Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

“Microsoft Pluton Hardware Security Coming to Our CPUs”: AMD, Intel, Qualcomm

anandtech.com

Post reply on HN
Print view View original

31–40 of 172 posts

Re: “Microsoft Pluton Hardware Security Coming to Our CPUs”: AMD, Intel, Qualcomm

#31

Post by dpoochieni »

azalemeth wrote: post #9

A previous HN link is here -- https://news.ycombinator.com/item?id=25131431 -- which links to MS's original press release -- https://www.microsoft.com/security/blog/2020/11/17/meet-the-... . That article explicitly states that it was designed originally for the xbox. I worry that going to be a very anti-consumer, anti-free-speech, DRM heavy chip that MS want to popularise as an alternative to the (still hated in some…

Imagine it being capable of enforcing something like which executables you are able to load... Quite in the vein of Apple sending the executables hash to some random server

Re: “Microsoft Pluton Hardware Security Coming to Our CPUs”: AMD, Intel, Qualcomm

#32

Post by darzu »

cm2187 wrote: post #23
darzu wrote: post #17

I worked extensively with Pluton when I was employed on Azure Sphere (an IoT platform marketed as highly secure and composed of a linux-based OS, ARM SoC, and cloud service). I might be able to answer questions about this. Here’s a blog by the engineer lead on Azure Sphere that discusses Pluton: https://azure.microsoft.com/en-us/blog/anatomy-of-a-secured-... Disclaimer: I still work at MSFT but in a different org.

A TPM integrated into the CPU makes sense (and I am puzzled why TPMs aren't a standard feature of all MB given the modest cost). But what about that diagram in the article with a link to the cloud? Will this thing phone home outside of the control of the OS?

In Azure Sphere, Pluton didn't do any direct network communication, that was all handled by the main core. Also there was no cellular so the whole system depended on user interaction to get online.

When the main core wanted to talk to the Azure Sphere cloud service (from Linux user land), it would go through a remote attestation process that involved Pluton. Pluton can securely track what software was booted on the main core (called "measure boot") and it basically sends a hash of that to the cloud to prove to the cloud what software is currently running.

So I imagine the chip-to-cloud thing they're talking about is this remote attestation protocol.

Also, it's possible the term "Pluton" has been expanded to refer to more than just the M4 chip we used in Azure Sphere.

Re: “Microsoft Pluton Hardware Security Coming to Our CPUs”: AMD, Intel, Qualcomm

#33

Post by wahern »

merb wrote: post #28
wahern wrote: post #12

Earlier quoted context omitted.

If Qualcomm is implementing it then it should be easy enough to break. Qualcomm's secure enclave software for Android has had an absolutely abysmal security track record. Apple gets all the press precisely because it's such an achievement (well, that and Apple is more well known). Qualcomm hacks have come out like every 6 months for nearly a decade, and nobody cares anymore.

well apple's enclave is broken aswell. https://arstechnica.com/information-technology/2020/10/apple... well at least it needs physical access.

FWIW, I meant Apple secure enclave hacks get all the attention because they're more of an achievement, at least in terms of published hacks being more rare. I tried to keep track of published Qualcomm breaks--which usually don't require physical access as they involve classic software bugs--several years ago but gave up because they were too numerous yet not as widely publicized. I had plenty of fodder by then, though I try to take mental note of new breaks that [briefly] appear on HN or elsewhere.

I was keeping track of hacks for marketing material related to a security startup I was working on. The competition would have principally been smartphone-based authentication apps, both Android and iPhone.

Re: “Microsoft Pluton Hardware Security Coming to Our CPUs”: AMD, Intel, Qualcomm

#34

Post by darzu »

Asmod4n wrote: post #30
darzu wrote: post #17

I worked extensively with Pluton when I was employed on Azure Sphere (an IoT platform marketed as highly secure and composed of a linux-based OS, ARM SoC, and cloud service). I might be able to answer questions about this. Here’s a blog by the engineer lead on Azure Sphere that discusses Pluton: https://azure.microsoft.com/en-us/blog/anatomy-of-a-secured-... Disclaimer: I still work at MSFT but in a different org.

So.. this basically means swapping your CPU gets rid of anything you stored on its "TPM", or can it be backuped up to the TPM of your Mainboard and restored to the new one you install?

