU from anyone, including US retailers, and using it in an SGI EU motherboard. The CPU itself isn't locked when new, this signing key locking isn't baked into the CPU at the factory. It happens when you plop it into the socket & fire it up for the first time.
        toast0 6y ago
        > As in for your example there isn't anything stopping you from buying a CPU from anyone. I can't buy a used cpu from an SGI US customer and put it in an SGI EU motherboard. I can buy a new CPU from anyone though, but then I can only sell it in-region.
        kllrnohj 6y ago
        > I can't buy a used cpu from an SGI US customer and put it in an SGI EU motherboard. Correct, but that's less a region thing and more this just poisons all used CPUs. As in you don't even know if an SGI US CPU will work in a different SGI US motherboard. There's no particular reason to assume all SGI US motherboard models will have the same signing key. Within the same model that'd almost certainly be the case, but if it's a different model, especially different chipset, I don't know why they would necessarily strive to keep the key the same across different firmware branches. > I can buy a new CPU from anyone though, but then I can only sell it in-region. Er, why? Nothing about this stops you from re-selling CPUs however you want. Or are you still talking about the used market here?
- Patrick-STH 6y ago
  HPE and some other vendors do this, not just Dell.

jlawer 6y ago

Its not really vendor locking by design. It locks to a signing key. That key COULD be shared between vendors or even a single vendor could have multiple incompatible keys. It provides a mechanism to prove the entire boot process hasn't been tampered with, but I wish AMD provided a way to run these fused processors in a generic way without the security chain, with it just reporting that there isn't a secure root of trust. However I assume they are afraid of that allowing malicious code to fool deeper parts of the system without the system administrator knowing. So good for security, but bad for e-waste and second hand sales.

3np 6y ago
Wouldn’t it make more sense to blow the motherboard rather than the CPU? A compromised CPU without anything connected is pretty useless at boot. The motherboard is what’s connected to all the good stuff.
- 0zymandiass 6y ago
  The CPU isn't what's compromised - this is protecting against a compromised motherboard
- soneil 6y ago
  I think that’s the chicken & egg. If the motherboard was responsible for this, you’re trusting the firmware to validate itself. So this moves the validation a level lower. It’s an interesting problem. The solution is valid, but it’s unfortunately permanent.
  - im3w1l 6y ago
    You could have a small rom firmware validating a larger ugradable firmware.
- bayindirh 6y ago
  However, the root of trust is embedded to the CPU. So, you can't hammer the CPU on another board for keys. Also, we sometimes lose the CPU rather than the board. As the CPUs become more complex, their probability to fail has risen.

Covzire 6y ago

What problem is this trying to solve? Is there that much of a black market for data center CPUs?

0zymandiass 6y ago
BIOS (UEFI) level rootkits
- im3w1l 6y ago
  I managed to get that much from the article but I still feel I'm missing a few pieces here. Are UEFI rootkits an actual concern, like are they common in the wild? Why should the responsibility of detecting them rest with the processor? How is this related to the Secure Encrypted Virtualization?
  - 0zymandiass 6y ago
    There have been a couple in the wild, but they aren't super common. They've become a bigger concern with UEFI since it has a massive attack surface compared to legacy BIOS. For a processor sitting in AWS / Azure, they want guarantees, and they're the ones EPYCs are designed for. The responsibility has to rest with the processor, since it's the only thing executing code prior to UEFI. What it's doing is validating that UEFI was cryptographically signed with the correct key prior to running any UEFI code. When it's first used, it is saving the key for the vendors UEFI implementation and won't allow it to proceed if the root signature ever changes (think something similar to root certs for HTTPS). It's only relevant to Secure Encrypted Virtualization insofar as they are both implemented inside the PSP which is a separate ARM core that runs at a higher privilege level than the x86 cores (and is the core that actually initializes the x86 cores). This is how all phones have worked for many years, but apparently it's now becoming a thing in servers too.
    - im3w1l 6y ago
      Oh the UEFI code is run by the main processor.. somehow I had always assumed it was running on some micro-processor on the mobo.

userbinator 6y ago

I am beyond sick of this "security" justification being used for everything. At the end of the day, the only thing really being secured are the greedy vendor's profits.

