AMD PSP: Firmware TPM Remote Code Execution via Crafted EK Certificate • Hacker News Board

Re: AMD PSP: Firmware TPM Remote Code Execution via Crafted EK Certificate

#61

Post by anarazel » Sat, Jan 06, 2018, 12:59 AM UTC

mulmen wrote: post #24

jhiska wrote: post #23

Oh, god. At this point I no longer trust ANY computer for mission-critical business at my company. We're going back to pen and paper. The extra safety makes the hassle worth it.

What makes you think pen and paper is secure?

The big differentiator is how attacks can be scaled. Most people/companies aren't individually a worthy enough target to develop an attack against a reasonably protected system. But with a lot of these types of attacks one can compromise a large number of systems in a largely automated manner, without risking ones personal physical security.

Re: AMD PSP: Firmware TPM Remote Code Execution via Crafted EK Certificate

#62

Post by madez » Sat, Jan 06, 2018, 1:02 AM UTC

forapurpose wrote: post #56

jhiska wrote: post #23

Oh, god. At this point I no longer trust ANY computer for mission-critical business at my company. We're going back to pen and paper. The extra safety makes the hassle worth it.

> We're going back to pen and paper. The extra safety makes the hassle worth it. I've read that, several years ago, parts of the Russian security establishment switched to mechanical typewriters.

You might be talking about the following article:

https://www.theguardian.com/world/2013/jul/11/russia-reverts...

Even in Germany high officials hinted at using mechanical typewriters:

https://www.theguardian.com/world/2014/jul/15/germany-typewr...

Luckily, the politicians in Germany and Europe wake up. They want to build up European chip and hardware facilities to have the full chain in Europe. Also they plan to demand certification and customer visible labels. Finally!

https://www.heise.de/newsticker/meldung/Prozessor-Luecken-Me...

Re: AMD PSP: Firmware TPM Remote Code Execution via Crafted EK Certificate

#63

Post by dogma1138 » Sat, Jan 06, 2018, 1:05 AM UTC

krylon wrote: post #43

dogma1138 wrote: post #8

Earlier quoted context omitted.

Yes, AMD's PSP runs a full OS which was made by Trustonic.

It must feel weird to create an operating system that runs on a CPU inside a bigger CPU.

Technically if you count virtual machines as CPUs then every piece of Javascript etc. code runs in a CPU inside a CPU :P

Re: AMD PSP: Firmware TPM Remote Code Execution via Crafted EK Certificate

#64

Post by the_duke » Sat, Jan 06, 2018, 1:30 AM UTC

madez wrote: post #59

conradev wrote: post #54

Earlier quoted context omitted.

> JavaScript and WebAssembly Isn't WebAssembly a huge step forward in the ability to distribute portable, high-performance, sandboxed code?

Code, that is unreviewed, unaccounted and executed automatically. Now it shall be high-performance, too? Does the sandbox work? Does it really work? Are there no side channels? Are you sure? How do you make sure you don't take part in a DDoS attack or mine cryptocurrencies for somebody else? These are just points I can come up with spontaneously. Besides that, the appification of the web is bad because it leads ultim…

This is all already true for Javascript, wasm doesn't change that much here.

Re: AMD PSP: Firmware TPM Remote Code Execution via Crafted EK Certificate

#65

Post by transpute » Sat, Jan 06, 2018, 1:31 AM UTC

cookiecaper wrote: post #47

comboy wrote: post #41

Earlier quoted context omitted.

Computer security has been ridiculous for quite some time. Your only chance is tons of layers and early detection that something's not OK. I'm really happy that everything that's happening is happening. Sad that things like Cloudbleed got so little attention outside HN-like circles. I'm happy because it's gonna have to change. Whole stack revisited. Eventually. These things speed it up. On the long run, the thing tha…

> I'm happy because it's gonna have to change. Whole stack revisited. Eventually. I used to believe this kind of thing, but now I think you greatly underestimate human indifference and interest in effort conservation (uncharitably called "laziness"). Look at Intel's response to Spectre/Meltdown. Are they going back and redesigning their microarchitecture with new hardware-enforced safety rings [that actually enforce,…

> TPMs ... Google is quietly working to remove them from their own machines

Are you referring to Chromebooks or Google's cloud server hardware? Are the TPMs being replaced with a proprietary hardware enclave?

