Slashdot Mirror
After Intel ME, Researchers Find Security Bug In AMD's SPS Secret Chip-on-Chip (bleepingcomputer.com)
An anonymous reader writes: AMD has fixed, but not yet released BIOS/UEFI/firmware updates for the general public for a security flaw affecting the AMD Secure Processor. This component, formerly known as AMD PSP (Platform Security Processor), is a chip-on-chip security system, similar to Intel's much-hated Management Engine (ME). Just like Intel ME, the AMD Secure Processor is an integrated coprocessor that sits next to the real AMD64 x86 CPU cores and runs a separate operating system tasked with handling various security-related operations.
The security bug is a buffer overflow that allows code execution inside the AMD SPS TPM, the component that stores critical system data such as passwords, certificates, and encryption keys, in a secure environment and outside of the more easily accessible AMD cores. Intel fixed a similar flaw last year in the Intel ME.
The security bug is a buffer overflow that allows code execution inside the AMD SPS TPM, the component that stores critical system data such as passwords, certificates, and encryption keys, in a secure environment and outside of the more easily accessible AMD cores. Intel fixed a similar flaw last year in the Intel ME.
... the component that stores critical system data such as passwords, certificates, and encryption keys, in a secure environment and outside of the more easily accessible AMD cores.
Oh, heh. EXACTLY the same thing as Intel's ME.
Quote from a complaining comment about the Bleeping Computer story: "Garbage FUD probably hired by Intel, and it wouldn't be surprising. In order to exploit AMD's TPM (which is an easy BIOS fix) the hacker needs physical access to the motherboard... at that point the hacker may as well have armed forces hijack the data center."
buggy (operating) systems all the way down.
Hardly a "similar flaw", plain incompetence. Never trust Intel.
Is it SPS or is it PSP?
What we know about Intel CPU backdoors so far (June 2017)
the real AMD64 x86 CPU cores"
softpedia yesterday was telling us about AMD Radeon Processors
now we get real AMD64 x86 CPU cores
you know that intel doesn't have money to buy at least an educated shill, when they shop from junior CS classes... and I even doubt that, I believe that they just hire SJWs for everything nowadays.
0.02 shekels have been deposited to your account
After millions of "entry-level-nerds" suggested everyone shall buy AMD instead of Intel... "The iRONY is strong in that one!"
...at least when mainboard makers support the option in UEFI.
https://www.phoronix.com/scan....
Twinstiq, game news
Yes, installing an EK cert requires pre-boot access.
You don't know what a buffer overflow, TPM, or attestation certificate are, do you?
Researchers = Intel engineers ;-)
the fact that over, and over, and over, systems prove to have obscure vulnerabilities that allow an attacker to spy on everything the user is doing.... seems like it might be deliberate. i.e. the government gave up on the clipper chip, and cracking down on encryption.... why?
The era of "oh the government doesnt care" or "it would never spy" is gone. they do spy. they feel like its their job, their purpose in life, the necessity of a stable government, they believe they have a god given right to all of your information. Because 9/11. Because Hitler. Because China. Because because because.
Look at these situations. These are the leading US tech companies, all of which have huge relationships with many secret govt agencies, all have revolving doors between themselves and the congress and the bureaucracy that regulates and profits from these tools... for example Cray wouldnt exist without NSA secretly bailing them out. You dont need to be a conspiracy theorist, just read a few history books about the actual NSA and CIA by people who worked there. They dont even apologize because they dont think they did anything wrong.
Look at the Russian or Chinese or Turkish or UK or any other government and how they exploit Info tech to spy on people. Realize the US is not really that different. These are all deliberate backdoors built by governments to spy on their people. These are not security bugs. These are security features.
Maybe.
Anything that disables IME or PSP is a net positive for the world.
The intel team must have worked long and hard to find some fud for that one.
SPECTRE can be exploited through javascript!
"Given ASRock's description..."
