Wednesday, July 19th 2017
AMD Confirms its Platform Security Processor Code will Remain Closed-Source
Since the launch of AMD Ryzen, a small piece of hardware that handles basic memory initialization as well as many security functions has been the center of some controversy. Called the Platform Security Processor (the "PSP" for short) it is essentially an arm core with complete access to the entire system. Its actions can be considered "above root" level and are for the most part invisible to the OS. It is similar in this regard to Intel's Management Engine, but is in some ways even more powerful.
Why is this a bad thing? Well, let's play a theoretical. What happens if a bug is discovered in the PSP, and malware takes control of it? How would you remove it (Answer: you couldn't). How would you know you needed to remove it? (answer, unless it made itself obvious, you also wouldn't). This scenario is obviously not a good one, and is a concern for many who asked AMD to open-source the PSPs code for general community auditing.
AMD has just replied with a big fat "no" on twitch.tv (at the 35m 35s mark in the source link). To be fair, they do point out in the same post that they have independent security firms constantly trying to hack the PSP and none have succeeded to date, but it's still a little disconcerting to think about the "what ifs" in our recent security climate.
AMD may have several good reasons for not open-sourcing the PSP. Maybe they don't own all the intellectual property and some is licensed. Maybe they don't want to give up some significant R&D to Intel. Still, you had certainly better hope the security testing firm they hire is good. You don't want the bad guys discovering this kind of bug before the good guys do.
Source:
AMD via Twitch.tv
Why is this a bad thing? Well, let's play a theoretical. What happens if a bug is discovered in the PSP, and malware takes control of it? How would you remove it (Answer: you couldn't). How would you know you needed to remove it? (answer, unless it made itself obvious, you also wouldn't). This scenario is obviously not a good one, and is a concern for many who asked AMD to open-source the PSPs code for general community auditing.
AMD may have several good reasons for not open-sourcing the PSP. Maybe they don't own all the intellectual property and some is licensed. Maybe they don't want to give up some significant R&D to Intel. Still, you had certainly better hope the security testing firm they hire is good. You don't want the bad guys discovering this kind of bug before the good guys do.
23 Comments on AMD Confirms its Platform Security Processor Code will Remain Closed-Source
That said, I think enabling "secure boot" in your motherboard enables the use of the "secure world" subprocessor.Nope, secure boot is an UEFI feature that doesn't even require a Trusted Platform Module. That said, it apparently requires the processor's no-execute (NX) bit support.Hardware firewall, like a router. The whole point of security processors is to be able to create a trusted environment which includes networking. If you're deliberately using the "secure world," network traffic from it is expected.It sounds to me like they deferred to ARM's expertise on the matter.
I don't think open sourcing it is a good move as a whole. It's for security purpose, the less people know the better.
@bencrutz: Is this om ben?
And this article does not intend to "cry wolf," only report the facts of the matter.
BTW, i work for a IT security company, there is no way my company would let anyone know the source code of our product.
They should keep the source code closed, as even if an exploit is found, it would have to make it past firewalls and have to get onto a system to execute and raise it's privilege level on the OS without being noticed, which while possible, is somewhat improbable if good security practices are in place.
or I'm missing point(s)?
And to those that say 'better keep it closed'... that was also 'security through obscurity'. We are living in a world today that proves how bad that works.
www.wired.co.uk/article/nsa-hacking-tools-stolen-hackers
It also takes all of 5 minutes to setup a PfSense or VyOS box with snort IDS/IPS installed.
Most of the time a good firewall protects absolutely everything on your network, no matter how insecure (run all the Window XP machines you want! - I don't actually think this is a good get out of jail card...).
en.wikipedia.org/wiki/Global_surveillance_disclosures_(2013–present)#September
en.wikipedia.org/wiki/RdRandyep thank the US government for the current Ransomware issues.......:banghead:thats a stupid idea because it allows government to circumvent natural rights and cause.....all the stuff Snowden/Binney/schreiner talked about and the most recent Ransomware issues........:slap:
This actually makes some stupid TV techno babble make sense!
Maybe the writers for Arrow know something we don't...yet