18 ms·
Lenovo vendor locking Ryzen CPUs with AMD PSB
- fnord77 5y agoI'm not up on CPU terminology. I read the article and I don't know what this means. What is "locking" in this context? What is the "AMD PSB" ?
- pomian 5y agoAMD's Platform Secure Boot (or PSB)
- NablaSquaredG 5y agolocking: At least some AMD CPUs (EPYC, TR PRO, Ryzen Pro) can have cryptographic keys burned into the silicon by the BIOS (Dell and Lenovo do that) Once a CPU has those keys burned into it, it is locked to motherboards of this specific vendor, because other motherboards don't have a BIOS that is signed with the cryptographic key that was burned in. PSB: Platform Security Boot PSP: Platform Security Processor (a CPU inside the CPU which handles e.g. the key burn in process)
- fnord77 5y agowhat advantage does locking a CPU to a specific vendor give the vendor?
- zrm 5y agoCustomers often want to upgrade the processors in their servers. Someone bought some Dell servers with 32-core processors. They upgrade to 64-core processors and have the old 32-core processors. You'd like to buy them to upgrade your servers which have 16-core processors. Sorry, even though the chips are otherwise completely identical, theirs came from a Dell and you have a Lenovo. But hey, you can buy the processors directly from Lenovo for only three times as much money.
- rasz 5y agoCheaper region locked CPU for Chinese market.
- kevin_b_er 5y agoBy ending the fundamental right of ownership itself, the vendor ensures no one can resell stuff and lower the value of what they "sell". It has little to nothing to do with actual security, but instead pure greed. You will own nothing, and you will be happy.
- woobilicious 5y agoThe point of locking the CPU to a specific vendor is to reduce the trusted user base in the cloud. Currently you have to trust AMD, the Vendor, and the data center with your data. The goal of verification of the firmware at such a low level is to eliminate tampering by the data center. Having another feature like SEV (encrypted memory) combined with this lets you create a secure remote box that is fully encrypted at a very early stage in the boot process. This reduces the chance of a malicious entity at a data center from tamping with the firmware to exfiltrate your keys. Other people here are just ignorant and think it's being done purely for profit with no benefit to the end user.
- post_break 5y agoRemember lenovo white listed wifi cards. I wouldn't be surprised if they locked the keyboards to their computers or the power supplies.
- deleted 5y ago[deleted]
- AnotherGoodName 5y agoCould it be AMDs doing behind the scenes? I don't see the motivation for Lenovo here but I do see AMD asking vendors to do this to prevent OEM CPUs completing with retail CPUs.
- YXNjaGVyZWdlbgo 5y agoThe feature was implemented in 2017 the only vendors that are using it are lenovo and dell. With lenovo being the only one using it on lower tier cpus than epyc.
- rasz 5y agoI imagine its Lenovo asking for lower prices on Chinese market bound CPUs and AMD being super happy killing secondary market after seeing Intel server/workstation CPUs flooding out of Asia.
- YXNjaGVyZWdlbgo 5y agoIt makes sense for server security as discussed by the same source as the op https://www.servethehome.com/amd-psb-vendor-locks-epyc-cpus-for-enhanced-security-at-a-cost/ https://www.servethehome.com/amd-psb-vendor-locks-epyc-cpus-...
- rasz 5y agoexcept those arent server chips
- YXNjaGVyZWdlbgo 5y agoThat's why I said in my initial comment that lenovo is the first vendor that uses it on workstation cpus. ie. Threadripper epyc is very much a server chip.
- monocasa 5y agoIt's probably both of their fault. Lenovo wouldn't do it unless there was something in it for them. I wouldn't be surprised if they get a better deal from AMD on these CPUs for being locked to a specific board (killing off their ability to be used in the parts reseller market).
- Shadonototra 5y agolenovo again.. when it's not shipping with rootkits (they did it twice!) and bloatware, it's about limiting HW a company to boycott
- Ysraes 5y agoIs there any laptop manufacturer that doesn't ship complete bloat/mal/spy/ware in their products?
- A4ET8a8uTh0 5y agoThat is actually a good question. I am slowly starting to prepare to purchase a laptop for my wife. Lenovo is basically out based on principle here, but can I realistically convince her to use System76, which seems less bloat-oriented? I honestly don't know. It is not like she needs a powerful machine, but I simply do not want to support a customer-hostile company.
