9 ms·

What can we learn from leaked Insyde's BIOS for Intel Alder Lake

191 points by hardenedvault 4y ago

Charlie11 4y ago
deleted 4y ago
[deleted]
csdvrx 4y ago
It's a slightly biased analysis: > Can open source firmware projects benefit from leaked content? > Unfortunately, no or rarely. > Individuals or organizations that are not eligible to sign CNDA with Intel, such as open source firmware maintainers. Please note that open source firmware projects cannot directly benefit/reuse from leaked content due to legal risks A direct reuse of everything is unlikely, but access to the material might lead to many interesting tools. Simple example: undervolting (to save battery and reduce heat) was taken away by intel because plundervolt allowed attacks against the SGX enclave. SGX has now been abandoned by Intel, but undervolting remains impossible. If I ever get an Alder Lake, would I look for a way to enable that on my laptop? Yes! Do I fear legal risks of altering the functionality of the hardware I purchased? No, thanks to the consequences of the first sale doctrine. > Binary blobs: It’s worth noting that in addition to the binary blobs required by various devices (Bluetooth BLE, WiFi, Ethernet, etc.), there are three different ACMs for security features: BiosGuard, BootGuard, and TXT > In addition, one thing should be noted that the key pairs required by BootGuard during provisioning stage is also included in the leaked content So there's everything I would need to understand, patch then flash my own alterations? Great! I'm even more interested now!! > the data center should prepare > Short-term plan: > Security team and patch management team should work together to ensure critical devices are upgraded to the latest version And IMHO the individual interested in future attempts to reclaim full ownership of their hardware should prepare in a very different way, by: - downloading a copy of the current BIOS binary update (and the last few versions, just to be on the safe side) - blocking BIOS updates ("capsules" etc) in the BIOS - in the OS, uninstalling the tools that allow such updates (ex: Lenovo Vantage) - ideally, even switching to Linux, as Microsoft can package drivers updates with the BIOS, and if it's that big one of these drivers may include code from Intel using unusual ways to forcefully apply upgrades, that would bypass the methods you can control if the binary is delivered and run on your hardware (ex: Intel ME) I really like Windows, and "security" in general, but I like the idea of having features like Undervolt even more!
- amluto 4y ago
  > SGX has now been abandoned by Intel, but undervolting remains impossible. SGX only really appears to be abandoned on client chips. SGX is a critical part of TDX, which is brand new.
- matheusmoreira 4y ago
  It's insulting enough that Intel can "take away" features... And we can't even replace their code with our own.
- j-bos 4y ago
  For someone with a passing curiosity, but limited time and skill atm. Where would we download the source code and previous updates?
- userbinator 4y ago
  You mean security, not "security". The former is securing your own hardware against others, the latter is others securing the hardware against you. Unfortunately the corporates are more interested in promoting the latter than the former.
- chx 4y ago
  It is, not to put a fine point on it, an absolute asshole move. They could have merely disabled the GUI element which enables the undervolting. This would've made it so you need tools like http://ruexe.blogspot.com/ http://ruexe.blogspot.com/ to edit the EFI variable which firmly put it outside of the reach of the average consumer but still makes it possible. But no, the EFI variable is protected and unless you manage to break the firmware it's impossible to change it. Sigh.
djhope99 4y ago
- pferdone 4y ago
  > I don’t know who leaked it but I’d say it was an Insyde job. ;) This is something I expect on reddit. A supposedly funny comment with no real value at the top… edit: quoted the original comment
  - marginalia_nu 4y ago
    Something something insensitive clod.
  - DominoTree 4y ago
    I’d suggest considering how much value the comment you just posted adds
    - pferdone 4y ago
      I couldn’t hide my dislike for it and commented. Maybe it was unnecessary to draw comparisons to reddit and it’d be better to just state HN rules. I will try to consider this next time. Thank you.
      - _zoltan_ 4y ago
        You could have of course chosen not to comment.
  - jpgvm 4y ago
