AMD's Zen to have advanced security features that even Kaby Lake doesn't

[qubit]

grabbing some popcorn and sitting here to this happens.... nice... made my day with this...

Regards,

Just to clarify, you've quoted me quoting the article! It's not me saying this.

 

[cadaveca]

haha! Hardware root of trust with NSA backdoor! No thanks.

Current Intel CPUs have similar, which apparently can wipe your HDD if they wanted, called Intel Insider.

http://blogs.intel.com/technology/2011/01/intel_insider_-_what_is_it_no/

Enabling this, IIRC, is why there was a P67 recall. Some "hacker" tripped it in a way it should not have been.

https://newsroom.intel.com/news-rel...s-chipset-design-error-implementing-solution/

 

[DeathtoGnomes]

This screams Enterprise security all over the place, these features might mean less overall performance even with the hardware SHA. Now I wonder if there will be another chip with one or two less of these features meant for the Home/Gamers.

Personally, I really like the security features and am probably willing to give up some performance/speed for them, but being a gamer I would still want an AMD chip meant for high FPS. If it comes down to such a choice Ill just have to build another rig.

 

[Recon-UK]

AMD FTW, come kick some intel ass.

 

[R-T-B]

Intel has that already.

Yep, intel ME.

Isn't it in the PCH though?

 

[cdawall]

Yep, intel ME.

Isn't it in the PCH though?

@cadaveca link has the info I honestly never looked into Intels specs on it.

 

[R-T-B]

@cadaveca link has the info I honestly never looked into Intels specs on it.

Pretty sure the Management Engine is still in the PCH, though it certainly could have moved knowing intels ways. I can't easily check that document now as I am on mobile.

 

[cdawall]

Pretty sure the Management Engine is still in the PCH, though it certainly could have moved knowing intels ways. I can't easily check that document now as I am on mobile.

The new ones the talk back chip is on the CPU, but I cannot find the article for it. It was in the news on here complaining about the "second CPU" on your CPU nonsense.

 

[R-T-B]

The new ones the talk back chip is on the CPU, but I cannot find the article for it. It was in the news on here complaining about the "second CPU" on your CPU nonsense.

Either way, don't matter. I don't like a third party accessible CPU in my PC, period.

 

[slozomby]

meanwhile the vast majority of users run as an administrator and don't require passwords to log in to the system.

just because the platform has security if its not used it doesn't mean anything

 

[R-T-B]

meanwhile the vast majority of users run as an administrator and don't require passwords to log in to the system.

just because the platform has security if its not used it doesn't mean anything

These firmware's basically run "above" administrator, but yeah, point taken. At least above Windows 7 UAC holds your hand whether you like it or not.

 

[silentbogo]

In addition to Intel ME there was a controversy over microcode updates: an exploit was demonstrated on Blackhat 2015, and few academic papers with similar security evaluation were published by several people even before that.
http://techreport.com/news/28784/vu...intel-cpus-gives-away-the-keys-to-the-kingdom
https://www.dcddcc.com/docs/2014_paper_microcode.pdf

The new ones the talk back chip is on the CPU, but I cannot find the article for it. It was in the news on here complaining about the "second CPU" on your CPU nonsense.

I believe Intel ME is still on the chipset. Though the way it works is exactly the same, and there were a bunch of papers written on possible implementation of such exploits.

Biscuits,, I think there's many an arm cored pocket rocket and millions more cores besides would argue against your assertion of backdoor bully, and all cases I've seen were coding derived vulnerabilities.
Amd have had trust zone enabled Apus and such a while now so it's not untested or unimproved tech either.

The company might have to go through some intellectual property spats before it can employ something like 4-PLUS-1 if NVIDIA patented the essential concepts, but it’s doable. More importantly, it would fit AMD’s new MO, to use both x86 and ARM technology.

