I think AMD is upset with HardOCP and the truth.

[razor1]

Wouldn't have to be remote hacks. Corporate espionage and state actors would need only insert a USB stick. One bad tech and your system gets owned. There are also forms of non-volatile memory showing up.

Memory encryption is only useful for certain types of hacks, if a user has access to a system for more than 30 minutes, memory encryption won't be able to stop them. Memory encryption only helps with when memory is in a non volatile state which is when you shut down after connecting to a server *encrypted hard drive*, which usually ram looses its data integrity fairly quickly, should be done within 5 minutes after power down. If the ram is cooled then it can last up to 10 or 15 minutes.

For cloud servers, if the provider has been infiltrated by someone that knows exactly what they are looking for, that is the only thing memory encryption will stop from a quick hit and run. And if a person has infiltrated the service, those guys arn't looking for a quick hit and run. Or the cloud service can't be trusted is, well that doesn't work because they have as much time as want to decrypt HD's.

This is why its just a nice feature to have, not a must have. If a cloud service provider is compromised, oh boy I'll bet my house they are not going for whats in the memory lol, they are going for a hell of a lot more and most likely they will get it. All they have to do is copy the HD's and they can decrypt them at their own pace. They aren't going to be doing that at place of work either. And if they spent the time to infiltrate a provider the seriousness of a cold boot hack is kinda moot. Doing a cold boot hack and then sitting around and copying the files while work is going on is not the smartest thing to do, copy everything as quick as possible and go elsewhere to decrypt em. That way the thief doesn't get caught red handed. If he is bold enough or stupid enough to sit around while he does a cold boot hack and then have time to go through the files and think he won't be noticed, man he must be really that good of spy lol or a really crappy security at the cloud server provider in the first place, the client should go else where.

Now if someone steals a laptop or what not that is a different matter, they still have limited time to do what they can to get the cold boot to work, so its not must have thing, if the user of the laptop is smart they will know how to shut down their laptop properly so that can't happen.

Well as you can see Intel already has something similar.... So is it really that big of deal now?

BTW fogot to add Zen will only have SME when its released, SEV which could be somewhat better in some instances over Intel's SGX 1.0 (Intel's SGX 1.0 is better in other areas too like when the OS is compromised SGX 1.0 can still function on an application level where AMD's SEV and SME can't again SEV won't be out and no one knows when it will be out). Right now Intel's SGX isn't fully implemented in end user run time environment either only in developer mode is it usable, probably will change soon though.

Pro's and cons of both, Intel's SGX requires a bit more work for 3rd party integration for now, so SME is easier to integrate from 3rd parties, but SGX in the future will be able to do this too, because right now SGX is driver controlled but it can be OS controlled (Linux and its derivatives have to incorporate it in as do they have to do with AMD's SEV or SME) which hasn't been fully implemented yet, and they have planned on that right from the start. Also there are much bigger changes for SGX 2.0 which will incorporate both the Intel driver and OS and 3rd party integration which should give even more protection, Skylake Xeons are expected to have this, which will be the direct competitor to Zen. And that will be more than what SEV can provide, much more pretty much its the whole enchilada.

PS

Interestingly enough SGX and SME both were released to Linux days within each other so neither AMD nor Intel have a time advantage here, Although Intel has had their hardware out earlier so developers might be working with SGX for more time though. So Intel has a good year and half advantage for their encryption methods.

Intel has been working with MS to get SGX incorporated into Windows which will become SGX 2.0, so I think they have quite a bit of lead.

Now SEV, SEM, keep this in mind, if the kernel of the OS is compromised they will not be able to protect you at all! At least from what I have read so far and the developer videos I've just watched. And we all know rootkits try to do this and this is why I stated AMD's encryption will not stop hackers. Might slow them down but won't stop em. And if a hacker has direct access to the hardware, forget about it, it will be done and over with.

Hopefully this post kills off the overhype?

