Intel Hit With More Than 30 Lawsuits Over Security Flaws (reuters.com)

Intel said on Friday shareholders and customers had filed 32 class action lawsuits against the company in connection with recently-disclosed security flaws in its microchips. From a report: Most of the lawsuits -- 30 -- are customer class action cases that claim that users were harmed by Intel's "actions and/or omissions" related to the flaws, which could allow hackers to steal data from computers. Intel said in a regulatory filing it was not able to estimate the potential losses that may arise out of the lawsuits. Security researchers at the start of January publicized two flaws, dubbed Spectre and Meltdown, that affected nearly every modern computing device containing chips from Intel, Advanced Micro Devices and ARM.

Comments

Couldn't happen to a...

[Anonymous Coward]

... nicer company. Carry on.

Re:Couldn't happen to a...

[Anonymous Coward]

apple has 32 as well. All well deserved.

Is everyone else getting sued, too?

[Anonymous Coward]

AMD, ARM, and whoever else? Are they getting sued too? Or is the strategy here just 'attack the biggest target'?

Re:Is everyone else getting sued, too?

[behrooz0az]

Meltdown which is the worst of all and was probably done on purpose to cheat in benchmarks only hits Intel.

Re:Is everyone else getting sued, too?

[Anonymous Coward]

> Security researchers at the start of January publicized two flaws, dubbed Spectre and Meltdown, that affected nearly every modern computing device containing chips from Intel, Advanced Micro Devices and ARM.

The summary clearly disagrees with your assertion.

Re:Is everyone else getting sued, too?

[Anonymous Coward]

No it doesn't. Read again.

Re:Is everyone else getting sued, too?

[Killall -9 Bash]

The summary is fucking wrong, and the writer of it probably got paid by Intel.

Re:Is everyone else getting sued, too?

[TheRaven64]

It isn't Intel only, ARM's Cortex A75 was vulnerable. The A75 chip is the only high-end core designed by ARM since the patent on the technique that turns out to be vulnerable to Meltdown expired. Intel helpfully (in retrospect) protected the industry by patenting it and not including it in any of their cross-licensing agreements, preventing anyone else from being vulnerable. The technique improved system call performance, so if you regard making system calls faster, then I suppose it was for cheating at benchmarks.

I'm quite nervous about these lawsuits, because Intel looks like a really attractive target at the moment (and I certainly wouldn't cry about them losing some money), but setting the precedent that you're liable if your product is vulnerable to exploit techniques that are invented after the product ships would be very dangerous for the entire industry. If you set that precedent, then even formal verification isn't enough, because formal verification only lets you prove correctness with regards to properties that you enumerate.

Re:Is everyone else getting sued, too?

[110010001000]

The A75 isn't on devices. Meltdown is Intel only. Just stop.

Re:Is everyone else getting sued, too?

[chefren]

The summary is how Intel wants this communicated so that they can spread the blame more.

Re:Is everyone else getting sued, too?

[Anonymous Coward]

Go fuck yourself, you corporate shill.

Re:Is everyone else getting sued, too?

[HiThere]

Intel not only made dangerously broken CPUs which had been predicted to be dangerously broken (without a definite exploit) before they were designed, but if they didn't already know about how to exploit it, they were informed at least 6 months before the public notice, and appear to have taken no steps to mitigate the problem prior to public notice. We can't really know, but the patches that they rushed out after notice was made public were so poor that they probably hadn't done anything.

Etc.

I'm willing for Intel to prove that they were acting in a reasonable and ethical manner, but the preponderance of the evidence seems against that assumption.

Re:Is everyone else getting sued, too?

[Vairon]

My personal opinion is that they are liable for replacing every CPU they sold after they were aware of this problem without disclosing it. I don't fault them for selling CPUs when they were not aware. The i9 7940X, 7960X and 7980X should not have been released last year or if released only with a disclosure of vulnerability.

Re:Is everyone else getting sued, too?

[thegarbz]

and was probably done on purpose

Yes because optimising code paths exist only to cheat benchmarks.

Some people have really lost their grip on reality. Are you by any chance that crazy person who's trying to launch himself into the sky on a steampunk rocket?

Re:Is everyone else getting sued, too?

[thegarbz]

The summary is fucking wrong

It is nothing of the sort. Spectre affects most CPUs including AMD, Meltdown affects most CPUs *except* for AMD. Just because AMD did something right doesn't mean that there aren't examples of SPARC, ARM, and multiple lines of Power chips affected too.

Painting this as Intel only is just as absurd as lumping AMD together with Intel when discussing 2 separate flaws.

Re:Is everyone else getting sued, too?

[Killall -9 Bash]

Specter THEORETICALLY affects most CPUs. Don't hold your breath waiting for proof-of-concept.

(yes, i know, if you google "specter proof of concept" you will find things, but what you will find is a proof of concept for meltdown called a proof of concept of specter. Some code-faggot got PAID to conflate the two, not to mention the scholastic-fag who wrote the scholarly paper conflating the two he refers to).

Painting this as Intel only is just as absurd as lumping AMD together with Intel when discussing 2 separate flaws.

Meltdown is intel only.... but don't worry. If you're running Intel, you're PWNT by IME/AMT anyway.
Specter is a different threat, conflated with Meltdown because it benefits Intel PR. All CPUs are vulnerable to Specter, but according to AMD, real-world use of the vulnerability is nearly impossible, and mitigation of the vulnerability is actually impossible. I don't know about you, but I trust AMD more than the guy pointing saying "Hey, him too!"

