SoylentNews is people
SoylentNews
Submitted via IRC for TheMightyBuzzard
Since the launch of AMD Ryzen, a small piece of hardware that handles basic memory initialization as well as many security functions has been the center of some controversy. Called the Platform Security Processor (the "PSP" for short) it is essentially an arm core with complete access to the entire system. Its actions can be considered "above root" level and are for the most part invisible to the OS. It is similar in this regard to Intel's Management Engine, but is in some ways even more powerful.
Why is this a bad thing? Well, let's play a theoretical. What happens if a bug is discovered in the PSP, and malware takes control of it? How would you remove it (Answer: you couldn't). How would you know you needed to remove it? (answer, unless it made itself obvious, you also wouldn't). This scenario is obviously not a good one, and is a concern for many who asked AMD to open-source the PSPs code for general community auditing.
Bit late to the reporting but we haven't covered it yet, so here it is. And I was so looking forward to a new desktop too. Guess this one will have to stay alive until ARM becomes a viable replacement.
Previous:
The Intel Management Engine, and How it Stops Screenshots
Intel x86 Considered Harmful
Of Intel's Hardware Rootkit
Intel Management Engine Partially Defeated
EFF: Intel's Management Engine is a Security Hazard
Malware uses Intel AMT feature to steal data, avoid firewalls
(Score: 2) by TheRaven on Monday August 21 2017, @08:21AM
ARM provides a feature called TrustZone that is integrated with the memory bus and allows you to restrict access to parts of physical memory to cores or peripherals running in a designated secure state. Some implementations, such as Apple's, use this in conjunction with a separate core that can protect itself against the rest of the system and can store encryption keys without the rest of the system being able to access them.
The problem is not the existence of such a coprocessor, it's the fact that it's running code over which the user has no control. On an iOS device, this isn't much of a problem: almost all of the code is out of the user's control, so the fact that the secure core is out of their control isn't much different. On a general-purpose machine, it's a problem, but currently ARM provides sample code to run in the secure enclave but users can replace it (as long as the SoC maker doesn't prevent them from doing so).
sudo mod me up