Stories
Slash Boxes
Comments

SoylentNews is people

posted by martyb on Saturday May 04 2019, @07:09AM   Printer-friendly
from the who-owns-your-PC? dept.

HP's Endpoint Security Controller: More Details About A New Chip in HP Notebooks

One of HP's key announcements this spring was its revamped security initiative for PCs that includes hardware, software, and deep learning-based approaches. The software and DL parts of the things were discussed earlier this month, but the hardware-based Endpoint Security Controller remained more or less a mystery. This is why we asked HP to talk about it in more detail.

When it was announced, the company said that the HP Endpoint Security Controller is indeed a separate piece of silicon that sits inside HP's PCs and performs certain security-based tasks. The ESC features a general-purpose processor core, HP's custom hardware IP blocks, and embedded software. What is interesting is that HP has been installing the controller into its laptops since the EliteBook 800 G1 series launched in 2013, but has been very secretive about it until recently.

Initially, HP used the Endpoint Security Controller only for its Sure Start technology that can 'heal'/recover the system BIOS. Fast forward to 2019, and the controller has gained capabilities. HP now uses it to protect Intel's Management Engine, and to enable its Sure Run and Sure Recover capabilities.

Would you rather purchase a Huawei or HP laptop?

[We have covered the Intel Management Engine many times before. --Ed]


Original Submission

Related Stories

PSPtool Allows Further Investigation of AMD's Platform Security Processor 11 comments

AMD Secure Technology PSP Firmware Now Explorable, Thanks to Researcher's Tool

A security researcher this week released the PSPtool, a software tool that "aims to lower the entry barrier for looking into the code running" on the AMD Platform Security Processor (PSP), officially known as AMD Secure Technology, and other AMD subsystems. The PSP serves similar functions to those of Intel's Management Engine (ME) processor. However, just like the Intel ME, the secretive and undocumented nature of the chip worries security and privacy advocates.

The researcher going by the online name of cwerling described the PSPTool as a "Swiss Army knife" for dealing with the AMD PSP's firmware. The tool is based on reverse-engineering efforts of AMD's proprietary file system that the company uses to pack firmware blobs into UEFI firmware images.

Usually, all firmware blobs can be parsed by another software program called the UEFITool. However, in this case AMD's firmware files are located in padding volumes that can't be parsed by the UEFITool. This is the reason for the PSPTool, which can locate the PSP firmware within UEFI images and parse it. Through this tool, more researchers can look into what their local PSP chip is doing to their computers, as its actions are normally hidden from the operating system or the main processor.

Previously: AMD to Consider Coreboot/Libreboot Support
AMD Confirms its Platform Security Processor Code will Remain Closed-Source

Related: Intel Management Engine Partially Defeated
EFF: Intel's Management Engine is a Security Hazard\
Disabling Intel ME 11 Via Undocumented Mode
Intel Management Engine Critical Firmware Update
HP Chip Protects Intel's Management Engine


Original Submission

This discussion has been archived. No new comments can be posted.
Display Options Threshold/Breakthrough Mark All as Read Mark All as Unread
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
(1)
  • (Score: 1, Interesting) by Anonymous Coward on Saturday May 04 2019, @07:29AM (3 children)

    by Anonymous Coward on Saturday May 04 2019, @07:29AM (#838747)

    Now I will pay more for an open hardware solution

    • (Score: 2) by The Mighty Buzzard on Saturday May 04 2019, @05:17PM (2 children)

      No you won't. Not if you want something that can outperform a ten year old notebook and costs less than a car.

      --
      My rights don't end where your fear begins.
      • (Score: 2) by sgleysti on Saturday May 04 2019, @08:30PM

        by sgleysti (56) Subscriber Badge on Saturday May 04 2019, @08:30PM (#838952)

        The Raptor Computing Systems Blackbird could fit that bill for ~2000 USD.

        https://secure.raptorcs.com/content/BK1B01/intro.html [raptorcs.com]

      • (Score: 0) by Anonymous Coward on Sunday May 05 2019, @04:48PM

        by Anonymous Coward on Sunday May 05 2019, @04:48PM (#839276)

        I'd rather have something that respects my freedoms than something that is cheap and/or fast. Products like this kind of already exist, though they're just old laptops with proprietary components removed/disabled.