Re: AMD PSP: Firmware TPM Remote Code Execution via Crafted EK Certificate

#66

Post by gatmne » Sat, Jan 06, 2018, 1:37 AM UTC

moby_click wrote: post #36

For a while, I was pretty excited about secure enclaves, as a tool before homomorphic encryption reaches practicality. If remote code execution on the PSP means broken remote attestation, that hope goes down the drain, quickly. Maybe, the keys in the PSP are still protected by secure computing technology, like ARM TrustZone…

Until a vulnerability is found in ARM TrustZone.

Re: AMD PSP: Firmware TPM Remote Code Execution via Crafted EK Certificate

#67

Post by madez » Sat, Jan 06, 2018, 1:43 AM UTC

the_duke wrote: post #64

madez wrote: post #59

Earlier quoted context omitted.

Code, that is unreviewed, unaccounted and executed automatically. Now it shall be high-performance, too? Does the sandbox work? Does it really work? Are there no side channels? Are you sure? How do you make sure you don't take part in a DDoS attack or mine cryptocurrencies for somebody else? These are just points I can come up with spontaneously. Besides that, the appification of the web is bad because it leads ultim…

This is all already true for Javascript, wasm doesn't change that much here.

It makes the use-case for this type of code deployment wider and it's more effective at what it's already used for.

These are two reasons why developing and supporting WebAssembly is finally against the interest of the users.

Re: AMD PSP: Firmware TPM Remote Code Execution via Crafted EK Certificate

#68

Post by nimbius » Sat, Jan 06, 2018, 1:43 AM UTC

The Platform Security Processor (PSP) is built in on all Family 16h + systems (basically anything post-2013), and controls the main x86 core startup. PSP firmware is cryptographically signed with a strong key similar to the Intel ME. If the PSP firmware is not present, or if the AMD signing key is not present, the x86 cores will not be released from reset, rendering the system inoperable.

The PSP is an ARM core

Re: AMD PSP: Firmware TPM Remote Code Execution via Crafted EK Certificate

#69

Post by birdman3131 » Sat, Jan 06, 2018, 1:46 AM UTC

jhiska wrote: post #26

mulmen wrote: post #24

Earlier quoted context omitted.

What makes you think pen and paper is secure?

Because you can't easily get away with several million documents in your trenchcoat. A data breach would be catastrophic for us. We lose less money this way.

Your assuming they did not sneak a small camera in.

Re: AMD PSP: Firmware TPM Remote Code Execution via Crafted EK Certificate

#70

Post by graycat » Sat, Jan 06, 2018, 1:58 AM UTC

comboy wrote: post #41

jhiska wrote: post #23

Oh, god. At this point I no longer trust ANY computer for mission-critical business at my company. We're going back to pen and paper. The extra safety makes the hassle worth it.

Computer security has been ridiculous for quite some time. Your only chance is tons of layers and early detection that something's not OK. I'm really happy that everything that's happening is happening. Sad that things like Cloudbleed got so little attention outside HN-like circles. I'm happy because it's gonna have to change. Whole stack revisited. Eventually. These things speed it up. On the long run, the thing tha…

Maybe with the new, secure stuff, have it implement a padded cell where can run the old stuff. What's inside the padded cell might become a security disaster, but at least it's kept inside the cell.

We've done more or less that several times in computing: At first the code just ran on the computer and had full access to everything. Soon we got memory protection, privileged instructions, and operating systems. Then we got rings of security, virtual memory, virtual machines, etc.

We can do it again.