A security flaw has been discovered on the AMD PSP (Platform Security Processor), which is a chip-on-chip security system, that stores critical system data such as passwords, certificates, and encryption keys, in a secure environment and outside of the more easily accessible AMD cores. AMD has fixed but not released the firmware updates. Much like the Intel ME, the AMD PSP is an integrated coprocessor that sits next to the real AMD64 x86 CPU cores. A Google Cloud Security researcher discovered the vulnerability and reported the issue to AMD in September with AMD developing a patch in December.
The news was released on the same day as the Intel Meltdown and Spectre flaws announcement. AMD has since confirmed their units are only affected by the Spectre flaw.
With million’s potentially impacted by the news, what can organisations do to protect themselves? Cyber Security professionals from FireMon and Lastline have offered their advise:
Josh Mayfield, director at FireMon:
It can be difficult for organisations to know just how to protect themselves from the AMD PSP vulnerability without intimate knowledge of where the vulnerability exists. Vulnerability scanners can be helpful to locate the assets affected, but unfortunately, scanners stop at this point.
The primary vehicle for mitigating the risk is basic analysis with attack simulation. This happens when you combine policy with vulnerability details to see how a weak spot can be accessed (and exploited). If an organisation can quarantine the communication of affected systems, they can reduce the risk of spread throughout the network. This compresses the patch list, because assets removed from communication can go lower on the list, and critical systems (those with necessary connections) can take priority.
Furthermore, PSP can be disabled on the systems with this vulnerability. However, it would be imprudent to suspend PSP on all AMD machines. Again, attack simulation reveals this. Ranking priorities is essential to mitigate the risk to systemic spread.
Unlike Spectre and Meltdown, this PSP vulnerability goes right to the security processing on the AMD chip. Several processors for security were built-in to these chips, including: encryption keying, certificates, privileged passwords. This is what makes the AMD vulnerability so frightening. It’s like disabling the part of your brain that reminds you to avoid danger, like running in front of a bus. The good thing is that it is not as widely distributed as the Intel Spectre/Meltdown vulnerabilities, so patching should not take as long to perform.
Organisations must reduce their attack surface. They can do so by visualizing their vulnerabilities, control endpoints, segment networks, and do analysis with every breath. Today it is Spectre, Meltdown, or AMD PSP. Tomorrow, it will be something else. Security teams need to reduce their attack surface to wage war on their own terms, compress the field of battle and remove these opportunities for exploit.
Giovanni Vigna, CTO and co-founder at Lastline:
This is not as bad as Spectre and Meltdown, as a fix to the firmware code would solve the problem.
However, this shows how “getting security right” is really hard, also when hardware-based support is available.
Another example of a similar class of vulnerabilities was Boomerang:
https://www.cs.ucsb.edu/~vigna/publications/2017_NDSS_Boomerang.pdf