intc 6y ago
And this doesn't solve the issue with PSP either. So not much actual progress with security. We need CPUs which do not contain black boxes and allow us to use open source (auditable) firmware (UEFI BIOS).
canofbars 6y ago
There are some realistic benefits. If my phone gets stolen, there is no way for it to be wiped and reused without my input. And if it makes it back to me, it is extremely unlikely that it has been loaded with malware which will send off my data when I log in again. But yes, its really shitty how the downsides end up with the loss of user control and ewaste. Especially when it is possible to design something that is secure and that the user controls.
- swiley 6y ago
  Really? What phone do you have? A decent number of the recent iPhones have a bootloader exploit now. So there’s no security, just a lot of bitchy software.
  - canofbars 6y ago
    Mine is newer than that exploit so no. But also a flaw in the implementation doesn't invalidate the reason for implementing it in the first place. Anti theft features on android and ios have likely saved hundreds of thousands of phones from being stolen, if not millions.
    - MegaThorx 6y ago
      But how often does a server gets stolen from a data center? It surely makes sense for phones as it makes less profitable to steal them (as you could only sell parts of the phone and even that can be blocked). Maybe even for laptops but not for desktops and servers.

tyingq 6y ago

This will be an interesting mess on eBay.

the_pwner224 6y ago

The title as submitted to HN is super clickbaity. Overall this doesn't seem 'bad', aside from some questionable defaults that other commenters said about it being enabled by default.

judge2020 6y ago
It really should copy the article: > AMD PSB Vendor Locks EPYC CPUs for Enhanced Security at a Cost
- fiberoptick 6y ago
  Should be corrected to "Vendor-Locks", as well.

Zenst 6y ago

This may well be a case of the vendor does this, they get a better price as removes all aspects of reselling the CPU's on and the whole grey market risk - https://en.wikipedia.org/wiki/Grey_market https://en.wikipedia.org/wiki/Grey_market Large vendor, such details may mean a few dollars saving on the CPU's and that will add up. For many it won't be an issue, more a gotcha for the second hand market upon those thinking they can buy and part it out. So down the line, this is going to make some second hand CPU's a real gotcha unless these chips have identifiable visible marking.

brokencode 6y ago

Is there any way to “fix” the processor afterwards? Maybe send it to AMD to be reset? If I’m buying a multi thousand dollar processor, I’d feel better if I could reuse it in other systems if needed.

soneil 6y ago
If they’re setting OTP on the die, all AMD could offer would be a warranty replacement at best. There’s no etching new fuses into a packaged die.
- p1mrx 6y ago
  They could blow the key to an "insecure" state, and then have a jumper on the motherboard to allow insecure booting.
  - soneil 6y ago
    That’s about the only way I see out of this, yeah. No fuses blown is obviously a specific state (works as expected everywhere). All-fuses blown needs to be a specific state too (say the trustroot is dead and it’s now “just a cpu”). You couldn’t just fail to that state (it’d be inappropriate for its primary use-case), as long as there’s some way to get there.
- argb 6y ago
  It could be done with some kind of JTAG mod-chip, but this depends on what kind of JTAG security they've implemented. If you want to know where to start, search GitHub for 'KaveriPI', if you unpack AMD BIOSDBG.EXE you can find a complete list of processor registers. This is all from 2015 but the PSP is documented in there. There's also a Microsoft Access database which has all the JTAG registers, but I don't have the time to decode the meaning of the fields... It is likely that things have changed since then but it still might be enough for a start. Should the JTAG interface be protected then some kind of laser(?) fault injection might be required to open it up. I guest some of the eFuse bits can be overwritten, maybe there's a combination which can remove the lock. An innovative recycling company could work on making a jig to automate this somehow... Some PSP JTAG stuff here (publicly available material from GitHub in 2015, fair use applies): 41469,3529,164000,164999,"SMU_PSP_efuse_ovr_tried",,1,0,0,0,50,"0000",0, 41470,3529,164000,164999,"SMU_PSP_FRA_pass_ld_err",,1,1,1,0,50,"0001",0, 41471,3529,164000,164999,"SMU_PSP_FRA_pass_ld_cor",,1,2,2,0,50,"0002",0, 41472,3529,164000,164999,"SMU_PSP_efuse_pdmb_aes_dis",,1,3,3,0,50,"0003",0, 41473,3529,164000,164999,"SMU_PSP_efuse_pcpu_dis",,1,4,4,0,50,"0004",0, 41474,3529,164000,164999,"SMU_PSP_efuse_ccp_cyph_dis",,1,5,5,0,50,"0005",0, 41475,3529,164000,164999,"SMU_PSP_efuse_FRA_en",,1,6,6,0,50,"0006",0, 41477,3529,164000,164999,"SMU_PSP_efuse_proto",,1,7,7,0,50,"0007",0, 41478,3529,164000,164999,"SMU_PSP_efuse_secure",,1,8,8,0,50,"0008",0, 41552,2352,164000,164999,"SMU_PSP_hard_resetb",,1,31,31,0,50,"101F",0, 41553,2352,164000,164999,"SMU_PSP_early_resetb",,1,30,30,0,50,"101E",0, 41554,2352,164000,164999,"SMU_PSP_slv_mbus2_reset",,1,29,29,0,50,"101D",0, 41555,2352,164000,164999,"PSP_SCAN_MODE_STICKY",,1,28,28,0,50,"101C",0, 41568,2352,164000,164999,"PSP_AEB_307_PCPU_RST_DLY_TDR_en_pclk",,1,15,15,0,50,"100F",0, 41569,2352,164000,164999,"PSP_AEB_304_PCPU_FORCE_rst_en_pclk",,1,14,14,0,50,"100E",0, 41579,2352,164000,164999,"PSP_Resetn",,1,8,8,0,50,"1008",0, 43605,555,164000,164999,"PSP_ENABLE_SPARE",,0,1,1,0,50,"0001",0, 43642,555,164000,164999,"PSP_SPARE",,0,7,14,0,50,"0007",0,