- fatboy93 5y agoProbably not Framework or Apple? Haven't experienced these two yet, but don't almost all windows laptops come with McAfee? Removing it is a pain.
- neither_color 5y agoSystem76 laptops with Pop OS.
- Mikeb85 5y agoI'm going to guess when OEMs ship Linux (Dell, Lenovo, System76, etc...) there's no bloatware. No bloatware on Apple except their OS ;-). But yeah, it's shocking. When I bought my laptop (an Acer Swift 3) it was borderline unusable with Windows and the standard install (wasn't even using native resolution, like WTF!?). Thankfully runs perfectly and looks great with Linux (even suspend, fingerprint reader, bluetooth, etc...).
- fsflover 5y agohttps://puri.sm/products https://puri.sm/products
- turminal 5y agoAll in the name of "security" of course.
- brink 5y agoAll this security is making me feel claustrophobic.
- userbinator 5y agoNo kidding. They're squeezing us slowly. There's a saying about how the best way to make people unware of what freedoms they're losing is to ensure they never had freedom in the first place.
- userbinator 5y agoIt's been around a decade since Secure Boot first appeared and I remember well the opposition that had, along with a rallying cry based on the infamous Franklin quote. Unfortunately many of the opposition either accepted it or even defected, but the more this "security" stuff appears, the more I like that quote. It's succinct and gets the sentiment across very well.
- Avamander 5y agoSecure Boot is really quite separate from AMD PSB and actually does provide protection against certain attacks, no need for the double quotes. It's fortunate, not unfortunate, that we've gone past such irrational opposition to a reasonable extent. Irrational opposition like that makes it much harder to talk about what's actually important, such as PSB/PSP, without getting lumped together with the tinfoil crowd.
- userbinator 5y agoIt's most definitely not "irrational opposition". It's the observation that computing systems have slowly become increasingly user-hostile in the name of "security", and the associated rise of authoritarianism. There's no doubt it "does provide protection against certain attacks", but the thing is WE DON'T CARE. We don't want our freedoms slowly being eroded, we see the edges slowly creeping in, and the best way to do that is to take a strong DO NOT WANT attitude towards any such dubious steps in that direction. Most people thought Stallman was in "the tinfoil crowd" 20 years ago. Yet his predictions have turned out more correct than not. Slowly, the frog boils... https://news.ycombinator.com/item?id=29859106 https://news.ycombinator.com/item?id=29859106
- UltraViolence 5y ago
- metalliqaz 5y agoAre there any that are not manufactured in China?
- ginko 5y agoVAIOs are assembled in Japan at least. https://us.vaio.com/pages/vaio-made-in-japan https://us.vaio.com/pages/vaio-made-in-japan
- n222jjj 5y ago
- beefield 5y agoMaybe Fujitsu? https://indianexpress.com/article/technology/tech-news-technology/fujitsu-bets-on-made-in-japan-label-to-gain-competitiveness-in-indias-premium-laptop-market-7413698/ https://indianexpress.com/article/technology/tech-news-techn... Of course, I assume lots of components for those are made in China. Samsung might make in South Korea? Asus in Taiwan?
- fomine3 5y agoSome models sold in Japan by Fujitsu/NEC/Lenovo/Vaio/Panasonic/HP are assembled in Japan. Lenovo acquired NEC and Fujitsu so they share factory. HP is interesting case. Some NEC/Vaio/Panasonic's laptop motherboard is also made in Japan.
- kiryin 5y agoOh the irony of fate...
- pengaru 5y agoApple/Foxconn?
- 5y ago
- jfim 5y agoThis different article from STH explains what the AMD PSB is, without having to watch a video: https://www.servethehome.com/amd-psb-vendor-locks-epyc-cpus-for-enhanced-security-at-a-cost/ https://www.servethehome.com/amd-psb-vendor-locks-epyc-cpus-... > An OEM who trusts only their own cryptographically signed BIOS code to run on their platforms will use a PSB enabled motherboard and set one-time-programmable fuses in the processor to bind the processor to the OEM’s firmware code signing key. AMD processors are shipped unlocked from the factory, and can initially be used with any OEM’s motherboard. But once they are used with a motherboard with PSB enabled, the security fuses will be set, and from that point on, that processor can only be used with motherboards that use the same code signing key. Basically, the CPU once in that mode will only work with the same signing key, and cannot be put on a motherboard from another brand (or potentially another model from the same manufacturer).