Re:Is everyone else getting sued, too?

[Anonymous Coward]

"two flaws, dubbed Spectre and Meltdown, that affected nearly every modern computing device containing chips from Intel, Advanced Micro Devices and ARM."

That's a bold faced lie. Meltdown doesn't effect but Intel and one line of ARM chips. Spectre doesn't effect a large percentage of ARM chips because they don't have speculative execution. So, strike one, only one flaw is at all prevalent, and two even that isn't only nearly every modern computing device.

Yes, the two issues are not just an Intel issue, but the two issues both effect Intel while it's a lot more complicated when it comes to everyone else. That's precisely why every lumping action, like the summary, are bullshit or outright lies.

Re:Is everyone else getting sued, too?

[thegarbz]

Meltdown is intel only

Yes which is why IBM, Broadcom, ARM and Oracle have issued statements about how they are affected by meltdown, or in Oracle's case they published a list of processors not affected ... a very short list and said nothing more.

AMD is not vulerable to meltdown. That doesn't mean it's Intel only. The bug is related to a specific optimisation that is used in a variety of architectures.

Re:Is everyone else getting sued, too?

[Archeopteryx]

When you post things like this, log in first unless you really ARE a coward.

Re:Is everyone else getting sued, too?

[Archeopteryx]

MIGHT have been done to make benchmarks better but without the realization that it exposed a vulnerability. Often engineering projects are success-oriented, and once the chip was running all of the tests and benchmarks and the performance was good, that may have been as hard as anybody looked. You need to have people whose job it is to break all such new products, but that both costs more and delays the time to market, and executives rarely want either.

Re:Is everyone else getting sued, too?

[sl3xd]

Meltdown which is the worst of all

That remains to be seen. Meltdown is a big problem if unpatched. However, patches are available, and they appear to work.

Spectre is harder to exploit, but also harder to mitigate. Nobody has fully patched Spectre; the in-flight 4.16 Linux kernel has only the beginning of Spectre patches, and the situation isn't any better with other OSes.

Spectre, unlike Meltdown, will haunt for years to come.

Re:Is everyone else getting sued, too?

[TheRaven64]

Intel not only made dangerously broken CPUs which had been predicted to be dangerously broken (without a definite exploit) before they were designed

Really? Care to cite those predictions (ideally from 1995 or earlier, when Intel introduced this feature).

they were informed at least 6 months before the public notice, and appear to have taken no steps to mitigate the problem prior to public notice.

They disclosed the vulnerabilities to ARM and worked with Microsoft, Apple, and some Linux developers on work-arounds, though the Linux people completely botched the embargo.

Re:Is everyone else getting sued, too?

[behrooz0az]

Spectre, unlike Meltdown, will haunt for years to come.

As she's been doing since 2006 https://dota2.gamepedia.com/Sp...

Re:Is everyone else getting sued, too?

[Killall -9 Bash]

Have you taken note of how Meltdown and Specter are getting conflated, by EVERYONE....?

The only other CPU vendor I heard of being vulnerable to Meltdown is Qualcomm.

Re:Is everyone else getting sued, too?

[thegarbz]

The you haven't been listening. IBM's advisory specifically calls out all three CVEs. Even news articles which know what they were talking about when they said Meltdown was thought to only affect Intel and some ARM processors have pointed out it also affects all of the POWER architecture processors.

And Oracle gave a long list of SPARC architectures that were affected by Spectre along with a patch, and then gave a single note that said SPARCv9 systems are not affected by Meltdown, and then proceeded to refuse to answer any customer questions (seriously go check their forums for a very interesting number of ways one can say "no comment") when asked about earlier SPARC systems. Make of that what you will.

class action = big payout

[fattmatt]

I can't wait to get my $3 !!

Re:class action = big payout

[Anonymous Coward]

No way you still have the paperwork to document your $3 claim. That $3 stays in the lawyer pot.

Re:class action = big payout

[Anonymous Coward]

Are you stupid or something? I'll just look up the receipt in my email account on my comput.....&TY&*GHSDFYSFG^ +++NO CARRIER, INTEL FLAW EXECUTED SUCCESSFULLY.

Re:class action = big payout

[AmiMoJo]

Does the existence of a class action stop you suing them yourself?

I'm using small claims court. Cheap and effective.

Re:class action = big payout

[Fly Swatter]

It will be a $3 coupon good only towards a future Intel processor, which may actually be a fixed version, the kicker is it will be $30 more than current prices to cover the class action lawyer fees. You'll also need a new motherboard with that, oh and they changed the memory design again. Yep we are all winners here.

Re:class action = big payout

[NicknameUnavailable]

Does the existence of a class action stop you suing them yourself?

Yes, if you don't take efforts to opt out of them all. Class action lawsuits are auto-opt-in, you have to personally track down and remove yourself from the list of people on each one to be able to sue because you can't sue twice. This means that while actual damages were around 70% of the cost paid for any Intel CPUs over the years (since that's the power loss and false advertising they conducting) you'll get a couple cents, if you explicitly state that, and the lawyers will get the rest. This class action suit should be enough to bankrupt Intel, but thanks to our backwards system they get to keep sticking it to us with their near monopoly.

Re:class action = big payout

[Actually, I do RTFA]

Class actions aren't for compensation. They're for deterrence and changing incentives.

Re:class action = big payout

[Anonymous Coward]

If they would be forced to fix the issue by replacing all affected CPUs, it might be better (if they don't insert a new backdoor)...