non-entity 6y ago

I get why its done, but all this locking down of modern systems is making me rapidly lose interest in computing.

wu_187 6y ago

Honestly I see this as a net positive. It increases the security of the server, which is good for everyone. The secondary market will adjust accordingly, probably by selling the processor/motherboard/barebones server together. The only issue I can see is that there is no way to distinguish a locked processor from an unlocked one.

saagarjha 6y ago
> The secondary market will adjust accordingly, probably by selling the processor/motherboard/barebones server together. You do understand that this can be fairly annoying, yes?
probably_wrong 6y ago
> It increases the security of the server, which is good for everyone That is exactly the point: it isn't good for everyone. In particular, it is suspicious that a move in the name of security just so happens to negatively affect the secondary market. A market that by definition doesn't net AMD any money. If AMD had released this exact same feature and said "we are doing this because the second-hand market is bad for our sales", regulators would immediately jump at them for anti-competitive behavior. And the fact that there is no option to disable this check at all makes it even more suspicious. It is possible that the benefits outweigh the downsides. But I wouldn't give them a pass that easily.

gigatexal 6y ago

Some enterprising enthusiasts will find a way around this i hope

userbinator 6y ago
Hopefully the keys get leaked someday, as often eventually happens with such DRM-ish schemes.

fiberoptick 6y ago

Does this defend against any additional attack surface that wasn't already defended by the UEFI Secure Boot standard?

wmf 6y ago
Yes, UEFI Secure Boot defends against OS/bootloader malware while this defends against flashing malware into the UEFI firmware itself.
- arpa 6y ago
  Wait so if i flash malware into the firmware, i should also have a spare fresh EPYC CPU i could install?
  - SaltySolomon 6y ago
    The keys for trusted compute, memory encryption and such are saved inside the CPU, so if you change the CPU you also loose all those keys.
  - jacoblambda 6y ago
    Yes, I think that would be a valid way to bypass the protection. With physical access you can bypass just about any protection given enough money and time. In a data centre context, the damage you can do is rapidly minimised by rapidly increasing the amount of capital and time required to access more of the DC. The more important change is that without this feature, malware could theoretically install itself into the firmware without requiring physical access. Now it should be just about impossible to break the chain of trust without a person physically tampering with the machine. Note: I should mention that I think this is such a massive double edged sword (maybe double edged shield is a better term). This lets you build a threat model that accounts for everything up to physical access. This however also has such a massive opportunity to be an incredibly anti-consumer feature that I fear to see how it will be used. I wish they would have required a physical switch to enable/disable the feature. I do however understand how adding such a feature could complicate its implementation quite a bit.

walrus01 6y ago

I'm not as sketched out about this as if it were single socket workstation ryzen/threadripper CPUs. In the market from $1000 to $6000 workstation desktops where enthusiasts and people with specific requirements (or just 10, 15, 20 years of experience building x86-64 PCs themselves) would want to build their own desktop from individual components ordered off Newegg. I doubt more than a single digit percentage of 'serious' dual socket (64-128+ core) rackmount server customers are going to be buying their own barebones motherboards and CPUs and assembling it themselves. They're going to buy it from a Dell, HP or a Supermicro integrator or similar. If you're buying a $12,000+ server with 128 cores and 512GB to 4TB+ of RAM and some fast NVME storage it's highly unlikely you're putting it together yourself. Any massive hosting/cloud scale operations that want to DIY their own EPYC systems from pieces will be doing it through a Taiwanese integrator, such as those that supply the ecosystem components for open compute platform server motherboards. And as such they'll also not encounter any technical issues or procurement issues with this. At the point where you have two $3000 CPUs on a motherboard that costs $1200, the full firmware/motherboard/CPU integration and qualification process is very different than putting a $399 ryzen into a $300 board.

