Can somebody explain what they mean when they say 'update

pls help

Google "microcode". CPUs are shitty so sometimes their microcode needs updates to work around hardware bugs.

>>58773631
thanks!

Microcode is basically firmware for a CPU. It's software that is loaded into the CPU by the BIOS/UEFI/OS at bootup and then reprograms it. Sometimes new versions of microcode are issued in response to moderate to severe hardware bugs.

>>58773631
Also to introduce vulnerabilities.

>>58773814
What kind of vulnerabilities would exist in CPU microcode? Like if you could plant one what would it be used for?

>>58773858
Likely fucking with operations associated with encryption

>>58773858
You could add something like a backdoor so the CPU could allow someone to access the computer

File: 1434610012279.jpg (46KB, 540x438px) Image search: [Google]

46KB, 540x438px

>>58773868
Well that particular bit is the Intel Management Engine, AMD has some equally stupid named equivalent.
>let's make ring -3 bullshit that works even when the computer is supposedly turned off!
Every new Intel/AMD cpu has this shit, I wish I could round up the engineers/management that made this decision and throw them in a gas chamber

>>58773865
I wonder why they would even introduce encryption and then break it. Plus no encryption software uses encryption instructions directly they pool them together with multiple other sources of randomness before creating keys.

>>58773899
>I wonder why they would even introduce encryption and then break it.
to give the illusion of security
> Plus no encryption software uses encryption instructions directly they pool them together with multiple other sources of randomness before creating keys.
Well, regardless of what method you use to try to mask the operations, they're compromised on a fundamental level. Eventually you're going to have to XOR some shit.

>>58773868
Ok but how? You'd have to fool the OS into doing something it didn't intend to, what would that be? Any change or update to the OS could render your microcode useless, so you'd have to target something very static. Are there proof of concept microcode exploits? I would assume this would only be a state sponsored target as the microcode is signed right? You'd need intels keys?

>>58773919
>to give the illusion of security
My point is they'd probably just ship it broken to begin with. In that case the worst that could happen is you just lose one of the sources of randomness but there's still others.

>>58773933
Even if you could get some perfectly random source, it wouldn't matter if the hardware doing your encryption can't be trusted to do the operations you want it to with that source.

They probably would just ship it broken to begin with though, you're right about that.
Still, nothing preventing inefficient bureaucracy from forcing you to backdoor your product after launch for whatever stupid non-technical reason.