Re:class action = big payout

[Aighearach]

I got $27 last year from a class action because some shady "collection agency" called my cell phone a bunch of times trying to collect on an invalid "debt."

The reason that you'd be lucky to get $3 is that Intel didn't promise that their chips could output some number of math answers per second in a secure way, they only sold you a CPU that does all the instructions they promised it does.

Numerous combinations of CPU instructions might turn out to not do what you wanted them to do, if you wanted a different thing than what they physically do! That has nothing even to do with Intel. These aren't even bugs, these are misfeatures! And you won't find promises about these features in the EULA, so you probably weren't misled in any way.

If speculative instructions are a misfeature, that is a mistake made together by the industry and the consumer, not a mistake made by "Intel."

Re:class action = big payout

[Anonymous Coward]

I can't wait to get my $3 !!

2$ whore and a ice-cream

Re:class action = big payout

[Aighearach]

None of these are class actions yet, whenever you see a story in the media that claims "some number of class actions suits were filed" you should know without looking at the details that it is not true as claimed.

You have to file an individual claim, with an individual cause of action. That is the thing that you "file" with the help of your lawyer. Then you ask the court to Certify a Class of plaintiffs that have been harmed in the same way. If the Court says yes, they will then rule on what the class actually is. So all of that happens after you've already filed the suit! Changing from a regular lawsuit into a class action suit happens during the case, not prior to it. So when you see the reporting getting that word wrong, and claiming the class action was "filed" then you know the reporter either doesn't understand what they're reporting, or more likely they reported some untrue drivel because they didn't think their readers could understand the actual events.

The news you'll see when it actually happened is, "Class certified in Foo lawsuit." Now that means that there is actually a class action.

If you're going to file your own case, talk to a lawyer about doing it now before any class gets certified. Don't wait.

Not that you're likely to have a case, or any injury on which to base one, however...

Re:class action = big payout

[Anonymous Coward]

Why $3?

If I bought (as I did) a system/CPU that was top of the range at the time and paid a premium price for it - and now have to run patches that slow it by 50% to "sort" Meltdown and Spectre problems - then the comparison and recompense should be in line with a system/CPU that ran at 50% of the performance and was available at the time of the original purchase. In which case the difference/reasonable compensation could be several hundred dollars per CPU.

Re:class action = big payout

[rtb61]

I don't know. Some bloody big companies got hacked et al. Some real deep pocketed companies, even they profit with a class action. So, so, many big companies, the losses way and beyond CPU price. So the question for the big players, take as much as you can without killing Intel or strip mine it for it's assets, it could be that bad. No need to panic yet, as the civil proceeding will likely take many years but in the end, it doesn't look good for Intel.

No warranty

[OrangeTide]

I'm pretty sure Intel never made promises that it was a highly secure chip. They mainly market on power and performance.

Re:No warranty

[behrooz0az]

It has, many many times.
Intel TXT, NX bit, Intel MPX, Intel Secure Key, Intel SGX, Intel KPT, IIRC MSRs, Intel Management Engine(this one is very secure)

Re:No warranty

[TheRaven64]

Did they ever claim that it was resilient against side channels?

The SGX one is perhaps the most interesting of these, because Spectre can allow disclosure of unencrypted memory from SGX enclaves, which makes them largely useless. If you bought processors specifically for the SGX functionality then you may be entitled to a refund along the lines of the refund when they disabled HTM in Haswell. Microsoft bought quite a lot of Intel chips for Azure for this reason, which could get interesting.

Re:No warranty

[Anonymous Coward]

ENGINEER: (ENTERING MANAGER'S OFFICE) "Sir. We seem to have found a vulnerability in the new chip design"
MANAGER: "What sort of vulnerability?"
ENGINEER: "Well, when a computer is connected to the Internet...."
MANGER: (INTERRUPTING) "Stop right there." (HOLDS DOWN BUTTON ON INTERCOM) "Call the lawyers and have them see if we promise the chips to be secure when attached to a network." (TURNS TO ENGINEER) "Is there anything else?"
ENGINEER: (GRINNING) "No sir. Thank you for your time." (LEAVES)
MANGER: (MAKES SURE THE ENGINEER IS OUT OF EAR SHOT. HOLDS DOWN BUTTON ON INTERCOM ONCE MORE) "While you have the lawyers, make sure they understand this is just a friendly question. I am not at all worried that there is anything not secure about our chips. Oh, and get my stock broker on the line."

Re:No warranty

[Anonymous Coward]

Then off with their heads!

Re:No warranty

[110010001000]

https://www.intel.com/content/...

Re:No warranty

[Anonymous Coward]

Um..... no. That's marketing.

Nice graphics though.

Re:No warranty

[110010001000]

" They mainly market on power and performance."

You aren't too bright.

Re:No warranty

[Actually, I do RTFA]

And Ford never formally states that their cars don't explode if used on alternate Thursdays. Fortunately, reasonable assumptions about a product are reasonable and actionable.

Re:No warranty

[Anonymous Coward]

More like suing Ford because your brakes failed after not maintaining them for 5 years.

Re:No warranty

[Anonymous Coward]

How the fuck do you "maintain" a hardware level bug that existed for a decade?

You Intel shills will say anything.