I think the whole idea here is that Pluton will be integrated inside of the same physical chip as the CPU. So physically swapping CPUs would swap your Pluton core too.

But the Pluton I know of didn't really have any writeable storage. It had some special ROM and fuses that it uses internally for its private keys but that's basically it.

Re: “Microsoft Pluton Hardware Security Coming to Our CPUs”: AMD, Intel, Qualcomm

#35

Post by chem83 »

darzu wrote: post #17

I worked extensively with Pluton when I was employed on Azure Sphere (an IoT platform marketed as highly secure and composed of a linux-based OS, ARM SoC, and cloud service). I might be able to answer questions about this. Here’s a blog by the engineer lead on Azure Sphere that discusses Pluton: https://azure.microsoft.com/en-us/blog/anatomy-of-a-secured-... Disclaimer: I still work at MSFT but in a different org.

Greetings!

- Was Pluton based on an RTOS or is it running on bare-metal on top of the M4? - Is the architecture on the i.MX8-based Sphere the same as the one on MT3620? - Does the Security Subsystem running on the Cortex-A's secure world have any relationship with Pluton? Is the Security Subsystem running on top of the Sphere's modified Linux kernel like the normal world is?

Thanks, cheers!

Re: “Microsoft Pluton Hardware Security Coming to Our CPUs”: AMD, Intel, Qualcomm

#36

Post by mtgx »

> chip-to-cloud security

I assume this also means cloud-to-chip, which means it might give Microsoft/NSA the ability to tap into it at will "from the cloud"?

After all, Windows 10's tracking features were like a longtime wishlist from the FBI/NSA, so I wouldn't be surprised if this is their "...one more thing" in the same vein.

Re: “Microsoft Pluton Hardware Security Coming to Our CPUs”: AMD, Intel, Qualcomm

#37

Post by noch »

skohan wrote: post #2

Is Pluton specifically Windows related? Will this affect how easy it is to run Linux on hardware using Pluton?

Do the kids remember Microsoft's ghastly Palladium, from 2 decades ago?

>Known Elements of the Palladium System:

> The system purports to stop viruses by preventing the running of malicious programs. The system will store personal data within an encrypted folder.

>The system will depend on hardware that has either a digital signature or a tracking number.

> The system will filter spam. The system has a personal information sharing agent called "My Man."

> The system will incorporate Digital Rights Management technologies for media files of all types (music, documents, e-mail communications). Additionally, the system purports to transmit data within the computer via encrypted paths

https://epic.org/privacy/consumer/microsoft/palladium.html

Re: “Microsoft Pluton Hardware Security Coming to Our CPUs”: AMD, Intel, Qualcomm

#38

Post by darzu »

chem83 wrote: post #35
darzu wrote: post #17

I worked extensively with Pluton when I was employed on Azure Sphere (an IoT platform marketed as highly secure and composed of a linux-based OS, ARM SoC, and cloud service). I might be able to answer questions about this. Here’s a blog by the engineer lead on Azure Sphere that discusses Pluton: https://azure.microsoft.com/en-us/blog/anatomy-of-a-secured-... Disclaimer: I still work at MSFT but in a different org.

Greetings! - Was Pluton based on an RTOS or is it running on bare-metal on top of the M4? - Is the architecture on the i.MX8-based Sphere the same as the one on MT3620? - Does the Security Subsystem running on the Cortex-A's secure world have any relationship with Pluton? Is the Security Subsystem running on top of the Sphere's modified Linux kernel like the normal world is? Thanks, cheers!

1. Bare-metal 2. I only worked with the MT3620 so I cannot comment on others 3. Pluton would boot the A7’s Secure World which would the boot A7 normal world. Secure World and Pluton interfaced regularly but they’re fundamentally different code and purposes.

Hope that helps!

Re: “Microsoft Pluton Hardware Security Coming to Our CPUs”: AMD, Intel, Qualcomm

#40

Post by wyldfire »

roywiggins wrote: post #19
shmerl wrote: post #14

> What the Pluton project from Microsoft and the agreement between AMD, Intel, and Qualcomm will do is build a TPM-equivalent directly into the silicon of every Windows-based PC of the future. CPUs with security modules controlled by MS? Who will guarantee it won't be abused against non MS systems and users?

How many Qualcomm CPUs run Windows?

Not many, but it's a growing market. Much of the Windows-on-ARM market is Qualcomm SoCs.
Post reply on HN