- R0b0t1 5y agoNotably this seems to happen to CPUs that you might purchase yourself, which seems like a huge liability. If you somehow burn a $1000 CPU on a shitty mobo I can't see most people eating that.
- iratewizard 5y agoMy first thought was, is it really a big deal to do that to your laptop's cpu? Then I saw that they're doing this to desktops. My next thought was, people buy pre-built desktops still? Still really concerning to see Lenovo make boneheaded moves like this when they've had one of the better track records for manufacturers.
- seized 5y agoMaybe not the worst track record but they have made other terrible choices... https://en.m.wikipedia.org/wiki/Superfish https://en.m.wikipedia.org/wiki/Superfish
- vetinari 5y ago> My next thought was, people buy pre-built desktops still? If you are enthusiast and need a one or two desktops, then probably not. If you need to procure several hundred of them every few months, then probably yes. What this definitely will do is to affect the market price of these desktops once the lease (or depreciation time) runs out and owner will try to unload them on second hand market.
- josephcsible 5y agoIf you buy a Lenovo, then the CPU dies and you replace it with an unlocked retail one, will the motherboard blow the fuses in the new one and lock it too as soon as you power it up?
- rasz 5y agoI think thats what the previous gen did, so most likely yes.
- kaladin-jasnah 5y agoDoesn't this one have a prompt? So if you choose "no" every time on startup, it won't blow fuses?
- akelly 5y agoWill it boot if you select no?
- judge2020 5y agoYes https://twitter.com/FedsAgainstGunS/status/1473479524805492744?s=20 https://twitter.com/FedsAgainstGunS/status/14734795248054927...
- hilbert42 5y agoThat needs to be fully determined. If it blew the fuses without prompting then it's likely the owner of the replacement chip could sue for damages (the 'replacement' chip only in the machine to test the faulty mono/CPU argument). Also, it would be complicated for Lenovo too as warranty and consumer laws in every country are different. Everyone, thanks for the info, once I had a high opinion of the company but it's been going steadily downhill in recent years. Reckon I'd never buy another PC from them again over this nonsense.
- mjevans 5y agoHow is it not illegal to do this without at least first ASKING the user for confirmation? I'd be annoyed but find it 'merely anti-consumer' rather than 'intentional destruction of property' if the BIOS refused to finish POST without the user confirming that yes, they want to sacrifice this CPU and make it (p)owned by $CORP.
- akelly 5y agoWatch the video, yes there is a prompt.
- judge2020 5y agothe prompt: https://twitter.com/FedsAgainstGunS/status/1473479524805492744?s=20 https://twitter.com/FedsAgainstGunS/status/14734795248054927...
- mjevans 5y agoThank you for the screencap, I wasn't about to watch a video to discover this. 1) It's WAY WAY too easy for someone to not really read this and just press Y to continue, like load setup defaults. 2) There should _not_ be a way of disabling the prompt (the popup even mentions you can do this.) 3) If ever there were a time for a simple math problem (like multiply two numbers and enter the result) to indicate a user had read and understood the prompt, this is it.
- robocat 5y ago> There should _not_ be a way of disabling the prompt (the popup even mentions you can do this.) I think you are mistaken. I am presuming that the prompt is suggesting that you can disable the PSB security feature (in which case the prompt doesn’t show, which seems very sensible).
- judge2020 5y agoBecause this is on the marketing page or spec sheet that you see before you buy the product, thus it being bound to $manufacturer's board is a feature. It's the same reason Apple execs haven't been thrown in jail for selling iPhones that only run iOS.
- aasasd 5y agoSomeone still buys Lenovo?
- mtgx 5y ago
- hoppyhoppy2 5y agoPerhaps not in your social bubble, but Lenovo is the world's largest personal computer manufacturer by market share, with just under 25% of the world's computer sales (measured by number of units shipped)
- userbinator 5y agoThere is much irony in still calling it a "personal" computer...
- amelius 5y agoAnd Apple at 9%.
- GekkePrutser 5y agoYeah they're huge in enterprise in particular. At work we have 120,000 ThinkPads
- isodude 5y agoThey have great replacement support, and they generally just work.