Article being referred to is inaccurate

[Anonymous Coward]

I'm sure everyone reading this already knows the obvious, but AMD is not affected by Meltdown in any capacity. Please do not encourage the spread of this misinfo. It is important to understand what processors are safe and what processors are affected by Meltdown and Specter's 2 variants.

https://www.networkworld.com/article/3246707/data-center/meltdown-and-spectre-how-much-are-arm-and-amd-exposed.html

Re:Article being referred to is inaccurate

[Anonymous Coward]

It is important to understand what processors are safe and what processors are affected by Meltdown and Specter's 2 variants.

https://www.networkworld.com/article/3246707/data-center/meltdown-and-spectre-how-much-are-arm-and-amd-exposed.html

That article contains errors. In particular, the article claims that AMD processors are "potentially vulnerable to only one of the three variants of Meltdown". This is incorrect for two reasons.

(1) There is only one "variant" of Meltdown. Presumably, the author mistakenly considers Spectre Variant 1 and Spectre Variant 2 to be "variants" of Meltdown.

(2) According to AMD's own statement (which is linked in the article), AMD processors are immune to Meltdown, but vulnerable to both variants of Spectre. But Spectre Variant 1 can be avoided by patching the operating system. After the operating system patch is applied, AMD processors are only vulnerable to Spectre Variant 2.

AMD also says that in 2019 they will begin shipping processors that are immune to Spectre Variant 2.

Re:Article being referred to is inaccurate

[Khyber]

"I'm sure everyone reading this already knows the obvious, but AMD is not affected by Meltdown in any capacity."

This theoretically isn't true. A DPA attack might be enough to open a hole for Meltdown-style problems.

What is the intended outcome?

[chispito]

Warning: Should a future vulnerability be discovered in this technology--which is almost certainly incomprehensible to you anyway and may as well be considered "magic"--corrective updates may impact advertised performance.

Only 30?

[Tablizer]

30 sounds low. Throw the book at 'em!

Looks like Intel made two mistakes

[Waffle Iron]

Mistake 1: A major engineering design flaw.

Mistake 2: Neglected to force their users to enter into a binding arbitration agreement before using the CPUs.

Re: Looks like Intel made two mistakes

[Anonymous Coward]

But did one thing right: CEO dumped his stocks just before the scandal hit the fan.

Re: Looks like Intel made two mistakes

[Anonymous Coward]

And then the Intel CEO pretended the stock dump was planned all along, but actually he created the dump plan only after learning about the flaws.

Re:Looks like Intel made two mistakes

[Stormy Dragon]

Wouldn't have helped. Don't forget that Intel found out about this at least seven months before it was revealed, which means for seven months it continued selling processors it knew were defective without disclosing that face.

Any agreement it reached with people who bought chips during those seven months would be invalid, because withholding material information means there was no "meeting of the minds".

Obligatory: Intel CPU Backdoor Report (Jan 1 2018)

[Anonymous Coward]

Change log:
2018/01/01 - Added 14 Useful Links. Disable Intel ME 11 via undocumented NSA "High Assurance Platform" mode with me_cleaner, Blackhat Dec 2017 Intel ME presentation, Intel ME CVEs (CVSS Scored 7.2-10.0)

Intel CPU Backdoor Report
The goal of this report is to make the existence of Intel CPU backdoors a common knowledge and provide information on backdoor removal.

What we know about Intel CPU backdoors so far:

TL;DR version

Your Intel CPU and Chipset is running a backdoor as we speak.

The backdoor hardware is inside the CPU/Bridge and the backdoor firmware (Intel Management Engine) is in the chipset flash memory.

30C3 Intel ME live hack:
[Video] 30C3: Persistent, Stealthy, Remote-controlled Dedicated Hardware Malware
@21:43, keystrokes leaked from Intel ME above the OS, wireshark failed to detect packets.

[Quotes] Vortrag:
"the ME provides a perfect environment for undetectable sensitive data leakage on behalf of the attacker".

"We can permanently monitor the keyboard buffer on both operating system targets."

Decoding Intel backdoors:
The situation is out of control and the Libreboot/Coreboot community is looking for BIOS/Firmware experts to help with the Intel ME decoding effort.

If you are skilled in these areas, download Intel ME firmwares from this collection and have a go at them, beware Intel is using a lot of counter measures to prevent their backdoors from being decoded (explained below).

Backdoor removal:
The backdoor firmware can be removed by following this guide using the me_cleaner script.
Removal requires a Raspberry Pi (with GPIO pins) and a SOIC clip.

2017 Dec Update:
Intel ME on recent CPUs may be disabled by enabling the undocumented NSA HAP mode, use me_cleaner with -S option to set the HAP bit, see me_cleaner: HAP AltMeDisable bit.

Useful links (Added 2018 Jan 1):
Disabling Intel ME 11 via undocumented HAP mode (NSA High Assurance Platform mode)
me_cleaner: Set HAP AltMeDisable bit with -S option
Blackhat 2017: How To Hack A Turned Off Computer Or Running Unsigned Code In Intel Management Engine
EFF: Intel's Management Engine is a security hazard, and users need a way to disable it
Sakaki's EFI Install Guide/Disabling the Intel Management Engine
Intel ME bug storm: Hardware vendors race to identify and provide updates for dangerous Intel flaws.
CVE-2017-5689: An unprivileged network attacker could ga

Fuck Intel, as of this moment AMD is much safer

[Anonymous Coward]

Don't fall for Intel's PR tactics.

Meltdown is much worse than Spectre and Meltdown is an Intel only flaw.

Purchase Delay

[Anonymous Coward]

No purchases until hardware fix.

This will be a total shit-storm

[Anonymous Coward]

Lovely bug that can't be fixed by microcode. Millions of flawed CPUs out there. What's the technology that pushes native code to run in web browsers called again? Can't wait for that clusterfuck to happen.