 

[Nobified[H]]

*yawns* People are really infantile these days! Putting Kyle on ignore list regarding tech reviews is just plain infantile! The truth will always come out unless it being suppressed by active agents.

 

[razor1]

*yawns* People are really infantile these days! Putting Kyle on ignore list regarding tech reviews is just plain infantile! The truth will always come out unless it being suppressed by active agents.

True its like people that hold their hands over their ears and yell "LA LA LA LA LA LA!"

 

[noko]

My faith in a company is roughly equal to its R&D. Outside that I need hard facts.

Then get down on your hands and knees and pray that AMD pulls something out of their ass -

 

[Anarchist4000]

Memory encryption is only useful for certain types of hacks, if a user has access to a system for more than 30 minutes, memory encryption won't be able to stop them. Memory encryption only helps with when memory is in a non volatile state which is when you shut down after connecting to a server *encrypted hard drive*, which usually ram looses its data integrity fairly quickly, should be done within 5 minutes after power down. If the ram is cooled then it can last up to 10 or 15 minutes.

You're missing the point of the tech entirely. If all memory pages are encrypted, transparently to the OS, it breaks code injection/execution. Malware would have to go through the OS/app as the decryption would scramble it when decoding. With top down encryption, in the case of a VM, the OS would have to be compromised while active. Even direct access would require someone to actually log in to compromise it. Still some risk with peripherals, but communication could be locked down there as well. If the system is only being accessed remotely, getting in directly is problematic.

Is the system perfect? No, but it does go a long way towards addressing the woefully inadequate security we have currently.

Well as you can see Intel already has something similar.... So is it really that big of deal now?

Software API built into apps, bit different from complete system encryption.

Now SEV, SEM, keep this in mind, if the kernel of the OS is compromised they will not be able to protect you at all! At least from what I have read so far and the developer videos I've just watched. And we all know rootkits try to do this and this is why I stated AMD's encryption will not stop hackers. Might slow them down but won't stop em. And if a hacker has direct access to the hardware, forget about it, it will be done and over with.

The FBI had a phone they allegedly needed Apple to unlock. With direct access to the hardware why couldn't they get in with all the resources of the US government?

 

[Factum]

I work in datacenters.
It's funny (and sad) to read how people that have never set foot in a datacenter think they know how the "world works".
There is a reason access to our datacenter are limited to 8 people (we are talking +5000 servers)....with access cards, facial-scan, codes, iris-scan etc.
There is a reason why external techs MUST be escorted (eg. by me) if they need hands on work...and NEVER to be let unattended...even for 5 seconds.

Any server with FireWire/USB ports can be injected in seconds.
If you have physcial access to the hardware, there is no need to go all "Hollywood"...all you need is a stick...and 5 seconds.

But keep posting...as an insider, I love to see how little people know..but still think they have knowlegde enoguh to play "experts"
(And yes I have a past as "whitehat"...part of the qualifications that enabled me to this job)

 

[Factum]

The FBI had a phone they allegedly needed Apple to unlock. With direct access to the hardware why couldn't they get in with all the resources of the US government?

The phone got unlocked...FFS!!!:
FBI unlocks shooter's iPhone without Apple's help

More ignornace you want to share?!

 

[razor1]

You're missing the point of the tech entirely. If all memory pages are encrypted, transparently to the OS, it breaks code injection/execution. Malware would have to go through the OS/app as the decryption would scramble it when decoding. With top down encryption, in the case of a VM, the OS would have to be compromised while active. Even direct access would require someone to actually log in to compromise it. Still some risk with peripherals, but communication could be locked down there as well. If the system is only being accessed remotely, getting in directly is problematic.

No it doesn't work that way Anarchist, listen to the developer videos

Is the system perfect? No, but it does go a long way towards addressing the woefully inadequate security we have currently.

Yeah and it is quite useless if a person has access to the hardware! Or uses root kits and what not.

Software API built into apps, bit different from complete system encryption.

