Intel to include DRM in new Pentium 4 series processors

[David Wagner]

Brian Gladman wrote:
>But whether an attack should be eliminated is not just down to its
>probability of occurence but also depends on the seriousness of the result.
>BIOS attacks are rarely detetcted and very often stay in place for the life
>of a machine so they may not be frequent but they are serious when they
>occur.

I agree probability of occurrence is not enough.  As I wrote earlier,
  I rank the risks by their probabilities of occurrence and their impact
  if they do occur.  [...] For typical users, [insecure boot attacks] are
  a much rarer form of attack, and the impact may not be much greater than
  the impact of buffer overruns and the like.
I still see no reason why BIOS attacks should have a much greater impact
than a buffer overrun attack.  BIOS attacks can in principle be written
in a way that stays in place for a long time without detection, but I would
think that the same is true for buffer overrun attacks.  In practice,
long-lived buffer overrun exploits are rare, as are long-lived BIOS exploits,
but this is probably a product of the sorts of exploits we see rather than
a function of innate vulnerability.  Or is there some reason I've overlooked
why long-lived BIOS attacks are likely to be more common than long-lived
buffer overrun attacks?