soneil 6y ago
Not yet. We will in 5 years time when their resale value meets our budgets. I work in a rather budget-constrained lab environment. “Beg, borrow, steal” is the order of the day. Just today I was pricing out pre-loved Gen8 HPs. In 5 years time I could be exactly the hypothetical the article outlines. This isn’t today’s problem - it’s a problem we’re creating today. We’ll hit it when your examples start retiring them and my example are eager to recycle them.
- walrus01 6y ago
  Yes - and no, I know lots of people including myself who have things like older dual socket Dell R710 as home test hypervisor servers. Also a very tiny percentage of people will bother to ever upgrade the CPUs on them. For home lab stuff... When people buy a $200 used Dell R610 off ebay with two 8-core CPUs they most likely expect to use it in the exact same CPU configuration. Maybe add RAM. And probably use their own choice of SATA 6Gbps SSD in the drive trays instead of whatever old, possibly unreliable used spinning drives might come with it. I have a 4U, quad socket Dell R910 with 32 total cores and 256GB of RAM that I got for $350. I'm absolutely not going to go messing around with replacing the CPUs on it with something I've purchased from ebay. When it's too old or slow, or I'm tired of having a 500W electrical load in my garage, I'll replace it with another thing that's come off a 3-4 year lease cycle.

ohazi 6y ago

The "this is for security" argument would make sense if they only locked CPUs that were sold by the vendor together with the motherboard, or if they had an action that an administrator could affirmatively take to lock the CPU. But automatically, permanently "poisoning" any CPU that's inserted into the socket after a single boot? That sounds like it's being done for economic reasons. They want to turn the used CPU market into a sketchball market for lemons so that everyone is so scared that they only buy board+CPU combos directly from the vendor rather than trying to save a few pennies here and there.

caf 6y ago
I don't know, when you think about what makes easier (cheaper) for the vendor, this way they just have to assemble the CPUs into the motherboards and ship the systems like they always have. I can't see that the market for enterprise system is heavily affected by grey market CPUs. Their customers are by and large buying these systems built & configured, and racking them up as they come. It'd be nice if there was a jumper you could set on the motherboard to stop it claiming a CPU though (maybe there even is?).
dastx 6y ago
My understanding was that you can put this in any other motherboard with the same signing key. Presuming the intent her is that every single machine would have to have a different signing key. If this was the case, then yes, security seems to be the reason. However, and I may have misunderstood this so please do correct me if I have, based on the article, it seems for certain vendors, they share the same signing key with multiple machines (presuming whole lines), in which case this certainly seems to be about vendor lock-in from the vendor side.

justinclift 6y ago

If I put a cpu in a server (Dell, HP, whatever), and that CPU then doesn't function in other equipment, than that cpu is broken. That's not an exaggeration in any way. So, the server maker then owes me a new cpu (of the same model obviously) that does work. It'll be interesting to see the legal fallout from this, as purposely breaking customer owned gear is not going to end well.

snuxoll 6y ago
While shitty, if this required pre-programmed OEM CPU’s it would be one thing - but knowing I could put a several thousand dollar boxed CPU into a branded motherboard and have it perpetually locked to that OEM is horrible. Quite frankly this should be an optional security feature I can flip off with a physical switch on the board - go show an alert on the BMC for all I care, but as is this is total bullshit.
TwoBit 6y ago
AMD created this feature, so why not complain to them?
- jacoblambda 6y ago
  While reaching out directly to the company is definitely a strong way to express disagreement, I almost guarantee that someone from AMD PR will be reading through comments on tech community posts like these. Expressing discontent in an open forum can catalyse a much larger reaction that PR depts will pay much more attention to compared to a few angry emails or twitter DMs.
alisonkisk 6y ago
No one owes you anything if the CPU functions exactly as advertised. If you don't want a platform-secured CPU, don't buy one.
- erik_seaberg 6y ago
  Nobody advertises irreparable damage. This testing lab found out the hard way and then had to follow up with the vendors to get an explanation.

