Intel vs AMD Processor Security: Who Makes the Safest CPUs?

[Admin]

Who has the most secure processors, AMD or Intel? We dive into how the two companies are affected by some of the most dangerous security flaws in their history, as well as what we can expect from their security features.

Intel vs AMD Processor Security: Who Makes the Safest CPUs? : Read more

 

[jimmysmitty]

These are the most useless comparisons. Never a fan when TH does it.

The biggest issue with security vulnerabilities is that just because they are not vulnerable to A doesn't mean there isn't B waiting to be found, or many have been found already just not by someone honest enough to notify anyone of it.

Intel is the biggest focus of it currently. When you have 99% of the server market and 90% of the desktop market you do become a massive target. AMD will probably find some. Some we may never know about, it happens a lot more than people think.

In the end if you want tru security the only secure PC is one that's unplugged.

 

[hotaru251]

These are the most useless comparisons. Never a fan when TH does it.

The biggest issue with security vulnerabilities is that just because they are not vulnerable to A doesn't mean there isn't B waiting to be found, or many have been found already just not by someone honest enough to notify anyone of it.

Intel is the biggest focus of it currently. When you have 99% of the server market and 90% of the desktop market you do become a massive target. AMD will probably find some. Some we may never know about, it happens a lot more than people think.

In the end if you want tru security the only secure PC is one that's unplugged.

not gonna say it was a good comparison, but undiscovered flaws arent an issue UNTIL they are found.

but even including them the fact is intel's has more at the current time and their "fixes" are more impactful to the end user :/

 

[jimmysmitty]

not gonna say it was a good comparison, but undiscovered flaws arent an issue UNTIL they are found.

but even including them the fact is intel's has more at the current time and their "fixes" are more impactful to the end user :/

Majority of fixes tend to only impact HPC operations more than consumers or enthusiasts. Even with patches benchmarks can show this.

I just am not a fan of this format for any of them. Its not helpful and just tends to get people riled up.

 

[joeblowsmynose]

Instead of "Winner" ... it should be ... "Less a loser"
"Winning" by having the least vulnerabilities is winning like Charlie Sheen ... 😉

I agree these types of comparisons (by taking some points and declaring a winner/loser) should be left to more fun things like ... CPU cooking, for example.

 

[jimmysmitty]

Instead of "Winner" ... it should be ... "Less a loser"
"Winning" by having the least vulnerabilities is winning like Charlie Sheen ... 😉

I agree these types of comparisons (by taking some points and declaring a winner/loser) should be left to more fun things like ... CPU cooking, for example.

Those days are long gone. I still love the old TH video where he took AMD and Intel CPUs and had them run Quake then pulled the heatsinks off while running to see if the CPUs would still play the game let alone survive.

 

[joeblowsmynose]

Those days are long gone. I still love the old TH video where he took AMD and Intel CPUs and had them run Quake then pulled the heatsinks off while running to see if the CPUs would still play the game let alone survive.

Ahh yes ... the good ol' days before throttling became much of a thing ... great entertainment. Everyone loves watching stuff break

But I was more referring to the more recent "Which CPU cooks the best pancakes" article 😉

 

[Raven_BC]

Very good comparison and it seems people from TH are unable to count to five?! Is it because AMD is far better than srintel? 😉

 

[Zippzoeyer]

Why didn't they include the reference to the infamous CTS Labs scam when they brought up Ryzenfall, chimera, and fallout bugs and them being register as very high risk.

AMD would've won that category making this comparison a shutout

 

[jelyon]

The "Intel vs AMD Processor Security: Who Makes the Safest CPUs?" article is actually a very good one. It would be great if TH covered cybersecurity a bit more than it does, because the independent nature of TH reviews makes them very useful.

The article also provides strong support for why organizations need to use a chip blend instead of being entirely or almost entirely dependent on one processor company.

Keep up the great work, TH!

 

[joeblowsmynose]

Why didn't they include the reference to the infamous CTS Labs scam when they brought up Ryzenfall, chimera, and fallout bugs and them being register as very high risk.

AMD would've won that category making this comparison a shutout

Just because the motivation for exposing those flaws in the way they did was merely to try to short sell AMD, doesn't mean those vulnerabilities didn't actually exist.

It should have been mentioned, but it wouldn't have changed the "score" imo.

 

[sykozis]

Why didn't they include the reference to the infamous CTS Labs scam when they brought up Ryzenfall, chimera, and fallout bugs and them being register as very high risk.

