AMD PSB Vendor Locks EPYC CPUs for Enhanced Security at a Cost

Re:AMD PSB Vendor Locks EPYC CPUs for Enhanced Security at a... by bubblethink on Wednesday September 09, 2020 @12:10AM (#24417044)

How many exploits/breaches in the wild due to open s3 bucket, default admin passwd to database, poorly written webshit code, plaintext password, etc. ? And how many prevented by secure boot, boot guard, memory encryption, ME, PSP etc. ? Other than obvious money reasons for Dell, people seem to be vastly overestimating their threat models. And even for the secure chain of trust, there are ways to do so where the owner has the key, not the vendor. See heads for example.

[ Parent | on HN ]

Re:AMD PSB Vendor Locks EPYC CPUs for Enhanced Security at a... by sedatk on Wednesday September 09, 2020 @12:52AM (#24417257)

Or, those scenarios just don't make the news as frequent as script kiddie stuff. We only learned about what NSA has been up to because Snowden happened.

[ Parent | on HN ]

Re:AMD PSB Vendor Locks EPYC CPUs for Enhanced Security at a... by young_unixer on Wednesday September 09, 2020 @03:42AM (#24418386)

If I want to protect against the NSA I'm worried about them using Intel ME, AMD PSP and other black boxes to hack me. I don't worry that much about them sneaking into my data center or house and physically changing my hardware.

The security you lose from having a black box in your CPU is much greater than the security you win by virtue of being (theoretically) protected against unsigned bootloaders and rogue hardware.

[ Parent | on HN ]

Re:AMD PSB Vendor Locks EPYC CPUs for Enhanced Security at a... by sedatk on Wednesday September 09, 2020 @03:40PM (#24425010)

I merely provided NSA as an example of how advanced attack vectors might go unnoticed for decades.

[ Parent | on HN ]

Re:AMD PSB Vendor Locks EPYC CPUs for Enhanced Security at a... by bubblethink on Wednesday September 09, 2020 @12:59AM (#24417289)

This is the opposite lesson to take away from Snowden's revelations. You want more user control, not less.

[ Parent | on HN ]

Re:AMD PSB Vendor Locks EPYC CPUs for Enhanced Security at a... by sedatk on Wednesday September 09, 2020 @03:41PM (#24425026)

I agree. I’m just saying that news may not be the best indicator of how common an attack vector is.

[ Parent | on HN ]

Re:AMD PSB Vendor Locks EPYC CPUs for Enhanced Security at a... by argb on Wednesday September 09, 2020 @07:52AM (#24419996)

Although a PSP flaw is very unlikely to harm an individual user, it puts the US and it's intellectual property at risk from foreign actors such as Russia or China. And many engineering firms do not have the resources of the NSA to protect against such threats.

Additionally, a PSP or Intel ME related hack involving a SCADA system would not be discovered until it's too late, with potentially extremely severe consequences. AMD is advertising the processor as being a security device that is intended to enhance system security. If such a SCADA hack involving the PSP was to result in loss of life for example, what would AMD's liability be in such circumstances, where the 'security device' itself has enabled the system to be hacked in the first place? Taking into account that the 'security device' cannot be disabled by the SCADA operator, so they have no choice to use it.

That is why I believe the PSP and ME should be removed completely. Should that not be possible it should be replaced with a processor that is transparent to its internal operation.

[ Parent | on HN ]