Some serious security bug in INTEL CPUs?? Since Westmere possibly

[mockingbird]

Re: Some serious security bug in INTEL CPUs?? Since Westmere possibly

FYI, Dell has started rolling out BIOS updates based on Intel's redux of their microcode fix for variant 2.

http://www.dell.com/support/article/...oducts?lang=en

Update 02/05/2018
Dell has received updated Intel microcode for select platforms to mitigate against the Spectre (Variant 2) vulnerability CVE-2017-5715. Dell has started to deploy the new BIOS updates for these platforms listed in the table of Dell Products Affected below. Other BIOS updates for listed affected platforms will roll out over the coming weeks.
All customers with an affected platform should download the latest BIOS update listed below, even if they have deployed an earlier BIOS version for this vulnerability. Those who have disabled the microcode patch using an OS configuration option should re-enable it manually after applying the BIOS updates.
As a reminder, the microcode update is required for Spectre (Variant 2), CVE-2017-5715. The Operating System patches provide mitigations to Spectre (Variant 1) and Meltdown (Variant 3) and are also required.

[Curious.George]

Re: Some serious security bug in INTEL CPUs?? Since Westmere possibly

I'm not that old but somehow I'm sure your right and Intel and MS are the pros of security by concealment. I don't know if it's correctly written, my english isn't so good.

Because security isn't a priority to them! It's like building a glass house and putting a fancy lock on the front door and THINKING it's secure! (D'oh!)

Walk around YOUR house and ask yourself how you'd "get in" if you had to. First, imagine the repair cost is not important (cuz you're an adversary, not the homeowner).

Then, having found a dozen or more ways, think about it, again, with an eye towards how to do it so that it is easy/free to repair.

You have to take the same sort of attitude when designing a system/product for security -- at each step in the process!

Would you have made all of those mistakes if you were designing the house to be secure??

The funny thing is that when the somebody buys a laptop without OS they want to install Windows 10 on it because is the latest, like there wasn't any other Os in this world.

MS and manufacturers don't make it particularly easy to install older OS's on new machines. Likewise, all of the FOSS offerings are still way too techy for the average user to install and maintain (without having a "friend in the business").

[stj]

Re: Some serious security bug in INTEL CPUs?? Since Westmere possibly

see the big e-coin heist yesterday??

2 questions:
1: did they use intel systems?
2: did they use m$ o.s.?

if either is yes, they should be held liable for not securing $500million in coins!!

neither are secure, we need some lawyers to point out to company's that they can be held liable for not securing data!!

[hikaruichijo]

Re: Some serious security bug in INTEL CPUs?? Since Westmere possibly

And, because the mindless masses have embraced a bad product, the entire industry has diverted resources to making (often inferior) products to fit that product -- to the detriment of better options (that don't command enough of a market share)!

I.e., the (poor, uninformed) choices of the masses drive the products available to all! It's taken 40 years for the Linux/MS worlds to make it to where we were in the 1970's (in terms of operating system reliability and security)...

I'm not that old but somehow I'm sure your right and Intel and MS are the pros of security by concealment. I don't know if it's correctly written, my english isn't so good.

there are Laptops without OS.
(

The funny thing is that when the somebody buys a laptop without OS they want to install Windows 10 on it because is the latest, like there wasn't any other Os in this world.

[Stefan Payne]

Re: Some serious security bug in INTEL CPUs?? Since Westmere possibly

I never recommend Win 10 to anyone, but new laptops come with it and so people use it, and a lot of customers are angry because of that big updates, but they continue on using Win 10 because they never saw a Linux logo on a new laptop.

there are Laptops without OS.

But the more complicated things are, the more it becomes like religion, believing/faith and shit like that are more important like facts...

Sad thing is that i don't believe Intels reputation took a hit

[Curious.George]

Re: Some serious security bug in INTEL CPUs?? Since Westmere possibly

I told to some friends to use Linux instead of Windows, but is impossible to convince then even when they see it on my laptop and they use their computers only for web browsing and multimedia.

And, because the mindless masses have embraced a bad product, the entire industry has diverted resources to making (often inferior) products to fit that product -- to the detriment of better options (that don't command enough of a market share)!

I.e., the (poor, uninformed) choices of the masses drive the products available to all! It's taken 40 years for the Linux/MS worlds to make it to where we were in the 1970's (in terms of operating system reliability and security)...

