How to Verify Intel CPU is Genuine

The serial number is usually on the printed label on the side or back of the product, following the: SN or S/N or Serial Number. Click to expand for more information on finding the printed Product Label.

All our production inventory is purchased via our trusted partners but for a R&D project we received not 1 but 2 fake CPU`s from Amazon.com. Still can`t beleive it, espeically since its not some random 3rd party seller but the seller was Amazon itself!

What is the Scam?

It looks to be a very elaborate scam, that was proven twice as Amazon sent me a replacement immediately. However that replacement was also a counterfeit product. How it entered the supply chain I`ve got no idea as allegedly Amazon is purchasing directly from the Intel. My guess is some moron at Amazon tried to flip 3rd party stock at a heavy discount, but hopefully gets fired for such a blatent scam.
Must say that Intel are pretty smart about their packaging and labeling to ensure everything gets cross checked and validated likely for inventory tracking. The added benefit is builtin security features, to cross-check the Box Packaging to the Heat Spreader, and to the actual CPU. There`s 3 different cross checks, probably more but from my brief investigation all 3 checks can be performed without opening the box, nice!

Check One : Serial number

The serial numbers are printed both on the factory sealed box, and also on the heat spreader (highlighted in Red). In This case the obviously don't match.

Check Two: FPO Number

Every CPU has a FPO (Finished Process Order) number, which is also printed on both the factory Box and the Heat spreader (Highlighted in Green). Again in this case there`s no match

Check Three: ATPO Number

But what if some scamer took off the heat spreader, and placed it on some faulty PCB/CPU socket ? Its pretty easy to do as shown in the image below
Yet Intel thought of this also. There`s a Assembly Test Process Order (ATPO) number that does exactly that, this number is actually the last 4 digits of the serial number. Thus its printed on the heat spreader AND the factory sealed box. In this case below in orange, none of the number match at all.

Verification With Intel

.. and there`s more. We can also check what Intel thinks the CPU model number is. Go to Intel`s Warranty information page Here and enter in the FPO number.
In our case we have 2 FPO numbers:
1) '3421B509' - value on the Heat Spreader
2) 'L436D041' - value printed on the box
Plugging these numbers into the Intel website you get.
Above screenshot is the number on the Heat Spreader. Clearly its not an E5-1650V3 as the the factory sealed box states
And finally the above screen shot shows the FPO number as printed on the Box. As expected, the box numbers match what the label says but does not represent the goods inside - scammed..

Summary

There`s a 3-way check you can use for any CPU purchase, and does not require opening the box. This is good for their latest E5 V3 CPU`s not sure how well it correlates to other product lines.
The 3 checks are:
1) Serial number: Box Heat spreader
2) ATPO Number: Box: Heat Spreader PCB
3) Intel Web site FPO Check: Heat Spreader FPO Purchased Product name
... all round a completely counterfeit CPU. But, factory sealed mind you.
And for reference here`s a correct OEM CPU box, verified without opening.
... and that concludes todays public service announcement!

Intel's Processor ID

Last month Intel Corp. announced that its new processor chips would come equipped with ID numbers, a unique serial number burned into the chip during manufacture. Intel said that this ID number will help facilitate e-commerce, prevent fraud and promote digital content protection.

Unfortunately, it doesn’t do any of these things.

To see the problem, consider this analogy: Imagine that every person was issued a unique identification number on a national ID card. A person would have to show this card in order to engage in commerce, get medical care, whatever. Such a system works, provided that the merchant, doctor, or whoever can examine the card and verify that it hasn’t been forged. Now imagine that the merchants were not allowed to examine the card. They had to ask the person for his ID number, and then accept whatever number the person responded with. This system is only secure if you trust what the person says.

Intel Cpu Serial Number Lookup Reverse

The same problem exists with the Intel scheme.

Yes, the processor number is unique and cannot be changed, but the software that queries the processor is not trusted. If a remote Web site queries a processor ID, it has no way of knowing whether the number it gets back is a real ID or a forged ID. Likewise, if a piece of software queries its processor’s ID, it has no way of knowing whether the number it gets back is the real ID or whether a patch in the operating system trapped the call and responded with a fake ID. Because Intel didn’t bother creating a secure way to query the ID, it will be easy to break the security.

As a cryptographer, I cannot design a secure system to validate identification, enforce copy protection, or secure e-commerce using a processor ID. It doesn’t help. It’s just too easy to hack the software that queries the hardware.

This kind of system puts us in the same position we were in when the government announced the Clipper chip: Those who are engaged in illicit activities will subvert the system, while those who don’t know any better will find their privacy violated. I predict that patches that randomize the ID number will be available on hacker Web sites within days of the new chips hitting the streets.

The only positive usage for processor IDs is the one usage that Intel said they would not do: stolen processor tracking. Pentium II chips are so valuable that trucks are hijacked on the highways, sometimes resulting in drivers being killed. A database of stolen processor IDs would drop the market for stolen CPUs to zero: board manufacturers, computer companies, resellers and customers could simply query the database to ensure that their particular CPU wasn’t stolen. (This is the primary usage for automobile VINs.) This same system could be used to prevent manufacturers from overclocking their CPUs — running them faster than Intel rated them for — another thing that Intel would love to prevent.

The real question is whether computers are a dangerous technology, and need to be individually tracked like handguns and automobiles. During the Cold War many Eastern European countries required mimeograph machines to be individually licensed; I have a hard time believing that computers need the same sorts of controls.

Intel Cpu Serial Number Lookup Engine

Categories: Business of Security, Computer and Information Security