Hacker News Reader

Comment by cwerling | Hacker News Reader

PSPTool author here. Since all PSP firmware must be signed by AMD, something like a psp_cleaner would be possible given that a bug in the firmware allows to inject arbitrary code. This was shown by CTS-Labs earlier. [1]

[1] https://msrnd-cdn-stor.azureedge.net/bluehat/bluehatil/2019/...

View on HN

Wow, only the header is signed (for the Ryzenfall-1 bug)? That is a pretty big oversight, did AMD attempt to patch these bugs?

If there is anything these secret proprietary built in hardware backdoors are its that they are very poorly thought out.

It does seem to be a pattern. I can think of a few reasons off the top of my head:

1. Incompetence - The engineers try to get it right, but fail due to skill, budget or time constraints.

2. Malice - This allows bad actors to compromise the PSP for evil

3. Benevolence - This allows hardware owners to alter the PSP for their own protection.

I think the smart money is on #1, but they're all interesting to think about.

ARM is the designer of the PSP, if its incompetence then they're the ones at fault.

AMD states that the PSP is "ARM TrustZone ... Industry standard" https://www.amd.com/en/technologies/security

That's supposed for data-only modules, so they can patch in live data later, without the need to fetch it from some flash or bios. I think no-one should call code from it.

thanks for posting the link. looking forward to the day when we can run post-2012 cpus knowing we'll be able to lock the backdoor.

Would this be something you would be interested in implementing? I still use Intel stuff only because no psp_cleaner exists yet.

I think the coreboot guys would also be interested in something like this, too.

Reply on news.ycombinator.com