3 ms·
It allows for a richer bootstrap than the x86 BIOS/UEFI, including checking signatures for the boot device. This helps mitigate attacks like persistent rootkit
by wyldfire 9y ago
It allows for a richer bootstrap than the x86 BIOS/UEFI, including checking signatures for the boot device.
This helps mitigate attacks like persistent rootkits that alter the OS to mask the presence of malware.
However, as a supervisor processor, the PSP is also a risk itself. If a well funded state setup a shipping interdiction on import or export, they could alter the PSP to insert their malware and we wouldn't be able to audit it.
This is a gift from all of those mobile SoCs that might've gotten signed bootloaders initially just to protect the subsidy. Part of the overall "death of the general purpose computer" (see Doctorow for more).
- albertgoeswoof 9y agoHow can you protect against this attack vector? Could you dump & hash the PSP firmware, then compare with other non-imported hashes to check for tampering?
- fulafel 9y agoDoing the comparison with code running on the potentially compromised system does not tell you much. Doing it another way is expensive for large scale (involves pulling chips and seeing what's in them).
- wyldfire 9y agoI doubt it -- if it was designed well, the PSP won't reveal anything about itself to the x86 processor and won't have any off-chip memory. I think the state-of-the-art is the Apple Secure Enclave Processor, which is probably old enough to have inspired some of the PSP design. Maybe a side-channel attack could help reveal the PSP firmware or other vulnerable design elements. But I'm pretty pessimistic -- the number of organizations/people capable of investing in the time and equipment necessary to do this is low.