Slashdot Mirror
Intel Plans To Release Chips That Have Built-in Meltdown and Spectre Protections Later This Year (businessinsider.com)
Intel plans to release chips that have built-in protections against the Spectre and Meltdown attacks later this year, company CEO Brian Krzanich said during company's quarterly earnings call this week. From a report: The company has "assigned some of our very best minds" to work on addressing the vulnerability that's exploited by those attacks, Krzanich said on a conference call following Intel's quarterly earnings announcement. That will result in "silicon-based" changes to the company's future chips, he said. "We've been working around clock" to address the vulnerability and attacks, Krzanich said. But, he added, "we're acutely aware we have more to do."
From the people who brought you F00F, FDIV, and now Meltdown? No thanks.
So in the end, Intel is going to make a shitton of money on Meltdown and Spectre because everybody is supposed to buy their new, fixed CPUs
CLI paste? paste.pr0.tips!
So instead of removing the vulnerability, they... will... build in more stuff to protect the CPU from its own inherently flawed design? Now I'm definitely moving to AMD for good.
I a reminded of Torvald's scathing emails about Intel, their proposed patch sets, and how they pointed toward intel wanting to make future chips "Fast but insecure" by default, and requiring the BIOS or OS to tell the CPU "No bitch, secure mode only please", just so they could continue to claim benchmark scores (naturally, with the anti-spectre and meltdown patches disabled so the chip runs really fast.)
Hopefully these silicon level fixes are *ACTUAL* fixes to the methodology used by the speculative execution implementation of the chip, so that speculative execution still is active, but the chip no longer leaves bits and pieces in the processor cache that can be exploited, and that it does this by default.
Hopefully.
INTEL: we've assigned some of our very best minds to developing new chips with built in protections
Slashdotters: what about the 8 generations of chips that do not have such protections and in fact require massive performance losses to protect?
INTEL: very...best...minds.
Good people go to bed earlier.
so roughly 1 year from "discovering" these vulnerabilities to retail cpu's based on fixed silicon, is this doable? or is it more plausible they knew about this before it's disclosure and had these planned and engineering samples already made when these vulnerabilities were made public?
From what I understand about the vulnerability, all they need to do is flush the execution pipelines and cache after a context switch - if a speculative branch has occurred. It can incur a performance hit under certain circumstances, but unless your OS is constantly context switching, it won't be that big of a deal.
For VMs, you can mostly mitigate this with CPU affinity.
Our CPUs cannot be fixed with software. You are going to need to buy a new CPU.
Intel Plans To Release Chips That Have Built-in NSA backdoors.
Why doesn't Intel redesign their chips so they don't have this flaw? Why build a chip with a flaw and add extra code to try and stop it? Oh, it's money. It's all about the money. Intel wants to sell insecure chips because they can't design secure ones fast and cheap enough. Every time Intel makes a statement about Spectre or Meltdown they reinforce how little they care about their customers.
But tell us which chips will be fixed. I recently built a Skylake based gaming rig. My motherboard can take a Kaby Lake with a flash. So I flashed my BIOS, with the hope they create a new batch of Kaby Lake with the Meltdown fix. It should be a nice upgrade, and avoid the slowdown of the patch. But if they just fix the new ones (Coffee Lake) I'll be pissed because I'll have to upgrade everything.
Ah, more news from the Intel Comedy Club. The microcode updates that are supposed to fix the problem don't fix it at all. Intel's CEO says there will be no recall even though the chips are defective. Claims "working as intended." And lets not forget that Intel's CEO did a mass sell-off of his stock in November 2017...BEFORE the security flaw was made public. Can you be even more suspicious? I guess he wanted to become the subject of a federal insider trading investigation.
Intel's PR department has been putting so much spin on this that there is now a cyclone above their Santa Clara, CA facility. ARM and AMD has published exactly what the problems with their chips are, which chips are affected, etc. Intel just tries to cloud the issue. And then they want us to reward them by buying more chips... And in other news, Intel reports that they had a record quarter of USD $17.7 Billion in revenue for 4th quarter 2017.
