From STH (@ServeTheHomeVideo) : Thanks for the shout-out LTT team. We just tested an HP AMD Ryzen Pro machine and both Pro and non-Pro chips were not AMD PSB locked. We now have a process to continue checking for PSB usage as we work through the 1L commercial desktop PCs: www.servethehome.com/hp-amd-ryzen-pro-psb-status-tested-via-a-hp-elitedesk-805-g6-mini-asus-gigabyte/
To be sure, never buy prebuilds from large corporations . If you don't know how to do it yourself, small hardware stores would do it for you for a small fee, or even no fee if you buy parts from them.
This will absolutely screw over the second hand market in a few years when these systems reach eol, or the motherboards die. You buy a "working" CPU off of someone who doesn't know this exists. You just sold them a paper weight unknowingly. This feature makes total sense on a SOC or soldered CPU, as in my mind there wouldn't be a reason to swap boards or cpus around. But with a socketed CPU that is the entire freaking point of having the CPU and motherboard be separated. The board dies, chip lives. That's typically how things go. Until now. I don't like this method of security, the amount of ewaste this will inevitably create is... Depressing.
Sad because the seller would know they sold a working CPU to the buyer but may be completely unaware of the PSB feature and unknowingly sold a locked CPU. Then the seller thinks the buyer is trying to scam them when they ask for a return/refund because they have a CPU that's completely useless to them. This security feature made it a living hell and a risk for the seller to sell or buyer to buy. No way in hell I'm buying Ryzen CPUs without a return policy or PayPal now.
@@QuackZack If you buy new or from a site like Amazon (or presumably Newegg) it shouldn't be too much of an issue from a consumer perspective since new chips won't be locked and Amazon has a pretty good return policy (with some exceptions but as far as I know abnormal return policies are always noted before purchase).
I work full time at a computer recycler. Selling used CPUs out of retired business workstations is a huge part of business. This stuff worries me. You're 100% correct, mother earth will pay for it.
Laptop motherboards are now prohibitively expensive because everything is soldered. So of course they end up in the trash because people can buy a whole new motherboard with all the rest of the shit (screen, case, keyboard, yknow, the laptop) attached to it for the same price. And everyone's sooo big on "green" nowadays. What a load of bs.
Imagine doing it maliciously. get stuff off newegg/amazon, pbs lock it, return it, saying it doesn't work. no bent pins? not your fault. amd's gonna have a blast with all these returns.
@@ylandry0783even better is to just buy a cheap Lenovo locked cpu or system and then return that cpu because it doesn't work and keep the working one from Amazon.
Just a quick tip: The best 'tool' I've come across for fixing bent pins is a mechanical pencil with a metal tip. Pull the lead out, slide pencil tip directly over pin. Surrounds the pin and gives you a longer arm for finer control over how much you're bending the pin back. Makes it super easy to align the pins, and there's next to no risk of affecting neighboring pins as well.
...and all that via the illusion of "security". Honestly reminds me of internet censoring and surveillance laws being passed with the killer argument of "think of the children!!!1" to win over all the dumb f*cks (of which there are plenty) who don't get that children aren't a priority at all. Money and control is.
This feature wasn't really made with consumers in mind, it was mainly for governments and major companies who wanted this feature for their machines. Which makes it all the more ludicrous that Lenovo uses it on consumer hardware and doesn't even disclose that fact.
@@canaconn2388 I dont think you can really blame amd for this, the way theyve build their entire zen linup is basically "we have one core design which we can fit in whatever configuration we want" its pretty likely that its way more efficient for them to just have one CCD design for everything than run a different design for server/pro. Hell it could even be that they DO have different designs but server/pro demand was lower than consumer demand so they threw server ccds on consumer chips. Also the feature is on consumer chips, but it ISNT on consumer mainboards. Which is why it was a complete nonissue for 6 years until lenovo decided to be retarded.
@@gabrielaharries8149 What? The Ideapad 5 and 5 Pro are amazing laptops! Probably the most highly praised laptops by reviewers of these last 2 years. You were either very unlucky or just chose a crappy low end model.
As an enterprise IT person, I don't recommend Lenovo and we don't use Lenovo systems for 1 big reason, their support is garbage. If something breaks, you're better off going to Best Buy to get it fixed. Dell and HP have leagues better support and won't leave you hanging.
@@swecreations it is definitely not a low end model as it was expensive as shit for what it is, I've had it now for about three years and during the first year it had a bunch of problems (hdd failed, cpu constantly overheating), and it's not just the insides, the build quality is horrendous (the crappy aluminum or whatever it's made of is so easy to break and one of the hinges is completely pulverized so I can't even close it without completely detaching the keyboard from the rest of it). Before it I had a Samsung laptop for 7 years that was much less money and insanely better quality and it was made out of plastic, I dropped it tens of times and spilled beer on it, and it was fine never had a problem with it. So I think I know at least something about how shitty it is
So, could these end up on ebay or whatever, appearing correct and valid, but be completely bogus once you receive it? A seller could request it back, plug it in and claim its a problem with the user?