AMD would've won that category making this comparison a shutout

I'm not sure of the current status of "vulnerabilities" but by the time I stopped reading news about CTS Labs, no reputable security researcher had managed to verify the "vulnerabilities" because CTS Labs refused to release any relevant data pertaining to them. I don't consider Dan Guido to be a reputable security researcher, btw, given that he couldn't even seem to grasp the level of access necessary for exploitation.

Given that CTS Labs failed to disclose these supposed "vulnerabilities" in a proper manor, but instead FIRST released the data to a media outlet well known for attempting stock manipulation schemes, I don't understand why these were even mentioned. CTS Labs, at the time of the disclosure, didn't even employ anyone with a background in hardware or security. Instead, they employed a staff with a background in....financial attacks and stock manipulation. CTS Labs was even founded in February 2018....right before the disclosure of the supposed "vulnerabilities"... "Vulnerabilities" that require direct access to the system, modification of the firmware AND administrator access to be exploited are hardly real vulnerabilities. If someone has direct access to the system, it's already vulnerable anyway.

Just because the motivation for exposing those flaws in the way they did was merely to try to short sell AMD, doesn't mean those vulnerabilities didn't actually exist.

It should have been mentioned, but it wouldn't have changed the "score" imo.

I would say the fact that they required physical access to and modification of the system firmware, means they aren't real vulnerabilities. Also, CTS Labs went to the extent of saying that these "vulnerabilities" can't affect Intel systems, when in fact that would be completely false.

Motivation means everything. It's not hard to conceive security vulnerabilities, then refuse to release the data necessary for "experts" to verify, and still claim they're legitimate.... The only "security researcher" I know of confirming these "vulnerabilities" is Dan Guido, and he supposedly did so without any testing whatsoever and without the actual technical data that would be required to test the vulnerabilities.

 

[redgarl]

ROFL... that's all you needed to show...

https://hardforum.com/data/attachment-files/2019/09/238926_fail.png

 

[redgarl]

Why didn't they include the reference to the infamous CTS Labs scam when they brought up Ryzenfall, chimera, and fallout bugs and them being register as very high risk.

AMD would've won that category making this comparison a shutout

You mean the attempted stock manipulation scam?

 

[kinggremlin]

Instead of "Winner" ... it should be ... "Less a loser"
"Winning" by having the least vulnerabilities is winning like Charlie Sheen ... 😉

I agree these types of comparisons (by taking some points and declaring a winner/loser) should be left to more fun things like ... CPU cooking, for example.

Agreed, terrible format for such an article. It's like ranking victims of a boat sinking by who died the least. Sorry, the guy that treaded water for 15 minutes longer than anyone else before drowning isn't a winner. If you have one serious security flaw, it doesn't matter how many the competition has above zero, you're still tied with them for loser/last.

 

[joeblowsmynose]

...
I would say the fact that they required physical access to and modification of the system firmware, means they aren't real vulnerabilities. Also, CTS Labs went to the extent of saying that these "vulnerabilities" can't affect Intel systems, when in fact that would be completely false.

Motivation means everything. It's not hard to conceive security vulnerabilities, then refuse to release the data necessary for "experts" to verify, and still claim they're legitimate.... The only "security researcher" I know of confirming these "vulnerabilities" is Dan Guido, and he supposedly did so without any testing whatsoever and without the actual technical data that would be required to test the vulnerabilities.

I'm not saying what you are saying isn't true ... I'm saying it doesn't add or take away from the vulnerabilities. Some of these also require physical access to Intel systems ... doesn't mean we shouldn't count them.

The article could have perhaps mentioned that some of Intel's older boards also had the ASMedia chipset - and thus the same vulnerability.

 

[jimmysmitty]

I'm not saying what you are saying isn't true ... I'm saying it doesn't add or take away from the vulnerabilities. Some of these also require physical access to Intel systems ... doesn't mean we shouldn't count them.

The article could have perhaps mentioned that some of Intel's older boards also had the ASMedia chipset - and thus the same vulnerability.

ASMedia has never made chipsets for Intel. They make third party SATA and USB chips that have been used on Asus boards to add more SATA ports or USB ports beyond what Intel provides but Intels chipsets are Intels chipsets.

 

[cwolf78]

These are the most useless comparisons. Never a fan when TH does it.

The biggest issue with security vulnerabilities is that just because they are not vulnerable to A doesn't mean there isn't B waiting to be found, or many have been found already just not by someone honest enough to notify anyone of it.

Intel is the biggest focus of it currently. When you have 99% of the server market and 90% of the desktop market you do become a massive target. AMD will probably find some. Some we may never know about, it happens a lot more than people think.

In the end if you want tru security the only secure PC is one that's unplugged.

