7 ms·

Well, this just sucks. This means Microsoft owns my computer. They can access parts of my CPU without my knowledge. WTF, AMD!

Cloudef 5y ago
Don't they own it already by taking advantage of TPM? Or well, at least control what software it can run, and whether your installation is "legit".
- no_time 5y ago
  The TPM is a step in that direction but still misses a couple of puzzle pieces to truly control your machine. For example it may sign the boot measurements but has no introspection into what runs on the machine afterwards.
  - d_tr 5y ago
    What about the Intel Management Engine that is more than ten years old? It is a full OS with maximum privileges.
    - no_time 5y ago
      ME was always sold of as a sort of Premium enterprise feature with no uses on the consumer front. However Intel dabbled with technology much more sinister (SGX) that did exactly what it said exactly on the tin, protecting data from the user of the machine. Unlike MS's track record with Pluton, it was always horribly broken,required a license to attest victim machines and only covered the Intel half of the PC market. The only commercial software I'm aware of that ever mandated SGX is some blu ray player for windows
AdrianB1 5y ago
No, that happens only if you reward them with your money (buy that CPU).
- no_time 5y ago
  You literally have no other option. Intel,AMD,Qualcomm all announced they will be adopting Pluton. Apple devices had black boxes dubbed "security chips" that could very well function the same way if apple decides to utilize it's features to control users. The world can't run on nerd vanity hardware like RaptorComputing POWER workstations and Honeycomb LX2's
  - yjftsjthsd-h 5y ago
    > The world can't run on nerd vanity hardware like RaptorComputing POWER workstations and Honeycomb LX2's It... Totally can? The only problem with Raptor is that they don't make any cheap hardware. In terms of performance and functionally, they're good.
  - floatboth 5y ago
    Ask marcan for more info :) but IIRC Apple's secure element does not do anything by itself and is behind an IOMMU.
Terry_Roll 5y ago
Companies run the world then, not Govt's!
judge2020 5y ago
> They can access parts of my CPU without my knowledge. Let me suggest you look into something called "Windows Update" which seems to be an intentional backdoor/RCE that Microsoft has baked into their operating system.
- deleted 5y ago
  [deleted]
- AdrianB1 5y ago
  You have a degree of control over that; you know when updates are installed, the list of updates, you can disable updates. Even if it is not 100% in your control, you have a fair amount.
- no_time 5y ago
  WU has no hardware backed way forcing you to comply. At the absolute worst case you could load a driver or patch the OS from linux to get it to function as you wanted. Pluton gives MS leverage to make you comply or you fall out of their favors (store,drm,office)
  - encryptluks2 5y ago
    Depends on the manufacturer. Many of them already include virtual hardware in the BIOS that will install some form of manufacturer spyware from Windows Update.
- mindslight 5y ago
  Most of us concerned about this slow tech-authoritarian march haven't been running MS Windows for decades. The problem is that by treacherous hardware, we'll get forced back into running more proprietary software. Instead of being able to run a Free web browser that renders content according to our own interests ("user agent"), remote attestation will allow websites to force us into running the locked down browser of their choice on a supported platform of their choice.
arprocter 5y ago
https://en.wikipedia.org/wiki/AMD_Platform_Security_Processor https://en.wikipedia.org/wiki/AMD_Platform_Security_Processo... already exists
323 5y ago
> This means Microsoft owns my computer. Yes, that's what Operating Systems tend to do. Why are you running an OS from a company you don't trust?
- nightski 5y ago
  Who said they are running windows? The security processor will be present no matter what OS you use.
  - lkxijlewlf 5y ago
    Exactly.
  - kllrnohj 5y ago
    That's very different from the security processor doing anything if you're not using Windows, though. If this processor can be disabled in the BIOS, like existing TPMs typically can be, then does this matter? If Microsoft's "hardware backdoor" is only powered on when using Microsoft's OS anyway then what's the problem? If this can't be easily turned off, then yes that's absolutely a problem. But there's no evidence that's the case, and would be a divergence from existing TPMs in that regard.
    - philistine 5y ago
      How could this co-processor, designed by Microsoft, be able to spy on you while you're running Linux, an OS it doesn't understand, and Linux itself is actively trying to keep itself hidden from such a co-processor. I'm disappointed in the HN crowd going into hysterics when the reality is simple; no hardware module can spy on an OS that knows exactly how the module works and can actively deny it any access.
      - m4rtink 5y ago
        Very easily - for example it can just dump any sequences in memory that look like encryption keys and send them to the mothership. This can be initiated through the actual "owners" of this chip or the next malware authors that exploit this undocumented black box that received zero scrutiny by the public security community.

