Comment by kop316 | Hacker News Reader

Comment by kop316 | Hacker News Reader

Seeing this reminded me of something that happened a few weeks ago. I went to a conference where someone very high up in Intel came out to give a presentation what they were doing for security. A few things stuck out to me:

- They said they work very hard to work with Linux to make sure their stuff is compatible.

- The person also specifically called out that they work with BIOS vendors (and called out Coreboot by name, implying they work with them)

- They added that they intend to make sure all of the features are on every chip, and it included the Intel ME.

When the talk was over, the first question someone asked was: "Is there any backdoor on your chips?" After a bit of laughter, the presenter said of course there was not and (understandably) got offended by the question. I specifically asked why they don't allow people to completely disable the Intel ME, and I did not get a concrete answer.

Seeing the _remotely_ exploitable Intel firmware vulnerability makes me not think that question was so funny. I really hope Intel is held responsible for this.

We in high-assurance security knew they backdoored it when they were in the Trusted Computing Group with closed-door meetings with the NSA for tech suiting their needs. Microsoft, too. They wanted to say security was purpose but we were pretty sure some backdoors and DRM would be in order in exchange for some payout. Also resulted in some special "high-assurance platform" tech that wasn't high-assurance (unlike pre-existing products), had to stay secret, was supplied by NSA, and would be in products people trust secrets to. Products running stuff like RHEL and VMWare. Oh yeah, that sounds legit as hell...

Then, I see Intel offer vPro/AMT with a networked, DMA'd microcontroller that listens for remote requests when the system is powered off and can bypass all security without host monitoring. Told everyone that would listen "There's the backdoor. They even said it publicly with different words but it's definitely rigged with a "un-avoidable flaw" with remote access. Or 0-days in rushed, complex firmware." Some security people here argued endlessly on some threads over whether the rand instruction was weakened for NSA on a chip with publicly-advertised, remote access to internal state. I mostly threw my hands up on the topic recommending PPC and SPARC most of the time with their Open Firmware if not custom stuff. Do embedded boards for management since they're cheap and can be isolated.

> They added that they intend to make sure all of the features are on every chip

Interesting that useful stuff like ECC RAM isn't treated like that.

ECC RAM is a bit of a hard case in that the memory controller needs a slightly different wire protocol for ECC vs. non-ECC DIMMs. "Back in the old days", this was one of the justifications for having a northbridge separate from the CPU. Now, in the name of efficiency, it's all on-chip, making ECC a processor feature rather than a motherboard feature.

That being said, it'd certainly be possible to fix this: just ask RAM manufacturers to make their non-ECC memory have the same pin out as ECC memory, with the ECC pins just stubbed to always report that everything is okay. Then all processors could just include the ECC version of the memory controller.

This is not accurate, all (modern) AMD processors can work with both ECC and non-ECC ram, and ECC and non-ECC can even fit into the same ram sockets (the keying is different however, but a board can be compatible with both)

> the keying is different

I don't think it is. DDR3 UDIMMs, EUDIMMs, RDIMMs and LRDIMMs all use the same physical format.

All processors do included the ECC version of the memory controller. Perhaps you're thinking of registered memory, which isn't supported by consumer-grade processors or the workstation/low-end server processors that use the same sockets?

While not exactly what you were suggesting, DDR4 ECC DIMMs and SO-DIMMS are already "pin compatible" with non-ECC modules. So it is straightforward to design a CPU and motherboard that support both, with a control bit in the IMC allowing the BIOS to enable/disable ECC checking (and the extra ECC byte lanes) iff ECC modules are installed (and that's what AMD did with Ryzen).

It is fair to say that Intel blocks ECC on its desktop i7 parts for non-technical/business reasons (i.e. so they can sell a higher-profit E3 Xeon if you want DRAM data integrity beyond what non-ECC memory can provide).

Interestingly, this is not true for DDR3 ECC SO-DIMMs. BTW, even AMD Bristol Ridge supports ECC I believe.

And yet the Pentium G4560 -- one of the cheaper models of their Kaby Lake lineup -- supports both ECC and non-ECC RAM. I suspect the only reason behind lack of ECC support on their mainstream processors is just market segmentation.

> I really hope Intel is held responsible for this.

Watch the stockprice at the opening bell and you'll know if they are being held responsible.

Like it or not, IMO there is little reason to expect this to have a material effect on the stock price, as it is not a product recall, and it probably will not seriously impact Intel's competitive position (given its main competitor is doing something similar).

Sadly, I think that was his point...

Yep. Of course us tech people would like to see Intel punished for ME but the market really won't care and that's the only thing that would push Intel off this path.

No doubt. It doesn't take long to find my own HN comments long before this story openly speculating that if the IME wasn't intentionally a backdoor, it had been made into one.

I also wonder how the timelines of IME match up with respect to the Clipper chip controversy as well, for that matter.

We did see some effects when the world started avoiding US cloud providers and network gear vendors. This time there's kinda nowhere to go.

https://fcw.com/articles/2013/08/07/price-of-nsa-surveillanc...

https://www.theguardian.com/books/2014/may/12/glenn-greenwal...

+0.5% after opening. So the market apparently doesn't care one bit about this. And as long as the mainstream press doesn't care about issues like these that will probably remain so.

Who was the presenter from Intel?

Or, perhaps less pointedly, what conference was it?

Reply on news.ycombinator.com