Microsoft Pluton "integrated security" (Intel, AMD, Qualcomm)

Lounge
1

Official Microsoft Pluton announcement
TechCrunch article
Phoronix - Pluton Linux 6.3 support

What we know for a fact?

  • Proprietary hardware blackbox inside your CPU which runs proprietary code.
  • Chip-to-Cloud security - which means it’s connected to the internet.
  • Has low level hardware access.
  • Impossible to physically remove, flash or make sure it is bypassed.
  • It’s advertised as TPM.

What are valid concerns to avoid it like a plague?

  • Breaking all encryption at once - is the biggest dream of all glowing agencies and governments around the world. Is there any better way of doing it than reading everything before it is encrypted, therefore completely bypassing end-2-end encryption by chip inside all CPUs on the market? Just like Apple already does with iOS and MacOS which means when you use any private messenger and talk with Apple user - your communication is already burned? That was rhetorical question.

  • Microsoft and all of it’s products are known worldwide for security…Spyware, selling your data to feds and ad companies, and now they’ve conspired with ALL top most CPU manufacturers to always have full system access on absolute most possible variants of hardware people use daily, be it PC market or mobile market.

  • Absolutely unremovable backdoor, which it’s already claimed to be a successor and logical conclusion of Intel ME and AMD PSP - known motherboard based backdoors that has full access to your system independently of OS, because it runs Minix. Both of those chips are likely runned by NSA, since according to whistleblowers all of their motherboards ordered aboard doesn’t have Intel ME / AMD PSP right from the factories, and there could be only one reason why. Given fact of massive corporate collusion - likely Pluton is the same, more sophisticated spyware grid.

  • Even if by miracle it’s not backdoor and only does what it actually advertised for (although there’s no way to check that for proprietary firmware) - what it certainly is - just another attack vector for bad actors, all similar chips become hackable and desired target for professionals and criminals, because it has full access to your system. Great example would be Apple T2 security chip which has unfixable 0 day - this way your system become significantly more vulnerable with such security chip without ability to mitigate it.

  • Chip that has full access to your system, meaning ability to read, write from memory and disk and access to the internet - can and therefore will at some point also be DRM and severe as violation of property rights in your own hardware, exactly the same way that Apple or XBOX does it already, meaning:

    • You don’t have a license to run that.
    • You can only install this.
    • We have scanned your file and it’s outlawed, we’ve removed it and send cops your way.

What can we do to avoid it?

Action

Let’s face it - hardware backdoors is not a technical problem to solve, because everyone can’t use RISC-V or some fully free system by definition, it’s mass market and mass-surveillance + breaking of encryption that is targeted.

So only boycott, huge media campaign, huge backlash and complete removal could really successfully fight it. Make yourself heard through media, tech creators, forums, public campaigns etc.

RISC-V

RISC-V is the only free & open-source CPU specification, that allows to build fully open-source hardware including motherboards which is driven by open-source firmware!

It’s still early days, there are mostly boards comparable to consumer ARMs, some comparable to Intel Core i7 performance.

:warning: Please note that if something allows to be Free & Open-Source - it doesn’t meant conrete implementation will be - you have to do some research before buying RISC-V.

Best reference example of implementation so far are sifive boards.
Linux support is still beta on Debian, Arch and Gentoo.

POWER9

Great option, in case you have spare 4000$ you can go endorsed by FSF. No laptops!

Talos II Lite mainboard
Talos II Mainboard

x86 / ARM CPUs

Don’t buy any CPU released after 17 November 2020:
There’s no database or viable way to check before you buy, if you want to be 100% sure - don’t buy CPU that was released past the date when Pluton was first announced.

First known CPU on market were AMD Ryzen 6000 for laptops, since then at least for Intel AMD and Qualcomm assume every CPU should certainly be released with Pluton, however only AMD reports it.