The Meltdown attack also affects chips from AMD and those based on ARM designs and, in turn, nearly every PC, smartphone and tablet made in recent years.
What. the. FUCK! That couldn't be further from the truth. It's like Intel wrote this garbage piece of shit "article" for them.
And of course, because they are serious about security, they won't be including the Intel Management Engine in computers that don't need it, RIGHT????? Fixing Meltdown and Spectre isn't news - everyone knew that they would jump on that one. But how about removing the bug-ridden, back-door infested Intel ME? THAT is what we should insist on every time they try to claim security credibility.
Make insecure chips but fast, use ahh didn't realize security issue marketing, slow down chips, resale chips with the same performance level, profit.
Much cheaper than actually coming up with faster chipsets to purchase.
Uplink Hosting - Web/email at an affordable price with high performance - https://uplinkhosting.ca/link.php?id=3
It should be ready to go since they have known about this issue for 20 years.
This was know about at least 7 months ago, there have been stories about side channels longer than that. So: why have they only got their 'best minds' working on it now ?
In the end it will take a year to ship 'fixed' silicon? BS. Intel doesn't want to be stuck with the existing flawed stock.
Vendor salesguy: you guys need any new hardware?
Purchasing: yes, but we'll wait for the models with the fixed CPUs or we'll take your flawed ones for 80% off.
This means vendors are screwed.
New headline: Intel promises to fix the bugs in their chips. But not give you a replacement for your old, broken one. Thanks Intel!
"assigned some of our very best minds"
just want to make you wet yourself laughing?
time to buy AMD.
AMD seems to have done it right with the latest designs, they're available now, and their performance is competitive especially with Intel's patches slowing down CPUs. Intel for a long time got away with tricks that let them claim better performance, but now we find that they were exactly that: tricks, that they knew - at least by 6 months or more ago - were unsafe. I will not buy Intel, at least n the foreseeable future. There will be a huge need to replace older Intel stuff over the next year or 2, and AMD better be lining up more fab capacity...
We don't need "built in protection" we need a "design which isn't vulnerable", if the former is truly their strategy then the analogue is anti-virus inside your CPU... You people who write headline need to stop playing into Intel PR's incredulous attitude to their own fucking design flaw. Meltdown and Spectre are not inevitable, they need to be designed out not paved over. Intel: stop treating everyone like morons or suffer the consequences.
Change log:
2018/01/01 - Added 14 Useful Links. Disable Intel ME 11 via undocumented NSA "High Assurance Platform" mode with me_cleaner, Blackhat Dec 2017 Intel ME presentation, Intel ME CVEs (CVSS Scored 7.2-10.0)
Intel CPU Backdoor Report
The goal of this report is to make the existence of Intel CPU backdoors a common knowledge and provide information on backdoor removal.
What we know about Intel CPU backdoors so far:
TL;DR version
Your Intel CPU and Chipset is running a backdoor as we speak.
The backdoor hardware is inside the CPU/Bridge and the backdoor firmware (Intel Management Engine) is in the chipset flash memory.
30C3 Intel ME live hack:
[Video] 30C3: Persistent, Stealthy, Remote-controlled Dedicated Hardware Malware
@21:43, keystrokes leaked from Intel ME above the OS, wireshark failed to detect packets.
[Quotes] Vortrag:
"the ME provides a perfect environment for undetectable sensitive data leakage on behalf of the attacker".
"We can permanently monitor the keyboard buffer on both operating system targets."
Decoding Intel backdoors:
The situation is out of control and the Libreboot/Coreboot community is looking for BIOS/Firmware experts to help with the Intel ME decoding effort.
If you are skilled in these areas, download Intel ME firmwares from this collection and have a go at them, beware Intel is using a lot of counter measures to prevent their backdoors from being decoded (explained below).
Backdoor removal:
The backdoor firmware can be removed by following this guide using the me_cleaner script.
Removal requires a Raspberry Pi (with GPIO pins) and a SOIC clip.