7:19 You can also see "Secure Roll Back prevention" which is actually pretty similar. It locks a CPU from being able to boot in a BIOS with older security firmware in it. This is done for the same reason: If a BIOS has an exploit, being able to roll back to that BIOS could re-open that exploit after it's been patched in a newer BIOS. The cost here of course is that if another motherboard doesn't have that newer firmware available or the newer firmware were to be buggy, there'd be no way to change back to the older BIOS with that CPU.
Cool... still waiting for a real world Spectre/Meltdown exploit. This is security theater, and the goal is to increase sales on new stuff. Because 10 year old processors still work perfectly fine and sales are dropping.
My HP PC was designed to be unupgradeable besides adding a stick of RAM. Of course it was made for offices, came with a ton of bloatware, and had no internal speakers. Made in December 2014, ofc
All of these vendor locked CPUs, go straight to the garbage when they are done. Lenovo and others are creating an E-Waste nightmare. There is no second-hand Market anymore for used servers, and used server CPUs, because many of them become vendor locked and unable to be used outside of their original motherboard. This was the intended effect, force people to buy new. This kind of thing should be illegal.
Yes - while I don't pretend to understand all the complexities, I smell BS when the exploit would need direct physical access. The only meaningful security at that stage is about controlling human access to the server room or office space - so it sounds very much like a way for CPU manufacturers to kill off any resale value and force new sales by convincing their buyers to be more 'secure' automagically. Or maybe someone can explain how you store sensitive data on a CPU? Like I said maybe I'm missing the point here?
@@julian.morgan The point of PSB is to make sure there is a chain of trust between them flashing a bios and it getting to you. It burns the refuse to make the CPU only trust other motherboards with the same signing key. It may be useful for server environments or more secret data but I do not see the point of it in office/workstation environments. If they are in the server room, you can have minorly meaningful security with encryption and other mitigations but this is for someone who is trying to get the server before/in shipping.
@@julian.morgan As Linus was saying, for servers it makes sense. A common thing for a company to do is to buy servers, set them up and send them to a Datacenter. This is a place that, while the idea is to trust them, could technically replace parts in your server without you knowing. That being said, I wonder what happens when a motherboard dies. Now you have to replace both like a soldered on CPU in a Laptop.
@@julian.morgan its pointless for a simple reason, sure its an aditional layer but... its on par with having a wooden shield.... inside an aircraft carrier.. IF whatever hit u managed to penetrate the armor of the ship.. ur puny shield is irrelevant, so if u have a security breach into ur server rooms... well... you're basically fucked, but hey.. drm cpus yay
This has the stink of corporate antitrust all over it. I'd say all the third party motherboard manufacturers should make a concerted effort to create a PSB bypass boot mode. Or just take Lenovo to court for the boot keys...
A bypass wouldn't work since the CPU itself will require an encryption key. Court may very well happen since Lenovo isn't advertising the function and is selling to consumers that don't know better.
@@grn1 There's a few potential ways to hack. One depends on if there's a master fuse. Someone might decrypt Lenovo firmware, sniff the data bus boot code, reset glitch hack the CPU...
@@randysmith7094 From what I've understood of it you'd have to get the key from the MoBo that did the locking then create a custom BIOS for the target MoBo to use said key. Lenovo seems to be using one key for all of their systems but it's absolutely possible for others to lock down the CPU to one particular system in which case you'd have to get the key from the exact system that did the locking rather than just a certain model. Brute forcing could potentially work but that's a lot of processing power and would have to be done on a case by case basis with specialized hardware and software (can't use the processor to unlock itself) so it would absolutely be cost prohibitive. If AMD did include a master key or fuse that would defeat the point (assuming this actually protects anyone in the first place).
this has nothing to do with security, it's to do with part prices going up, vendors get cheaper parts and so sometimes it can be cheaper to buy a prebuilt, take the part out, and resell the rest, this makes that impossible, it's a nasty practice locking these down to force people to buy parts at higher prices
The sooner a CPU or system gets tossed in the trash, the sooner the manufactures get to sell a new one. And us Canadians even get the bonus of paying environmental fees to the EPRA for the whole crooked deal...
@@equalmc276 It's a legit feature that AMD's business customers want for security purposes. Lenovo's the one taking things too far by forcing it on desktops. Louis Rossman has done a pretty good video about the situation.
I expect a large volume customer could request they ship without it enabled. I know we used to request our systems ship without Intel ME, consider it a security hazard. My employer banned Lenovo products in the procurement process a few years back due to security concerns. I think Ivy Bridge was the last gen we saw from them.
1) By enabling the feature by default; Lenovo in effect reduces the value of the CPU. In doing so WITHOUT clearly notifying the consumer, Lenovo is in essence advertising a CPU that is not what they are selling. 2) This adds ZERO security. If the lock can be bypassed by simply putting in an unlocked CPU; no additional security is achieved by breaking the CPU.
