Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Google reveals its servers all contain custom security silicon

theregister.co.uk

Post reply on HN
Print view View original

91–100 of 129 posts

Re: Google reveals its servers all contain custom security silicon

#91

Post by stuckagain »

a_imho wrote: post #85
Buge wrote: post #79

Earlier quoted context omitted.

If the NSA could force Google to hand over anything, why were there Snowden slides showing that the NSA was secretly tapping Google's internal networks? https://www.washingtonpost.com/world/national-security/nsa-i...

The infiltration is especially striking because the NSA, under a separate program known as PRISM, has front-door access to Google and Yahoo user accounts through a court-approved process. I don't know. Maybe it is easier than going to court all the time? Who knows?

Snowden didn't reveal anything even suggesting this "front door access". He's got some PowerPoint slides that say prism and some that have Google logo on them. All meaning of these materials has been supplied by internet conspiracy theorists.

Re: Google reveals its servers all contain custom security silicon

#92

Post by jstanley »

pacala wrote: post #62
pdkl95 wrote: post #21

Earlier quoted context omitted.

More ground is lost in the cold[1] civil war[2] for control of the General Purpose Computer. I hope that everyone choosing to centralize computing power likes the future they are creating. [1] https://www.youtube.com/watch?v=nT-TGvYOBpI#t=2824 (sec. 10 - http://geer.tinho.net/geer.blackhat.6viii14.txt ) [2] http://boingboing.net/2012/08/23/civilwar.html

What is different about centralized compute power compared with centralized energy production?

Your centralised energy supplier can't monitor what you're doing with the energy, or exfiltrate your results, or even stop you from doing it.

Re: Google reveals its servers all contain custom security silicon

#93

Post by eric_h »

cmdrfred wrote: post #69
hedora wrote: post #63

Earlier quoted context omitted.

> Recent iPhones are a distant second in terms of security architecture. Source? Apple does some pretty sophisticated stuff around hardware security mechanisms and software correctness. (I genuinely want a technical description of the mechanisms consoles use these days so I can read it -- not trying to start an argument...)

I don't have any details but without a exploit a game console will never run a single line of code that isn't signed. It makes the attack surface rather smaller than an iPhone.

Without an exploit, how does one run unsigned code on an iPhone, exactly?

Re: Google reveals its servers all contain custom security silicon

#94

Post by timdierks »

ocdtrekkie wrote: post #50
vgt wrote: post #10

Earlier quoted context omitted.

It's a sign of changing times indeed, but for the consumer's benefit. It is absolutely in Google's best interests to externalize security for its customers as a differentiator of Google Cloud. The parent article itself links to the white paper that outlines how this is done for Google Cloud. I understand how one may consider this a "closed ecosystem" from one perspective. However, from a customer point of view any st…

Let's be clear: The customer never wins when the product is closed. Google used to understand that: https://googleblog.blogspot.com/2009/12/meaning-of-open.html In realty, mom-and-pop don't need these security developments, because mom-and-pop have much less attack surface on a server running in their back room. The cloud necessitates it be possible to manage a server over the Internet, but for many situations that i…

Strongly disagree. Mom and pop businesses get owned all the time and close as a result (see Krebs On Security for cites). The economics of online attacks mean that even smallish targets are not obscure enough to be safe.

Disclosure: I work on security at Google.

Re: Google reveals its servers all contain custom security silicon

#95

Post by ocdtrekkie »

timdierks wrote: post #94
ocdtrekkie wrote: post #50

Earlier quoted context omitted.

Let's be clear: The customer never wins when the product is closed. Google used to understand that: https://googleblog.blogspot.com/2009/12/meaning-of-open.html In realty, mom-and-pop don't need these security developments, because mom-and-pop have much less attack surface on a server running in their back room. The cloud necessitates it be possible to manage a server over the Internet, but for many situations that i…

Strongly disagree. Mom and pop businesses get owned all the time and close as a result (see Krebs On Security for cites). The economics of online attacks mean that even smallish targets are not obscure enough to be safe. Disclosure: I work on security at Google.

