> But: If an attacker manages to flash a new BIOS to your server, you're already lost. That either requires physical access (which is bad), or access to the OOB / BMC / IPMI (which is equally bad, because those usually have a remote KVM feature, so you could e.g. boot the OS into recovery mode)
BIOS flashing from the OS has been a thing for a long, long time now. Heck my XPS 13 running Linux even gets BIOS updates from apt-get.
> About 99% of all hardware (except HDDS) from datacenters is sold on the second hand market. Locked CPUs are essentially worthlese, especially if buyers or sellers don't know and throw the CPU away because they think it's defective.
And 99% of that hardware is sold together as a unit. It will hamper repair efforts, as the CPU & motherboard are now effectively a single unit, but it does not effectively kill or even significantly harm the second hand market.
> I think this is just AMD's greediness again in the cloak of "improving security"
Intel has this same feature. This almost certainly wasn't done by AMD's "greediness" but rather because major customers, like Lenovo, demanded it. And even as a "greed" argument it's a pretty flimsy one. Nobody is running a datacenter on second-hand hardware anyway, there's no market to cripple there.
> BIOS flashing from the OS has been a thing for a long, long time now. Heck my XPS 13 running Linux even gets BIOS updates from apt-get.
UEFI capsule updates are triggered by the OS, but don't occur in the OS. The updates are copied to the EFI system partition, and on next reboot the firmware is triggered to apply them. The flashing process involves the firmware verifying a signature on the image before applying it. The reason for this is that the firmware flash is locked down at runtime, and most of it can't be written to outside System Management Mode. Halting the entire OS for long enough to flash the firmware isn't realistic, so it makes more sense to do it in the firmware environment instead. In any case, the net effect is that while, yes, you trigger the update from the OS, the OS itself is unable to directly modify the firmware, and if you try to flash a modified image via the capsule update mechanism the firmware will reject it for having an invalid signature.
> BIOS flashing from the OS has been a thing for a long, long time now. Heck my XPS 13 running Linux even gets BIOS updates from apt-get.
Yes, I forgot to add that point. It's also just as bad as the other options, because it means that the attacker has gained root access.
Using the vendor locking as a method to remedy this issue (an attacker being able to compromise a servers' BIOS or BMC) is basically just fighting the symptoms, not the root cause (which is that inband updates from the OS for BIOS and BMC are generally a bad idea)
> And 99% of that hardware is sold together as a unit. It will hamper repair efforts, as the CPU & motherboard are now effectively a single unit, but it does not effectively kill or even significantly harm the second hand market.
This is generally not true. 90% of the hardware is sold separately, servers are mostly sold as barebones and CPUs without servers. Some vendors offer custom configurable servers and I know from many that they make the majority of their sales from barebones or single CPUs, not configured or assembled systems.
> Nobody is running a datacenter on second-hand hardware anyway, there's no market to cripple there.
Not hyperscalers, no. But many SMEs / SMBs buy refurbished hardware and running their datacenters on refurbished hardware.
With your argument, we could as well say "just toss all server hardware in the bin once it has been decommissioned" which is obviously nonsense, because if there wasn't demand for refurbished server hardware, there wouldn't be a such a big market in the first place.
You can assume that at least 95% of decommissioned server hardware (except HDDs, still too many of them are shredded) gets a second or third life.
BIOS flashing from the OS has been a thing for a long, long time now. Heck my XPS 13 running Linux even gets BIOS updates from apt-get.
> About 99% of all hardware (except HDDS) from datacenters is sold on the second hand market. Locked CPUs are essentially worthlese, especially if buyers or sellers don't know and throw the CPU away because they think it's defective.
And 99% of that hardware is sold together as a unit. It will hamper repair efforts, as the CPU & motherboard are now effectively a single unit, but it does not effectively kill or even significantly harm the second hand market.
> I think this is just AMD's greediness again in the cloak of "improving security"
Intel has this same feature. This almost certainly wasn't done by AMD's "greediness" but rather because major customers, like Lenovo, demanded it. And even as a "greed" argument it's a pretty flimsy one. Nobody is running a datacenter on second-hand hardware anyway, there's no market to cripple there.