2017 Dec Update:
Intel ME on recent CPUs may be disabled by enabling the undocumented NSA HAP mode, use me_cleaner with -S option to set the HAP bit, see me_cleaner: HAP AltMeDisable bit.
Useful links (Added 2018 Jan 1):
Disabling Intel ME 11 via undocumented HAP mode (NSA High Assurance Platform mode)
me_cleaner: Set HAP AltMeDisable bit with -S option
Blackhat 2017: How To Hack A Turned Off Computer Or Running Unsigned Code In Intel Management Engine
EFF: Intel's Management Engine is a security hazard, and users need a way to disable it
Sakaki's EFI Install Guide/Disabling the Intel Management Engine
Intel ME bug storm: Hardware vendors race to identify and provide updates for dangerous Intel flaws.
CVE-2017-5689: An unprivileged network attacker could ga
Fucking Intel presstitude.
Intel cheated to get better benchmarks, AMD didn't.
Comment removed based on user account deletion
Then pretend it was planned long time ago, when the plan was created a month after he was notified of the bug.
Fuck Intel.
Comment removed based on user account deletion
Through Windoze exploits, or fucking Spectre
"From the people who brought you F00F, FDIV, and now Meltdown? No thanks."
Intel has had many years of insufficient management, in my opinion.
It is not difficult to find evidence of insufficient management at Intel. Yesterday I got 2 poorly considered, poorly written marketing emails from Intel.
More evidence of insufficient management: Intel's CEO reportedly sold shares after the company already knew about massive security flaws
Will Intel be allowed to PROFIT from many years of producing processors with vulnerabilities? Will Intel be treated like U.S. banks in 2008, when many banks profited and many finance system managers got bonuses after the financial crash?
If vulnerabilities are profitable, would Intel deliberately allow vulnerabilities in its products? Were the previous vulnerabilities deliberate? Maybe the CEO didn't previously know about the vulnerabilities. Did someone else at Intel profit from the vulnerabilities?
amd needs boards with IPMI for the E-3 class of cpus (aka desktop) that they have. Not all servers needs an 8 ram channel 128 pci-e high end system.
Are you seriously "planning"?
I thought it was a mandatory move to be done as priority 1 over everything else!
You insensitive silicon clod!
Sent as ripples into the electromagnetic field. No single photon has been harmed in the process.
... built-in protections against the Spectre and Meltdown attacks ...
Hey Intel! It's not an attack, it's a demonstration of why your design is broken.
It's fundamentally broken to read protected memory without permission.
If your chip can read protected memory without permission at any time, for any reason, it's broken.
Don't try to mitigate the "attack", just fix your damn broken design.
[quote]Intel Plans To Release Chips That Have Built-in Meltdown and Spectre Protections Later This Year [/quote]
Translation: Intel Plans To Releas Chips That Have Fixed The Meltdown and Spectre Bugs Later This Year.
These are not added protection. This is not some feature. This is repairing a mistake in all chips released while continuing to sell broken products up to "Later This Year".
Slashdot social media options: AIM, ICQ, Yahoo, Jabber and Mobile Text. Why no MySpace?
Now security is important. But, otoh, Intel has already manufactured a lot of these flawed chips. Following the news about these vulnerabilities the demand for these chips is going to drop. This should open up a window of opportunity to snap up these chips at some steeply discounted prices and use them for workloads and in environments where the chips' design flaw isn't going to be an issue (just avoid applying the mitigation patches that slow everything down).
This is complete BS. Intel won't have fixed silicon for at least two years. And sites like Slashdot should get a clue and stop propagating Intel's lying PR.
Kick X86 to the curb!
(and put some Sparc back into computing!)
or as Intel will try to frame it - next-gen performance and security!!
Pain is merely failure leaving the body
the die is flexible too. Make it soldered on-board, with the I/O configured for server stuff like 10GbE. Replace the (3rd party) companion chip chip known as X370, B350, A320 with another one.
Fun fact the Ryzen looks very similar to Xeon D on all grounds. Although, a low end Xeon E5 server is so cheap that I don't think many bother with a Xeon E3 or Xeon D..