Re:This will be a total shit-storm

[sconeu]

What's the technology that pushes native code to run in web browsers called again?

ActiveX.

Re:This will be a total shit-storm

[Actually, I do RTFA]

What's the technology that pushes native code to run in web browsers called again?

ASM.JS

What do they hope to get out of it?

[swb]

Will they have to actually demonstrate a material loss resulting from a security breach associated with the flaw, including some kind of material proof that the flaw was actually the cause of the breach?

I'm kind of guessing time spent running around and patching probably isn't something they can sue for, otherwise MS would have been out of business ages ago on this item.

And what do they actually hope to get out of it? New CPUs not compatible with their existing motherboards? A cash payment based on the pro-rated cost of the microprocessor itself based on remaining life cycle?

I can see the obvious desire to rake Intel over the coals and perhaps they deserve some of it, I just don't get how you can link any specific loss to this chip flaw, or if you can, it's extremely hard to prove.

I'm also curious if there's not some general defense for Intel along the lines of "running a computing infrastructure involves dealing with bugs and flaws in hardware and software, problems will arise".

Re:What do they hope to get out of it?

[Aighearach]

Exactly this.

The harm is that when the user accidentally grants explicit access for some malware to run on their computer, now it can be 15% more naughty. That's bad, but pinning it on Intel is going to be hard, even if it is actually a bug. But it might not even be a bug, it might be a misfeature that the whole industry misunderstood. And it might not be a misfeature in the CPUs, but in many of the Operating Systems, who foolishly trusted things that were only assumed to be true, but had not actually been promised.

The lawyers are just hoping that when it is clear the cases are weak, that Intel offers them a settlement of some legal fees to make it go away faster. Obviously the "plaintiffs" won't see trial, I doubt they'll see even a token settlement amount.

Re:What do they hope to get out of it?

[Anonymous Coward]

I own a boutique near-line cloud company. We serve cloud infrastructure to a few specific industries. I own roughly 16,384 Cores of Xeon processors. Patching them consumes anywhere from 15-20% more CPU. So it's a pretty easy thing to point out that Intel effectively owes me 2500 or so cores of xeon and associated delivery hardware plus infrastructure ( we use UCS/Nexus/EMC, hosted in commercial datacenters ) to bring me up to the performance I purchased from them.

I'm a small fish in this market. I can't imagine the damages one of the larger players will ask for.

-A

Re:What do they hope to get out of it?

[Anonymous Coward]

They hope to push CPU development to Asia.

Re:What do they hope to get out of it?

[Anonymous Coward]

>I can see the obvious desire to rake Intel over the coals and perhaps they deserve some of it, I just don't get how you can link any specific loss to this chip flaw, or if you can, it's extremely hard to prove.

For one thing, if there's a measurable performance hit for operating system software that patches the bug, then that's money off the bottom line of companies with huge numbers of servers and virtualized machines where they charge by the CPU hour. Suddenly due to a security flaw in Intel's hardware their performance dropped by 10% (depends on a bunch of factors, but they can benchmark before and after). If they bill by the hour that's worth something.

As you mention, the question becomes whether you can claim any damages at all, but they certainly are measurable. I don't think it's much different from the Volkswagon scandal where they faked pollution performance with defeat devices, except that in this case Intel can claim they didn't know about it until someone pointed out the problem, rather than intentionally trying to commit fraud. That's why they might be protected, but it would hinge on what they knew and when, and how they handled the knowledge.

Re:What do they hope to get out of it?

[Anonymous Coward]

To be honest; I'd much rather see them hit with fraud & other things when they continued to sell known defective chips those 6 past months & even came out with Coffee Lake. In their attempt to cash in before the big reveal in January.

Fuck off

[Anonymous Coward]

but setting the precedent that you're liable if your product is vulnerable to exploit techniques that are invented after the product ships would be very dangerous for the entire industry.

Fuck off, make dangerously broken shit and you need to do a recall, just like the auto industry.

Re:Fuck off

[Sarten-X]

Now, that may be the moral obligation, but the legal concept is much more difficult to define.

How dangerous is dangerous enough to warrant a recall? Sure, this may leak some data, but now that the vulnerabilities are known, they can be mitigated... or do we also claim that software vendors who don't implement mitigations are making a "dangerous" product?

Who's responsible for the recall? I've rarely purchased directly from Intel. More often, I buy CPU/motherboard combos from vendors. Are they going to support the recall? My mother isn't qualified to take apart her computer and replace the chip, so who's paying for the tech to come out and do it?

Meh, I'll be joining one

[rsilvergun]

I already know I don't have it in me to take Intel to court, but I'm pretty peeved since I bought an i5-7500 right before this stuff was announced (and you can't return processors anywhere). It knocked about 5% off the performance and I would have waited until the next gen stuff was out this year or next (or bought a Ryzen) if I'd known.

They should be sued

[Anonymous Coward]

They were selling processors with known security flaws for six months without disclosing that information. They should have to make good with the people that they screwed over.

Will it even matter, though?

[Voyager529]

I mean, thinking this all through, it seems to be a frivolous exercise without some massive shift.

Intel grossed over $60 billion in FY 2016. Even if each of these lawsuits requires Intel to pay $1 billion, and all of them are won, it's less than six months of revenue for them - not fun, but not the corporate equivalent of $150,000 in individual medical debt, either. Intel has enough in the bank to ride the storm, and simply bump up CPU prices by another 15% until the costs are paid...and then leave the prices there.

