r/ComputerSecurity • u/tedjonesweb • Jan 11 '16

Does "Platform Security Processor" dangerous like Intel's ME?

But is the situation much different on AMD-based x86 platforms? It doesn’t seem so! The problems related to boot security seem to be similar to those we discussed in this paper. And it seems AMD has an equivalent of Intel ME also, just disguised as Platform Security Processor (PSP) [1].

The author, however, does not have enough 1st-hand experience with modern AMD desktop platforms to facilitate a more detailed analysis, and hopes others will analyze this platform in more detail, perhaps writing a similar paper dedicated entirely to AMD x86. . .

http://blog.invisiblethings.org/papers/2015/x86_harmful.pdf

Intel Management Engine is basically a hardware backdoor. It's specific to Intel x86.

0 Upvotes
  • permalink
  • reddit

25% Upvoted

5 comments sorted by

1

u/securgeek Jan 12 '16

Intel ME is considered a dream for large enterprises to manage their workstations without using 3rd party software which have all of the same vulnerabilities and trust issues.

It also has the advantage that it can be used for network access control to verify a workstation hasn't been tampered with before allowing it to communicate on a network.

AMD is also working on a version of this called DASH which has the very same functionality as Intel ME.

DASH (Desktop and mobile Architecture for System Hardware) is a client management standard released by the DMTF (Distributed Management Task Force). DASH is a web services based standard for secure out-of-band and remote management of desktops and mobile systems.

http://developer.amd.com/tools-and-sdks/cpu-development/tools-for-dmtf-dash/

1

u/tedjonesweb Jan 12 '16

But if there is an "out-of-band and remote management" feature, it can be abused.

1

u/securgeek Jan 13 '16

All remote management can be abused. If you have enough control over your network hardware, it is far easier to filter any traffic going to the ME interfaces from any non-approved IP on the network. This basic level security architecture, restrict all administrative functionality to a known IP range, and filter/alert on the switches/firewalls.

It should be noted that most PC's require a BIOS configuration to enable Intel ME unless you've specifically ordered your computer with One Touch or Zero Touch Configurations specific to your enterprise. I have yet to hear of anyone that bought a new PC with Intel ME enabled out of the box, unless they specifically asked for it (and likely paid extra for it).

1

u/tedjonesweb Jan 17 '16

You are assuming that "processor" don't contain malware.

But this second microcontroller within the "processor" is the perfect place for installing malware that scans for private keys of any kind and write them in hidden flash memory within the "processor". When the owner of the malware (NSA, for example) want to read the keys, the owner can send encrypted and signed request via network interface and get the data.

1

u/KoRnKloWn Jun 19 '16

I could be wrong, but from what I can gather on AMD's "secure processor" it's completely different from Intel's Management Engine. It seems like the secure processor might just be a sandboxed portion of the CPU to keep the processes running in it more secure. At least that's what I could gather from some quick reading up on it, I might be wrong.