[hikaruichijo]

Re: Some serious security bug in INTEL CPUs?? Since Westmere possibly

I never recommend Win 10 to anyone, but new laptops come with it and so people use it, and a lot of customers are angry because of that big updates, but they continue on using Win 10 because they never saw a Linux logo on a new laptop.

Microsoft has they money to promote their OS like Google has the money to promote their web browser, and both of then are pretty aggressive on that, so a lot of people relates the use of the Google search engine with the use of the Chrome browser, most users don't know what is a search engine and what is a Web browser, like a lot of people only knows Intel because they saw it even on the TV.

I told to some friends to use Linux instead of Windows, but is impossible to convince then even when they see it on my laptop and they use their computers only for web browsing and multimedia.

[stj]

Re: Some serious security bug in INTEL CPUs?? Since Westmere possibly

Do "you", the people that understand run a MS OS?

no.

[Curious.George]

Re: Some serious security bug in INTEL CPUs?? Since Westmere possibly

The marketing is they key to this, it does not matter if "we",the people that understand and have to deal with these problems are angry or not, while the people on the street asks for intel and nvidia, and if we think with our heart instead of our heads, and don't put some logic to this, things can only go worse.

Do "you", the people that understand run a MS OS? Despite the weekly patches -- many of which are on a par with the size of the OS itself?? Doesn't your HEAD tell you that's a silly approach? Would you drive a car if the dealer recalled it EVERY WEEK??

[hikaruichijo]

Re: Some serious security bug in INTEL CPUs?? Since Westmere possibly

The people on the street only sees the marketing and belives that, the "intel inside" and "It's meant to be played", that's what normal people see, and so they ask for intel and nvidia, and so nvidia had the bumpgate and people still buys nvidia thinking they are the best and intel had other big problems and people still buys intel because the think intel is the best, and neither nvidia or intel went into bankrupcy.

The marketing is they key to this, it does not matter if "we",the people that understand and have to deal with these problems are angry or not, while the people on the street asks for intel and nvidia, and if we think with our heart instead of our heads, and don't put some logic to this, things can only go worse.

Intel stackes are around at fouty dolars, and amds are at around fourteen.
So it seens that intel isn't having any problems because of this.
People still buys intel, and I think they will still buy intel even if they had a gun pointing at their head.

[RJARRRPCGP]

Re: Some serious security bug in INTEL CPUs?? Since Westmere possibly

I've tested and i7 920 that said 130W TDP and it reached more than 200W with prime95

Sounds just like Kentsfield again, LOL. And worse, your test wasn't even with Linpack, LOL. Linpack will work it harder, often. I haven't found a Prime95 setting that I can confirm to match Linpack!

The wattage, sounds just like I would expect with my grumpy ol' 2008 Q6600 at 3.3 Ghz, LOL.

Also, that T-bird was toasted, because the heatsink was also taken off with a game running, IIRC, LOL.

[stj]

Re: Some serious security bug in INTEL CPUs?? Since Westmere possibly

well......
that's that then, you go AMD, or you go home!

https://www.computerworld.com/articl...are-fixes.html

cant help wondering if this is a devious scam to sell an absolute fuckload of new hardware soon.
if it is, i hope they get sued into bankrupcy and physically destroyed by the receivers looking for stuff to sell!!
NEVER trust Israeli company's or products!!

[stj]

Re: Some serious security bug in INTEL CPUs?? Since Westmere possibly

who remembers AOL and the "DUN" dialup manager software!!

[RJARRRPCGP]

Re: Some serious security bug in INtel CPUs?? Since Westmere possibly

It was the dark ages of computing! The period that made Topcat put his feet down, due to widespread bad motherboard caps! (Also includes the period of the widespread-bad-Antec-PSU-caps-problem...)

And that was the same period, as Adelphia! That motherfucking ISP, is why I refused to get cable in 2003 and stayed with 56K, LOL (Even though with a local ISP, who didn't boss me around about what I can and can't do with *my* PCs.)

I'm glad that Adelphia is extinct!

[Curious.George]

Re: Some serious security bug in INTEL CPUs?? Since Westmere possibly

But the most likely reason why such problems exist is just arrogance and bad attitude and managers pushing chip designers and programmers to make something faster and with less money, rushing everything to release new stuff every one or two years.

This is almost certainly the reason.

Systems (and components) nowadays are incredibly more complex than they were a decade (or four) ago. My favorite definition of "complex" is: "something too big to fit in your head". As a result, you can't see the unintended interactions that can occur inside a particular system.