In a perfect world, this would give AMD the golden opportunity to pick up the slack. The Ryzen line of processors has been met with a whole lot of favorable press; they could easily take over the i3/i5/i7 desktop/laptop markets from a performance perspective. However, AMD has spent the last decade scraping the bottom of the barrel with their A10 processors and similar, low performance CPUs that are almost synonymous with the sub-$400 laptop market, and the hatred that people associate with Windows machines. Even if the shelves at Best Buy became 50/50 between AMD and Intel (as opposed to right now, when there are more Xeon-based laptops available than Ryzen 5 and Ryzen 7 combined), it's going to take consumers quite a while to realize that AMD makes high end processors, too. Intel sales take a dip, sure, but I don't see AMD managing to truly eat at Intel's market in a way that leaves a lasting impact.

The server room is still Intel's. Dell, HP, and Lenovo have dabbled in a few AMD-based machines (I've got a pair of Opteron-based R415's running as routers myself), but will AMD having misstepped with the Bulldozer architecture and certain server applications being all "we only support Intel", I don't see AMD making massive inroads there either. This is compounded by the likelihood that Dell ordering 0.8X Xeon processors from last year and making up the slack with newer Opterons is going to inevitably involve a higher per-processor price, making their servers more expensive, meaning that if Lenovo keeps their orders up, they will be cost favorable, leaving Dell less able to compete on price unless sysadmins really do start ordering AMD-based servers for their racks.

Now, the one player that really could make a dent would be Samsung - there's not a laptop component they don't make except the processor at this point, so retooling their Exynos chip fabs to make an x86 processor that can compete with an i3 and deliver an end-to-end, single-manufacturer laptop or desktop is in the cards for them, certainly more so than any other manufacturer. If they can pitch one running Android and avoid a Windows license, even better. Even so, it's risky for Samsung, and although they can eat a pretty big loss, trying to capitalize on Intel while they are down and hoping that consumers end up buying a laptop sporting a CPU from relative newcomer is not the kind of gamble that risk-averse execs are likely to go full force on.

In summary, Intel CPU processors will rise, AMD may well be capable of meeting demand but OEMs, retailers, sysadmins, and consumers are going to be a bit skittish about giving AMD a shot when Intel is a known quantity, and while Samsung could probably kick 'em while they're down, it's highly debatable that they will do so. In the end, Intel is likely to just raise prices and the world continues as normal.

Re:Will it even matter, though?

[110010001000]

Wow. You are a good corporatist there. You never mentioned the affected end users, just Intel and a few other mega corporations. Good job.

Re:Will it even matter, though?

[Voyager529]

Wow. You are a good corporatist there. You never mentioned the affected end users, just Intel and a few other mega corporations. Good job.

Affected end users aren't fabbing their own processors. Affected end users are in a position to decide how much they care, and whether they will buy not-Intel for their next computer. Affected end users may choose AMD, but are unlikely to do so in an impactful manner. Affected end users may have the option to purchase from Samsung if Samsung decides to enter the market. Affected end users will likely end up paying more for Intel, as Intel is likely to simply increase costs to affected end users in order to cover the payout of the lawsuits.

Is that rephrasing more to your liking?

Re:Will it even matter, though?

[swb]

Stop making sense. Just climb onto the pro-AMD/anti-Intel bandwagon and brigade against the man!

We were promised perfection by Intel, and by God we will scream until we get it.

Re:Will it even matter, though?

[Anonymous Coward]

We were promised perfection by Intel..

No, we were promised secure hardware, you obtuse douche-nozzle.

Re:Will it even matter, though?

[Aighearach]

They said if I bought a used 8088, my computer would run "too slow" to do anything, but I still did stuff.

They said if I bought a 386SX, my computer would run "too slow," but it didn't.

They said if I bought Cyrix, my computer would run "too slow," but GCC didn't care and neither did I.

They said if I bought AMD, my computer would run "too slow," but I had long stopped listening and just kept using the tool.

The truth is that most of what I use my computer for I could be doing on a microcontroller if it was all I had. But I don't have to, because even old personal computers are easily fast enough to do it all; at low load!

Re:Will it even matter, though?

[Aighearach]

We were promised perfection by Intel..

No, we were promised secure hardware, you obtuse douche-nozzle.

No, you were promised hardware, dill weed.

And it was delivered.

That's a bold strategy cotton

[rsilvergun]

try that in America where we do Jury trials for a lot of these sorts of things and it'll blow up in your face. The rest of the world that might work though.

Re: Russians did it! lol Intel named Pentium @ h

[Anonymous Coward]

I want to be a Russian! There isn't anything those heroic, chisel-jawed Slavic comrades can't do. They can materially affect the outcome of US elections with $87 and 1000 posts on social media. They can infiltrate yer softwares at will. They are truly supermen.

Chinese alternative coming soon

[Anonymous Coward]

Zhaoxin launches their highest-performance Chinese x86 chips

China has taken a major step forward in its quest for high-performance domestic Chinese microprocessors with Zhaoxin's launch of their newest x86 processors.

In case you've never heard about Zhaoxin, they are a Chinese microprocessor designer that has been working on developing a domestic x86 CPU microarchitecture. Being partially owned by VIA Technologies most likely means they are covered by VIA's x86 cross-license agreement, although VIA refused to confirm this when we asked. The 2010 FTC settlement required Intel to modify agreements with AMD, Nvidia, and Via to allow them to undergo mergers and joint ventures with other companies without the threat of being sued for patent infringement. Zhaoxin is majority owned (80.1%) by the Shanghai Municipal Government and the push for domestic x86 chips comes as part of their national security initiative which calls for the reduction in reliance on foreign products and greater control over their own intellectual property (i.e., the hardware in this case).
5th Generation KaiXian

On December 28 at a conference dedicated for independently-developed domestic Chinese CPUs, Zhaoxin officially launched their 5th generation KaiXian processors. Fabricated domestically on HLMC's 28nm process based on the WuDaoKou microarchitecture, those processors represent a significant step forward.