    If a chuckle isn't of value I don't know what is.
    - pferdone 4y ago
      You are right, it isn‘t of any value to me on HN. Additional information on the topic or a discussion with arguments is. Now you know what is.
mgaunard 4y ago
I mostly learned that people make such intrusive ads nowadays that I won't be reading this article.
- 2Gkashmiri 4y ago
  - matheusmoreira 4y ago
    Could be using a mobile browser. Chrome's Google account integration makes it really annoying to switch.
    - 2Gkashmiri 4y ago
      use firefox focus for casual link openining, firefox mobile+ublock for the rest.
      - azinman2 4y ago
        Not always feasible, but pi hole makes all devices and software magically ad blocking. Just works!
        2Gkashmiri 4y ago
        why? what website works on chrome and fails on both firefox focus and firefox mobile + ublock origin? i have been using this setup since focus was introduced and it has worked 100% for me. there are bugs but what software doesnt so can you give me some concrete examples when this wouldn't?
        azinman2 4y ago
        I’m just providing an alternative. Not everyone wants to use Firefox, and many apps have use built in browsers for links like Reddit and TikTok.
changler 4y ago
Original thread announcing the leak: https://boards.4channel.org/g/thread/89060767 https://boards.4channel.org/g/thread/89060767 Internet Archive link to .zip file snapshot of files from GitHub (but no git commit history): https://web.archive.org/web/20221007235925if_/https://codeload.github.com/LCFCASD/ICE_TEA_BIOS/zip/refs/heads/master https://web.archive.org/web/20221007235925if_/https://codelo... Also mirrored here: https://git.tcp.direct/TheParmak/ICE_TEA_BIOS https://git.tcp.direct/TheParmak/ICE_TEA_BIOS The git bundle for that mirror is also on the Internet Archive: https://web.archive.org/web/20221008155117if_/https://git.tcp.direct/TheParmak/ICE_TEA_BIOS/archive/master.bundle https://web.archive.org/web/20221008155117if_/https://git.tc... (which can be restored via the instructions at https://git-scm.com/book/en/v2/Git-Tools-Bundling https://git-scm.com/book/en/v2/Git-Tools-Bundling) Note that downloading the git bundle (from the link on git.tcp.direct or its mirror on Internet Archive) is the most space-efficient download, as there are many large identical files in the repo that git deduplicates but the zip file format does not.
- matheusmoreira 4y ago
  Thanks. Funny how stuff like this always gets leaked on chans.
  - throwaway12245 4y ago
    Their lollygagging on "moderation" is a feature.
    - retox 4y ago
      The 4chan/4channel moderation is much quicker to respond to reports than they're given credit for. Any post flagged by users as illegal is dealt with (deleted and the user banned/reported to authorities if applicable) usually within minutes. First line of defense are janitors from the community who do the work for free, anonymously and are hated by the very community they help.
    - cowtools 4y ago
      well, each thread basically has a time limit before it gets archived and removed, so the users know to keep making threads if they want to keep their topic alive. So if someone comes and makes a DMCA claim on a thread, the moderators can just ignore it and wait for the thread to time out or they delete it and the users just make another thread. As long as the moderators wait a couple hours or so to respond to legal threats, and maintain a semblance of "low moderation" they pretty much have plausible deniability to void copyright. It's sort of genius.
deleted 4y ago
[deleted]
somat 4y ago
It is unfortunate that this stuff is not open source in the first place. the pcengines apu2 is currently my preferred small system. one of the things I really like about it is that the firmware is open source. I will probably never need to build my own firmware, but I like knowing that I could. https://pcengines.github.io/ https://pcengines.github.io/ Having said that, I think there is still a big ol black box of AMD secret sauce in there, sigh, so close yet still so far. why so secretive? what are you trying to hide?
- smoldesu 4y ago
  It might not even be legal to ship motherboards with fully open-source firmware, especially if it has WiFi/Bluetooth baked in. Once you add anything related to networking in your stack, the chance of running FOSS firmware goes out the window. It's all very lock-and-key stuff, according to... <squints at piece of paper> ...the United States Government.
  - paulryanrogers 4y ago