Those are completely different use cases. There are ARM cpus everywhere, but they are used either as Central Processor, or peripheral processor. AMD plans to use it as secure boot mitigator, which means the following:
1) you have no control over it, and you probably can't monitor it beyond passive observation and firmware reverse-engineering. Being inside of a CPU (just like ME is a part of chipset), only makes things more complicated
2) this ARM core is the first thing to start and have access to all system resources. Nothing prevents it from injecting sub-routines on BIOS level, altering a bootloader, or observing/manipulating your hardware without you knowing it.
3) An external flash for this chip will most likely run on an SMBUS or SPI with many other devices, so exploiting the new secure boot system will be just as easy as updating BIOS on your GPU. Using deceptive techniques may provide hackers with an easy way to create an army of zombies.
https://www.contextis.com/documents/93/CRESTCon_-_Exploiting_hardware_management_subsystems.pdf
https://www.blackhat.com/us-16/training/applied-physical-attacks-on-x86-systems.html

 

[FireFox]

It looks like AMD doesn't know anymore what to do in order to go back in the game.

It's like to be lost in the space.

 

[RejZoR]

Sometimes security features like this are welcome, but sometimes they become an exploitation vector.

 

[TheoneandonlyMrK]

In addition to Intel ME there was a controversy over microcode updates: an exploit was demonstrated on Blackhat 2015, and few academic papers with similar security evaluation were published by several people even before that.
http://techreport.com/news/28784/vu...intel-cpus-gives-away-the-keys-to-the-kingdom
https://www.dcddcc.com/docs/2014_paper_microcode.pdf


I believe Intel ME is still on the chipset. Though the way it works is exactly the same, and there were a bunch of papers written on possible implementation of such exploits.




Those are completely different use cases. There are ARM cpus everywhere, but they are used either as Central Processor, or peripheral processor. AMD plans to use it as secure boot mitigator, which means the following:
1) you have no control over it, and you probably can't monitor it beyond passive observation and firmware reverse-engineering. Being inside of a CPU (just like ME is a part of chipset), only makes things more complicated
2) this ARM core is the first thing to start and have access to all system resources. Nothing prevents it from injecting sub-routines on BIOS level, altering a bootloader, or observing/manipulating your hardware without you knowing it.
3) An external flash for this chip will most likely run on an SMBUS or SPI with many other devices, so exploiting the new secure boot system will be just as easy as updating BIOS on your GPU. Using deceptive techniques may provide hackers with an easy way to create an army of zombies.
https://www.contextis.com/documents/93/CRESTCon_-_Exploiting_hardware_management_subsystems.pdf
https://www.blackhat.com/us-16/training/applied-physical-attacks-on-x86-systems.html

Draaaaaaaaammmmmmmaaaaaaaa ,you are aware most routers ,set top boxes, network equipment ,ssd controllers are arm based, if it's vulnerable fine I get it , but it has been for years already.

 

[EarthDog]

Good for servers... doesn't that say SoC? I would assume something like this to trickle down to desktop for AMD.

Intel has something similar already no? Also, SecureBoot...

EDIT: Dave already got there, LOL!

 

[silentbogo]

Draaaaaaaaammmmmmmaaaaaaaa ,you are aware most routers ,set top boxes, network equipment ,ssd controllers are arm based, if it's vulnerable fine I get it , but it has been for years already.

I'm simply running out of ideas how to explain this in layman terms.
Let me repeat it in a short, loud and clear sentence:
IT IS NOT A COMPUTATIONAL CORE, AND IT HAS ACCESS TO YOUR WHOLE SYSTEM - NOT JUST SOME ISOLATED PART.

Maybe I am overly paranoid, but it's always better to be on the safe side. Even my router wears a tinfoil hat.

 

[TheoneandonlyMrK]

I'm simply running out of ideas how to explain this in layman terms.
Let me repeat it in a short, loud and clear sentence:
IT IS NOT A COMPUTATIONAL CORE, AND IT HAS ACCESS TO YOUR WHOLE SYSTEM - NOT JUST SOME ISOLATED PART.