To get fully FOSS system (no Pluton, no Intel ME, no AMD PSP):

My personal initial reaction in the time of first hearing about it

May i say it?
Can i please say it?!?

F*CK MICROSOFT!!! :facepunch: :face_with_symbols_over_mouth: :boom:
Burn in Hell :fire:

9 Likes
2

What could possibly go wrong? :roll_eyes:

2 Likes
3

Absolutely nothing! :joy:
You see, it’s for your safety and security :rofl:

Just like Intel ME & AMD PSP was, but don’t tell nobody :shushing_face:

Safety first.
THINK ABOUT CHILDREN!

And what’s that, :pirate_flag: content?
Oh you nasty boy, we gonna suspend your accounts since we know all your passwords, and send officer your way…

Jesus Christ, it’s like from 0 to Deus Ex in 60 seconds…

8 Likes
4

I don’t want Microsoft having anything to do with my hardware, firmware, passwords or anything else! Seriously …same with Google, Facebook etc. :rage:

7 Likes
5

Usually works.

2 Likes
6

I saw this and was like post it? Then I went back to what I was doing. This is not new windows already grabs your hardware info on installation.

2 Likes
7

Over my dead body. Hoka Hey!

8

clearly they are trying to prevent people from converting windows machines to linux ones.

2 Likes
9

I really don’t understand what this is intended for. What’s the problem they’re trying to solve here? 95% of personal info (credit cards, passwords, etc.) get leaked by human error, not some advanced attacker. Same with malware, it’s almost entirely human error…

Maybe I’m just awful at reading, but the whole article feels like just blanket terms and
2020-11-19_07-16

Sure it can’t read your keys or whatever else its meant to store, but I’m sure it can and will read everything else, beaming it over to the Mothership. God forbid you’re some evil enthusiast who wants to mess with their hardware, experiment with different operating systems or just want to “own” your device.

4 Likes
10

Won’t that affect linux in some way? As in not being able to put linux on their pc?
Also can’t wait for BSOD on the cpu after a windows update LOL

11

You see, they’re solving your freedom problem here, so it won’t be a problem anymore :male_detective:

Hard to say, but sure as sh*t it won’t help to have a freaking vulnerability / backdoor in CPU by most manufacturers out there, which means you will be unable to remove it unlike Intel ME which was hard enough and required technical skills…

5 Likes
12

You could argue that this is the point. The machines are secure and become even more secure, eventually all that is left is the human error.

I don’t think they care. This will make hundreds of millions of corporate and non-technical home users happy. As long as it is optional (ala Secure Boot), OK whatever.

1 Like
13

I mean, if that “security” chip will give us “protection”, you know very well they want to protect us from installing linux LOL

3 Likes
14

Come on, why are you not happy?

image
image1265×1005 133 KB

Can you please just be happy?!?! :grimacing:

Just give up all your freedom, it’s so simple.
What can go wrong?

Optional (hardware) CPU backdoor, how do you think that will work? :thinking:

5 Likes
15

Isn’t that the case, for the most part, already though?

Is a proprietary chip to announce who you are and to manage any of your encryption, really necessary?

2 Likes
16

image

1 Like
17

They want to prevent users from tampering with their hardware. Then they can also control what software is allowed to run on the hardware and what is not.

3 Likes
18

Sounds like Apple!

3 Likes
19

Again, yes. At some point in time somebody said “let’s have it”. And then there a countless times when somebody says “let’s improve it”. This is another “let’s improve it”.

It highly depends what proprietary means, I run all my code on proprietary chips. All I have seen so far are PR announcement, but no technical analysis how it works and what it means for non MSFT operating systems. I’ll wait for that before casting judgement.

2 Likes
20

The goal is to make every PC like Apple. Specifically, Microsoft wants every Windows PC to be like Xbox, where the user does not own his computer, but effectively rents it from a corporation. It’s total erosion of property rights in one’s hardware, using anti-tampering mechanisms.

8 Likes