PIII Security Bypassed (fwd)

K. M. Ellis (protozoa@tux.org)
Mon, 22 Feb 1999 17:20:22 -0500 (EST)

• Next message: Niels Möller: "Re: SSL sans RSA"
• Previous message: K. M. Ellis: "cfp announcement (fwd)"

There was a thread some time ago about the specifics of the Pentium III
chip and its PSN..thought I'd pass this on in case anyone was interested.
Any thoughts?

    --------- K. Ellis -- KB3CWP -- protozoa@tux.org -------------
                "Praise Eris, and pass the ammo."
                        (as seen in alt.sysadmin.recovery)
    ----------------------------------------------------------------

        http://www.heise.de/ct/english/99/05/news1/
        http://www.heise.de/ct/99/05/016/

Pentium III serial number is soft switchable after all
Christian Persson

Intels privacy strategy changed again

The controversial serial number of the new Pentium III processors can be
read on the quiet after all. Contrary to Intels description so far, the
system architecture allows for individual identification by software
tricks without a users explicit allowance or notice.

Intels new technique for securing E-Commerce transactions already caused
quite a stir as the Pentium III presentations approached. Privacy
advocates expected the readable serial number to act as a "permanent
cookie" and to produce the completely transparent surfer. The processor
manufacturer appeased with the guarantee, the user would have full
control whether he would allow the read-out of the serial number. Once
switched off, the corresponding processor command could not be activated
until the next cold start.

This description has proved wrong. The processor expert of c't magazine,
Andreas Stiller, has figured out a procedure to switch on the command
for reading out the serial number by software. This procedure is based
on specific features of the processor architecture that are documented.
They would have got around in cracker circles sooner or later. A
spokesperson from Intel confirmed upon inquiry by c't, that the serial
number can be re-activated this way.

Intels solution is a renewed correction of announcements how privacy in
spite of the serial number could be guaranteed: whereas only a software
tool for switching the serial number on and off was intended so far, now
the PC manufacturers are encouraged to integrate the configuration of
the switching into the BIOS. This way, the switching on by software
could be prevented. Earlier Intel had rejected this method with the
argument, changes in the BIOS setup could not be expected from untrained
users.

Intel said that the BIOS manufacturers had been informed
correspondingly. Also, they had been equipped with software samples. It
remains to be seen, how many manufacturers will be able to incorporate
appropriate BIOS functions into the first delivered Pentium III systems
and how they are configured by default. To top it all, the new privacy
concept has holes, too: after all, the BIOS setting has to be stored in
the CMOS memory. Someone who knows the respective BIOS very well can
crack this, too. (as)

• Next message: Niels Möller: "Re: SSL sans RSA"
• Previous message: K. M. Ellis: "cfp announcement (fwd)"