4 ms·

For the uninitiated; what good does this PSP to the system?

kobeya 9y ago
It runs in god mode with access to anything and everything, and is completely hidden from even system mode software. With access to peripherals it can access the network and take remote commands, exfiltrate data, etc. If you've ever used a server they often have a nice feature where you send an authenticated command to them on a certain port and get it to shutoff, turn on, reboot, whatever. This is run from the PSP on AMD processors. Or maybe it has a remote backdoor put there by the NSA (or maybe just escrowed command and control keys) and ANY AMD device connected to the Internet can be controlled remotely by them at will. We have no way of knowing. Or if TLAs don't worry you, then maybe the code running on it has a 0-day vulnerability and every server out there is vulnerable to remote code execution + the ultimate privilege escalation and we don't know about. Or if that doesn't worry you, then maybe it'd at least be nice to be able to program it yourself and add new features, bug fixes, etc. Those are all good reasons for requesting open source PSP code.
- zdkl 9y ago
  I don't mean to downplay this, but intel's doing it too with their management engine. Don't bash AMD for this specifically, at least now we-consumers have a realistic choice as to the purveyor of backdoors. It's... something?
  - kobeya 9y ago
    AMD has traditionally been a more consumer-friendly vendor and there was some hope that they might differentiate themselves from intel in this way, giving people concerned about this at least one major vendor to source their parts from. Alas, that is not the case.
  - quickben 9y ago
    At least AMD doesn't make lan cards. The Intel combo is scarier.
wyldfire 9y ago
It allows for a richer bootstrap than the x86 BIOS/UEFI, including checking signatures for the boot device. This helps mitigate attacks like persistent rootkits that alter the OS to mask the presence of malware. However, as a supervisor processor, the PSP is also a risk itself. If a well funded state setup a shipping interdiction on import or export, they could alter the PSP to insert their malware and we wouldn't be able to audit it. This is a gift from all of those mobile SoCs that might've gotten signed bootloaders initially just to protect the subsidy. Part of the overall "death of the general purpose computer" (see Doctorow for more).
- albertgoeswoof 9y ago
  How can you protect against this attack vector? Could you dump & hash the PSP firmware, then compare with other non-imported hashes to check for tampering?
  - fulafel 9y ago
    Doing the comparison with code running on the potentially compromised system does not tell you much. Doing it another way is expensive for large scale (involves pulling chips and seeing what's in them).
  - wyldfire 9y ago
    I doubt it -- if it was designed well, the PSP won't reveal anything about itself to the x86 processor and won't have any off-chip memory. I think the state-of-the-art is the Apple Secure Enclave Processor, which is probably old enough to have inspired some of the PSP design. Maybe a side-channel attack could help reveal the PSP firmware or other vulnerable design elements. But I'm pretty pessimistic -- the number of organizations/people capable of investing in the time and equipment necessary to do this is low.

It runs in god mode with access to anything and everything, and is completely hidden from even system mode software. With access to peripherals it can access the network and take remote commands, exfiltrate data, etc. If you've ever used a server they often have a nice feature where you send an authenticated command to them on a certain port and get it to shutoff, turn on, reboot, whatever. This is run from the PSP on AMD processors. Or maybe it has a remote backdoor put there by the NSA (or maybe just escrowed command and control keys) and ANY AMD device connected to the Internet can be controlled remotely by them at will. We have no way of knowing. Or if TLAs don't worry you, then maybe the code running on it has a 0-day vulnerability and every server out there is vulnerable to remote code execution + the ultimate privilege escalation and we don't know about. Or if that doesn't worry you, then maybe it'd at least be nice to be able to program it yourself and add new features, bug fixes, etc. Those are all good reasons for requesting open source PSP code.

zdkl 9y ago
I don't mean to downplay this, but intel's doing it too with their management engine. Don't bash AMD for this specifically, at least now we-consumers have a realistic choice as to the purveyor of backdoors. It's... something?
- kobeya 9y ago
  AMD has traditionally been a more consumer-friendly vendor and there was some hope that they might differentiate themselves from intel in this way, giving people concerned about this at least one major vendor to source their parts from. Alas, that is not the case.
- quickben 9y ago
  At least AMD doesn't make lan cards. The Intel combo is scarier.

wyldfire 9y ago

It allows for a richer bootstrap than the x86 BIOS/UEFI, including checking signatures for the boot device. This helps mitigate attacks like persistent rootkits that alter the OS to mask the presence of malware. However, as a supervisor processor, the PSP is also a risk itself. If a well funded state setup a shipping interdiction on import or export, they could alter the PSP to insert their malware and we wouldn't be able to audit it. This is a gift from all of those mobile SoCs that might've gotten signed bootloaders initially just to protect the subsidy. Part of the overall "death of the general purpose computer" (see Doctorow for more).

albertgoeswoof 9y ago
How can you protect against this attack vector? Could you dump & hash the PSP firmware, then compare with other non-imported hashes to check for tampering?
- fulafel 9y ago
  Doing the comparison with code running on the potentially compromised system does not tell you much. Doing it another way is expensive for large scale (involves pulling chips and seeing what's in them).
- wyldfire 9y ago
  I doubt it -- if it was designed well, the PSP won't reveal anything about itself to the x86 processor and won't have any off-chip memory. I think the state-of-the-art is the Apple Secure Enclave Processor, which is probably old enough to have inspired some of the PSP design. Maybe a side-channel attack could help reveal the PSP firmware or other vulnerable design elements. But I'm pretty pessimistic -- the number of organizations/people capable of investing in the time and equipment necessary to do this is low.