Combine this with the CPU's buitin TPM and full disk encryption(with keys stored on said TPM). It provides a good bit of data security. No one cares if the PC can be made to work the data is what any business is trying to protect.
its not about the cpu, its about the uefi (which you would know if you watched the video), its to prevent the pc from booting if the uefi is compromised.
@@unicaller1 when youre trying to protect something, allowing anything to self check and go "alls good here" is a serious flaw in ANY system. there is a cryptographic key in the bios that gets checked by the cpu and if it doesnt match? no boot.
@@jordanwardle11 The PC boots if they swap in a fresh CPU. All this does is stop the CPU from being used in a different motherboard. This does nothing for data security, it only limits resale value/market for used CPU's and forces end consumers to trash old CPU's if they decide to later upgrade.
This is the kind of info that needs to be spread quite literally everywhere. As someone who bought an old lenovo to scrap and use as the base of a first budget gaming pc, this is super important to know. Great to know to avoid lenovo indefinitely
Agreed. Everyone is up in arms over a security feature like this.. but just knowing that these cpu's can be bricked in this way will make people think twice when purchasing on the second-hand market.. which is both a good and bad thing. It should exist but limit it to exclusive parts... should not be able to happen with a consumer part.. or "off the shelf".
This is the kind of thing that in any civilized country would result in someone going to prison, or at the very least the company having its charter revoked and being unmade. Secretly stealing and crippling people's expensive parts just because it was plugged in is just so far beyond the pale that a message needs to be sent. Something so severe no company dares to try this again.
Avoid all brands... Bunch of a-holes. They were super happy with soldered CPUs and now got another way of screwing over the second hand market, because fck poor people, fck the environment, fck any future chip shortage, they got their money so fck you, too. Never again will I buy HP, Dell, Lenovo (not to mention Apple), any of their prebuilt garbage. Pay a bit more for freedom and control over *my* hardware.
Your locked Ryzen 5 now needs a Rest Glitch Hack to boot on another board. This "security" sounds a lot like Xbox 360 security, where the CPU has an efuse key paired to the encrypted firmware. Maybe some cool motherboard company or hackers will release a "glitch chip" or glitch feature to boot up locked CPUs... and dump the vendor keys.
Cool that you bring this up. I saw the same in a Serve The Home video, and this has to be spread out to the tech audience and home users like GN's Newegg scandal.
I work at a Lenovo dealership and they haven't told us any of this, none of my co-workers or bosses knew, I was the first one to bring it up after I started hearing about it a few weeks ago. The only thing I can say is that I've never needed to salvage a CPU so it hasn't been a problem for me. My job is mostly upgrading hard drives to SSD's, fixing errors in Windows and doing PDI's.
@@marcogenovesi8570 We're more like the "middle men" to selling and repairing Lenovo products, whatever goes on at the factory before it gets shipped to us is out of our hands.
The only customers this affects are downstream from you in the used market. The only people it would impact would be the people who bought a used workstation with the idea of salvaging parts. I'm not saying it's a good thing or anything. It's just your customers aren't affected.
I've salvaged CPUs (and other parts) from plenty older (couple years) Lenovo systems over the years, the vast majority of those having bad proprietary PSUs you can't get replacements for without exceeding the whole PCs value or dead motherboards for no apparent reason that will not turn on whatsover or they'll turn on but not POST or even attempt to (POST code reader FFFF). This PSB BS turns the most valuable part (if not monetary then from a "still very usable" standpoint) into complete e-waste, because what are you gonna do with it? Stick it in another Lenovo sh*tbox that'll have a dead proprietary PSU or mobo in no time? And all of this for the illusion of security?!
This is going to be a huge pain when they start coming out in huge waves on the second hand market. Imagine spending all that money for a nice new Ryzen 5000 series only for it to not work in your computer. Also gotta add, in a world that's moving towards a less eWaste future and right to repair, Lenovo should get sued for locking CPUs to it's own motherboards.
No, because the security feature has many valid reasons to exist. But it needs to be be better implemented. It should not be bricking the CPU, it should instead be making it so that it can no longer be used in a secure system, but fine for normal every day use.
@@truckywuckyuwu yup. For example knocking out the protection could knock our the TPM data (thereby triggering bitlockers recovery mode and warn the user, similar to intrusion detection on several cases
@@truckywuckyuwu I imagine it was one of those things they built into the architecture in the days of yore, when re-purposing shitty enterprise APUs would have been met with a "but why?" The development of 5000 series chips ended long before covid was even a twinkle in our throats. I think if they had known that three years later people would be scrambling for any silicon they could get their hands on, they might have tried a little harder to create a solution like you suggested.
This happened to me with my Thinkcentre i7 4790. Bought a new motherboard and it never worked together. Tried a different CPU and that worked fine. After all these years I have answers. Thank you!
You're telling me the company that has been caught installing root kits into their system twice is also doing other stupid anti consumer practices. Who would have thought
The newer IT nerds are still praising Supermicro on forums. Not withstanding that every competent IT server farm dropped Supermicro like a plague potato five years ago.