People's Google accounts get owned all the time too. None of this excess security measures Google is talking about helps if you have bad security practices or your password is 123456.

Google's security measures here largely are a result of a security problem Google created in the first place. That isn't unusual, mind you. Web design is much the same way. We create new problems via added complexity, then have to solve them.

The whole threat model that requires you put custom silicon in your servers just doesn't apply or matter to smaller parties.

Re: Google reveals its servers all contain custom security silicon

#96

Post by wang_li »

tlb wrote: post #67

"Before a decommissioned encrypted storage device can physically leave our custody, it is cleaned using a multi-step process that includes two independent verifications. Devices that do not pass this wiping procedure are physically destroyed (e.g. shredded) on-premise" Why not just shred all decommissioned disks? Someone must be buying them for enough money that Google created a multi-step process for cleaning and ve…

I'd imagine it's easier to recycle an intact HDD than a jumbled mix of silicon, ceramic, steel, aluminum and what not.

Re: Google reveals its servers all contain custom security silicon

#97

Post by [deleted] »

tlb wrote: post #67

"Before a decommissioned encrypted storage device can physically leave our custody, it is cleaned using a multi-step process that includes two independent verifications. Devices that do not pass this wiping procedure are physically destroyed (e.g. shredded) on-premise" Why not just shred all decommissioned disks? Someone must be buying them for enough money that Google created a multi-step process for cleaning and ve…

[deleted]

Re: Google reveals its servers all contain custom security silicon

#98

Post by dx034 »

euyyn wrote: post #82
a_imho wrote: post #60

Earlier quoted context omitted.

Which then shows that they are trying to prevent eavesdropping by NSA & Co. Why would the NSA eavesdrop on Google, they are in bed with them, aren't they?

Snowden revealed the opposite: https://cdn.grahamcluley.com/wp-content/uploads/2013/10/nsa-... NSA actively tries to eavesdrop on Google.

And the chips are probably the reaction to exactly that slide. Not only enabling SSL between datacentres, but verifying all code that servers run, to avoid that the NSA can download private keys from Google servers just because they handed an ESL to the datacentre operator.

Of course they can still use courts to get data directly from Google, but that way they can always only target individuals or small groups, not whole nations.

Re: Google reveals its servers all contain custom security silicon

#99

Post by rl3 »

Buge wrote: post #79
a_imho wrote: post #70

Earlier quoted context omitted.

For me, the whole takeaway of the Snowden leaks was that the NSA can legally force Google (or anyone) to hand over basically anything, am I mistaken? Articles like [1] seems to underline they are indeed working together. [1] http://www.huffingtonpost.com/2014/05/06/nsa-google_n_527343...

If the NSA could force Google to hand over anything, why were there Snowden slides showing that the NSA was secretly tapping Google's internal networks? https://www.washingtonpost.com/world/national-security/nsa-i...

>If the NSA could force Google to hand over anything, why were there Snowden slides showing that the NSA was secretly tapping Google's internal networks?

First, they can force Google to hand over anything. NSLs and the PRISM program are evidence of this, and both are relatively narrow in scope. However, each time the feds compel a top-tier tech corporation like Google to cooperate, the entire thing is scrutinized by lawyers on both sides, and risks drawing the ire of pissed off employees. There's probably many more potential Mark Kleins in Google than there are at a telecom like AT&T—the latter company's relationship with the NSA being best categorized as incestuous.

That being the case, why conduct bulk data collection overtly when they can do it covertly? The aforementioned overt measures ensure prompt data access in the event of an emergency, and keep everyone thinking they're on the up and up. Meanwhile, the truly nasty stuff like domestic bulk collection is conducted behind the scenes.

Re: Google reveals its servers all contain custom security silicon

#100

Post by bogomipz »

I was curious about this:

>"There's plenty more in the document, like news that Google's public cloud runs virtual machines in a custom version of the KVM hypervisor."

Does anyone know if this "container inside kvm" is true of their internal infrastructure as well or its just an extra layer of security for their public facing cloud?

Post reply on HN