Maybe I am overly paranoid, but it's always better to be on the safe side. Even my router wears a tinfoil hat.
View attachment 79964

Ok in reply then I say,,,, Let me repeat it in a short, loud and clear sentence:
IT IS NOT A COMPUTATIONAL CORE, AND IT HAS ACCESS TO YOUR WHOLE SYSTEM - NOT JUST SOME ISOLATED PART. As does a router micro controller or an ssd micro controller ,hope that clarifies my point , it is already happening smart ass now go teach you mother to suck eggs ffs.
All your info I might nick will be behind an arm non compute core.

Why so paranoid , to me your too paranoid tin foil windows wtf I will reply no more to you as your clearly a Special case.

 

[bogmali]

Let us restore civility in here people. No need to get worked up and start typing in CAPS

 

[SimpleTECH]

Yep, intel ME.

Isn't it in the PCH though?

@cadaveca link has the info I honestly never looked into Intels specs on it.

Pretty sure the Management Engine is still in the PCH, though it certainly could have moved knowing intels ways. I can't easily check that document now as I am on mobile.

Actually it's just a flash chip used by the BIOS. More info here (including the security issues that face Intel Management Engine).

 

[Easy Rhino]

Current Intel CPUs have similar, which apparently can wipe your HDD if they wanted, called Intel Insider.

http://blogs.intel.com/technology/2011/01/intel_insider_-_what_is_it_no/

Enabling this, IIRC, is why there was a P67 recall. Some "hacker" tripped it in a way it should not have been.

https://newsroom.intel.com/news-rel...s-chipset-design-error-implementing-solution/

Bahah! Remember those intel inside commercials from years ago? How else do you know if your PC has intel inside? Your HDD gets wiped by a covert government agency!

This will make the youngins crack up

 

[d265f2785]

hoping for mainline linux kernel support

 

[BiggieShady]

Either way, don't matter. I don't like a third party accessible CPU in my PC, period.

If the attacker is in the position to access the ARM cpu inside a cpu, you have bigger problems than that because he is already in control on the big cpu admin privileges and all ... and he doesn't need to go further, he's quite fine where he is

 

[Kanan]

Some people here don't understand it, but the new news article on the frontpage clarfied it pretty good: the ARM chip is supposed to make everything SAFER, not UNSAFE*R. It's a chip that manages control of the system instead of a supervisor account doing it, the chip does it. And the chip is not touchable in any way - hacking or any corruption aside. I'm not really paranoid btw. just some users here seem to be - well I'd say, don't be. AMD had this tech for long now, ARM chips are also pretty widespread now - everything is working fine so far and Zen won't change that.

 

[R-T-B]

If the attacker is in the position to access the ARM cpu inside a cpu, you have bigger problems than that because he is already in control on the big cpu admin privileges and all ... and he doesn't need to go further, he's quite fine where he is

When I said third-party, I was thinking implemented backdoor, not hacker.

Some people here don't understand it, but the new news article on the frontpage clarfied it pretty good: the ARM chip is supposed to make everything SAFER, not UNSAFE*R. It's a chip that manages control of the system instead of a supervisor account doing it, the chip does it. And the chip is not touchable in any way - hacking or any corruption aside. I'm not really paranoid btw. just some users here seem to be - well I'd say, don't be. AMD had this tech for long now, ARM chips are also pretty widespread now - everything is working fine so far and Zen won't change that.

There is absolutely nothing "safer" about this. At most, the security processor may be working as intended and enhance performance. At worst, it is hijacked and preventing even reinstalls from cleaning your system.

Even if the worst case is unlikely, the fact does not change: There is NOTHING SPECIAL this can do that a general purpose core cannot. It at most, provides sone enterprise encryption PERFORMANCE enhancing functions. It does NOT make your machine more secure, no more than the aes-ni of intel did.

I have a bit of a background in these issues, the fact that you just called this thing an "unhackable supervisor" has me picturing the Titanic barreling towards an iceberg, to be frank.