Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Lenovo vendor locking Ryzen CPUs with AMD PSB

servethehome.com

Post reply on HN
Print view View original

211–220 of 234 posts

Re: Lenovo vendor locking Ryzen CPUs with AMD PSB

#211

Post by mjg59 »

raxxorrax wrote: post #206
alerighi wrote: post #165

Earlier quoted context omitted.

You said it: it prevents you from booting a custom firmware. If the manufacturer decides to lock down the stock firmware for only booting Windows (something that is not absurd and some manufacturers already attempted in the past, and keep in mind that Microsoft is requiring TPM and secure boot with Windows 11) you are basically screwed. You can't boot Linux with the stock firmware and you can't change the system firm…

> The real thing is, we don't need this kind of security This is a real argument. While it might make sense for cloud computing for the client to verify system integrity, malware that modifies firmware is not the largest blip on the radar in these times. A good protection is actually the numerous different manufacturers. I agree, these technologies aren't primarily for security, they are to enforce how devices are us…

It's not the largest, but against advanced targets who have a chance of detecting other attack vectors, it's a realistic threat. "We don't need this kind of security" is probably true for specific (and even broad) definitions of "we", but it's not universally true and it's not an argument for the technology not existing. Like I said elsewhere, I'm not convinced that the way it's currently being deployed provides anywhere near enough extra security to justify the loss of owner control, but we shouldn't conclude that it means this technology has no legitimate use cases.

Re: Lenovo vendor locking Ryzen CPUs with AMD PSB

#212

Post by mjg59 »

kllrnohj wrote: post #150
NablaSquaredG wrote: post #43

There are a couple of issues I see with this. First, the security argument is nonsense in my opinion. This "feature" only prevents an attacker from flashing a modified, malicious BIOS on to the server. But: If an attacker manages to flash a new BIOS to your server, you're already lost. That either requires physical access (which is bad), or access to the OOB / BMC / IPMI (which is equally bad, because those usually h…

> But: If an attacker manages to flash a new BIOS to your server, you're already lost. That either requires physical access (which is bad), or access to the OOB / BMC / IPMI (which is equally bad, because those usually have a remote KVM feature, so you could e.g. boot the OS into recovery mode) BIOS flashing from the OS has been a thing for a long, long time now. Heck my XPS 13 running Linux even gets BIOS updates fr…

> BIOS flashing from the OS has been a thing for a long, long time now. Heck my XPS 13 running Linux even gets BIOS updates from apt-get.

UEFI capsule updates are triggered by the OS, but don't occur in the OS. The updates are copied to the EFI system partition, and on next reboot the firmware is triggered to apply them. The flashing process involves the firmware verifying a signature on the image before applying it. The reason for this is that the firmware flash is locked down at runtime, and most of it can't be written to outside System Management Mode. Halting the entire OS for long enough to flash the firmware isn't realistic, so it makes more sense to do it in the firmware environment instead. In any case, the net effect is that while, yes, you trigger the update from the OS, the OS itself is unable to directly modify the firmware, and if you try to flash a modified image via the capsule update mechanism the firmware will reject it for having an invalid signature.

Re: Lenovo vendor locking Ryzen CPUs with AMD PSB

#213

Post by YXNjaGVyZWdlbgo »

monocasa wrote: post #145
YXNjaGVyZWdlbgo wrote: post #140

Earlier quoted context omitted.

PSB is there to protect you from a compromised motherboard it protects you from malware in your UEFI firmware. It's not even a vendor lock in it's signing key lock in that is used in that manner by AWS, Gcloud and Azure. Compromised UEFI Firmware is a constant point of failure in pentesting of the secure chain of trust. That you as a security researcher are dismissing the fact is honestly just unbelievable.

> It's not even a vendor lock in it's signing key lock in that is used in that manner by AWS, Gcloud and Azure. Which is not the mechanism under discussion.

No, my comment talked about that some believe PSB is only there to destroy the second hand market and I wrote that it is a false statement and PSB actually provides a higher security for servers and you persisted it's not.

Re: Lenovo vendor locking Ryzen CPUs with AMD PSB

#214

Post by raxxorrax »

mjg59 wrote: post #211
raxxorrax wrote: post #206

Earlier quoted context omitted.

> The real thing is, we don't need this kind of security This is a real argument. While it might make sense for cloud computing for the client to verify system integrity, malware that modifies firmware is not the largest blip on the radar in these times. A good protection is actually the numerous different manufacturers. I agree, these technologies aren't primarily for security, they are to enforce how devices are us…

It's not the largest, but against advanced targets who have a chance of detecting other attack vectors, it's a realistic threat. "We don't need this kind of security" is probably true for specific (and even broad) definitions of "we", but it's not universally true and it's not an argument for the technology not existing. Like I said elsewhere, I'm not convinced that the way it's currently being deployed provides anyw…

Then I believe it prudent to make such security optional. But enforcing secure boot to me is currently a Microsoft DRM feature, despite the otherwise sensible security consideration that went into the development of it.

Especially if you extend features like remote attestation, it is more about user control than user security.

Re: Lenovo vendor locking Ryzen CPUs with AMD PSB

#215

Post by aspyct »

alerighi wrote: post #165
mjg59 wrote: post #138

Earlier quoted context omitted.

