Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

AMD PSP: Firmware TPM Remote Code Execution via Crafted EK Certificate

seclists.org

Post reply on HN
Print view View original

71–80 of 99 posts

Re: AMD PSP: Firmware TPM Remote Code Execution via Crafted EK Certificate

#71

Post by hinkley »

mulmen wrote: post #27
blattimwind wrote: post #25

Earlier quoted context omitted.

Pen and paper in a good old fashioned steel cabinet (you can get those with some nice solid wood enclosing as well) require actual physical access to read. However, side channels exist. If you write classified information on a correspondence pad, then the pad itself becomes a classified item, too. Obviously.

Who gets keys to the cabinet? How do you know they haven't been duplicated? What if there is a fire? Do you keep a copy of the files somewhere? How do you control access to those?

Did you let Richard Feynman into the building...

Re: AMD PSP: Firmware TPM Remote Code Execution via Crafted EK Certificate

#72

Post by JepZ »

Yeah, while it seems that every modern CPU is affected by the recently discovered vulnerabilities, Intel and AMD still refuse to release their source code for the ME and PSP. Therefore, everybody on this planet has to run hardware with a lot (by all odds) of unpublished zero-day vulnerabilities.

And to make matters worse at least for Intel we have indications that those security wholes are the result of a calculated risk to afford a higher development velocity: https://danluu.com/cpu-bugs/

This year is going to be fun...

Re: AMD PSP: Firmware TPM Remote Code Execution via Crafted EK Certificate

#73

Post by hinkley »

blattimwind wrote: post #45
jacquesm wrote: post #40

Earlier quoted context omitted.

I would not at all be surprised if Spectre and Meltdown were already known at nation state level, they have a lot of resources to throw at problems like this. The fact that Google provides this service for free is an amazing counterbalance to that kind of power, the bugs don't magically disappear but at least the playing field has been leveled a bit.

It is my impression that analysis of side channels has been done and professionalized in the intelligence community for a long time before it became an important consideration in the general IT community.

Adi Shamir, the S in RSA, has done tons of work on side channel analysis, especially of hardware crypto, for decades. Timing attacks, voltage attacks, EM, you name it.

So it's not unknown. But as a counterpoint I had a shocking moment in the 90's when I learned that Faraday Cages (to prevent TEMPEST attacks) were being designed with a second Faraday cage inside them to protect the light bulbs.

Seems that the interference between a CRT and a fluorescent bulb are sufficient that you can detect information on the power lines leading into the room. So they caged the bulbs to keep them magnetically isolated from the computers.

Re: AMD PSP: Firmware TPM Remote Code Execution via Crafted EK Certificate

#75

Post by eat_veggies »

transpute wrote: post #65
cookiecaper wrote: post #47

Earlier quoted context omitted.

> I'm happy because it's gonna have to change. Whole stack revisited. Eventually. I used to believe this kind of thing, but now I think you greatly underestimate human indifference and interest in effort conservation (uncharitably called "laziness"). Look at Intel's response to Spectre/Meltdown. Are they going back and redesigning their microarchitecture with new hardware-enforced safety rings [that actually enforce,…

> TPMs ... Google is quietly working to remove them from their own machines Are you referring to Chromebooks or Google's cloud server hardware? Are the TPMs being replaced with a proprietary hardware enclave?

It looks like they built their own chips for their servers:

https://cloudplatform.googleblog.com/2017/08/Titan-in-depth-...

Notable quote:

"Google designed Titan's hardware logic in-house to reduce the chances of hardware backdoors. The Titan ecosystem ensures that production infrastructure boots securely using authorized and verifiable code."

This is what we need. Authorized and verifiable code, none of this opaque binary blob BS.

Re: AMD PSP: Firmware TPM Remote Code Execution via Crafted EK Certificate

#76

Post by candiodari »

cookiecaper wrote: post #47
comboy wrote: post #41

Earlier quoted context omitted.