Cloudef 5y ago

Don't they own it already by taking advantage of TPM? Or well, at least control what software it can run, and whether your installation is "legit".

no_time 5y ago
The TPM is a step in that direction but still misses a couple of puzzle pieces to truly control your machine. For example it may sign the boot measurements but has no introspection into what runs on the machine afterwards.
- d_tr 5y ago
  What about the Intel Management Engine that is more than ten years old? It is a full OS with maximum privileges.
  - no_time 5y ago
    ME was always sold of as a sort of Premium enterprise feature with no uses on the consumer front. However Intel dabbled with technology much more sinister (SGX) that did exactly what it said exactly on the tin, protecting data from the user of the machine. Unlike MS's track record with Pluton, it was always horribly broken,required a license to attest victim machines and only covered the Intel half of the PC market. The only commercial software I'm aware of that ever mandated SGX is some blu ray player for windows

AdrianB1 5y ago

No, that happens only if you reward them with your money (buy that CPU).

no_time 5y ago
You literally have no other option. Intel,AMD,Qualcomm all announced they will be adopting Pluton. Apple devices had black boxes dubbed "security chips" that could very well function the same way if apple decides to utilize it's features to control users. The world can't run on nerd vanity hardware like RaptorComputing POWER workstations and Honeycomb LX2's
- yjftsjthsd-h 5y ago
  > The world can't run on nerd vanity hardware like RaptorComputing POWER workstations and Honeycomb LX2's It... Totally can? The only problem with Raptor is that they don't make any cheap hardware. In terms of performance and functionally, they're good.
- floatboth 5y ago
  Ask marcan for more info :) but IIRC Apple's secure element does not do anything by itself and is behind an IOMMU.

Terry_Roll 5y ago

Companies run the world then, not Govt's!

judge2020 5y ago

> They can access parts of my CPU without my knowledge. Let me suggest you look into something called "Windows Update" which seems to be an intentional backdoor/RCE that Microsoft has baked into their operating system.

deleted 5y ago
[deleted]
AdrianB1 5y ago
You have a degree of control over that; you know when updates are installed, the list of updates, you can disable updates. Even if it is not 100% in your control, you have a fair amount.
no_time 5y ago
WU has no hardware backed way forcing you to comply. At the absolute worst case you could load a driver or patch the OS from linux to get it to function as you wanted. Pluton gives MS leverage to make you comply or you fall out of their favors (store,drm,office)
- encryptluks2 5y ago
  Depends on the manufacturer. Many of them already include virtual hardware in the BIOS that will install some form of manufacturer spyware from Windows Update.
mindslight 5y ago
Most of us concerned about this slow tech-authoritarian march haven't been running MS Windows for decades. The problem is that by treacherous hardware, we'll get forced back into running more proprietary software. Instead of being able to run a Free web browser that renders content according to our own interests ("user agent"), remote attestation will allow websites to force us into running the locked down browser of their choice on a supported platform of their choice.

arprocter 5y ago

https://en.wikipedia.org/wiki/AMD_Platform_Security_Processor https://en.wikipedia.org/wiki/AMD_Platform_Security_Processo... already exists

323 5y ago

> This means Microsoft owns my computer. Yes, that's what Operating Systems tend to do. Why are you running an OS from a company you don't trust?

nightski 5y ago
Who said they are running windows? The security processor will be present no matter what OS you use.
- lkxijlewlf 5y ago
  Exactly.
- kllrnohj 5y ago
  That's very different from the security processor doing anything if you're not using Windows, though. If this processor can be disabled in the BIOS, like existing TPMs typically can be, then does this matter? If Microsoft's "hardware backdoor" is only powered on when using Microsoft's OS anyway then what's the problem? If this can't be easily turned off, then yes that's absolutely a problem. But there's no evidence that's the case, and would be a divergence from existing TPMs in that regard.
  - philistine 5y ago
    How could this co-processor, designed by Microsoft, be able to spy on you while you're running Linux, an OS it doesn't understand, and Linux itself is actively trying to keep itself hidden from such a co-processor. I'm disappointed in the HN crowd going into hysterics when the reality is simple; no hardware module can spy on an OS that knows exactly how the module works and can actively deny it any access.
    - m4rtink 5y ago
      Very easily - for example it can just dump any sequences in memory that look like encryption keys and send them to the mothership. This can be initiated through the actual "owners" of this chip or the next malware authors that exploit this undocumented black box that received zero scrutiny by the public security community.