jhallenworld 6y ago

I thought this type of system would provide a way to revert to factory defaults with a side effect of erasing all keys. So the processor would no longer be secure, but would at least still boot. Maybe this clearing can be done through the BIOS/UEFI on the original Dell system.

bubblethink 6y ago

How many exploits/breaches in the wild due to open s3 bucket, default admin passwd to database, poorly written webshit code, plaintext password, etc. ? And how many prevented by secure boot, boot guard, memory encryption, ME, PSP etc. ? Other than obvious money reasons for Dell, people seem to be vastly overestimating their threat models. And even for the secure chain of trust, there are ways to do so where the owner has the key, not the vendor. See heads for example.

sedatk 6y ago
Or, those scenarios just don't make the news as frequent as script kiddie stuff. We only learned about what NSA has been up to because Snowden happened.
- bubblethink 6y ago
  This is the opposite lesson to take away from Snowden's revelations. You want more user control, not less.
  - sedatk 6y ago
    I agree. I’m just saying that news may not be the best indicator of how common an attack vector is.
- young_unixer 6y ago
  If I want to protect against the NSA I'm worried about them using Intel ME, AMD PSP and other black boxes to hack me. I don't worry that much about them sneaking into my data center or house and physically changing my hardware. The security you lose from having a black box in your CPU is much greater than the security you win by virtue of being (theoretically) protected against unsigned bootloaders and rogue hardware.
  - sedatk 6y ago
    I merely provided NSA as an example of how advanced attack vectors might go unnoticed for decades.

dayjobpork 6y ago

This is bullshit. Unless it clearly says at boot 'continuing will permanently prevent your CPU from being used in a non Dell computer y/n?' they are asking for a lawsuit for damaging hardware

dayjobpork 6y ago
In fact Australian Consumer Law flat out holds them liable for costs due to problems a seller could have reasonably foreseen
- elmo2you 6y ago
  Do consumer laws apply to businesses in Australia? Because afaik, in the EU regretfully a lot of laws that protect consumers against abuse from vendors, do not apply to B2B/enterprise transactions. On the other hand, there have been people who have warned about the dangers of CPU vendors putting Management Engines in their products, which are outside of the control of end users (by design). One of those concerns was the ability to rig sales or even kill off second hand markets markets all together. Apparently, this have already become a reality now. I'm not surprised it's sold as security feature, just as terrorism and child pornography have been magic words in other fields. But at the end of the day, vendors stand to substantially increase their control on sales and with it their profits, with features that may only be significant in edge cases. That smells a lot like an antitrust issue to me. That all vendors are likely try to move in this same direction, as an opportunity to make more profit, doesn't make it any less devious. All the more reason for antitrust investigators to start looking into this.
  - shakna 6y ago
    > Do consumer laws apply to businesses in Australia? Because afaik, in the EU regretfully a lot of laws that protect consumers against abuse from vendors, do not apply to B2B/enterprise transactions. Yes. Consumer protections apply to everyone. Within Australia, those protections are considered the "bare minimum" that must be implemented by every business, across the board. Certain industries have other protections they must implement atop of those.

pjmlp 6y ago

So where are all the AMD fans "will never buy either Intel nor NVidia" now?

userbinator 6y ago
Intel has ME, AMD has PSP. Intel has Boot Guard, AMD has this. Either one may have seemed the better choice at one point in time, but it's clear they're really going down the same path.

yk 6y ago

I can think of two scenarios where this security feature is helpful. First, somebody breaks into a server room, replaces the motherboard with a compromised one, and notices mid replacement that they forgot a processor. (Since the processor locks during first boot, it is of no use if the supply chain is compromised before the first boot. On the other hand, I would imagine somebody willing to break into a data center to replace a motherboard would also be willing to do all kinds of other shenanigans, like bringing another processor.) The second scenario is, somebody thinks about buying a used instead of an new processor.

skinner927 6y ago
Bingo. It’s a money grab. It’s actually easier to swap a mobo with a cpu and heatsink that’s already seated.
mmis1000 6y ago
Well, the security key of VM is stored in the CPU, so you can't replace CPU unless you can enter the console, copy the data out and re-encrypt it with key from another CPU. While if you can do this, you don't need to replace mother board/CPU anyway because you already pwned them and copy/modify the data whatever you want.
- Dylan16807 6y ago
  > Well, the security key of VM is stored in the CPU What security key? Do you mean the memory encryption key? We're talking about a powered off machine, so that's irrelevant.
  - SaltySolomon 6y ago
    Memory and Virtual Machines
    - Dylan16807 6y ago
      Please explain better. The article talks about virtual machines as a subset of memory encryption. It also specifically says "ephemeral keys". Not ones that would be preserved across a shutdown. What is encrypted on a powered-off server that the CPU knows the key to?