Lenovo has been doing this at least 15 years back, I bought an old T61 Thinkpad with locked BIOS that was used in a corporation, however this can be undone by shorting the correct pins on the EEPROM chip. Similar hack could be used on a CPU security chip, however this is practically almost impossible to do since we cannot access the chip without breaking the CPU, and even then we would need microcsopic rools to attempt the shorting hack. It's understandable that corporations would like to protect their BIOS access on their workstations or encript and lock data storage, however locking the CPU makes no sense, there is no data stored there, there is nothing to compromise by using the CPU on another system
I made a big mistake when getting Lenovo. Nothing told me that my model did not allow GPUs before I got one . Actually all the research I did told me it could. I had to hack the bios and enable a lot of system features that was locked out of the user lever. I can now use pci net cards and sound cards now to. I also want to thanks the LTT forums again. Solid help from a nice community and didn't laugh at me or tell me to hit the road like the other forums I asked for help at. Cheers all.
To intel's credit (as flawed as the ME has been), the ARM chip they use for ME (which are their lockable component like the PSB) are on the chipset instead of the cpu itself, and since the chipset is soldered to the board, it doesnt really impact the reusability of the CPU, but AMD wanted a CPU that could operate as a SoC (without a chipset) so they had to put it on the CPU.
2:48 I think I had something around that Wattage dimension like 20 years ago for the last time. When building my Barton 2500+ rig in 2003, I installed a 400W Zalman and never had anything less afterwards... oh well. 8:06 The editor OTOH is feeling just fine, in fact he is having way too much fun! :D
As soon as I heard about this, I pretty much blacklisted Lenovo from my recommendations to friends/family just needing a simple home computer... I may not be their customer, and most of the viewers here may not be their customers - but when our less tech savvy relatives/friends ask for recommendations, it's important to press home that Lenovo is shoveling even more e-waste than we see with the likes of Dell/HP/etc. with their proprietary motherboard sizes.
Their "budget" laptop have intentionally bad plastic hinge socket on $200-$900 since 2013 especially their ideapad line-up(my experience). Just look at their forum /yt video anything related to it's hinges being suddenly break from normal usages. Of course they'll decline given warranty despite the obvious flaw
I don't doubt Dell would use the exact same tactic. They already do for their Epyc poweredge servers. I bought an Epyc 7742 last year from a second hand company based in Scotland which had a vendor lock to Dell servers (which wasn't on their website at the time). After a bit of back and forth, i got my money back after they confirmed the vendor lock and changed their website to specify that the CPU's were locked to Dell branded servers. Dell wasted both my time, and the companies time with PSB. So i have 0 doubts with Dell's history that they would do the exact same thing on consumer platforms. From what I know, HP Proliant servers also have secure boot but they do not utilise PSB (at least by default).
Um I'm confused as to why this was the straw that broke the camel's back ? Lenovo has shipped PCs they compromised to the US government, then shipped malware/spyware with a number of different generations of their machines at the consumer level. Not only did they ship the malware but it also left some other security holes and they have shipped some really stupid bios settings with some of their machines too...trusting a company that will happily take your money then ship you a machine THEY compromised ...
I see this as preventing IT departments from repairing devices with cannibalized parts out of other systems that have failed for another reason. Lenovo would certainly benefit from forcing the purchase of new hardware or support.
The 3 I’ve worked for have all been “replace the entire system with a spare and add the old one to the recycle pile” The most hardware level work I’ve done is pull hdd for shredding
@@billy101456 I have seem the same thing at my old job, ended up with a bunch of dell 9010s (I knew the guy that delt with them and he just told me to turn in the hard drives), spend a handful of money on basic harddrives and donated them to students (they had to pay the $30 to activate them unfortunately, couldn't afford that much money) who needed a computer for school, and a handful to my old school to lend to students in the same situation. I'd prefer to not generate the e waste on a simple issue. Most would drive failures, few ram sticks here and there, and two with bad CPUs became parts machines for the others. But it's maddening to see it, and this wasn't a super large scale, ended up with 21 systems over all and mostly because an office got upgraded.
As an early 80s kid that wanted everything beyond the 2000s with great anticipation and excitement, this has now entered my painfully long and heavy list of "not that". We really went the wrong way in a profound manner during the mid 2010s, in almost all regards, globally.
