4 ms·
I can think of two scenarios where this security feature is helpful. First, somebody breaks into a server room, replaces the motherboard with a compromised one
by yk 6y ago
I can think of two scenarios where this security feature is helpful.
First, somebody breaks into a server room, replaces the motherboard with a compromised one, and notices mid replacement that they forgot a processor. (Since the processor locks during first boot, it is of no use if the supply chain is compromised before the first boot. On the other hand, I would imagine somebody willing to break into a data center to replace a motherboard would also be willing to do all kinds of other shenanigans, like bringing another processor.)
The second scenario is, somebody thinks about buying a used instead of an new processor.
- skinner927 6y agoBingo. It’s a money grab. It’s actually easier to swap a mobo with a cpu and heatsink that’s already seated.
- mmis1000 6y agoWell, the security key of VM is stored in the CPU, so you can't replace CPU unless you can enter the console, copy the data out and re-encrypt it with key from another CPU. While if you can do this, you don't need to replace mother board/CPU anyway because you already pwned them and copy/modify the data whatever you want.
- Dylan16807 6y ago> Well, the security key of VM is stored in the CPU What security key? Do you mean the memory encryption key? We're talking about a powered off machine, so that's irrelevant.
- SaltySolomon 6y agoMemory and Virtual Machines
- Dylan16807 6y agoPlease explain better. The article talks about virtual machines as a subset of memory encryption. It also specifically says "ephemeral keys". Not ones that would be preserved across a shutdown. What is encrypted on a powered-off server that the CPU knows the key to?
- mmis1000 6y agoI mean keys stored in cpu ftpm. So next time it boot, it can't get the disk decrypted with the key in the cpu. And the admin will notice something very incorrectly happened.