Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Google reveals its servers all contain custom security silicon

theregister.co.uk

Post reply on HN
Print view View original

101–110 of 129 posts

Re: Google reveals its servers all contain custom security silicon

#101

Post by eva1984 »

sergiosgc wrote: post #5

This is another signal of an interesting development on the hardware front. What used to be decoupled, with some companies offering hardware, and different companies buying hardware, is now coupled and hidden within these mega-companies (Google, Amazon, FB). Google is big enough to develop a trusted hardware solution for internal use only, it has no financial need to sell it. Worse, due to competitiveness in the clou…

Thinking from another perspective, are those hardware just hardware? Not really, they are solutions, with tons of software supporting them. There is no point selling individual pieces, and they will not work out of box.

Re: Google reveals its servers all contain custom security silicon

#102

Post by donavanm »

woliveirajr wrote: post #3

> Disks get the following treatment: > “We enable hardware encryption support in our hard drives and SSDs and meticulously track each drive through its lifecycle. Before a decommissioned encrypted storage device can physically leave our custody, it is cleaned using a multi-step process that includes two independent verifications. Devices that do not pass this wiping procedure are physically destroyed (e.g. shredded)…

Check out "Opal" and "SED" https://en.m.wikipedia.org/wiki/Opal_Storage_Specification. Many (most?) drives support it these days. When I briefly looked a year or two ago basically all drives had the physical capability, but some firmwares didnt expose it to the iser. As always key management is the hassle.

Re: Google reveals its servers all contain custom security silicon

#103

Post by donavanm »

sergiosgc wrote: post #5

This is another signal of an interesting development on the hardware front. What used to be decoupled, with some companies offering hardware, and different companies buying hardware, is now coupled and hidden within these mega-companies (Google, Amazon, FB). Google is big enough to develop a trusted hardware solution for internal use only, it has no financial need to sell it. Worse, due to competitiveness in the clou…

Is it really any different in practice? TPM is installed in basically every computer used in basically none. Even though its been a uniquitous "standard" for two decades its effectively impossible to correctly do attestation.

Similar arguments could be made for UFI and similar. Just because some can write code for it only a handful of major suppliers actually do.

Are those any more accessible than this?

Re: Google reveals its servers all contain custom security silicon

#104

Post by rwmj »

_yosefk wrote: post #9
sergiosgc wrote: post #5

This is another signal of an interesting development on the hardware front. What used to be decoupled, with some companies offering hardware, and different companies buying hardware, is now coupled and hidden within these mega-companies (Google, Amazon, FB). Google is big enough to develop a trusted hardware solution for internal use only, it has no financial need to sell it. Worse, due to competitiveness in the clou…

It's not the cloud - it's the sad downside of the democratization of hardware design, as in fabs like TSMC and IP companies like ARM making it relatively cheap to make your own chips with competitive functionality in a wide range of areas. There's a lot of custom hardware outside the cloud, say in embedded electronics, that's just as closed as the stuff in server farms - closed specs and no way to program the thing,…

Pretty sure this is nothing to do with Google manufacturing their own silicon. It's an open secret that standard Intel server chips contain "special silicon" with features which are only switched on for certain customers. I'm pretty sure this is what Google is referring to. Source: https://techreport.com/forums/viewtopic.php?t=118026

Re: Google reveals its servers all contain custom security silicon

#105

Post by cmdrfred »

eric_h wrote: post #93
cmdrfred wrote: post #69

Earlier quoted context omitted.

I don't have any details but without a exploit a game console will never run a single line of code that isn't signed. It makes the attack surface rather smaller than an iPhone.

Without an exploit, how does one run unsigned code on an iPhone, exactly?

Like so: https://www.igeeksblog.com/how-to-sideload-apps-on-iphone-an...

Re: Google reveals its servers all contain custom security silicon

#106

Post by [deleted] »

eric_h wrote: post #93
cmdrfred wrote: post #69

Earlier quoted context omitted.

I don't have any details but without a exploit a game console will never run a single line of code that isn't signed. It makes the attack surface rather smaller than an iPhone.

Without an exploit, how does one run unsigned code on an iPhone, exactly?

[deleted]

Re: Google reveals its servers all contain custom security silicon

#107

Post by phire »

tlb wrote: post #67

"Before a decommissioned encrypted storage device can physically leave our custody, it is cleaned using a multi-step process that includes two independent verifications. Devices that do not pass this wiping procedure are physically destroyed (e.g. shredded) on-premise" Why not just shred all decommissioned disks? Someone must be buying them for enough money that Google created a multi-step process for cleaning and ve…

Probably because of the verification.

You can't really verify a shredding, the pile of shredded remains no-longer has a serial number. I assume the cleaning process cryptographically verifies the identify of the disk both before and after the wipe, making it impossible to sneak a drive out.

For those drives which fail the cleaning process, they probably have a complex process with multiple witnesses to ensure it actually gets shredded.

Re: Google reveals its servers all contain custom security silicon

#108

Post by DanielDent »

A lot of stuff from this made it's way into the chromebook. There's a verified boot process, hardware assisted key management, rollback protection, ...

And it's all open source and nicely documented for anyone who cares to look. With a bit of work you can actually create your own chain of trust and run your own verified boot process.

It's very cool.

Re: Google reveals its servers all contain custom security silicon

#109

Post by bastawhiz »

cookiecaper wrote: post #32
pm90 wrote: post #16

Earlier quoted context omitted.

It reduces the resources needed to bootstrap your own company. Of course once it reaches a certain size, it makes it more cost effective to host your resources internally. There are also many organizations who do not want to deal with a whole division dedicated to maintaining a reliable, distributed, secure computer network for their employees and would be more willing to pay for the cloud rather than the extra peopl…

This is not really true. Not "once you reach a certain size", but once you move off the lowest-tier starter hardware, cloud quickly becomes much more expensive than owning hardware, and security solutions continue to depend on the individual administrators (most backups do too). Cloud's biggest benefit is really convenience, because you don't need to go to the datacenter and put in another hard drive yourself when yo…

That's not also strictly true. I can spin up redundant cloud server instances on three continents for roughly the same price as three instances in a data center physically near me. If I need to put a drive in a physical server on the other side of the world, I'm dead in the water. It's only a matter of convenience if there's a reasonable, cheaper alternative.

Re: Google reveals its servers all contain custom security silicon

#110

Post by wmf »

bogomipz wrote: post #100

I was curious about this: >"There's plenty more in the document, like news that Google's public cloud runs virtual machines in a custom version of the KVM hypervisor." Does anyone know if this "container inside kvm" is true of their internal infrastructure as well or its just an extra layer of security for their public facing cloud?

Internal Google stuff does not use KVM and that's one reason it took them a while to offer VMs — they had little experience with it.
Post reply on HN