Zhaoxin announced two new series based on their latest architecture: KaiXian 5000 (KX-5000) and the KaisHeng 20000 (KH-20000). Note that "KaiXian"/"KX" is exactly the same family as the previously named "Zhaoxin KaiXian"/"ZX". The slight renaming was done to distinguish prior VIA Technologies architecture from Zhaoxin mostly domestically developed architecture.

Andy Patrizio is either a fucking Intel shill

[Anonymous Coward]

That article contains errors. In particular, the article claims that AMD processors are "potentially vulnerable to only one of the three variants of Meltdown". This is incorrect for two reasons.

(1) There is only one "variant" of Meltdown. Presumably, the author mistakenly considers Spectre Variant 1 and Spectre Variant 2 to be "variants" of Meltdown.

Or he's a moron

Voyager52 thinks with Intel's dick in his mouth

[Anonymous Coward]

However, AMD has spent the last decade scraping the bottom of the barrel with their A10 processors and similar, low performance CPUs that are almost synonymous with the sub-$400 laptop market, and the hatred that people associate with Windows machines. Even if the shelves at Best Buy became 50/50 between AMD and Intel (as opposed to right now, when there are more Xeon-based laptops available than Ryzen 5 and Ryzen 7 combined), it's going to take consumers quite a while to realize that AMD makes high end processors, too. Intel sales take a dip, sure, but I don't see AMD managing to truly eat at Intel's market in a way that leaves a lasting impact.

LOL you're a fucking moron, 10 years ago the world didn't run on social media, now news travel fast, very fast.

AMD is killing Intel in performance and prices, that's what the customers see, not what AMD fucking released 10 years ago.

You think like a moron, stop thinking with Intel's dick in your mouth.

Re:Voyager52 thinks with Intel's dick in his mouth

[Voyager529]

LOL you're a fucking moron, 10 years ago the world didn't run on social media, now news travel fast, very fast.

AMD is killing Intel in performance and prices, that's what the customers see, not what AMD fucking released 10 years ago.

You think like a moron, stop thinking with Intel's dick in your mouth.

Normally I would just ignore the AC who can't spell my name right...

We agree that AMD's mainline CPUs are at least equivalent, if not superior, to Intel's offerings. The issue isn't that AMD had very low end processors a decade ago, but that AMD's low end processors have been the most readily accessible to customers for the past decade. The brief time when AMD beat Intel to 64-bit desktop CPUs with the Athlon64 line was the last time, to my recollection, that midrange machines sporting both Intel and AMD shared shelf space side by side in most computer retailers. Since about the Core 2 Duo/Quad era, it's been rare to see a midrange or high end laptop or desktop with an AMD processor; it's the sub-$400 machine space where AMD has been hanging out for a very long time.

Now yes, people like you and I know better. My last two NAS builds, along with my homebrew cable box, are all FX-6300 based (as are three others I built for friends and clients). My original post indicates that I've got a pair of Opteron-based Poweredge servers functioning as routers. I've personally bought more AMD processors than Intel processors, because they deliver solid performance at a good price (and are a good fit for FreeNAS because they support ECC RAM at 1/3 the price of a Xeon).

Go to Bestbuy.com and filter laptops by Ryzen5 and Ryzen7 processors. In my region there were precisely two options available. There were three laptops listed with Xeon processors. Over a hundred each for i3's and i5's. 3/4 of the other AMD laptops were in the under-$500 range, with three under $300. Now, you can argue that I'm a moron for using Bestbuy.com as my baseline because everyone shops at Amazon, but I don't have that kind of time and there are still plenty of people unlikely to buy a laptop sight unseen.

This leaves us with the custom build market for the more powerful CPUs to reside, but in my experience, that's still a bit of a crapshoot. It's dumb to recommend AMD wholesale when someone going to Costco is likely to get one of the lower end CPUs in the box, rather than the nicer processors you and I both know they make. There are still some people who are willing to have their machines custom built, but it's a relatively small market that is far less likely to get the sort of social media traction that would be able to stem a decade's worth of inertia.

Even if this ends up being AMD's time to shine and they're able to muscle their way past all of this, Intel can either reduce prices provisionally or can pull some 90's Microsoft back door deals to ensure more prominent advertising and similar, bringing it all back to status quo.

I'm not an Intel shill, but I've watched far BP and Bank of America and Equifax pay virtually no consequences for their poor actions. I do not put it past Intel to do anything different.

low life and willing to be

[Anonymous Coward]

The ambulance chasers are having fun.

Nice try Intel shill

[Anonymous Coward]

Numerous combinations of CPU instructions might turn out to not do what you wanted them to do, if you wanted a different thing than what they physically do! That has nothing even to do with Intel.

Look up Pentium's FDIV bug.

But then

[Anonymous Coward]

The i9 7940X, 7960X and 7980X should not have been released last year or if released only with a disclosure of vulnerability.

The Intel CEO wouldn't be able to dump his stock at high prices.

EZ way to cripple Intel AMT/ME

[Anonymous Coward]

Stop it's ability to send info. outward via router port filtering ports 16992-16995 + 623-625 Intel AMT/ME uses in a modem/router external to OS/PC.