  • (Score: 5, Insightful) by lentilla on Saturday May 04 2019, @07:59AM (4 children)

    by lentilla (1770) on Saturday May 04 2019, @07:59AM (#838753)

    Is anyone able to explain what problems we are attempting to solve by adding these features?

    A disobedient computer is not my friend, yet all these features seem to imply inbuilt disobedience.

    A simple example: we don't want unauthorised people to be able to reflash the BIOS. OK - can't we simply put a "permit write" jumper on the board (otherwise known as a "physical switch")? It appears (and I may be entirely naive here) that we are are attempting to solve security problems by adding layer upon layer of additional security problems.

    • (Score: 2, Insightful) by Anonymous Coward on Saturday May 04 2019, @09:08AM

      by Anonymous Coward on Saturday May 04 2019, @09:08AM (#838768)

      We can't have physical switch because NSA and MPAA are authorized to flash your BIOS but they can't access your physical switch most of the time,

    • (Score: 2, Interesting) by Anonymous Coward on Saturday May 04 2019, @10:31AM

      by Anonymous Coward on Saturday May 04 2019, @10:31AM (#838780)

      Customers complain to tech support when they forget their BIOS password or screw something up and magically expect everything to be fixed. Corporations don't want employees stealing laptops and remote flashing/updating 5000 laptops is far, far cheaper than manually updating each one. We can no longer have fixed BIOSes because companies and developers are too lazy to do things right the first time. They can't have write-protect switches because that would add 40 cents to the cost of the product and customers would mess with it. The chip allows more extensive debugging features during development. The media industry gives kickbacks to companies which help it secure analog/digital holes. The manufactures can claim their hardware is brick-proof as failed BIOS updates used to be a big concern. Of course there are other ways to do that, but few care. The FCC requires they prohibit installation of wireless devices which can be pushed above the legal limits. And finally, they only want customers buying replacement components from them. See how well Apple does controlling everything. See how well Intel fared with all the compatible clones.

    • (Score: 0) by Anonymous Coward on Saturday May 04 2019, @02:36PM

      by Anonymous Coward on Saturday May 04 2019, @02:36PM (#838819)

      Simple. Overbilling the fed for unwarranted remote surveillance is a lucrative business. The problem it solves is that HP wasn't getting enough market share.

    • (Score: 2) by driverless on Sunday May 05 2019, @10:03AM

      by driverless (4770) on Sunday May 05 2019, @10:03AM (#839160)

      It's actually kinda scary that a manufacturer has to put a hardware firewall in its PCs to deal with the backdoors that the CPU vendor puts in the CPUs it sells them.

      Or at least, given the lack of detail, to replace Intel backdoors with HP ones.

  • (Score: 1, Funny) by Anonymous Coward on Saturday May 04 2019, @08:55AM (6 children)

    by Anonymous Coward on Saturday May 04 2019, @08:55AM (#838762)

    ...what is going to protect the HP's Endpoint Security Controller?

    • (Score: 2) by Bot on Saturday May 04 2019, @09:07AM

      by Bot (3902) on Saturday May 04 2019, @09:07AM (#838767) Journal

      I suggest to get rid of the internet and use TCP/Internet Pizzini over avian carriers.

      EDIT: oops I should have posted as AC

      --
      Account abandoned.
    • (Score: 2) by WizardFusion on Saturday May 04 2019, @09:30AM (1 child)

      by WizardFusion (498) Subscriber Badge on Saturday May 04 2019, @09:30AM (#838771) Journal

      More and more layers of security controllers

      • (Score: 0) by Anonymous Coward on Saturday May 04 2019, @11:56PM

        by Anonymous Coward on Saturday May 04 2019, @11:56PM (#839022)

        Security controllers all the way down.

    • (Score: 0) by Anonymous Coward on Saturday May 04 2019, @09:36AM

      by Anonymous Coward on Saturday May 04 2019, @09:36AM (#838775)

      Quis custodiet ipsos custodes?