Unfortunately we are part of the problem or more so people who don't understand computers and how the market goes and just want something to work out of the box without doing some research or even asking a friend or two who have more knowledge to recommend to make an informed purchase . For christ sake hp did the same thing with there toner cartridges you can use a the cartridge only on the one printer you bought .Thank god that people complained and they made it an option that can be turned off witch is still BS it shouldn't be there in the first place
So crazy that Lenovo also developed that one-off AR Star Wars lights are training game too, idk what it was called to save the life of me but I know I have it somewhere
So i was the one who brought this to the attention of ServeTheHome, LouisRossmann, and eventually LTT, and i did not see the twist ending of ALL AMD CPUs supporting vendor locking. I was initially very upset because where i work, we resell our older(but not too old) crap boxes, with god tier i7/R7 processors to the local community, and most of these people will swap a processor more fitting of the hardware into our truely crap boxes, and then our great CPUs into a more fitting motherboard, but now they cant do that, and this will cause a huge headache for us. At this point i manage hundreds of these ticking time bombs of resale nightmare. There is no reason the PSB has to be permanent, but disabling PSB should prevent it from working on PSB motherboard again. Because, if you can disable PSB on the motherboard, then there should be a way to disable PSB on the processor, also disabling PSB on the motherboard should be permanent as well because at that point the chain of trust has been broken just like it it was disabled on the processor.
Note that on my personal lenovo M75Q gen2 with PSB, i tested 3000G and 4000G non-pro processors, and they did not seem to support vendor locking, but 3000G and 4000G pro series did ask to be locked
It was always a lottery buying IBM laptops, because they could password protect the bios and it was a pain to bypass, and most eBay sellers didn’t have the first clue on how to check this before auctioning it
One thing I can see customers of workstations might want this feature is in leasing situations, a lot of places that lease workstations to customers for use in professional environment. At the end of the contract you send the machines back, this is one way to prevent the leasee from swapping parts out.
Lenovo is really turning to shit. They had some amazing laptops, still do honestly, and their gaming PCs are a pretty solid offering compared to Dell and HP, but if Lenovo goes back to using proprietary hardware instead of making their hardware more standardized, I will be very disappointed. I got a Lenovo mainboard for my testbench. Great board - any RAM and any GPU I throw in works flawlessly, 0 compatibility issues whatsoever (which at least to me happen regularly with non-OEM boards like Asus and Gigabyte), but their front panel and USB connectors are proprietary. WHY?!
Honestly though from an enterprise level, Lenovo is SO much better than Dell or HP, especially when it comes to things like customer service/support/onsite tech scheduling. Can't speak for the consumer division though
Fishing defence... Hmm are you working with Mr.Nimbus by any chance? Why would you be advertising fish defences? Are these any fishing hook or fishing net protections? hehehehe
An easy way to straighten bent CPU pins is with a syringe needle. Find one that just fits between the pins. Slide the needle in at the base of the pins then carefully lift it out sideways. A few strokes like that down every row will have pins straight enough to get into the socket. Clamping the socket finishes the straightening. Using a knife puts a lot of stress right at the bases of the pins which can break them off instead of straightening them. One way to spot bent pins is to reflect light off the ends of them. You should see uniform brightness on all the pin ends. One that's darker or brighter than the others is bent.
This just seems like a vulnerability waiting to happen. So if you have a non-blown cpu, a malicious actor can blow the fuse with arbitrary vendor code and brick your machine?
They will argue that you can buy new parts (from them of course) and re-lock them to fix any issue, since the original cpu is already not reparable and it's unlikely most people would bother to fix a motherboard. It's viciously clever. They create a whole new locked market where repair shops are just really drop off for a massive recycling company to swap half the system for an inflated price. ...hmmm sounds familiar actually, there's an unfriendly brand that does just that with great financial success^^
this is a serious problem. the cpus need to be physically marked somehow as being lockable. people are going to resell them not even knowing they're locked
You seem to be missing the fact the ALL current AMD CPUs have this feature... Just Lenovo was the bunch of idiots that decided to use it on consumer boxes...
You forgot to mention one huge security risk that pisses me off: The possibility that malware gets enough access to permanently burn garbage into the AMD PSB fuses, rendering the chip useless as it will not validate with any key.
@@willj4243 No, it's not the same thing. Not by a long shot. If a hacker gains BIOS level access, I can grab an SPI controller and reflash the bios. Good as new (granted, requires quite the technical skill but there's even youtube videos about it, or you can send it to someone who knows how to do it). I can also buy a new MB which is much cheaper than a CPU, and problem solved. However if an AMD CPU gets their fused blown up, it's now an unrepairable brick. Not even AMD can repair it. It's worth as much the materials in it; but it was very costly to buy.
On Intel anyway, you can program the fusing in another way to disable BootGuard (same thing as PSB basically) for the platform permanently. Likely AMD has similar. As a consumer you miiight be able to do this to your CPU, and thus defend it from ever getting PSB enabled if you didn’t want it. Also, side note, because these are one time programmable fuses, OEMs enabling PSB, actually protects you from malware that might try to write garbage to them.
@@darksylinc As someone else said, if someone has that level of access to your system and wishes to cause hardware damage, they could simply fry the CPU instead with less effort. You're worrying about the wrong part of such an attack.
I don't care if this is fOr SeCuRiTy, this absolutely WILL get implemented without such a clear notification by OEMs and I hate it. And I hate even more that it's activated by default without choice or clarification. For servers? Ok
@@Jaker788 Yeah, but you don't get a choice to use the PC WITHOUT enabling it, making any Lenovo office/work PC in the future a no-buy and any AMD (for now) CPU used in it to be instant e-waste.