Computer security has been ridiculous for quite some time. Your only chance is tons of layers and early detection that something's not OK. I'm really happy that everything that's happening is happening. Sad that things like Cloudbleed got so little attention outside HN-like circles. I'm happy because it's gonna have to change. Whole stack revisited. Eventually. These things speed it up. On the long run, the thing tha…

> I'm happy because it's gonna have to change. Whole stack revisited. Eventually. I used to believe this kind of thing, but now I think you greatly underestimate human indifference and interest in effort conservation (uncharitably called "laziness"). Look at Intel's response to Spectre/Meltdown. Are they going back and redesigning their microarchitecture with new hardware-enforced safety rings [that actually enforce,…

> Does anyone care?

Let me answer that for you. In the period of the last 10 years, the world has all but switched to mobile devices. Mobile devices that make windows look like a secure operating system. In theory vendors promise 2 years of "safe" operation, and I am unaware of a single case where they actually shipped phones without major security vulnerabilities (and known, to at least some of their development team).

Internationally, iPhones do not matter. They're like 10% of the market, so I'm focusing on android phones here. And it's not like iPhones don't have exploits for them, it just means a few more years, something more like 4 year, until they're exploitable.

It is regularly reported that 40% of all android phones are vulnerable to individual vulnerabilities. At least half of all active android phones do not receive security updates, even in the case of serious vulnerabilities (and that patched "half" technically is described as anyone who ever got at least a single security update). How many of the total amount of android phones are trivially hackable if you run an app on them ? I'm going to say at least 75%, and at least including all phones more than 2 years since they were released.

So no. Nobody cares. We all know how bad the wintel situation is, and android is worse.

We need a global security disaster to happen so totally that regulators intervene and hold these vendors accountable.

Re: AMD PSP: Firmware TPM Remote Code Execution via Crafted EK Certificate

#77

Post by guy98238710 »

anarazel wrote: post #61
mulmen wrote: post #24

Earlier quoted context omitted.

What makes you think pen and paper is secure?

The big differentiator is how attacks can be scaled. Most people/companies aren't individually a worthy enough target to develop an attack against a reasonably protected system. But with a lot of these types of attacks one can compromise a large number of systems in a largely automated manner, without risking ones personal physical security.

What prevents attackers from collecting photos of the papers with nearby phones, security cameras, or even a fleet of tiny drones?

Re: AMD PSP: Firmware TPM Remote Code Execution via Crafted EK Certificate

#78

Post by ams6110 »

Decabytes wrote: post #58
jhiska wrote: post #23

Oh, god. At this point I no longer trust ANY computer for mission-critical business at my company. We're going back to pen and paper. The extra safety makes the hassle worth it.

Or we could just get ME and PSP off of our chips like people have wanted for years. They have been major security and privacy risks ever since their inception.

People may have wanted but Enterprise customers like ME.

Re: AMD PSP: Firmware TPM Remote Code Execution via Crafted EK Certificate

#79

Post by viraptor »

blattimwind wrote: post #25
mulmen wrote: post #24

Earlier quoted context omitted.

What makes you think pen and paper is secure?

Pen and paper in a good old fashioned steel cabinet (you can get those with some nice solid wood enclosing as well) require actual physical access to read. However, side channels exist. If you write classified information on a correspondence pad, then the pad itself becomes a classified item, too. Obviously.

> Pen and paper in a good old fashioned steel cabinet (you can get those with some nice solid wood enclosing as well) require actual physical access to read.

On the other hand, also the bad part is that pen and paper require actual physical access to read ;)

Re: AMD PSP: Firmware TPM Remote Code Execution via Crafted EK Certificate

#80

Post by katastic »

jhiska wrote: post #23

Oh, god. At this point I no longer trust ANY computer for mission-critical business at my company. We're going back to pen and paper. The extra safety makes the hassle worth it.

If you can afford to use pen-and-paper as an option, there's no way you're using your computers to their full (or even 10%) of their ability.

People computing large amounts data don't have the luxury of hand calculations and the HUGE AMOUNT of errors that method entails. I have a client that has THREE levels of human validation of the SAME numbers (that the Dynamics NAV they're using could have calculated for free). Literally 1-2 full salaried persons worth of man-hours billed every year.

Going backwards away from that, and using more humans, is even crazier. Their hours and errors would skyrocket.

Post reply on HN