Years ago, an individual could design a processor. Now, the job is so large and the time (and money) pressures so intense that you MUST rely on a team to do the job. And, those heads rely on imperfect communication mechanisms (speech and writing) to convey their thoughts -- all fraught with potential for misunderstanding!

Also, people invariably bring "assumptions" to a design that they may not even be aware of... things that they consider such "basic truths" that they never question them ("Who in their right mind would deliberately crash an aircraft? THEY would die in the event!!")

I'd be curious as to how many organizations formally adopt a red team-blue team approach to these problems (and how many extend the concept beyond just "raw security")... Nowadays, it seems like companies expect their customers to test their products! :<

[Topcat]

Re: Some serious security bug in INTEL CPUs?? Since Westmere possibly

Yeah, the problem is you don't know how many of these bugs were required by NSA and other organizations...

...and if one believes that, one is also foolish to believe that AMD and other chipmakers are 'immune' to it...

[i4004]

Re: Some serious security bug in INTEL CPUs?? Since Westmere possibly

stj, ^^ wow!
where was that written, i hear today fb takes accounts offline for much less!

this is overblown, just as most stories these days (politics becomes gossip rather quickly, science becomes sf), and i bet this thread alone holds at least...hm...10(?) conspiracy theories on "who exactly made this bug and for what reason".

but let me offer my take on it, but you don't have to think i'm totally serious, OR that i'm totally kidding....heh:

the most interesting thing about this is how EU actually payed somebody to produce more CO2!

hear me out: austrian team of "researchers" from graz university is partially sponsored by EU bodies (if you read the end of the meltdown.pdf on the relevant website), then this patch/patches waste some cpu cycles, and as a result increase energy consumption. a bit on every pc, but all "farms" and "clouds" (back in the day they were called servers!) have plenty of machines, and ergo megawatts and megawatts of power are wasted, and germany (for example) still makes almost half of it's electricity via coal plants, so there, EU partially sponsored global warming (offcourse trump can't come up with such an elaborate explanation how europeans shoot themselves in the foot...hehe)

so now the science has "advanced" so much that they do what exactly?
read blogs (that influence them) and then spend tax payers money to find bugs that wouldn't otherwise be found, because script-kiddies don't know how cpus work anyway....
advancement indeed!

i injected some humor here, but unfortunetely there are so much facts i said above that it becomes less funny.
yes, i know google researcher also came to same conclusions, but i was originally reading meltdown.pdf and just witnessed how these boys of austrian universty become internet reality stars....hehe...i mean you read that paper like it was some monumental discovery, bigger than transistor or ac current.

on a more serious note, this is overblown in another way too: is it like prior to this there were no keyloggers and cryptlockers and malware that took COMPLETE control over your pc, not just sniff the ram?
isn't it more fun to know what's on hdd?

so overall this is just the sign of the times.

[mariushm]

Re: Some serious security bug in INTEL CPUs?? Since Westmere possibly

Yeah, the problem is you don't know how many of these bugs were required by NSA and other organizations to be put there in the first place , or how much money Intel received to NOT fix some of these bugs.
Or how many things Intel is forced through non disclosure agreements and other national security letters and laws not to reveal.
There's even rumors that NSA has people inside Intel working as programmers or managers with agenda to make such exploits possible.

But the most likely reason why such problems exist is just arrogance and bad attitude and managers pushing chip designers and programmers to make something faster and with less money, rushing everything to release new stuff every one or two years.

[stj]

Re: Some serious security bug in INTEL CPUs?? Since Westmere possibly

a guy on eevblog has a good solution.

The only way to fix this situation, is to take about 10% of the top management of Intel and Microsoft, and kill them. Give the companies 30 days to open source the entire platform and a year to remove all the spying bullshit, on pain of the next 10% getting the same treatment. And so on.

sounds good to me, but 25% may be more effective!

[RJARRRPCGP]

Re: Some serious security bug in INtel CPUs?? Since Westmere possibly

Well, it's apparently not remotely exploitable, unlike the Blaster virus incidents of 2003, and Sasser of 2004 (and maybe later in 2003)

All you had to do to get exploited, with the 2003 and 2004 incidents, was to hop on the internet without a firewall!

You could get exploited within seconds on 56K, IIRC!

It was the dark ages of computing! The period that made Topcat put his feet down, due to widespread bad motherboard caps! (Also includes the period of the widespread-bad-Antec-PSU-caps-problem...)