    Why? Because of FCC requirements around radio emissions?
    - runnerup 4y ago
      Yeah the firmware can control the gain/broadcast power and exceed FCC limits. It can be open source still, but modifying it and running the modified version would invalidate the FCC certification and running non certified transmitters is generally frowned upon, often illegal, depending on precise circumstances.
      - RF_Savage 4y ago
        Not even the running, but sale of. If it's too easy to modify then FCC will make it's sale illegal. Nobody wants that risk for their product.
        4y ago
boreboot 4y ago
> Individuals or organizations that are not eligible to sign CNDA with Intel, such as open source firmware maintainers. Many of them do actually have CNDAs signed with Intel, at least those employed to work on commercial products based on Intel's chips. You'll see tons of references to NDA-only datasheet in coreboot's commit history.
- userbinator 4y ago
  You'll see tons of references to NDA-only datasheet in coreboot's commit history. Isn't that really against the principles of open-source (and possibly the NDA itself)? It's a strange situation and why I'd rather manufacturers release datasheets instead of contributing to OSS. The source is technically "open" in the latter case, but in practice it's not much more informative than what you'd get if you just decompiled the binary.
  - Kamq 4y ago
    > and possibly the NDA itself Depends on the NDA. A lot of NDAs won't require you to never mention that there is a thing that's under NDA, just from divulging the information in question.
    - userbinator 4y ago
      I suppose that gets into the area of what counts as a derivative work. Given that "source code" which looks like decompiled binary wouldn't be of much informative value anyway, I can see how it wouldn't seem like it's leaking any NDA'd information.
userbinator 4y ago
I wonder why it seems to be mostly the new stuff that's getting leaked, and not the old out-of-support platforms that are long out of production, since the latter would be of value to BIOS-modders trying to add features and the like. I agree with the other comment here that this stuff should've been open-source in the first place, but more than that, I wish Intel would just release all the detailed documentation on their products. They used to be far better about that --- I believe you can still find reference schematics and such for Pentium II/III-era chipsets on their site, or in the Internet Archive thereof. The latter part of the article is more "open source bad" fearmongering, sadly common these days in that part of the software industry.
- mook 4y ago
  In this case, possibly because it wasn't a leak, just somebody making a (possibly job-ending) mistake. LCFC appears to be a Lenovo subsidiary that is part of their laptop etc. design; the initial commit in the git repository (saw a screenshot somewhere — not going to touch that code) appears to be recent, from a user using their work account (name prefixed with "LCFC\" which may indicate Windows domain login), with their work email. The repository was in a GitHub organization called "LCFCASD", presumably a subgroup within the company.
VectorLock 4y ago
Quite a "Frist" commit!
roastedpeacock 4y ago
> Individuals or organizations that are not eligible to sign CNDA with Intel, such as open source firmware maintainers. Please note that open source firmware projects cannot directly benefit/reuse from leaked content due to legal risks This has probably occurred in certain communities but 'clean-room' documentation may have been written by third-parties from an understanding of non-public information and as long as the developer(s) nor the writers of said documentation were involved in any malice towards obtaining said information it is probably somewhat ok.
phendrenad2 4y ago
It's so funny to me that people seriously claim that open-source projects do not benefit from this. As hard as open-source projects try to warn their developers against looking at leaked sources, are we really supposed to believe that no one looks?
- bloqs 4y ago
  I was under the impression that this mentality is somewhat theatrical to discourage the accidental subconcious inclusion of mechanics into open source projects as it increases their legal risk exposure.
- themoonisachees 4y ago
  If intel sues kernel.org for using the leaked source for development, kernel.org can just go "we told everyone not to look at it, so either it's coincidental, or a specific person looked and we'll revert sorry"

