5 ms·

Unfortunately anyone who takes their security or privacy seriously will be totally unable to use this. Every AMD chip contains a likely backdoored system called

Unfortunately anyone who takes their security or privacy seriously will be totally unable to use this. Every AMD chip contains a likely backdoored system called AMD Secure Processor (formerly “Platform Security Processor” or “PSP”) [1]. This separate processor contains closed source, proprietary binaries that have complete and unrestricted access to the host. Despite a large petition for AMD to opensource this, they refused in the end. [2][3] Anyone running AMD chipsets have a completely separate and unaccessible operating system running on their computer that they can not control nor know exactly what it's doing. [4] Intel has the same sort of system with it's Intel Management Engine (known as Intel ME) that even the NSA didn't want to have running on their own computers. [5] [1] http://www.amd.com/en-us/innovations/software-technologies/security http://www.amd.com/en-us/innovations/software-technologies/s... [2] https://www.reddit.com/r/privacy/comments/5z4phx/petition_for_amd_to_opensource_the_psp_backdoor/ https://www.reddit.com/r/privacy/comments/5z4phx/petition_fo... [3] https://www.reddit.com/r/Amd/comments/6msujx/what_happened_to_the_open_source_the_security/ https://www.reddit.com/r/Amd/comments/6msujx/what_happened_t... [4] https://libreboot.org/faq.html#amd https://libreboot.org/faq.html#amd [5] https://www.theregister.co.uk/2017/08/29/intel_management_engine_can_be_disabled/ https://www.theregister.co.uk/2017/08/29/intel_management_en...

sgift 9y ago
Looking at [4] tells me that no modern, relevant CPU supports what libreboot needs/requires, so while not a good point it doesn't help deciding between AMD or Intel - and those are, for better or worse, the only relevant CPUs for laptops/desktops.
- flukus 9y ago
  The intel one can can finally be disabled: https://puri.sm/posts/purism-librem-laptops-completely-disable-intel-management-engine/ https://puri.sm/posts/purism-librem-laptops-completely-disab...
rnhmjoj 9y ago
No psp_cleaner yet?
SkyPuncher 9y ago
Isn't Intel doing pretty much the same thing? Seems like it's just a part of operating a modern computer :(
glogla 9y ago
So the same as Intel Management Engine?
kbhn 9y ago
> Unfortunately anyone who takes their security or privacy seriously will be totally unable to use this. Every AMD chip contains a likely backdoored system called AMD Secure Processor This is fear mongering to the extreme. Intel has the exact same type of system embedded in their processors called Intel Management Engine. You can't escape this problem by buying Intel. I notice you provided a lot of sources, but none for the claim "a likely backdoored system". Your post reads like something a bad Intel astroturfing shill would say.
- Kliment 9y ago
  The Intel one has a known technique to disable the ME, the AMD one does not (for the moment).
  - m45t3r 9y ago
    However, disabling it is not trivial, needing to open your laptop and solding skills, also special equipment to read/write modified firmware.
    - Kliment 9y ago
      You don't need soldering skills (at least for the device I use), but I agree it's not trivial. However, a nontrivial fix is still a significant improvement over a nonexistent one.
- Jach 9y ago
  Totally agree. And these "maybe they are backdoors" have not actually been demonstrated in the wild yet (apart from Intel's AMT that most people don't have to worry about). If you want to fearmonger, at least do it with demonstrated issues not just "maybes". So a much bigger security issue is buying a laptop from anyone at all at this point that isn't a Mac or a Surface, i.e. directly from the OS vendor. Lenovo does shit like this: http://www.zdnet.com/article/lenovo-rootkit-ensured-its-software-could-not-be-deleted/ http://www.zdnet.com/article/lenovo-rootkit-ensured-its-soft... (which also references the earlier Superfish shit they pulled). Sony has done shit like https://en.wikipedia.org/wiki/Sony_BMG_copy_protection_rootkit_scandal https://en.wikipedia.org/wiki/Sony_BMG_copy_protection_rootk... Dell et al: http://www.zdnet.com/article/researchers-find-insecure-bios-rootkit-pre-loaded-in-laptops/ http://www.zdnet.com/article/researchers-find-insecure-bios-...
mrchicity 9y ago
Does this exist on Epyc platforms that don't use a traditional chipset? This is bad, but seems like more of an incremental issue than anything. Can you audit every line of source in your system? No closed source drivers or firmware on any devices? No devices on your network with vendor controlled firmware? You log all network I/O through a passive tap? For the average user targeted by a state actor this makes little difference.
- wmf 9y ago
  The PSP is part of the processor die so it is included in Epyc.

sgift 9y ago

Looking at [4] tells me that no modern, relevant CPU supports what libreboot needs/requires, so while not a good point it doesn't help deciding between AMD or Intel - and those are, for better or worse, the only relevant CPUs for laptops/desktops.

flukus 9y ago
The intel one can can finally be disabled: https://puri.sm/posts/purism-librem-laptops-completely-disable-intel-management-engine/ https://puri.sm/posts/purism-librem-laptops-completely-disab...

rnhmjoj 9y ago

No psp_cleaner yet?

SkyPuncher 9y ago

Isn't Intel doing pretty much the same thing? Seems like it's just a part of operating a modern computer :(

glogla 9y ago

So the same as Intel Management Engine?

kbhn 9y ago

> Unfortunately anyone who takes their security or privacy seriously will be totally unable to use this. Every AMD chip contains a likely backdoored system called AMD Secure Processor This is fear mongering to the extreme. Intel has the exact same type of system embedded in their processors called Intel Management Engine. You can't escape this problem by buying Intel. I notice you provided a lot of sources, but none for the claim "a likely backdoored system". Your post reads like something a bad Intel astroturfing shill would say.

Kliment 9y ago
The Intel one has a known technique to disable the ME, the AMD one does not (for the moment).
- m45t3r 9y ago
  However, disabling it is not trivial, needing to open your laptop and solding skills, also special equipment to read/write modified firmware.
  - Kliment 9y ago
    You don't need soldering skills (at least for the device I use), but I agree it's not trivial. However, a nontrivial fix is still a significant improvement over a nonexistent one.
Jach 9y ago
Totally agree. And these "maybe they are backdoors" have not actually been demonstrated in the wild yet (apart from Intel's AMT that most people don't have to worry about). If you want to fearmonger, at least do it with demonstrated issues not just "maybes". So a much bigger security issue is buying a laptop from anyone at all at this point that isn't a Mac or a Surface, i.e. directly from the OS vendor. Lenovo does shit like this: http://www.zdnet.com/article/lenovo-rootkit-ensured-its-software-could-not-be-deleted/ http://www.zdnet.com/article/lenovo-rootkit-ensured-its-soft... (which also references the earlier Superfish shit they pulled). Sony has done shit like https://en.wikipedia.org/wiki/Sony_BMG_copy_protection_rootkit_scandal https://en.wikipedia.org/wiki/Sony_BMG_copy_protection_rootk... Dell et al: http://www.zdnet.com/article/researchers-find-insecure-bios-rootkit-pre-loaded-in-laptops/ http://www.zdnet.com/article/researchers-find-insecure-bios-...

mrchicity 9y ago

Does this exist on Epyc platforms that don't use a traditional chipset? This is bad, but seems like more of an incremental issue than anything. Can you audit every line of source in your system? No closed source drivers or firmware on any devices? No devices on your network with vendor controlled firmware? You log all network I/O through a passive tap? For the average user targeted by a state actor this makes little difference.

wmf 9y ago
The PSP is part of the processor die so it is included in Epyc.