You're conflating two different things - AMD's Platform Security Processor (PSP) and Platform Secure Boot (PSB). PSP is broadly equivalent to Intel's ME, but lives on the CPU package rather than in the chipset. PSB is equivalent to Intel's Boot Guard, a feature that verifies that the system firmware has a valid signature before letting the CPU boot it. Both Boot Guard and PSB prevent you from modifying the system fir…

You said it: it prevents you from booting a custom firmware. If the manufacturer decides to lock down the stock firmware for only booting Windows (something that is not absurd and some manufacturers already attempted in the past, and keep in mind that Microsoft is requiring TPM and secure boot with Windows 11) you are basically screwed. You can't boot Linux with the stock firmware and you can't change the system firm…

It is a possible attack though, isn't it?

Even with a fully encrypted disk with LUKS, someone could replace your boot manager with a tool to capture your encryption key.

For most people this will be a non issue: the cost of such an attack would highly surpass the benefits.

But I suspect some people would be valuable targets for this.

Re: Lenovo vendor locking Ryzen CPUs with AMD PSB

#216

Post by klelatti »

smoldesu wrote: post #174
klelatti wrote: post #107

Earlier quoted context omitted.

As others have pointed out the ISA has nothing to do with this. Intel could start building RISC-V CPUs with ME type technology tomorrow. Sure you're open to buy RISC-V CPUs from China but how are you going to be certain that they have no backdoors?

> As others have pointed out the ISA has nothing to do with this. Intel could start building RISC-V CPUs with ME type technology tomorrow. From a purely technical standpoint, I agree (and wouldn't put it past Intel either). My argument is that having an open ISA makes it easier for manufacturers to compete with each other, which in turn makes it harder for interested parties to pin down every CPU manufacturer and pun…

You're conflating so many different factors here: openness of architecture, diversity of design / manufacturing, market needs in different sectors etc - all of which influence what features are built into CPUs / SoCs.

There seems to be a bit of a consistent thread running through lots of discussions that RISC-V because its 'open' magically solves all sorts of problems - it does have some advantages - but it doesn't solve these issues any more than Arm does (and Arm already has massive diversity of supply and billions of CPUs shipped without ME type issues).

Re: Lenovo vendor locking Ryzen CPUs with AMD PSB

#217

Post by BlueTemplar »

mjg59 wrote: post #211
raxxorrax wrote: post #206

Earlier quoted context omitted.

> The real thing is, we don't need this kind of security This is a real argument. While it might make sense for cloud computing for the client to verify system integrity, malware that modifies firmware is not the largest blip on the radar in these times. A good protection is actually the numerous different manufacturers. I agree, these technologies aren't primarily for security, they are to enforce how devices are us…

It's not the largest, but against advanced targets who have a chance of detecting other attack vectors, it's a realistic threat. "We don't need this kind of security" is probably true for specific (and even broad) definitions of "we", but it's not universally true and it's not an argument for the technology not existing. Like I said elsewhere, I'm not convinced that the way it's currently being deployed provides anyw…

You say in your blogpost :

> If you're a journalist or an activist dealing with governments that have a track record of targeting people like you, it should probably be part of your threat model.

But considering what we know about the NSA, at least Intel's Management Engine is likely backdoored. So any anti-USA journalist/activist has probably to worry about that too. And an even bigger threat is industrial and diplomatic espionage of non-USA companies and countries using these processors.

(Also could be extrapolated to other countries' secret agencies for potential Huawei, Russian processors, if those ever get popular, like Huawei's control over EU's telecommunications.)

Re: Lenovo vendor locking Ryzen CPUs with AMD PSB

#218

Post by fsflover »

mjg59 wrote: post #198
mjg59 wrote: post #168

Earlier quoted context omitted.

A computer that requires the firmware to be replaced to boot Linux is already at the point where 99% of users are just not going to install Linux (I've personally ported Coreboot to two of my laptops, and even I would never buy hardware that required me to do that before I could run Linux). And, well, you may well have never heard of attacks that would be mitigated by these technologies, but I have. Firmware-based at…

Ok, as promised, I wrote up my thoughts at https://mjg59.dreamwidth.org/58424.html . I think with a few small tweaks Boot Guard could be turned into something that offered the same security benefits without being as user-hostile. PSB may require more work in this respect, but it should be technically possible to achieve the same outcome.

See also: https://puri.sm/posts/the-future-of-computers-the-neighborho....

Re: Lenovo vendor locking Ryzen CPUs with AMD PSB

#219

Post by fsflover »

Ysraes wrote: post #125
Shadonototra wrote: post #4

lenovo again.. when it's not shipping with rootkits (they did it twice!) and bloatware, it's about limiting HW a company to boycott

Is there any laptop manufacturer that doesn't ship complete bloat/mal/spy/ware in their products?

https://puri.sm/products

Re: Lenovo vendor locking Ryzen CPUs with AMD PSB

#220

Post by [deleted] »

alerighi wrote: post #165
mjg59 wrote: post #138

Earlier quoted context omitted.

You're conflating two different things - AMD's Platform Security Processor (PSP) and Platform Secure Boot (PSB). PSP is broadly equivalent to Intel's ME, but lives on the CPU package rather than in the chipset. PSB is equivalent to Intel's Boot Guard, a feature that verifies that the system firmware has a valid signature before letting the CPU boot it. Both Boot Guard and PSB prevent you from modifying the system fir…

You said it: it prevents you from booting a custom firmware. If the manufacturer decides to lock down the stock firmware for only booting Windows (something that is not absurd and some manufacturers already attempted in the past, and keep in mind that Microsoft is requiring TPM and secure boot with Windows 11) you are basically screwed. You can't boot Linux with the stock firmware and you can't change the system firm…

[deleted]
Post reply on HN