Lenovo: we keep getting caught installing keyloggers in new computers- ive got an idea, how about we make more e waste to increase the profits we losing from keyloger partners
This was informative, but can we pause for a minute at the "freeze RAM in liquid nitrogen and read the bits off it" part... Is that a video-worthy topic? Because that sounds very cool (no pun intended)
@@nicholassmerk It's a Lenovo, the mobo will die for no discernible reason whatsoever anyway at some point in the next year or two. And if it's not the mobo, then it's the crappy proprietary PSU that dies and replacements will cost more than the entire PC is worth. But hey at least you can still salvage the one part that's usually worth the most in a wrecked/totaled PC right? oops... no usable CPU/APU for you
@@sovo1212 -if you watch the video from minute 6:28 to 6:32 you would register that Linus says, both AMD and Intel do a similar thing with there CPUs, which means that in conclusion Lenovo is still the culprit here, because they are the only ones who light the fuse which AMD and or Intel have laid! And if you think about it it's even simpler to tell, say you have a nuke with a big fat red button to fire it, who is responsible for causing trouble using it in the first place? The person that placed the big red start button or the moron who actually pushes it???
Lenovo: We’ll lock the CPU secretly so that when any components in PC malfunction. They buy new one. Probably with us, again. Landfill: Give me that thing, quick!
Couple notes here: 1. PSB also assumes that the CPU stays constant with any BIOS changes. Of course, the bigger issue here would be physical access, but as with most security measures you can take, PSB is entirely useless if an attacker has physical access to the machine. 2. Theoretically, there would be nothing to prevent a non PSB-locked CPU from being locked by malicious firmware. In theory, firmware could be compromised in such a way that it locked PSB with a bad key, effectively rendering the chip completely useless since it can't verify with any BIOS. Some more cleverly-crafted malicious firmware could possibly make this an extremely effective tool for ransomware, although how that would be done I have no idea off the top of my head.
Their shit? They don't sell CPUs they sell prebuilt computers. No one is buying tiny prebuilt computers with the express intention of putting them in a bigger desktop, it's just not a sound business decision. These are bought because someone needs a small desktop for regular professional applications like word processing and this will do fine for a long long time. Where it does get annoying obviously is if someone was intending on buying these aftermarket years for a low end gaming rig obviously but it wouldn't suddenly be a useless computer. I don't understand this virtue signaling of ewaste with this situation. It'd be much more wasteful to take the cpu out of the computer for another rig and tossing the rest. The bigger problem in my mind is that it's not clearly labeled as a feature of the product, not that they're using the feature of the amd cpus.
5:28 Honestly? as a former tech support agent, the Lenovo platform is amazing for business. They just work and work well and have all the enterprise options available unlike a lot of other manufactures like Dell and for sure Apple machines. They also have great tech support. In order to get full tier 3 security status and be certified, they want a platform they can trust for security. Lenovo's are known for that in the business world. That particular model you used is used on desks everywhere in offices. Well most go with the Tiny PC units ( like the M series) as they are oh so small (smaller than a NUC) but are full-fledged desktops with i7's in them and not just dummy terminals. All of those M and T series Thinkpads and Thinkcenters are business oriented, not just some Yogabook or Ideapad. BTW those coolers actually work very well, especially the ones in those Tiny PC models and the laptops.
Oh lord I had to fix pins on my first build. I picked up the cpu and the over hang of my fingers pushed in some outside pins. Spent a while eyeballing them using a debit card to realign the pins. It worked and the cpu served me well for like 10 years. Now it's in a friend of mines pc for his kids to use for school work. Still handles games decently.
This is so why we need the right to repair laws to pass.. Would make it so much easier for consumers to stomp their foot down on these e-waste practices.
@@marcosolo6491 That's because our government is too busy trying to pass laws with several thousand pages of BS so they can sneak in an under the table cut. None of our law makers or politicians give a crap about anyone but themselves and their pockets.
If this is by some miracle actually legal, the right to repair movement should definitely attempt to stop this and leave it up to the consumer's choice.
@@dotJata I was about to say, it's probably in the TOS and since we all agree to them without actually reading them - only 'We' as consumers are to blame for this shit.
@@dotJata I don't think you need to sign those when buying it though, do you? Also even then you could argue that it's highly obfuscated information about a major functionality issue. And then there's ofc the environmental standpoint from which this could be regulated
There was one step that was missed, trying the CPUs in another Lenovo motherboard that already had the "security" option enabled, to see it the CPUs could be switched across M/Bs* - I doubt it... As Linus said, there are plenty of applications where it is actually a good thing, but where the issue lies, to me, is it's essentially bricking the ECU. It should have been simple enough to design it so there was a separate sub-routine, or handshake, but that wouldn't have killed the CPU for other applications. *Worse, and even more insidious, is if the 'security' feature means that if there's a fault with the motherboard that requires it to be returned, the CPU also has to be returned - I can't see it being a generic code but a unique code generated at the time of enablement.