AsRock mentions fixes for AsRock Intel processor motherboards in one of the most badly designed web pages I've seen: Intel Firmware vulnerability INTEL-SA-00086.
"These are the leading US tech companies, all of which have huge relationships with many secret govt agencies, ..."
"These are all deliberate backdoors built by governments to spy on their people."
Its just too lucrative for these companies too not put a backdoor in for sale to deep intel or bad state actors. Get used to it, nothing digital is safe.
"An anonymous reader writes" ... to tell us about an unrelated security bug in an AMD product. Funny how anonymous people seem to post so many stories of concern ....
Change log:
2018/01/01 - Added 14 Useful Links, Intel CPU CVE links (CVE-2017-5689 CVSS Score 10.0), how to disable Intel ME 11 via undocumented NSA "High Assurance Platform" mode.
Intel CPU Backdoor Report
The goal of this report is to make the existence of Intel CPU backdoors a common knowledge and provide information on backdoor removal.
What we know about Intel CPU backdoors so far:
TL;DR version
Your Intel CPU and Chipset is running a backdoor as we speak.
The backdoor hardware is inside the CPU/Bridge and the backdoor firmware (Intel Management Engine) is in the chipset flash memory.
30C3 Intel ME live hack:
[Video] 30C3: Persistent, Stealthy, Remote-controlled Dedicated Hardware Malware
@21:43, keystrokes leaked from Intel ME above the OS, wireshark failed to detect packets.
[Quotes] Vortrag:
"the ME provides a perfect environment for undetectable sensitive data leakage on behalf of the attacker".
"We can permanently monitor the keyboard buffer on both operating system targets."
Backdoor removal:
The backdoor firmware can be removed by following this guide using the me_cleaner script.
Removal requires a Raspberry Pi (with GPIO pins) and a SOIC clip.
2017 Dec Update:
Intel ME on recent CPUs may be disabled by enabling the undocumented NSA HAP bit.
Decoding Intel backdoors:
The situation is out of control and the Libreboot/Coreboot community is looking for BIOS/Firmware experts to help with the Intel ME decoding effort.
If you are skilled in these areas, download Intel ME firmwares from this collection and have a go at them, beware Intel is using a lot of counter measures to prevent their backdoors from being decoded (explained below).
Useful links (Added 2018 Jan 1):
Disabling Intel ME 11 via undocumented mode (NSA High Assurance Platform mode)
Blackhat 2017: How To Hack A Turned Off Computer Or Running Unsigned Code In Intel Management Engine
EEF: Intel's Management Engine is a security hazard, and users need a way to disable it
Sakaki's EFI Install Guide/Disabling the Intel Management Engine
Intel ME bug storm: Hardware vendors race to identify and provide updates for dangerous Intel flaws.
CVE-2017-5689: An unprivileged network attacker could gain system privileges to provisioned Intel manageability SKUs
CVE-2017-5705: Multiple buffer overflows in kernel in Intel Manageability Engine Firmware
CVE-2017-5706: Multiple buffer overflows in kernel in Intel Server Platform Services Firmware
Sadly AMD has completely failed to counter the Intel PR that Meltdown/Spectre affects all CPUs when in reality Intel is massively more impacted. The press it parroting Intel PR unchallenged.
AMD doesn't have an easy way to remove their inbuilt PSP when Intel has made lots of people worry about their ME. An obvious thing for AMD to offer.
And why oh why don't AMD support ECC memory on their desktop chips. I know why Intel don't as they want to sell Xeons but AMD has no real server market share. The silicon to do this is pretty minimal. I don't get it, an easy win over Intel.
Change log:
2018/01/01 - Added 14 Useful Links. Disable Intel ME 11 via undocumented NSA "High Assurance Platform" mode, Intel CPU CVE links (CVE-2017-5689 CVSS Score 10.0)
Intel CPU Backdoor Report
The goal of this report is to make the existence of Intel CPU backdoors a common knowledge and provide information on backdoor removal.
What we know about Intel CPU backdoors so far:
TL;DR version
Your Intel CPU and Chipset is running a backdoor as we speak.