191 points by hardenedvault 4y ago

Charlie11 4y ago

deleted 4y ago

[deleted]

csdvrx 4y ago

It's a slightly biased analysis: > Can open source firmware projects benefit from leaked content? > Unfortunately, no or rarely. > Individuals or organizations that are not eligible to sign CNDA with Intel, such as open source firmware maintainers. Please note that open source firmware projects cannot directly benefit/reuse from leaked content due to legal risks A direct reuse of everything is unlikely, but access to the material might lead to many interesting tools. Simple example: undervolting (to save battery and reduce heat) was taken away by intel because plundervolt allowed attacks against the SGX enclave. SGX has now been abandoned by Intel, but undervolting remains impossible. If I ever get an Alder Lake, would I look for a way to enable that on my laptop? Yes! Do I fear legal risks of altering the functionality of the hardware I purchased? No, thanks to the consequences of the first sale doctrine. > Binary blobs: It’s worth noting that in addition to the binary blobs required by various devices (Bluetooth BLE, WiFi, Ethernet, etc.), there are three different ACMs for security features: BiosGuard, BootGuard, and TXT > In addition, one thing should be noted that the key pairs required by BootGuard during provisioning stage is also included in the leaked content So there's everything I would need to understand, patch then flash my own alterations? Great! I'm even more interested now!! > the data center should prepare > Short-term plan: > Security team and patch management team should work together to ensure critical devices are upgraded to the latest version And IMHO the individual interested in future attempts to reclaim full ownership of their hardware should prepare in a very different way, by: - downloading a copy of the current BIOS binary update (and the last few versions, just to be on the safe side) - blocking BIOS updates ("capsules" etc) in the BIOS - in the OS, uninstalling the tools that allow such updates (ex: Lenovo Vantage) - ideally, even switching to Linux, as Microsoft can package drivers updates with the BIOS, and if it's that big one of these drivers may include code from Intel using unusual ways to forcefully apply upgrades, that would bypass the methods you can control if the binary is delivered and run on your hardware (ex: Intel ME) I really like Windows, and "security" in general, but I like the idea of having features like Undervolt even more!

amluto 4y ago
> SGX has now been abandoned by Intel, but undervolting remains impossible. SGX only really appears to be abandoned on client chips. SGX is a critical part of TDX, which is brand new.
matheusmoreira 4y ago
It's insulting enough that Intel can "take away" features... And we can't even replace their code with our own.
j-bos 4y ago
For someone with a passing curiosity, but limited time and skill atm. Where would we download the source code and previous updates?
userbinator 4y ago
You mean security, not "security". The former is securing your own hardware against others, the latter is others securing the hardware against you. Unfortunately the corporates are more interested in promoting the latter than the former.
chx 4y ago
It is, not to put a fine point on it, an absolute asshole move. They could have merely disabled the GUI element which enables the undervolting. This would've made it so you need tools like http://ruexe.blogspot.com/ http://ruexe.blogspot.com/ to edit the EFI variable which firmly put it outside of the reach of the average consumer but still makes it possible. But no, the EFI variable is protected and unless you manage to break the firmware it's impossible to change it. Sigh.

djhope99 4y ago

pferdone 4y ago
> I don’t know who leaked it but I’d say it was an Insyde job. ;) This is something I expect on reddit. A supposedly funny comment with no real value at the top… edit: quoted the original comment
- marginalia_nu 4y ago
  Something something insensitive clod.
- DominoTree 4y ago
  I’d suggest considering how much value the comment you just posted adds
  - pferdone 4y ago
    I couldn’t hide my dislike for it and commented. Maybe it was unnecessary to draw comparisons to reddit and it’d be better to just state HN rules. I will try to consider this next time. Thank you.
    - _zoltan_ 4y ago
      You could have of course chosen not to comment.
- jpgvm 4y ago
  If a chuckle isn't of value I don't know what is.
  - pferdone 4y ago
    You are right, it isn‘t of any value to me on HN. Additional information on the topic or a discussion with arguments is. Now you know what is.

mgaunard 4y ago

I mostly learned that people make such intrusive ads nowadays that I won't be reading this article.