rasz 6y ago

This sounds reasonable. I mean to bypass this lock our criminal would have to ... replace the CPU and continue attack like nothing happened. Totally infeasible, inconceivable even! proving this was introduced for safety and not Vendor_lock-in!!!1

deleted 6y ago
[deleted]

mikedilger 6y ago

This would be better if there were a physical-only method to factory reset the CPU, instead of blowing fuses.

jmnicolas 6y ago

I didn't read the article. I felt like the author had an assignment to make it a certain length and is filling it with useless sentences.

zwaps 6y ago

Sorry to be blunt, but am I correct that this is a measure against tampering with servers by Chinese intelligence during the customs process? In that case, are the CPUs themselves signed or could they be replaced after modifying the motherboard? Because otherwise it's really hard why the website would claim that every end user would be enthused about these lock-ins. Sort of weird statement.

caf 6y ago
No, it's about stopping BIOS-level rootkits from being installed when someone remotely compromises the machine.
- rasz 6y ago
  No, its about shutting down secondary server hardware market.

intricatedetail 6y ago

It should be illegal to lock devices like that. Pure corporate greed. It is sad that as soon as AMD restored its glory they gone for a cheap cash grab. It should be easy to tell that device is running unsigned boot loader without blocking it (e.g. a jumper on the motherboard). If attacker is able to switch a jumper, then you have bigger problems than a boot loader. Community should nip this in the bud and out AMD.

tifadg1 6y ago
Did you even read the article? AMD is shipping everything unlocked, it's the OEMs that can choose to active this feature. Certainly it's a debate whether such feature should exist in the first place, but presumably OEMs are the driving force behind this, so they see a need.
- intricatedetail 6y ago
  AMD has created this "feature" out of greed.
- tgsovlerkhgsel 6y ago
  This is the work of AMD together with the OEMs. AMD wins because it destroys the secondary market, driving up the prices they can charge for new CPUs. The OEMs win because once you've put your CPUs into Dell servers, you can't just buy different servers and move your CPUs over (e.g. to reuse CPUs from servers that broke in other ways or were decomissioned for other reasons), so you have a higher hurdle when switching to a competitor. Payment from AMD could also be involved, because I think AMD has more to win here. You as a CPU buyer, or a buyer of services that cost more if CPUs cost more (aka everything), lose, as does the environment.
bserge 6y ago
How soon can we expect them to just use soldered BGA chips on desktops and servers? Works really well for laptops - motherboard fried? Just throw that CPU, GPU, RAM and VRAM away, and buy a new one! You're not rich enough to pay for its repair, are you? Justified by thinness for consumers and security for corporate. What a terrible practice.

kaspar030 6y ago

I felt a great disturbance in the Force, as if millions of voices suddenly cried out in terror and were suddenly silenced. I fear something terrible has happened.

nottorp 6y ago

I don't understand what this secures, with the exception of Dell's profit. If it locks the CPU to a certain manufacturer, all an attacker has to do is get an identical new system and swap the CPUs. Besides, what matters is the data on the storage. Is it encrypted with keys stored on the CPU? If it's not, how does this help?

stingraycharles 6y ago
I may be wrong, but as far as I understand the most likely scenario it protects against is a tampered bootloader. Someone could inject malware in there and then the whole chain of trust of secure computing breaks.
- nottorp 6y ago
  Ok, that makes sense. What does not make sense is that it's not optional.

tgsovlerkhgsel 6y ago

If this was about actual security, not destroying the secondary market, the obvious solution for this would be providing a way to "factory reset" the CPU using a pin that is normally physically disconnected. An attacker that breaks into your datacenter to physically reset the CPU could also swap it, so once you have physical access, the security argument doesn't hold. OEMs/recyclers could simply plug each CPU into a testing/resetting jig that has this connected, or mainboards could have a jumper for it. Disgusting. Edit: I wonder if this will enable a new category of ransomware. "Pay us (half the current value of your CPUs) to get your firmware signed with the key that we just locked all the CPUs in your fleet to".

ksec 6y ago

If you dont provide this, Enterprise Vendor wont be buying AMD CPU, and AMD lose. ( They desperately need those EPYC Sales ) If they do, lots of people, whether they will buy it or not, will complain and make a big fuss about it. If they are going with Vendor lock they might as well go back to Intel. Looks like AMD just cant Win.

