Back To The Future With Platform Security

on YouTube ↗53m

" summary

Finds and demonstrates concrete AMD platform failures: unlocked SMRAM on an Acer Swift 3 and other models, SPI flash misconfigurations that allow host reads/writes, exploitable SMM handlers that provide arbitrary read/write primitives, and a persistence path that reaches ring -2 (SMM) by corrupting PSP/PSB structures. Authors reverse engineer missing AMD docs, report 20+ CVEs across OEM firmware, and release a verification tool (FlatBox / platforms) that reproduces the issues and checks systems for these misconfigurations.

AI-written summary · about

" chapters (38)

1. 0:00Introduction
2. 0:36Outline
3. 1:58Lack of Documentation
4. 3:21SMM in a Nutshell
5. 4:48SMRAM Protection
6. 6:07Unlocked TSEG on Acer Swift 3
7. 6:41SMM Unlock Key?
8. 7:16SMM Key Backdoor
9. 7:44SMM Callout Protections
10. 9:06SPI Flash Basics
11. 9:25ROM Protected Range
12. 10:57SPI Restricted Commands
13. 11:44SPI Controller Programming
14. 12:35SPI Read Demo
15. 14:11The Case of Asus Strix G513QR.330
16. 15:46The Story of a Dangerous SMI Handler
17. 16:57The Interesting Code
18. 17:55The Disabled SMI Interface
19. 19:07Exploiting the Bug
20. 20:57SMRAM Analysis
21. 22:37ROM Armor in a Nutshell
22. 23:11The Whitelisted SPI Regions
23. 24:13AmdPspRomArmor3Smm Flow
24. 25:25Host PSP Communication
25. 27:35Late Deregistration
26. 31:08Finding the PSB Configuration
27. 32:28PSB Fuse Register
28. 33:11Example of a good configuration
29. 36:47What is an SMM Supervisor?
30. 38:36SmmSupervisorBinRelease
31. 41:40Example of a Demoted SMI Handler
32. 42:14Legacy Supervisor Syscalls
33. 43:15Protection via Paging
34. 43:38Attack Surface
35. 44:03SmmSupvBin Format
36. 45:07Project Mu is a fork()
37. 45:59SMM Supervisor Policy Analysis
38. 49:10Conclusions (2/3)

" related talks

• 40mHardware Security Is Hard: How Hardware Boundaries Define Platform SecurityAlex Matrosov · WOOT '20
• 33mSecuring the Unseen: Vulnerability Research in Confidential ComputingJosh Eads · Confidential Computing Mini Summit at Open Source Summit Europe 2023
• 28mComplexity Killed SecurityDaniel Gruss · Black Hat Asia 2020
• 51mExploiting Hardware Glitches And Side Channels In Perfect SoftwareHerbert Bos · OWASP Global AppSec Amsterdam 2019
• 25mThe Memory of a MeltdownShane Cota, Chris Magistrado · BSidesSF 2018
• 27mProtecting Data In-Use from Firmware and Physical AttacksSteve Weis · Black Hat USA 2014
• 51mFirmware Cartography: Charting the Course for Modern Server CompromiseNathan Keltner, Dionysus Blazakis · Black Hat USA 2019
• 49mBreaking Hardware-Enforced Security With HypervisorsJoseph Sharkey · Black Hat USA 2016