2Gkashmiri 4y ago
- matheusmoreira 4y ago
  Could be using a mobile browser. Chrome's Google account integration makes it really annoying to switch.
  - 2Gkashmiri 4y ago
    use firefox focus for casual link openining, firefox mobile+ublock for the rest.
    - azinman2 4y ago
      Not always feasible, but pi hole makes all devices and software magically ad blocking. Just works!
      - 2Gkashmiri 4y ago
        why? what website works on chrome and fails on both firefox focus and firefox mobile + ublock origin? i have been using this setup since focus was introduced and it has worked 100% for me. there are bugs but what software doesnt so can you give me some concrete examples when this wouldn't?
        azinman2 4y ago
        I’m just providing an alternative. Not everyone wants to use Firefox, and many apps have use built in browsers for links like Reddit and TikTok.

changler 4y ago

Original thread announcing the leak: https://boards.4channel.org/g/thread/89060767 https://boards.4channel.org/g/thread/89060767 Internet Archive link to .zip file snapshot of files from GitHub (but no git commit history): https://web.archive.org/web/20221007235925if_/https://codeload.github.com/LCFCASD/ICE_TEA_BIOS/zip/refs/heads/master https://web.archive.org/web/20221007235925if_/https://codelo... Also mirrored here: https://git.tcp.direct/TheParmak/ICE_TEA_BIOS https://git.tcp.direct/TheParmak/ICE_TEA_BIOS The git bundle for that mirror is also on the Internet Archive: https://web.archive.org/web/20221008155117if_/https://git.tcp.direct/TheParmak/ICE_TEA_BIOS/archive/master.bundle https://web.archive.org/web/20221008155117if_/https://git.tc... (which can be restored via the instructions at https://git-scm.com/book/en/v2/Git-Tools-Bundling https://git-scm.com/book/en/v2/Git-Tools-Bundling) Note that downloading the git bundle (from the link on git.tcp.direct or its mirror on Internet Archive) is the most space-efficient download, as there are many large identical files in the repo that git deduplicates but the zip file format does not.

matheusmoreira 4y ago
Thanks. Funny how stuff like this always gets leaked on chans.
- throwaway12245 4y ago
  Their lollygagging on "moderation" is a feature.
  - retox 4y ago
    The 4chan/4channel moderation is much quicker to respond to reports than they're given credit for. Any post flagged by users as illegal is dealt with (deleted and the user banned/reported to authorities if applicable) usually within minutes. First line of defense are janitors from the community who do the work for free, anonymously and are hated by the very community they help.
  - cowtools 4y ago
    well, each thread basically has a time limit before it gets archived and removed, so the users know to keep making threads if they want to keep their topic alive. So if someone comes and makes a DMCA claim on a thread, the moderators can just ignore it and wait for the thread to time out or they delete it and the users just make another thread. As long as the moderators wait a couple hours or so to respond to legal threats, and maintain a semblance of "low moderation" they pretty much have plausible deniability to void copyright. It's sort of genius.

deleted 4y ago

[deleted]

somat 4y ago

It is unfortunate that this stuff is not open source in the first place. the pcengines apu2 is currently my preferred small system. one of the things I really like about it is that the firmware is open source. I will probably never need to build my own firmware, but I like knowing that I could. https://pcengines.github.io/ https://pcengines.github.io/ Having said that, I think there is still a big ol black box of AMD secret sauce in there, sigh, so close yet still so far. why so secretive? what are you trying to hide?