_kbh_ 6y ago

I honestly don't see why the CPUs couldn't from the factory contain a public key from AMD, and from there AMD issues certificates to firmware vendors to sign their firmware with. This would allow the CPU to 'verify' the certificate chain of the firmware that is being used without locking it to a specific vendor. This decreases security a little because the leakage of a single signing certificate means you can malicious firmware on any device but it seems like its much more consumer friendly.

argb 6y ago

These kind of DRM-like 'security' features starting being implemented first with phones and consoles and then has spread throughout the entire industry like a cancer. Many of the features of the AMD PSP could be implemented as hardwired logic, no need for a CPU for that. And thus no chance of malware being able to run undiscovered. It's like Orwellian doublespeak, in fact the Platform Security Processor might well be making the entire system less secure. Because we cannot inspect the content of the eFuse ROM how do we know if a state level adversary has placed code in there to weaken the system security? Note: On the nVidia Tegra platform the eFuse ROM can contain executable code to patch the boot-up process, as Nintendo has done with the Switch console. It's likely that AMD has such similar functionality. So the PSP could be cracked, and then CPUs can be eFused with malware before shipping the server, and nobody would know that there's an easily exploitable vulnerability now present. I guess one of the real purposes of the PSP is to protect AMD's security and prevent the user from unlocking disabled cores, boosting clock frequencies, retrieving HDCP keys, etc. on both CPUs and GPUs. So it's partly to prevent the owner from doing what they want with the hardware.

argb 6y ago
AMD should realize they are tarnishing their own brand reputation with the inclusion of the PSP and the recent CPU lockdown. Even though it's a server CPU that's affected by the lockdown, stories like this are definitely not well received by the enthusiast and gamer communities and draw attention to such anti-features like the PSP. Knowing that there's a special processor inside the CPU specifically designed to prevent you from unlocking cores, etc. would NOT be good PR for AMD at all. I am using a Ryzen system right now and I regret buying it, I wish I went with Intel instead. At least the management engine has been cracked, unlike AMD's AFAIK. It's about time we looked into a legal response to this behavior, just as with John Deere farm equipment, it will likely not stop unless fines are imposed or some kind of consumer boycott occurs. Regarding the CPU lockdown, even Intel wouldn't do such a thing. Surely isn't it anti-competitive to lock the CPU to a specific system in this way? What would the EU think about this regarding e-waste and recycling? And I believe in Australia the ACCC would crack down very hard on such shenanigans?
- 6y ago

dboreham 6y ago

"Vendor-Locks" perhaps?

bubblethink 6y ago

Amidst all the hype for firmware security, one point missing in these discussions is how many points of failure these guys have added. 1) Intel/AMD for ME/PSP 2) Dell for bios signing keys 3) MS for secureboot keys 4) American Megatrends, Phoenix, etc., companies that people don't even know exist, who actually write the bios code. If the threat model is nation state attacks, there is plenty of surface area here in the circus.

the8472 6y ago

Why does this require to blow fuses? Just store a secret into the CPU that can only be unset if the same secret is provided again. It could be totally reversible, as long as you know the secret, that way the lock could be removed when decommissioning the system. With a tiny bit more fancy crypto one could also generate per-system unlock keys so that a vendor doesn't have to reveal his master lock or something like that. Unlocking bootloaders is a solved problem on android. Why introduce a worse solution that creates vendor lock-in?

teddyh 6y ago
> Why introduce a worse solution that creates vendor lock-in? Obviously in order to create vendor lock-in.

mleonhard 6y ago

Manufacturers push the term "gray market" to imply that resold goods are somehow bad and people who sell them are participating in something like an illegal black market. Reselling equipment is a normal part of doing business. There's nothing gray about it. There is no separate market for new products that have been bought from manufacturers and resold. It's just one market. We don't need to refer to something that doesn't exist, so we don't need a special term for it. The term "gray market" is linguistic manipulation to benefit manufacturers at the expense of customers, society, and the environment. Let's stop using the term. For products that have been used, we have a "second-hand market".