Its not software, software developers have full control of the what is in encrypted and what isn't and its fully hardware driven!, again you don't know what you are talking about. SGX gives the developer complete control of what they want protected (they can protect the entire application as a whole too) vs what AMD does with flagging certain memory parts (page files, which a developer has to assign) with what they call c bit (just a term they use for the flag) which are set up by the developer in the application too but because it isn't digitally signed by the application and that memory portion isn't sealed off to the particular application it will fail if the OS kernel is compromised! Yes I did watch and read about how to develop with these things, which I know you didn't because you won't have made that comment. SGX has more levels of checks than what even SEV has, which is why it should be better (when fully operational), all theory of course till we see the real things in action. I think they will find many holes in both of these systems, time will tell.

The FBI had a phone they allegedly needed Apple to unlock. With direct access to the hardware why couldn't they get in with all the resources of the US government?

They hacked it it pretty quickly! the court ordered them to show how they did it too, limited parts!

 

[Algrim]

The FBI had a phone they allegedly needed Apple to unlock. With direct access to the hardware why couldn't they get in with all the resources of the US government?

A bit OT but the FBI had no fucking interest in actually unlocking the phone. They thought they had the perfect scenario (i.e. domestic terrorism) to use the All Writs Act to set a court precedent to force companies to do the FBI's own fucking job. You'll notice that the FBI conveniently found a company that could do the hacking as soon as the court case was about to actually happen.

Then there was a research paper posted recently that explains how someone with very little hardware can do what the FBI presumedly paid 1.1 Million USD for.

Trying to equate the FBI 'unable to hack an iPhone' with iPhones being unhackable is like saying glass is unbreakable (it is as long as you don't let anything break it).

 

[Deleted member 93354]

When a company just becomes dishonest because they can't admit they f'd up, they deserve what they get...

I'm done with you AMD. I don't care how good Vega is. I can't believe anything you say.

 

[Anarchist4000]

Any server with FireWire/USB ports can be injected in seconds.
If you have physcial access to the hardware, there is no need to go all "Hollywood"...all you need is a stick...and 5 seconds.

Thanks for making my point for me.

The phone got unlocked...FFS!!!:
FBI unlocks shooter's iPhone without Apple's help

More ignornace you want to share?!

And just how long did that take? Five minutes covering all the public banter back and forth between Apple and the FBI? At the very least you could read some news and be a little more informed. Assuming the owner wasn't dead, I'm sure he never would have realized his phone was missing.

You just went on a rant about the very reason why this tech is needed. Say it's pointless, yet all the tech companies are working on developing it. Claim to work in a datacenter. Then point out steps have been taken to help mitigate the very threat this tech works to prevent? So who is ignorant here? The threat is right in front of you and you don't even realize it. That right there is a mind boggling amount of ignorance.

And yes I've been in datacenters, national labs, and other generally sensitive server areas.

A bit OT but the FBI had no fucking interest in actually unlocking the phone.

Why I included "allegedly". I have no doubt they could probably breach the security one way or another. At the time I figured it was subterfuge.

Then there was a research paper posted recently that explains how someone with very little hardware can do what the FBI presumedly paid 1.1 Million USD for.

Still not nearly as trivial as plugging in a jump drive though.

 

[razor1]

Thanks for making my point for me.

And you can still do that with these types of memory encryption techniques, this is how rootkits work, they don't go after whats in the memory they don't do memory injections like game trainers do lol. They are executed at a kernel level because the OS knows no better. And if you remember memory injections were used with early types of viruses but quickly they were thwarted.

And just how long did that take? Five minutes covering all the public banter back and forth between Apple and the FBI? At the very least you could read some news and be a little more informed. Assuming the owner wasn't dead, I'm sure he never would have realized his phone was missing.

The first time something is hacked it takes time, but after that, its easy and even new iterations of them will be easier then the first original hack of the old device. Just look at Denuvo encryption for games, once it was cracked its done, all Denuvo games are being cracked quickly now and it will only getting faster.

