mjg59

34 ms·

571.
by mjg59 4y ago
I worked on it to the extent that it worked for my use case, given it was a spare time project. It's all been merged upstream, and Intel (to their credit) are maintaining it now even though still refusing to document it.
572.
by mjg59 4y ago
> I don't understand what's so difficult about this. It requires parsing multiple undocumented binary file formats, making sense of how the information in each is interlinked, and writing code that keeps track of system state,
573.
by mjg59 4y ago
> It shouldn't be too difficult to correct this... In the sense of "You can install thermald and it will be corrected", yes. In the sense of "The only reason this works on Linux is that I reverse engineered the Intel
574.
by mjg59 4y ago
By default Linux is taking no approach at all, which means the thermal policy is the most conservative the firmware can configure. If you install thermald then Linux will implement the same policy that Windows does and should have the same
575.
by mjg59 4y ago
It is corrected on Linux. Just install thermald.
576.
by mjg59 4y ago
Intel ship DPTF drivers for Windows, so the appropriate thermal policy is configured at boot time. If you install thermald then Linux will do the same.
577.
by mjg59 4y ago
Boot Guard is based on RSA signatures, so the private key material isn't present on the device
578.
by mjg59 4y ago
While developing my DPTF implementation for Linux I caused the outer skin of my test laptop to reach a temperature that would have caused burns to my legs if I had left it sitting on them for more than a couple of minutes. Now, I have worki
579.
by mjg59 4y ago
> Despite literally zero evidence of that actually being a problem in practice? Sustained contact with metal at a temperature as low as 45C is sufficient to cause discomfort, and it's a surprisingly small rise above that before you
580.
by mjg59 4y ago
> "now you have more performance than they wanted you to have" "An unthrottled CPU without any OS-level policy will generate enough heat that the case temperature may rise to levels that violate safety regulations" ca
581.
by mjg59 4y ago
You're being weirdly obtuse here. Yes, you can make hardware perform faster by running it outside its design limits. That doesn't mean it's a good idea in the general case, even if the tradeoffs make sense for you as an indiv
582.
by mjg59 4y ago
You can design hardware that's capable of dissipating the maximum heat output of every component simultaneously, but you'll end up with hardware that's significantly larger, heavier, and costs more to manufacture. Or you can
583.
by mjg59 4y ago
The EC may trigger an emergency shutdown if any monitored component (not just the CPU) ends up outside its thermal limits.
584.
by mjg59 4y ago
I'm not sure how failing to publicly document the DPTF specification is anything other than Intel's fault. The CPUs are not running in such a constrained configuration under Windows, for example, because Intel supply drivers to co
585.
by mjg59 4y ago
The whole point is that the CPU is only a single part of the equation. Yes, you're not going to burn out the CPU itself by unlimiting PL1/2 (although if the system vendor cheaped out on power circuitry because they'd only des
586.
by mjg59 4y ago
Manufacturers (rightly or wrongly) believe users want machines that are as thin and light as possible. This makes a bunch of things more complicated, including managing system thermals. Heat generated from the CPU has to go somewhere. As yo
587.
by mjg59 4y ago
No, Linux is getting lower performance than Windows because distributions aren't shipping the tooling needed to inform the firmware that the OS can manage platform thermals, and so the firmware is defaulting to a safe state. Of course,
588.
by mjg59 4y ago
This is really not the correct approach. https://github.com/intel/thermal_daemon ought to do a better job without ignoring manufacturer thermal limits (I reverse engineered Intel's Dynamic Power and Thermal Framew
589.
by mjg59 4y ago
The initial infection requires the ability to execute code as admin under Windows, but the writeup notes that it attempts to bypass UAC to gain that even as an unprivileged user (albeit one who is permitted to run code as admin). If you run
590.
by mjg59 4y ago
It doesn't trick the TPM, but as mentioned in the other comment, it does disable Bitlocker before compromising the boot chain so that won't be obvious from an end-user perspective. Remote attestation would still demonstrate that t
591.
by mjg59 4y ago
Microsoft has not yet chosen to revoke the vulnerable bootloader
592.
by mjg59 4y ago
Literally the only difference between a system with secure boot and one without is that unsigned boot components (such as the ones used by prior UEFI bootkits) won't boot. The fact that they don't work is absolutely evidence of th
593.
by mjg59 4y ago
There are UEFI bootkits in the wild that are prevented by secure boot.
594.
by mjg59 4y ago
A new mechanism called SBAT ( https://github.com/rhboot/shim/blob/main/SBAT.md ) is now used to allow revocation of groups of bootloaders rather than individual hashes in order to mitigate the resource con
595.
by mjg59 4y ago
Measuring the version is easy enough, and having that in the event log makes it easy to parse out remotely, but given the PCR is just going to end up as the SHA256 of it you can't write policy that says "Unlock if this value is x
596.
by mjg59 4y ago
Yup
597.
by mjg59 4y ago
That doesn't update the factory install image, and reinstalling that won't roll-back the revocation updates (so it just won't boot instead)
598.
by mjg59 4y ago
It does, but it's not signed with the UEFI Secure Boot keys (Boot Guard has its own mechanism that's burned into chipset fuses, you can't re-key it)
599.
by mjg59 4y ago
No, it's only able to disable Bitlocker because the initial deployment requires admin level access in Windows - stage one of infection is to disable Bitlocker from a running system that's already unlocked the drive.
600.
by mjg59 4y ago
(replied to wrong comment)

More ›