speleding 6y ago
In Europe there is indeed a market for new products that have been bought from manufacturers and resold right away, that's what's called a grey market. This happens because suppliers tend to use different pricing in countries with a different purchasing power, in order to extract more consumer surplus. It's not uncommon that if you buy the cheapest product in a webshop in Northern Europe you will find it has a Polish user manual when it arrives. It's not illegal to do that (although suppliers would probably like it to be). The same happens with servers, just compare USD and EUR prices on the Dell website.
- hvidgaard 6y ago
  It should not be considered a grey market. But it should be considered illegal to grossly vary prices inside the EU region. It's an extremely anti consumer practice and all it does is, as you say, extract more money from the consumers.
  - speleding 6y ago
    There actually are rules that say you cannot charge different prices depending on the location of the buyer, but suppliers trivially manage to circumvent that by making a tiny change and giving it a different SKU. Although I understand the sentiment, I'm not sure I would like additional legislation to try to prevent that. Even if you do manage to make that water tight the end result will probably mean higher prices for the consumers in countries with low purchasing power.

AstralStorm 6y ago

One time programmable fuses are rather terrible. I'd rather have an old UV resettable fuse that would also clear the key space. Or perhaps a set of contacts to reset the fuse, like a jumper or lands that should be connected with a pencil.

hlandau 6y ago

So this basically seems like the AMD equivalent of Intel Boot Guard, except that the keyfusing seems to be done on the CPU, not the PCH. What I'm hearing here is that Dell, HP, etc. are designing their firmware to keyfuse any unfused CPU it sees to their firmware automatically, silently, and without any prompting whatsoever. And that AMD apparently has no problem with this. In no way, shape or form is this a reasonable design. A boot prompt before basically quasi-destroying (for many purposes) a CPU would be the only reasonable thing to do. "This operation is irreversible and will render the CPU unusable in other machines", etc. I'm wondering if Dell etc. could be sued for this. >Outside of x86, IBM POWER10 is making a push for enhanced security, so the will need to have a silicon root of trust to enable their security feature set. If this were true, this would make POWER10 dead-on-arrival in terms of being something Raptor is willing to ship. Comments made by Raptor don't suggest this and suggest they will be able to ship POWER10 eventually, so it doesn't seem likely. Keyfusing is an excessively brittle technology, can't support key rollover (you're stuck with one key forever, or at best can change it only a couple of times, depending on the size of OTP), and is basically unusable for owner controlled (not vendor controlled) secure boot.

clinta 6y ago
Having such a prompt doesn't really alleviate any of the concerns in this article. I still have to worry about that when buying a second hand CPU, except now I'm even less sure, because sure the CPU came out of a Dell, but maybe the owner never fused it.
- R0b0t1 6y ago
  If the CPU doesn't perform as advertised you can always return it. The only hope here may be putting enough pressure on Dell and whoever else to make their components worthless on the second hand market. I've been involved in more than one purchasing decision where the ability to resell the parts was factored into the sticker price.
  - Godel_unicode 6y ago
    > If the CPU doesn't perform as advertised you can always return it. For second-hand CPUs? Not likely.

devit 6y ago

That seems absurd, why not just clear the secure area (or make it inaccessible until cleared) if the processor detects a different firmware instead of not booting? Looks like they might be doing this intentionally to get some sort of financial gain: perhaps the plan is that this would lead to less used AMD chips being resold and thus more AMD chips bought from AMD itself and more profit for AMD? Even then, why would Dell play along? Is AMD contractually forcing them to create a firmware that locks the chips? What about the massive liability of customers demanding refunds or suing them because the Dell firmware irreparably damaged their CPUs?

oneplane 6y ago

This is just waiting to be abused. No software or firmware (or even silicon!) is 100% secure; if at any point someone figures out a way to flip a fuse (maybe something like creating a short by overloading two adjacent fuses or abusing reads via power supply gliching) and then make the CPU unusable for everyone... Hell, next step might be ransomware that fuses your CPU and unless you pay them they will reboot them so you can't use them any more until you buy their signing key.

parliament32 6y ago

I'm looking forward to the malware/ransomware that permanently locks CPUs to an attacker-signed BIOS.

virgulino 6y ago

The article was updated with new info from HPE: "HPE does not use the same security technique that Dell is using for a BIOS hardware root of trust. HPE does not burn, fuse, or permanently store our public key into AMD processors which ship with our products. HPE uses a unique approach to authenticate our BIOS and BMC firmware: HPE fuses our hardware – or silicon – root of trust into our own BMC silicon to ensure only authenticated firmware is executed. Thus, while we implement a hardware root of trust for our BIOS and BMC firmware, the processors that ship with our servers are not locked to our platforms. (Source: HPE)"