You just went on a rant about the very reason why this tech is needed. Say it's pointless, yet all the tech companies are working on developing it. Claim to work in a datacenter. Then point out steps have been taken to help mitigate the very threat this tech works to prevent? So who is ignorant here? The threat is right in front of you and you don't even realize it. That right there is a mind boggling amount of ignorance.

It doesn't matter if that type of protection is there for data centers *explained later below*, yes it is helpful as its another layer, but both Intel and AMD have it, so its a wash, with which ever one they go with.

Still not nearly as trivial as plugging in a jump drive though.

If a system is on, and you can log in, yes it is that trivial. And if you have access to go into work at a data center, you can do it. As explained above the OS knows no better sometimes with certain types of rootkits. And that is why they are so fricken hard to get rid of once you get infected by them. And also virus removal software too, have difficult time distinguishing between the rootkit and the OS too.

The Iphone thing, what the FBI couldn't get around was the encryption of the password or fingerprint that was the problem, but they got around it, and no it probably didn't take them that long to do, we have no idea how long it took. But they sure didn't have access to the phone when its unlocked. You are talking about three different here, are you talking about someone that would have direct access to the hardware when its in an on state? or are you talking about someone that has access to a stolen computer or a person that is hacking in from the outside? Only one of these can be stopped by memory encryption and that is the second one, a stolen computer but even that is time sensitive.

 

[Anarchist4000]

And you can still do that with these types of memory encryption techniques, this is how rootkits work, they don't go after whats in the memory they don't do memory injections like game trainers do lol. They are executed at a kernel level because the OS knows no better. And if you remember memory injections were used with early types of viruses but quickly they were thwarted.

OS's are moving towards execution within a VM. So even a standard desktop will be running within that VM with a hypervisor controlling it for security. The rootkits run parallel to the OS kernel and are generally invisible for that very reason. I wouldn't be surprised to see apps executing within a VM (consoles/mobile already does this) to sandbox things for security/stability. Not perfect, but still goes a long way.

It doesn't matter if that type of protection is there for data centers *explained later below*, yes it is helpful as its another layer, but both Intel and AMD have it, so its a wash, with which ever one they go with.

Both have technologies to do it, but for AMD which has been targeting server deals in China lately it's a significant feature.

The Iphone thing, what the FBI couldn't get around was the encryption of the password or fingerprint that was the problem, but they got around it, and no it probably didn't take them that long to do, we have no idea how long it took. But they sure didn't have access to the phone when its unlocked. You are talking about three different here, are you talking about someone that would have direct access to the hardware when its in an on state? or are you talking about someone that has access to a stolen computer or a person that is hacking in from the outside? Only one of these can be stopped by memory encryption and that is the second one, a stolen computer but even that is time sensitive.

All of those actually, but with varying degrees of defense. Ultimately it's a question of just how long it takes someone to break in and for the owner to mitigate damage. All encryption methods will likely be hacked eventually. 10 years down the road a lot of methods could be brute forced.

Direct Access - Depends on who, how long, and to what degree they have access. At the very least all USB ports can be locked down. Top down encryption would likely require login information. In the case of a server a remote connection could be entirely encrypted and rule out eavesdropping. Keylogger on the keyboard you're screwed. If all memory, data, and communication are encrypted even breaching the system with direct access can be difficult. Requiring different levels of sophistication to actually penetrate the system.
Stolen - Depends on who stole it. State actors can probably get in, but probably aren't stealing devices either. At the very least the owner likely will have time to realize it's gone and mitigate damage. If stealing passwords, cards, or identity, any extra time to update them is significant.
Hacking - Depends on the environment. In the case of a VM a single compromised guest could breach all guests. Only takes one weak link. The tech likely helps with VMs, but even sandboxing apps within a VM could prove beneficial.

 

[razor1]

OS's are moving towards execution within a VM. So even a standard desktop will be running within that VM with a hypervisor controlling it for security. The rootkits run parallel to the OS kernel and are generally invisible for that very reason. I wouldn't be surprised to see apps executing within a VM (consoles/mobile already does this) to sandbox things for security/stability. Not perfect, but still goes a long way.