- NablaSquaredG 5y agoThere are a couple of issues I see with this. First, the security argument is nonsense in my opinion. This "feature" only prevents an attacker from flashing a modified, malicious BIOS on to the server. But: If an attacker manages to flash a new BIOS to your server, you're already lost. That either requires physical access (which is bad), or access to the OOB / BMC / IPMI (which is equally bad, because those usually have a remote KVM feature, so you could e.g. boot the OS into recovery mode) It does not prevent any other attacks, because you could still swap out the CPU. The servers usually just quietly burn the CPUs, so you wouldn't notice if the CPUs were replaced by an attacker. Second, this produces a lot of unnecessary e-waste. About 99% of all hardware (except HDDS) from datacenters is sold on the second hand market. Locked CPUs are essentially worthlese, especially if buyers or sellers don't know and throw the CPU away because they think it's defective. Third, this opens up a MASSIVE attack surface. Imagine if somebody finds a bug im the PSP (Platform Security Processor, a CPU inside the CPU that handles the locking thing amon g other things) and is able to burn arbitrary keys into the CPU. The attacker would randomly generate a key and burn them into the CPU. You could permanently kill an entire datacenter with that within seconds. Or if somebody manages to write a malicious BIOS version and flash it to servers which usually don't have a locked BIOS. This BIOS version would also burn a random key into the CPU with the same result: You can easily permanently destroy an entire datacenter. I think this is just AMD's greediness again in the cloak of "improving security"
- newsclues 5y ago“ You could permanently kill an entire datacenter with that within seconds.” Nobody is going to care until this happens.
- UI_at_80x24 5y ago>or access to the OOB / BMC / IPMI I've worked on a few SuperMicro servers that bundled OOB/IPMI onto the same NIC that is used for the LAN. 1 RJ45, 2 MAC addresses I will stab the bean-counter that thought this was an OK idea with a fork if I ever meet them.
- akelly 5y agoGood analysis. My question is wouldn't it be both more secure and more user friendly to burn the BIOS signing public keys into the motherboard chipset instead of the CPU?
- alerighi 5y agoThe problem is the AMD PSB functionality in itself. It should be considered malware like the Intel managament engine and thus refused by users. It's a second processor that runs a proprietary firmware signed by the vendor (that the user cannot modify or substitute entirely with a FLOSS alternative) that vendors can use do harm to the user. The AMD PSB can also be used to lock down a processor to enforce secure boot and thus don't let you run an unsigned operating system, i.e. no longer allowing you to run Linux on your machine that comes out of the factory with Windows preinstalled. That would be a very very bad thing. Unfortunately both for Intel and AMD you don't have choices these days. I'm hoping someone develops a processor based on the RISCV architecture (a free architecture that doesn't include that shit) to be used in a computer entirely under the control of the user (hardware and software) and not the corporation that makes it.
- judge2020 5y ago> RISCV architecture (a free architecture that doesn't include that shit) Surely you can't think the architecture itself is the differentiator. x86 didn't have all of this security 20 years ago, give engineers a few years of time to throw some locks on a risc-v chip and it'll be Enterprise Ready™ in no time.
- orangepurple 5y agoThe good news is the main manufacturers of RISC-V are Chinese vendors that allow complete access to low level processor details. They generally don't lock down their products at all.
- pjmlp 5y agoBad news is that US doesn't want to have anything with them.
- orangepurple 5y agoYou can still import them into the US en masse
- tiku 5y agoCan't we just bridge the connection with a lead pencil like on the old CPUs haha
- mnd999 5y agoThat Thundebird Athlon over clock was amazing.
- GekkePrutser 5y agoWith a 10nm pencil and a very stable hand maybe :)
- deleted 5y ago[deleted]
- firebaze 5y agoIsn't Lenovo the problem? CPU vendors have to implement a secure enclave somehow to fulfill requirements from the content industry for quite some time now. But there never was a nefarious actor like Lenovo in this case to my knowledge. I understand from this case that my reasonable course of action is to inform my (non-IT-focused) peers and friends that they should avoid Lenovo by explaining the reason behind it (your device is worth less, since you won't be able to install linux or a Mac Clone!) to them.
- richardfey 5y agoI hate it when an article goes on without ever mentioning what an acronym stands for. PSB = Platform Secure Boot
- SergeAx 5y agoI wonder if it is possible to return such a system to the vendor based on a claim that the lock is irreversible decreased it's consumer value?
- PostThisTooFast 5y ago
- anonymousiam 5y agoSo to "protect" us from APTs, they've gone the same way that Intel did with their "Management Engine". In other words, you are pretty much fucked when a nation state uses the secret built-in exploits to pwn your system.
- mrtweetyhack 5y ago