Intel ME/AMT operates from your motherboard but has NO CONTROL OF YOUR MODEM/ROUTER!

(This stops it cold talking in/out permanently OR being able to remotely 'patch' it to use other ports by Intel OR malicious actors/malware makers etc.!)

Additionally, once you disable the AMT engine's software interface (ez via software like the unistaller for it & DisableAMT.exe + the test in usermode via Intel-SA-00075-GUI.exe to TRIPLE CHECK)? A malware to 'repatch' this = impossible (bios updaters require it in usermode ware, e.g. ASUS).

(I only allow 80, 8080 & 443 in/out here on a SINGLE stand-alone system (no home LAN but TCP/IP connected online in BOTH my modem or router port filters or software firewalls))

HOWEVER - Be CERTAIN your modem/router's internal ware is "solid" too (turn off things like UPnP etc. & CHECK router/modem HAS NO KNOWN BACKDOOR EXPLOITS (tons do unfortunately)) - get it patched ASAP if it's KNOWN exploited & TONS of routers, ARE https://it.slashdot.org/comments.pl?sid=9995967&cid=53488785/

* GOOD ROUTERS/MODEMS HAVE PORT FILTERING OPTIONS (crappy ones don't)!

Especially after this finding: Intel Management Engine pwned by buffer overflow vendor patches for the vulnerability may not be enough http://www.theregister.co.uk/2017/12/06/intel_management_engine_pwned_by_buffer_overflow/ & Marcus Hutchin's "magic bit" patch doesn't help vs. this either.

APK

P.S.=> Good luck - it's the BEST EASIEST & CHEAPEST DEFENSE using what you already have (hopefully, again as not ALL modems have port filtering but most do & certainly GOOD ONES DO) vs. this threat by stopping it being able to communicate in/out period, from OUTSIDE of the INTEL chipset external to it via a router/firewall hardware... apk

Re: EZ way to cripple Intel AMT/ME

[Anonymous Coward]

Thanks APK. That was helpful

To be clear:

[Anonymous Coward]

Speculative execution (security problem by arbitrary elevation of ring 3 --user application-- to ring 0 --operating system kernel--) is done exclusively by Intel. Branch prediction was over 95% effective on pentium series processors, and since its so good lets pre-compute the 'winning' side several hundred instructions in... and they escalated priveledges to do it. And got a performance gain, so long as security isn't affected, and it theoretically wasn't til now. And so we all suffer a 1.5% performance hit to fix the hole. As for reading the TLB. The translation lookaside buffer is a special kind of stack, used as an index. Imagine programs in the pipeline. They get context switched every 4000-5000 clock cycles. The computer is a dumb box full of electric circuits and it doesn't know where anything is... and its just like an undergrad reading a college textbook. You find a word you don't understand, so you mark your page, flip to the back, look in the alphabetical index, find out the meaning of the word, and move on. Only here the index is added to when a new program is started. As more programs are started, older entries are pushed down. When it needs to find something, it looks in the index, which can find any entry in a few clock cycles (in theory one, but there are 3 levels of index: fast, medium, slow). When it finds what it needs, it pulls it out, pushes everything above it down one, and puts what it found back on top. When the index is full, stuff falls off the bottom, which is like a freshman who can't find the word in the index, you have to search the whole book (search all of memory)... page 1, page 2, page 3.... if it can't find it, it coughs up an error. Back to security: reading the TLB might not be the keys to the kingdom, but it sure as heck is a map to the whole kingdom! AMD gets hit with this one too. Workarounds and more security regarding access to the TLB are ongoing. The Linux developers had a security mechanism called "Full Unloading Complete Kernel With Indexed Trampolines". Their contempt for the hardware developers can be seen by abbreviating their workaround.

Performance hit

[Anonymous Coward]

We pay top dollar for performance and now the hardware providers solution to these vulnerabilities is to steal back performance. I think a partial refund of the purchase price is the only solution. How would a car enthusiast react if they purchased a Dodge Hellcat for example and six months in Dodge informs them they have to detune the motor so it performs like a typical sedan because itâ(TM)s doesnâ(TM)t pass smog. There is no difference here. They should refund the difference between the hellcat and the sedan.

fix it in the OS without patching the CPU...

[Anonymous Coward]

1) Remove ALL supervisor code and all credential information from user process's virtual memory
2) All user mode I/O and supervisor calls are re-implemented as message passing functions with read-only user mode
    driver code in the client process and separate supervisor state driver code that only exists in the supervisor process
3) The supervisor and I/O drivers run on a separate CPU core from user code
4) If the supervisor and I/O drivers are idle flush the CPU L1 cache before running any user process on the
    Supervisor CPU
5) The ONLY shared memory between a user process and the supervisor are the I/O buffers pages for open user
    process I/O devices
6) User processes CANNOT load code, ALL code is marked execute-only/read-only
7) Fuzz the result of calls to get high resolution timer values to 100us resolution with a random value for
    us and ns values only trusted applications can access higher resolution timers
8) Trap all speculative access to out of bounds locations. Instead of allowing a process to continue if the
    condition is not met, disable the process and force manual intervention to re-enable the process until developers
    fix their bugs. Force the result of a speculative load of an invalid address to be zero in all cases.

You're welcome... apk

[Anonymous Coward]

You're welcome. I wish I could come up w/ something as effective vs. the Intel Spectre/Meltdown issue though.

APK

P.S.=> "Onwards & UPWARDS"... apk