This is also what happens when you milk and rehash the same architecture for a decade. That's a huge amount of time to poke holes in it. Let's not make excuses for Intel's laziness.

 

[jimmysmitty]

This is also what happens when you milk and rehash the same architecture for a decade. That's a huge amount of time to poke holes in it. Let's not make excuses for Intel's laziness.

To be fair the last two times Intel tried to use a different uArch they got either panned (Netburst) or rejected for the easier method provided by AMD (Itanium). In fact if we were not so stubborn and went the easier route of x86-64 then we would have been using IA64 instead which was mostly immune to these attacks.

I would also say more than a decade since Core is based on the Pentium III Coppermine which is in essence based on the Pentium 54C. So we have been using the same base uArch for multiple decades.

However I am not making any excuses. The fact is these comparisons are stupid and there is no real winner. I can say without doubt that the more popular AMD gets the more security flaws and exploits we will see become public.

In the end all this says is that AMD is more secure for now. Down the road they may find something that could also be exploited on older designs. AMD will milk Zen for as long as they can.

 

[StewartHH]

Just because the motivation for exposing those flaws in the way they did was merely to try to short sell AMD, doesn't mean those vulnerabilities didn't actually exist.

It should have been mentioned, but it wouldn't have changed the "score" imo.

My concern about all these security issues - that I have yet seen a virus actually reported in the field that actually uses them. There is no doubt these flaws have hurt Intel more than AMD but even though in lesser extent it has been proving that they also happen on AMD and even ARM processors. I wonder how much this is delay Intel from releasing 10nm and even 7nm efforts.

As for business purpose, I believe it safe to stay with Intel. Maybe for gamers AMD is ok but for professional, for long term I would keep my purchases with Intel.

 

[Dennis623]

I think this is a very good article that talks about the current security vulnerabilities for both camps, and what to expect going forward with upcoming designs myprepaidcenter

 

[joeblowsmynose]

My concern about all these security issues - that I have yet seen a virus actually reported in the field that actually uses them. There is no doubt these flaws have hurt Intel more than AMD but even though in lesser extent it has been proving that they also happen on AMD and even ARM processors. I wonder how much this is delay Intel from releasing 10nm and even 7nm efforts.

As for business purpose, I believe it safe to stay with Intel. Maybe for gamers AMD is ok but for professional, for long term I would keep my purchases with Intel.

Yeah but for servers sticking with Intel (at this time) means twice the price for half the performance and twice the per socket licensing costs ... so whether one feels comfortable with all the security holes or not, there's still that on top of being (theoretically) more secure.

Ice lake should be good for servers though, I am sure Intel is trying to get those out as soon as absolutely possible. 14nm++++++ isn't really cutting it in the server space right now compared to competitors offerings.

 

[TJ Hooker]

Yeah but for servers sticking with Intel (at this time) means twice the price for half the performance and twice the per socket licensing costs ...

I think per-core licensing is becoming more common these days.

 

[joeblowsmynose]

I think per-core licensing is becoming more common these days.

Really depends on the application, but since MS is a filthily greedy company, they'll squeeze it anyway they can.

 

[jimmysmitty]

Yeah but for servers sticking with Intel (at this time) means twice the price for half the performance and twice the per socket licensing costs ... so whether one feels comfortable with all the security holes or not, there's still that on top of being (theoretically) more secure.

Ice lake should be good for servers though, I am sure Intel is trying to get those out as soon as absolutely possible. 14nm++++++ isn't really cutting it in the server space right now compared to competitors offerings.

Again there is more to it than cores. If you look at most benchmarks Intel is not as behind as you think even with a core disadvantage.

Then there are the tools and support, which again Intels software team dwarfs most large software companies.

Servers have a ton of aspects that desktops don't ever need to care about. Ice Lake SP is currently slated, per roadmaps, to launch in 2020 but will only be up to so many cores.

Really depends on the application, but since MS is a filthily greedy company, they'll squeeze it anyway they can.

Per-core licensing charges?

Some vendors are charging licensing fees for each processor or even each processor core in a server. In an article on Network World Oracle is described as charging for each individual core on multi…

netcraftsmen.com

Thats from 2008. Oracle was already charging on a per core basis. Microsoft just switched to it in 2017. Its more like the industry is moving to a per core licensing for servers.

Look at AutoCAD. You can no longer buy persistent licenses. Say I wanted AutoCAD 2020 stand alone. I would have to purchase a subscription based license that you have to renew each year or it stops working. That was in 2016.

So I wouldn't say Microsoft is any more filthy or greedy than anyone else in the industry. If anything they held off longer than most major HPC/software developers.