smoldesu 4y ago
It might not even be legal to ship motherboards with fully open-source firmware, especially if it has WiFi/Bluetooth baked in. Once you add anything related to networking in your stack, the chance of running FOSS firmware goes out the window. It's all very lock-and-key stuff, according to... <squints at piece of paper> ...the United States Government.
- paulryanrogers 4y ago
  Why? Because of FCC requirements around radio emissions?
  - runnerup 4y ago
    Yeah the firmware can control the gain/broadcast power and exceed FCC limits. It can be open source still, but modifying it and running the modified version would invalidate the FCC certification and running non certified transmitters is generally frowned upon, often illegal, depending on precise circumstances.
    - RF_Savage 4y ago
      Not even the running, but sale of. If it's too easy to modify then FCC will make it's sale illegal. Nobody wants that risk for their product.
      - 4y ago

boreboot 4y ago

> Individuals or organizations that are not eligible to sign CNDA with Intel, such as open source firmware maintainers. Many of them do actually have CNDAs signed with Intel, at least those employed to work on commercial products based on Intel's chips. You'll see tons of references to NDA-only datasheet in coreboot's commit history.

userbinator 4y ago
You'll see tons of references to NDA-only datasheet in coreboot's commit history. Isn't that really against the principles of open-source (and possibly the NDA itself)? It's a strange situation and why I'd rather manufacturers release datasheets instead of contributing to OSS. The source is technically "open" in the latter case, but in practice it's not much more informative than what you'd get if you just decompiled the binary.
- Kamq 4y ago
  > and possibly the NDA itself Depends on the NDA. A lot of NDAs won't require you to never mention that there is a thing that's under NDA, just from divulging the information in question.
  - userbinator 4y ago
    I suppose that gets into the area of what counts as a derivative work. Given that "source code" which looks like decompiled binary wouldn't be of much informative value anyway, I can see how it wouldn't seem like it's leaking any NDA'd information.

userbinator 4y ago

I wonder why it seems to be mostly the new stuff that's getting leaked, and not the old out-of-support platforms that are long out of production, since the latter would be of value to BIOS-modders trying to add features and the like. I agree with the other comment here that this stuff should've been open-source in the first place, but more than that, I wish Intel would just release all the detailed documentation on their products. They used to be far better about that --- I believe you can still find reference schematics and such for Pentium II/III-era chipsets on their site, or in the Internet Archive thereof. The latter part of the article is more "open source bad" fearmongering, sadly common these days in that part of the software industry.

mook 4y ago
In this case, possibly because it wasn't a leak, just somebody making a (possibly job-ending) mistake. LCFC appears to be a Lenovo subsidiary that is part of their laptop etc. design; the initial commit in the git repository (saw a screenshot somewhere — not going to touch that code) appears to be recent, from a user using their work account (name prefixed with "LCFC\" which may indicate Windows domain login), with their work email. The repository was in a GitHub organization called "LCFCASD", presumably a subgroup within the company.

VectorLock 4y ago

Quite a "Frist" commit!

roastedpeacock 4y ago

> Individuals or organizations that are not eligible to sign CNDA with Intel, such as open source firmware maintainers. Please note that open source firmware projects cannot directly benefit/reuse from leaked content due to legal risks This has probably occurred in certain communities but 'clean-room' documentation may have been written by third-parties from an understanding of non-public information and as long as the developer(s) nor the writers of said documentation were involved in any malice towards obtaining said information it is probably somewhat ok.

phendrenad2 4y ago

It's so funny to me that people seriously claim that open-source projects do not benefit from this. As hard as open-source projects try to warn their developers against looking at leaked sources, are we really supposed to believe that no one looks?

bloqs 4y ago
I was under the impression that this mentality is somewhat theatrical to discourage the accidental subconcious inclusion of mechanics into open source projects as it increases their legal risk exposure.
themoonisachees 4y ago
If intel sues kernel.org for using the leaked source for development, kernel.org can just go "we told everyone not to look at it, so either it's coincidental, or a specific person looked and we'll revert sorry"