VM's aren't as secure as you think, there are actual tools which are freely available that after you get into a VM, you can turn the VM on its host. And its very effective.

Both have technologies to do it, but for AMD which has been targeting server deals in China lately it's a significant feature.

Not that big, China's interest in AMD is the same as any other companies man, and if they can muster the performance against Intel, those deals..... Will not be around.

All of those actually, but with varying degrees of defense. Ultimately it's a question of just how long it takes someone to break in and for the owner to mitigate damage. All encryption methods will likely be hacked eventually. 10 years down the road a lot of methods could be brute forced.

True evolution is the only metric that can withstand the hacker

Direct Access - Depends on who, how long, and to what degree they have access. At the very least all USB ports can be locked down. Top down encryption would likely require login information. In the case of a server a remote connection could be entirely encrypted and rule out eavesdropping. Keylogger on the keyboard you're screwed. If all memory, data, and communication are encrypted even breaching the system with direct access can be difficult. Requiring different levels of sophistication to actually penetrate the system.

If a person has the time and ability to infiltrate a data center, damn they will have the skills and tools to do everything else, not only that they will have practiced and mastered exactly what they want to do well before hand. Because they aren't stealing just credit card numbers they are going for something much much bigger. People like that aren't your common mobster looking for a quick buck or even a million bucks.

Stolen - Depends on who stole it. State actors can probably get in, but probably aren't stealing devices either. At the very least the owner likely will have time to realize it's gone and mitigate damage. If stealing passwords, cards, or identity, any extra time to update them is significant.

Again its who is doing what.

Hacking - Depends on the environment. In the case of a VM a single compromised guest could breach all guests. Only takes one weak link. The tech likely helps with VMs, but even sandboxing apps within a VM could prove beneficial.

Nah it doesn't help as much as we would like to think. It will stop the ill equipped people the guys that want the small stuff and be happy with that, but the guys that want everything, nope its just another test for them. Once they get into the VM its all there. And ram exploits is not what these guys use. Even the small guys don't use ram exploits over a network, its actually hard to exploit ram over a network, you really need direct access to the hardware or connecting to the hardware and then enter in at the same time to see what is going on in the ram at the same time, which is kinda hard to do unless you have a partner or you are right there at the server.

Take it apart from what this tech does, it only does ram encryption nothing else, and the reason why its "so bad" and "hyped" is because its easy to do for even the most technically incompetent people. That is all its stopping the most unsophisticated criminal. And people like that are usually easy to catch anyways.

Any case ram encryption is the start of hardware based encryption methods for many other things too, and its a starting place, but as I stated, there will be exploits. The only way to truly stop a hacker is to physically remove the server or piece of hardware from the network or shut it down entirely.

 

[Factum]

Thanks for making my point for me.

You need to read again..

And just how long did that take? Five minutes covering all the public banter back and forth between Apple and the FBI? At the very least you could read some news and be a little more informed. Assuming the owner wasn't dead, I'm sure he never would have realized his phone was missing.

Razor1 already explained it for you....you need it explaiend twice?

You just went on a rant about the very reason why this tech is needed. Say it's pointless, yet all the tech companies are working on developing it. Claim to work in a datacenter. Then point out steps have been taken to help mitigate the very threat this tech works to prevent? So who is ignorant here? The threat is right in front of you and you don't even realize it. That right there is a mind boggling amount of ignorance.

No, I said datacenters, not datacenter.....nothing will save you if the "bad buy" has physical access.

And yes I've been in datacenters, national labs, and other generally sensitive server areas.

I had my daughter with me at work....being a guest in a data-center doesn't mean the guest know how things works...you keep proving that...sad.

Why I included "allegedly". I have no doubt they could probably breach the security one way or another. At the time I figured it was subterfuge.

Allegedly I have heard that you are ignorant...see how that kind of useless semantics work?