    • (Score: 3, Touché) by c0lo on Saturday May 04 2019, @11:21AM (1 child)

      by c0lo (156) Subscriber Badge on Saturday May 04 2019, @11:21AM (#838785) Journal

      The Intel's Management Engine.

      --
      https://www.youtube.com/watch?v=aoFiw2jMy-0 https://soylentnews.org/~MichaelDavidCrawford
      • (Score: 0) by Anonymous Coward on Saturday May 04 2019, @01:51PM

        by Anonymous Coward on Saturday May 04 2019, @01:51PM (#838803)

        Runs For Sure.

  • (Score: 5, Interesting) by Anonymous Coward on Saturday May 04 2019, @01:42PM (6 children)

    by Anonymous Coward on Saturday May 04 2019, @01:42PM (#838798)

    Would you rather purchase a Huawei or HP laptop?

    The more NATO bandits are yelling about Huawei, the more I am willing to drop HP, Apple or network stuff and get Huawei devices. Well, not literally drop, I have too many pieces of working hardware, but phase out old and refocus new purchases. Logic is trivially simple: I do not live in China, China government cannot do me any legal/political/criminal/whatever harm, even if they could get into my hardware. But bandits in U.S. could get me extradited easily at their will, not for criminal but for pure political reasons, and my collaborative European regime would not protect me. Seen reality so clear. So, backdoors existent or not, Huawei is the way of future. I do not believe in propaganda against Huawei and in current epoch I certainly trust Americans much less than I trust Russians or Chinese.

    • (Score: 0) by Anonymous Coward on Saturday May 04 2019, @02:03PM (3 children)

      by Anonymous Coward on Saturday May 04 2019, @02:03PM (#838808)

      That's all fine and good until the Chinese remotely delete your porn.

      • (Score: 0) by Anonymous Coward on Saturday May 04 2019, @02:24PM (1 child)

        by Anonymous Coward on Saturday May 04 2019, @02:24PM (#838815)

        Why would any foreign agent delete a potential compro material? That would be pretty stupid. Never happened to me in past 40 years. Porn was always the best cover set for real information hidden under it. Sometimes it even distracts intruder for longer period and provides a reaction time...

        • (Score: 0) by Anonymous Coward on Saturday May 04 2019, @04:08PM

          by Anonymous Coward on Saturday May 04 2019, @04:08PM (#838858)

          Has not happened *yet*

      • (Score: 1, Interesting) by Anonymous Coward on Saturday May 04 2019, @04:05PM

        by Anonymous Coward on Saturday May 04 2019, @04:05PM (#838856)

        Pfft
        more likely they will upload incriminating evidence to your computer so you can be accused of tax evasion or similar so they can drain your bank accounts

    • (Score: 0) by Anonymous Coward on Saturday May 04 2019, @05:43PM (1 child)

      by Anonymous Coward on Saturday May 04 2019, @05:43PM (#838898)

      Trust Russians? Man you are ignorant.

      • (Score: 0) by Anonymous Coward on Sunday May 05 2019, @04:50PM

        by Anonymous Coward on Sunday May 05 2019, @04:50PM (#839279)

        I guess it's less about trust and more about who can harm you the most. If you live in the US or one of its lackey countries, the Chinese and Russians, while they cannot be trusted at all, cannot harm you as much as the US can.

  • (Score: 2, Interesting) by Anonymous Coward on Saturday May 04 2019, @06:06PM

    by Anonymous Coward on Saturday May 04 2019, @06:06PM (#838906)

    this is the same HP that used to employ carly fiorina who bragged during the presidential debates that she gladly helped the NSA intercept shipments of their computers? yeah, sell your spyware to someone else.

  • (Score: 3, Interesting) by exaeta on Saturday May 04 2019, @07:43PM

    by exaeta (6957) on Saturday May 04 2019, @07:43PM (#838939) Homepage Journal
    I don't trust secret bootloaders and secret IP. Especially by American companies. We already knew this was a problem, Snowden only proved what most of us strongly suspected. I'd rather Huawei/China spy on me than the USA anyway. China just wants to copy technology, the USA acts far more malicious.
    --
    The Government is a Bird
(1)