When i originally broke this story to ServeTheHome i had tested 3000G and 4000G non Pro and they did not ask to be locked, this must be an addition to the 5000G, I need to get my hands on a 5600X and a Lenovo with a PCIe slot so i can test if all 5000 series and later support it, or only the 5000G processors
@Jose Sousa and I think this is the whole point of bringing PSB to desktop systems. If you cannot buy used CPUs or you can, but they turn out useless, you'll most likely buy a new CPU, which is $$$ for the companies.
10:37 that's a tamper seal! That's actually genius! I'd like to see a physical change to the chip, though. Maybe blowing the fuse also breaks a bit of dye that colours the pins black, And it needs to get removed from non-pro version entirely. And every machine that has this enabled needs to ship with a special sticker on it. Every system or motherboard that can enable this needs to ship with a sticker that you can add yourself if you decide to lock it. The feature is fair enough, how Lenovo goes about it is not.
It isn't anti-competitive but it is massively anti-consumer. At this point I have no issue recommending anyone to just boycott Lenovo. And the fact they do not disclaim that this feature is enable by default could leave them open to a CA.
@@AbRaSkZo The feature is there for those vendors that decide to support it in thier custom BIOS. You know, for corporate environments as any CPU could be used there. The fact that Lenovo decided to use it in consumer products puts the full blame on them.
@@AbRaSkZo It gets pretty tiring repeating this over and over. AMD designed this feature because corporate and government agencies wanted it. The fact that Lenovo enables the feature on consumer products is entirely on Lenovo, nobody else does it.
Not to mention how many people just click "yes" without reading dialogue boxes. The amount of times I've gotten "hey my computer is acting weird, it pops up some error code. I don't know what error, I just click okay"
That only pops up if PBS is enabled, though. If you don't want to lock your CPU, go back to the BIOS and disable PBS. It's stupid that it's on by default tho.
No, you can also get rid of it by disabling PSB in the bios, as it clearly stated. And then use any unlocked CPU normally. Lenovo is being shitty by shipping pre-locked CPUs in consumer systems, but that popup isn't a bad thing - hear me out; it only shows up specifically when PSB is enabled and you're booting a still-unlocked CPU (meaning PSB won't work), it tells you exactly how to deal with that with two different options, and then still gives you the option to finish booting without locking the processor or disabling PSB at the bios level. The only bad part about it is people will click "yes" without reading things - instead of yes/no, it really should have buttons labeled something like "Lock CPU," "Disable PSB," and "Boot without locking platform" instead.
Samsung does the same thing. :/ Even though you are allowed to deny Android updates, you will get notifications until you say yes. It really should be illegal for companies to force updates on people.
A fun question is, could a malicious actor trigger this from a virus on an AMD cpu that supports it and use some gibberish key to brick the cpu? Sure the code is closed source, but that doesn’t really stop security researchers.
After buying a new Lenovo laptop recently, I have no doubt that this is done solely to lock-down the customer and prevent them from reusing old hardware. My Lenovo laptop uses Torx screws to hold the bottom plate on, so the average user can't open up the laptop. The ram is also soldered on, even though it's a 14 inch laptop with plenty of room for at least 1 SODIMM slot. Lenovo doesn't give a shit about customers and it seems like they're testing the waters with their vendor wide lock before they move to a model-specific CPU lock. Never again will I buy from Lenovo. Edit: I should mention that I actually prefer Torx screws. I hate Phillips-head screws with passion. And yes, I know that torx screwdrivers are readily available, but almost everyone has a phillips head screwdriver around, but not everyone has Torx. Also, on the inside Lenovo is using phillips-head, so they didn't chose Torx because of its advantages.
What do you mean the average user can't open it? It's debatable on if it's to keep users out, but torx is a pretty common screw these days and easy to obtain, also after getting used to it, it's legit so much better, there isn't any guess work on size, it fits or doesn't thusly I have never stripped a torx screw either, I'm genuinely sold on torx now. Soldered ram is BS though, but other OEMs also do it all the time on modern laptops as well, you kinda have to go out of your way to look for modern laptops with replaceable ram/ssds/batteries.
Most if not all vendors use Torx screws now. They are superior to Phillips in every way. Using Torx security screws would be a little more questionable but even those are pretty easy to find for an average consumer. Now, Apple with their pentalobular screws are a perfect example of anti-consumer...
It sounded like the entire firmware would be signed, and the CPU verifies that signature, changing the BIOS to work with a different board would invalidate the signature.
It's described as a signature. The way digital signatures typically work is they calculate the hash value of the code and then encrypt the result using a private encryption key held by the vendor. This can only be decrypted with a corresponding public key. To validate the signature the platform first tries to decrypt it using the known public key. If it works this proves it was signed by Lenovo. The system then calculates a hash of the current code and if this matches the decrypted value it proves the code hasn't been tampered with since Lenovo signed it. If you were to transplant part of it the overall hash value would be different so you'd need to re-sign it using Lenovo's private key or it wouldn't validate.
