Presented at
Black Hat USA 2020 Virtual,
Aug. 5, 2020, 10 a.m.
(40 minutes).
<p>AMDs Zen (and later) CPUs contain the "(Platform) Secure Processor" (PSP) which is an embedded ARM core inside your x86 CPU responsible for initial system bootstrapping. The PSP is running even before the main x86 cores and has full access to the main memory. During system runtime it serves as a trust anchor for features like AMDs "Secure Encrypted Virtualization" feature and recently a generic TEE interface for which there are Linux kernel patches pending currently. The firmware running on the PSP is completely proprietary and there is almost no public documentation available. These are more than enough reasons for us to have a closer look at this system.</p><p>During the last two years, we reverse engineered several components of the PSP firmware and hardware in order to gain an understanding of the capabilities of this critical component looking for possible security issues. We found multiple security issues that allow us to gain code execution on the PSP.</p><p>Lately, we developed an emulator for the PSP which enables us to trace the execution of the firmware and to make it easier to develop and test our own code which will later run on the PSP by exploiting found security issues. The emulator is able to run the on-chip and off-chip bootloader that are used to bootstrap the systems. In the emulated setup, it is also possible to put the firmware into a debug mode where signature verifications are disabled, and additional debug output is generated.</p><p>We'll also present a mode where a stub is running on the physical PSP and takes commands from the emulator to forward hardware accesses from the firmware in order to bootstrap the real system using the firmware running inside the emulator.</p><p>The emulator and all other developed tools are open source and available on github: https://github.com/PSPReverse</p>
Presenters:
-
Robert Buhren
- Security Researcher, Technische Universität Berlin - Security in Telecommunications
Robert Buhren is a security researcher and firmware reverse engineer currently pursing a PhD at the Technische Universität Berlin. His research focuses on cloud security and shielding systems. Previously, he presented his work on on the AMD Platform Security Processor at the Chaos Communication Congress and the Chaos Communication Camp.
-
Alexander Eichner
- Mr, Technische Universität Berlin - Security in Telecommunications
Alexander Eichner is a software engineer currently pursing his MSc. in Computer Engineering at the Technische Universität Berlin. He focuses on writing tools helping in a better understanding of AMDs Platform Secure Processor and proprietary firmware. Previously, he presented his work at the Chaos Communication Congress.
Links:
Similar Presentations: