oh geez is it okay crap i bent a lot of pins
Linus that's really bad i can fix it
if everything goes according to plan today i'm gonna install this brand new
ryzen 5600g CPU in that lenovo thing
center m75s pc destroying it permanently
and believe it or not that's a feature not a bug you see some AMD ryzen cpus
contain a fuse that allows a motherboard manufacturer to lock the CPU to their
own brand of motherboard it's a security feature that first showed up in epic
server chips but lenovo seems to have taken it upon themselves to enable it on
the desktop okay maybe destroyed permanently is a little unfair the chip
will still work as long as you put it in a lenovo motherboard but
damn it i'm mad or at least i will be if
it behaves the way that i'm expecting obviously we don't want to break any
more chips than we absolutely have to so we haven't actually tried it yet but
we're about to smart deploy gives you zero touch zero
headache pc management for it you can deploy Windows apps and drivers from the
cloud with no vpn required get your free subscription worth over six hundred
dollars at smartdeploy.com Linus
why am i so good at fixing hardware when you break a lot of hardware you gotta
fix a lot of hardware well it's not hardware in general that i'm good at
fixing but i am pretty good at fixing dead pins
there is virtually no way of knowing if the lenovo system that you just bought
has a locked CPU inside it there's no visual indication no sticker the website
no mention of it whatsoever and even the full nine page spec sheet nothing and
i'd bet that the vast majority of people that bought a system like this one would
think that the ryzen 5 5650g inside it
would work like any other desktop CPU let's try that first maybe this is all a
big misunderstanding and lenovo didn't lock down this machine i guess we should
power it on first make sure it actually works right yeah sure
there we go everything booted up as normal the dvd drive works which is
really good overall what are we looking at here we've got solid front i o uh
less solid rear i o ryzen 5650g
processor with a very unexceptional looking blower cooler although i do like
that it exhausts all the heat directly out of the back of the system
m.2 boot drive
260 watt power supply wow i don't even
get a 260 watt power supply anymore oh
lordy is that single channel memory for shame 16 gigs on a single stick well i
can definitely see why people would want to put the CPU in a different computer
so what's your bet alex doesn't work you bet it doesn't work it
doesn't work i don't know there's so little concrete
information out there about this i kind of am hoping that it's just a
storm in a teacup situation holy crap
it's just in a boot loop what's the code it's throwing it ends up at c2 and then
it reboots it goes c2 0 0 and then it
reboots and i know 0 0 means no processor we've given this a solid five
minutes at this point it's clearly not going to fire up i want to take a closer
look at this CPU maybe it's uh maybe there's something else at play here okay
well here's one thing this is a ryzen 5 pro 5650g
and we do know that their pro lineup is geared more towards the workstation
market i don't mean workstation in the sense that you're doing like 3d modeling
or animation certainly not on a machine like this but workstation that this is a
professional machine maybe it's just pro
ones or maybe that motherboard's not pro compatible or if you want we can test a
pro CPU in that motherboard we have another pro yeah we have another pro oh
i can go grab it yeah let's do that so i have this 4750g although we do have a
problem that this is from a lenovo system so oh if it's locked that would suck i just
fired this one up and alex is about to fire this one up if this turns on then
what we'll know for sure is that this motherboard works with pro cpus and if
it doesn't then we won't really know anything either that CPU is also vendor
locked or this board doesn't support pro cpus
if this one turns on then we will know for certain that the CPU itself still
works but that lenovo absolutely did lock it down to their motherboard ryzen
pro compatibility confirmed there we go it only took me
two tries to time that do i have to break the 5600g
well we don't know if it'll break or not we're pretty sure it's going to break
alex but we don't know there it is
psb enable enabled by default if it is enabled when a new CPU is installed the
system will notify the user during post this notice message can be cleared by
pressing y so you clear it by pressing y but which if i understand correctly will
also mean that you have just vendor locked your CPU that's not as simple as just
clearing a notification and confirmed it is
locked down so that the CPU will only work in a lenovo system by default which
raises the question why would anybody want that in the first
place i mean i get why you'd want to lock down certain parts of your pc
firmware for example could help prevent malicious code from being injected into
it or having an encrypted hard drive to make sure people can't steal your data i
mean heck even encrypted RAM since you could hypothetically have someone freeze
it with liquid nitrogen and then read the bits off of it but how could vendor
locking a CPU increase security well as
it turns out we aren't actually super concerned about the CPU we're concerned
about the UEFI BIOS the firmware and locking the CPU is a byproduct of
locking down that the culprit here then is AMD's platform secure boot or psb and
we can see it's enabled right here and it's legitimately a useful feature that
some customers do want because once an intruder has access to your BIOS the
rest of your security measures become largely meaningless so to address this
AMD and Intel for that matter puts a little ARM microcontroller in their CPU
that is responsible for security and to ensure that everything is secure the
BIOS or firmware needs to trust the CPU and the CPU needs to trust the BIOS so
when psb is enabled there's a little field programmable fuse in the CPU that
has some information from the BIOS written onto it including a
cryptographic code from the motherboard manufacturer so let's disable psp in the
BIOS and put our off-the-shelf ryzen 5 5600g in here oh wow you did a great job
of straightening those pins it actually goes in pretty easily thank you like so
many parts of this video we are not 100 sure that our non-pro ryzen CPU will
even have this feature at all so we're going to head into the BIOS
with it disabled you don't want to accidentally lock it and see what it
says okay
pspn okay well the features here i want
to enable it i want to i want to know oh apparently it's on the regular chips
a new CPU has been installed on your system press yes button or y to lock the
CPU and execute the platform secure boot process note the locked CPU cannot be
used on other models am i supposed to do it now is this the point in the
adventure when i have to do it press y oh god
goodnight sweet friends to confirm the CPU does still work lttstore.com holy
crap we launched the cute little plushies but i am now expecting the CPU
to not work on our other machine i hate this that light's just blinking and it's
going through the exact same postcode cycle oh i like really don't feel very
good right now that really sucks so at this point you guys
are probably thinking surely there is some way to reverse this
process right no there is not once psb
is enabled it cannot be undone in fact the whole point of AMD's psp is to allow
the CPU to verify that the BIOS can be trusted so
if a hacker was able to easily overwrite the
cryptographic key then you can sure as heck bet that that would be the first
step of their hack to just disable it right speaking of hacking we're
currently working on a video where we hack a ps4 pro get subscribed so you
don't miss it now to be clear i have no problem at all with this
feature existing or even oems having it
on their systems the problem is that in the case of this one i wasn't given a
choice nor was i given clear messaging around it there are
so many better ways that lenovo could have
handled this they could have shipped the system with the feature enabled but not
yet locked and maybe had a better worded warning about it they could have had psb
as an option in their online configurator i mean heck even just
clearly stating it on the web page would be a great start so people know what the
trade-off is so the blame rests pretty much entirely
on lenovo here because on servers for example psb is something that customers
actually want and almost more importantly understand having a server
shipped to you with psp enabled from the factory is
valid because it allows the CPU to verify once it arrives that the BIOS of
the firmware has not been tampered with in shipping hp dell and probably a bunch
of other companies have been doing this for years and we didn't make a video
about it Intel also has a similar feature in some xeons but again that
kind of hardware is much less likely to end up in the hands of the average
consumer by contrast when this desktop
ends up at a recycler or in an office supplies auction do you think the person
that buys this will know that that CPU cannot be used in other motherboards
probably not and it's going to be a huge pain in the butt when these cpus end up
on the second hand market even worse is the fact that nothing prevents lenovo
from using this feature to actually lock the CPU to a particular model to our
knowledge that hasn't been done yet it's only a vendor level lock for now but is
there any reason lenovo couldn't have a whole host of different encryption keys
for all their different models now patrick from serve the home came up
with what he thinks is a solution to this problem AMD cpus could come with
two fuses one that enables psb and then
another that permanently disables it once that CPU is put out to pasture this
would allow it to be disabled hopefully without compromising cpus that are
currently using the feature but as much as that sounds good on paper it
would probably require a hardware change so we are unlikely to see a solution
like that in the short to midterm probably the biggest issue with this
whole cluster though is that like Intel's notorious management engine
psb's value as a security measure is unproven at best it assumes a couple of
things number one that the vendor's cryptographic signature or signatures
will never be leaked and number two it assumes that it's actually secure but
it's closed source meaning that there's no way for independent security experts
to audit it so it could very well be that we're just creating more e-waste
for no good reason sorry mother earth i
guess this is just one more that you're gonna have to take for the team graphis
is an automated fishing defense solution that protects every inbox in your
organization from outside threats adding graphics to your security stack allows
you to defend your employees from cyber attacks including phishing email
compromise account takeover identity spoofing malware and ransomware they use
a patented machine learning technology that monitors communication patterns
between people devices and networks to reveal untrustworthy emails and they
analyze messages in real time integrating at the API level to detect
social engineering attacks and activation only takes a few minutes so
don't wait you can get 30 off the list price and 30 off onboarding with graphis
at the link down below if you guys enjoyed this video why don't we throw it
at the temple os video it's a good video and Anthony did a good job of writing it