The backdoor hardware is inside the CPU/Bridge and the backdoor firmware (Intel Management Engine) is in the chipset flash memory.
30C3 Intel ME live hack:
[Video] 30C3: Persistent, Stealthy, Remote-controlled Dedicated Hardware Malware
@21:43, keystrokes leaked from Intel ME above the OS, wireshark failed to detect packets.
[Quotes] Vortrag:
"the ME provides a perfect environment for undetectable sensitive data leakage on behalf of the attacker".
"We can permanently monitor the keyboard buffer on both operating system targets."
Backdoor removal:
The backdoor firmware can be removed by following this guide using the me_cleaner script.
Removal requires a Raspberry Pi (with GPIO pins) and a SOIC clip.
2017 Dec Update:
Intel ME on recent CPUs may be disabled by enabling the undocumented NSA HAP mode.
Decoding Intel backdoors:
The situation is out of control and the Libreboot/Coreboot community is looking for BIOS/Firmware experts to help with the Intel ME decoding effort.
If you are skilled in these areas, download Intel ME firmwares from this collection and have a go at them, beware Intel is using a lot of counter measures to prevent their backdoors from being decoded (explained below).
Useful links (Added 2018 Jan 1):
Disabling Intel ME 11 via undocumented mode (NSA High Assurance Platform mode)
Blackhat 2017: How To Hack A Turned Off Computer Or Running Unsigned Code In Intel Management Engine
EFF: Intel's Management Engine is a security hazard, and users need a way to disable it
Sakaki's EFI Install Guide/Disabling the Intel Management Engine
Intel ME bug storm: Hardware vendors race to identify and provide updates for dangerous Intel flaws.
CVE-2017-5689: An unprivileged network attacker could gain system privileges to provisioned Intel manageability SKUs
CVE-2017-5705: Multiple buffer overflows in kernel in Intel Manageability Engine Firmware
CVE-2017-5706: Multiple buffer overflows in kernel in Intel Server Platform Services Firmware
While it is worrying there are these security issues, I am not sure how worried we should be? We didnâ(TM)t have these security features in the past and this shouldnâ(TM)t be the only line of defense. It is good to have these security elements in place, but I wonder if too much focus is being put on a single security point?
Jumpstart the tartan drive.
> Is the TPM protected from writing? If not, I assume the certificate can be modified/replaced via software.
No, you cannot write directly to TPM nvram from the OS. The spec says the endorsement key is supposed to be permanently burned in at the factory, but some manufacturers instead support CreateEndorsementKeyPair, which asks the TPM to create a key for itself, if it doesn't already have one. If it already has a key, as it should, CreateEndorsementKeyPair does nothing but return an error code.
To put your own malicious endorsement key in the TPM, you'd need to directly access its NVRAM. The most direct way to do that would be to pull out your scanning electron microscope and connect to the nvram traces on the chip. If some *other* vulnerability allowed full write access to TPM NVRAM, that would be a game changer.
But why not let anyone disable it including the 99% of the planet not running UEFI?
Enterprises which want to peer into the butt cracks and behind the eyeballs of their employees need ME. No one else does.
At least AMD agree people should be allowed to disable it. Intel's arrogance on their ME has been amazing. What a company of cunts. My next PC won't be Intel.
I'm waiting to hear if there is a copyright mark or NSA Easter eggs in the silicon...
Admittedly I did not read tfa, but where does it say that amd feels they need to patch this? if they do feel they have to patch it, it's probably a cautionary measure to address a non-issue blown out of proportion by people on /.
Or are least they figured they may as well patch it. Easy patch.
What bothers me the more than the overflow in parsing a malicious EK cert is that they CAN patch it, that a BIOS / UEFI update touches this code. Presumably if a BIOS update can fix it, a malicious bios update can *create* at least a similar problem, and probably a significantly worse variation. Of course we already knew a malicious BIOS would be bad, but I wouldn't expect it to touch that code.