If Intel did the extra check and cleanup like AMD does, it'd be 5% or more slower.
That's just it. If it's connected to your LAN you should be able to see the mac address and/or any network traffic through your router.
There are three main types of computing environment:
- Monolithic single process,
- Complex single process,
- Mixed processes
MSP: written in a low-level language (asm, c, c++), typically a very finely tuned process that may use CPU threads for parallelism in a very carefully managed way, probably implementing its own scheduling etc. Non-deterministic operations like OS/Kernel interactions are generally very, very carefully supervised, custom memory management all over the place, etc, this is the core focus of the system and every effort is made to strip the OS down to preserve cache and determinism,
CSP: possibly written in a less high-level language or one that uses a VM, or incorporates lots of disparate libraries, less to no focus on determinism, often heavy interaction with the os (file access, etc), non-organized thread organization (typically task-specific threads), cache/memory efficiency may be optimized for algorithms or routines but the overhead multitasking isn't a major factor,
Mixed: The system is expected to run a large number of processes/services and the process has no expectation of determinism, everything from assembly to python-implemented-in-bash.
The design of Windows means that it's hard to build an MSP on Windows but it's feasible now with some of the server versions. These are usually extreme cases like High Frequency Trading but also all kinds of realtime systems.
CSPs are your "performant" industrial server process, from game servers to web servers. They probably take huge amounts of RAM for granted, but you'd probably get fired if you logged in on one and started using CPU.
Mixed: everything from your mundane intranet server, mail machine, firewall, to desktop computer. There's a ton of stuff running and unless someone logs in and uses 100% cpu for a couple hours people probably wouldn't notice even high amounts of contention.
For all of these solutions we follow one model: Everything competes for time on the same CPU: Scheduler, Kernel, OS and Processes.
We've moved some tasks out to co-processors which have been reabsorbed into the CPU: MMU, FPU...
Now we have complex chips with multiple cores and ... thread assignment is done in code, in competition with the code-threads that should be running?
In the MSP case: The OS is essentially a forced hit you have to take on your processor availability: you know that every so often it's going to pop in and steal some cycles determining that ... you should carry on doing what you were doing, sorry for messing up your cache line.
In the other cases, especially when there are a lot of processes, you get a gradual degradation caused by the system taking longer to make decisions about what is fair, while it is, itself, obstructing work from being done.
We need the ability to have a Kernel-Core or a Scheduler-Core with custom instructions that can do things like tell memory to go zero a page for us rather than writing zeros to memory... That can get special state information about the CPU cores to make smart decisions about what to run, instructions only available on those cores.
Putting the kernel on its own core gives us a security barrier, and again allows us to dedicate instructions.
We're over due for this architecture. We're already trying to do this with containers and hypervisors, but CPU vendors are just like "*shrug* we'll sell you more of the same"...
-- A change is as good as a reboot.
Slashdot subject size limitation helps to find out the truth.
Slashdot, fix the reply notifications... You won't get away with it...
I am Pentium of Borg. Division is futile. You will be approximated.
Ah. That never gets old.
I think Spectre is much more difficult to fix (or at least try to mitigate) in hardware so here I think it is more likely the microcode update is simply built in. It could be there are some tweaks here and there that might make the new features exposed to the operating system work better etc. but I doubt it is fully mitigated in hardware, at most it is some evolutionary change on top of the microcode update fix.
But given Meltdown has the biggest performance impact, it is also the most important to fix. And as mentioned, I think that is very feasible.
Chips with built-in meltdown and spectre features for years
Yes you do.
How about offering some compensation to people, who bought your chips with the flaws, for the drops in the performance created by the patches? You did receive semi-monopoly prices for them, so coughing some of that up would be only fair, as we're left up with something that doesn't perform as good as advertised.
Now if only avoiding Intel on notebooks would be easier. There will be some potentially good stuff coming up this year, such as Ryzen powered Thinkpads, but there just isn't much choice. ... vote with your wallets people!
On the desktops or workstations however