@@matrixfull i mean, quantum computing will certainly break this, and if it is RSA and N is small it is certainly breakable, and it may be possible to copy the same bios and use it on a different system, or the vendor could sign the bios of a different platform
One of the biggest banks in my country deploy these Lenovo machines at all the branches as terminals and they're at the core of all their on-site infrastructure. I had wondered why, but now it makes sense why they may have chosen to go with this solution.
When serve the home did the original video on it I was soo glad it was them that badly ran into it first. Given that they has had this experience before with server chips they didn't just throw more CPS's at the problem and waste lots of them.
The fuse for these workstation machines kinda makes sense for computers that are company property. It prevents some "high tech" thefts like swapping out components with worse ones as a lot of workplaces do not actually properly register their computer system's components. The problem occurs when an individual customer buys them as a home-use item or when companies start to sell their old assets as part of a planned upgrade cycle, as the CPU is permanently stuck in the board(s) preventing any further upgrade to the system, reasonable or not, which means that they are basically e-waste at the points.
I used to love Lenovo PC's, first rig being an old ThinkCentre that eventually got upgraded with time as it used standard parts.. now they are competing with Dell and HP for who can screw over the end user the most
Let me get this straight… Linus decided to make a video where he gets to intentionally break something and in the process he still managed to accidentally break the thing in a way he didn’t intend? Classic!
The best way I have found to fix bent CPU pins is a Pentel mechanical pencil .5 or .7. The tip is the proper dimension to fit over the bent pin with the control to get it right where you need to.
Lenovo has always had some of the hardest bios passwords to clear too... sometimes requiring physical, well timed shorting of contacts with the laptop half disassembled during boot...
I've had at least one ryzen from every generation and I never knew this was a thing... Makes me wonder how many of the chips sold on aliexpress and ebay will do this
So as long as the 5th gen CPUs are in the market as it seems all AMD CPUs will have the FSB fuse but the BIOS needs it to be enabled or disabled and 5th gen CPUs arent "new" at least 1 year old so it will be sucks to be that one screwed boi who buys from a vendor who will brick CPUs for Lenovo because thats their test bench CPU
For an entire year, my 5350GE has had me corresponding on and off with Gigabyte global support and a regional Gigabyte factory trying to eliminate the error source. As a misleading red herring, it turns out that my B350 mobo is an early revision that likely needs a hardware change to support Cezannes in the first place. Then I finally ran my 5350GE on an Asus B450 and go figure, it was just as dead there and my concerns about post-warranty RMA deals all become a moot point. In defense of the 2:nd hand vendor, they did state "Lenovo locked CPU". Not "Lenovo-locked CPU" though. I figured clearly this means a locked *multiplier* CPU taken from a Lenovo build. No way will any motherboard brand be able or *willing* to ruin a regular movable AM4 CPU for any and all competitors, clearly? That would mean, that for any CPU upgrade a consumer does on their Lenovo, they would be stuck with an unusable leftover chip for all other brands, and saturate the aftermarket with dust-collecting Lenovo-only CPUs. Now I know better. Thank you Lenovo, for hijacking my 150 dollar trans-Atlantic chip and leaving me spending a ton of garbage time on this unsalvageable problem. Now I won't even be able sell it as tested working, unless I buy a no-frills test purpose mobo from a brand I thoroughly dislike by now.
It's ironic. The ryzen 3000 line had a security problem in that a rootkit could be made permanent by installing itself in the board motherboard firmware. This meant that you'd have to replace the motherboard when cleaning up a rootkit if you wanted to be certain it was gone (or at least de/re solder the bios storage chip). Now we have a "solution" to that which masquerades as a dead CPU, and cannot be verified to work so doesn't really solve the initial issue. The one minor improvement is it means when you are trying to restore the compromised bios you can be somewhat certain you have it back in its stock state if the cpu posts... more likely is you replace the CPU that randomly quit working, put a new one in, and let the rootkit *pretend* to vendor lock it (or vendor lock it with its own key). The sad thing is it's *so close* to being an actual solution. The problem is the CPU cannot communicate the nature of the problem, given that the motherboard cannot be trusted to relay the message to the user. There are plenty of potential solutions to let the end user talk directly to the CPU. The obvious choice would be a TTL serial header that would be mapped direct from the CPU pins to accessible pins on the motherboard, so when you get a CPU fault you can connect to those pins and see if the CPU is really dead, or just wanting to talk directly. At the very least, reporting a different trouble code for "cpu refuses to work" vs "cpu not found" would be a start.
Seems to me like a badly designed security feature is being exploited by OEMs to facilitate anti-competitive business practices. Recyclers are almost certainly going to attach a negative value to product ranges that have this 'feature', though by that point Lenovo is long gone with their customer's money.
0:39 - they can all it a "security feature" all they want but the reality is they want to make sure you cant use that CPU with any other motherboard. more consumerism, more $$$$$$ for the manufacturer of the CPU