AMD To Issue PSP/BIOS Firmware Updates For Recent Vulnerabilities

[duby229]

This is extremely short-sighted. I hope you don't work at security.

Yes a physical access to your computer means auto-pwnage but the issue here is there's another "secret" layer that can now be exploited to keep things hidden and continue said pwnage. AMD failed on the signature checks on their "secure" system. I'd say that's a bloody big no-no.

To give it as an example.

Without these "security systems" and their holes you can wipe a computer and be sure it's clear. Wipe BIOS too and it should be all good.

You CAN'T officially wipe the PSP. So say I'm just an individual buying a used machine, I can't now be sure it's now pre-pwned. There are SOO many vectors of attack you're blatantly fanboyishly ignore here.

So let me ask you this, where do you think the code that the PSP runs comes from? What is it? It's basically ARM binaries. As in 1s and 0s that take up some amount of capacity. You can't just wipe everything. It had to have been written somewhere. And that fact alone most definitely makes this detectable.

[F.Ultra]

Easy solution: sell these big corporate IT departments something different from what you sell to the regular public.

People like you and me are a drop in the ocean as compared with the big IT departments that buys computers in 100k bulk per set. Also putting "secure XXX" on the box sells more items, few people know what these things are.

FFS, seriously?

1.) CPU with functionality X, Y, Z.
2.) CPU with functionality X, Y, Z, but Z is fused off.

2. is very much something different from 1.

Where you two did confuse each other is that if PSP or IME was fused off then the entire CPU would be dead so Intel and AMD cannot do this like they can with dead cores, reduced ram and/or cpu speed and so on.

[wizard69]

No that's what you just said. The fact is that CPU manufacturers cannot fabricate different dies for every product, it won't happen ever. They fabricate 1 die that is as complete as possible and then they bin it to all the different product lineups that they can.

They already do fabricate different dies for different products. I really dont understsnd your position. Dies can infact change from mobile to desktop to server. Sometimes dies get reused such that a desktop chip ends up in a server. However that foesn't mean that unique server dies dont exist.

When it comes to mass produced chips economics pretty much demands custom dies per product. Case in point Apples A series chips wherethe X variants are obviously different dies than the non X variants.

In the end every square mm of space costs money. Fusing off functionality is more about managing defects than anything ekse.

[Sachiru]

So let's say I'm your computer distributor (not even manufacturer). Let's say some 3 letter agency, or some less-than-savoury friends come and tell me to put this in your Ryzens. I just boot a USB to "root" because BIOS is unlocked and all that and put my own PSP firmware in. Then proceed to do whatever else as usual and give you the machine (possibly without an OS).

You're now hosed without a way to know it whatsoever. I can't understand why all the AMD fanboys refuse to see this gaping hole for what it is.

The "root required" is completely irrelevant.

If I replace "Ryzen" with "Core i7", and "AMD" with "Intel", would this also not be a gaping security hole for the blue team?

Physical access for hardware is game over, whether it's AMD or Intel. I would not be surprised if firmware-level exploits for Intel ME exist, and if government or large agencies intercept shipments of Intel boards and embed Intel ME malware before sending it on. Does this then not warrant the same level of fearmongering for Intel, or should AMD be singled out for reasons other than "we want to short its stock"?

[CtrlAltShift]

If I replace "Ryzen" with "Core i7", and "AMD" with "Intel", would this also not be a gaping security hole for the blue team?

Physical access for hardware is game over, whether it's AMD or Intel. I would not be surprised if firmware-level exploits for Intel ME exist, and if government or large agencies intercept shipments of Intel boards and embed Intel ME malware before sending it on. Does this then not warrant the same level of fearmongering for Intel, or should AMD be singled out for reasons other than "we want to short its stock"?

In fact it's an other way around. Intel was criticized for IME almost on daily basis for few good years now. Almost each bug discovered in IME (if not all) required admin or physical access to hardware, which didn't stop anyone from attacking Intel and didn't stop Intel from taking these bugs seriously. At the same time AMD somehow managed to stay under the radar with it's security solution. But once bugs, similar to Intel's bugs, were discovered it suddenly became non-critical, and the whole blame was directed to the the company discovered the bugs. Can't you see any bias here...?

[starshipeleven]

What vulnerabilities? There weren't any discovered. Completely other different vulnerabilities would already have had to have been exploited in order to get that far. You're already screwed long before the fact.

They did discover vulnerabilities. The fact that to exploit them you need to use other vulnerabilities does not make any subsequent vulnerability not a vulnerability.

What they did is blow pretty low-danger vulnerabilities out of proportion.

[Gusar]

But once bugs, similar to Intel's bugs, were discovered it suddenly became non-critical, and the whole blame was directed to the the company discovered the bugs. Can't you see any bias here...?

When the first flaw in the PSP was discovered in January, no one blamed the company which discovered it, and AMD did receive the same kind of flak Intel had been receiving before. It's just that the discovery of the first flaw was made by a reputable company that followed the industry standards of disclosure. Said company also didn't blow the discovered vulnerability out of proportion or do any of the other scummy things CTS Labs and Viceroy did.

So there's no bias here. There's just two very, very scummy companies (CTS and Viceroy), that's why the reaction to these flaws is so very different.

[Vistaus]

I don't think the issue is that there is a vulnerability that has to be patched, but instead with the way this whole thing was reported, and the fact that it seems to want to paint AMD in the worst possible light. IOW, it was a hit-job.

True, but their were actually people on the internet who kept dismissing this as fake news and asking the site they replied on to delete the CTS-Labs news.

[Almindor]

I don't believe PSP has its own flash - you "hide stuff in PSP" by flashing the BIOS with an altered image that includes different PSP code. AFAIK "resetting the PSP code" is as simple as restoring the original BIOS image.

And don't you DARE call me a fanboy

I am so tempted now Will wait until the next AMD hoopla :P

[Vistaus]

If I replace "Ryzen" with "Core i7", and "AMD" with "Intel", would this also not be a gaping security hole for the blue team?

Physical access for hardware is game over, whether it's AMD or Intel. I would not be surprised if firmware-level exploits for Intel ME exist, and if government or large agencies intercept shipments of Intel boards and embed Intel ME malware before sending it on. Does this then not warrant the same level of fearmongering for Intel, or should AMD be singled out for reasons other than "we want to short its stock"?

Physical access for hardware could be game over, but their could also be ways to reset it. Physical access to PSP, on the other hand, is not resettable and people can do stuff remotely after successfully exploiting this. One-time access to physical hardware, besides the reset part, means you can only do something to the computer once, but once the computer is reset, you have no access anymore. That's why the PSP exploit is way worse when there's physical access to hardware, 'cause you can do more damage over a long period of time.

Besides, it's worse for second-hand hardware. If you want to be sure that there's nothing left on the second-hand system, you can reinstall the OS, reset the BIOS, etc. But how do you know if the PSP has been exploited or not (besides the fact that you can't reset it)? Trust level for second-hand hardware = 0 thanks to this. And the same goes for Intel ME.