How do these security processors verify the firmware integrity?
Through a set of cryptographic keys and their hashes, which are used to verify the cryptographic signature of the UEFI firmware. These keys or hashes are *burned* into the processor and cannot be changed. /3
For now, these functions are not strictly enforced or turned on in a lot of consumer devices.
But is there anything stopping nation states from forcing hardware manufacturers and OEMs to do so?
What options do you have in such a case? /4
![Manufacturer response to IOActive's disclosures regarding AMD PSP implemenation flaws:
Acer:
“We appreciated your information about a possible vulnerability in Acer product. After thoroughly investigation, AMD PSB is an Optional Design during develop on
consumption product, it's not a mandatory requirement in Swift 3 SF314-42;
even though AMD PSB status is not enabled by default, platform with Secure Boot and Secure Flash are in position to protect system if malicious code injecting to flashROM, so we don’t consider this as a vulnerability.”
Lenovo:
“Platform Secure Boot was introduced as a standard feature on all consumer Lenovo laptops in 2022, and laptops manufactured prior to this date were not designed with this feature in mind. Enabling it on devices now in the field would be likely to frustrate consumers if any unexpected issues arise.”
Huawei:
“The PSB function was not enabled on our early AMD platform product, the PSB-like function(also known as “Intel Boot Guard”) was enabled on our later Intel platform product (such as MateBook 16s 2022).
We confirmed with the BIOS supplier (Wingtech Technology) of the AMD platform
product, there is no modification plan for this issue. To avoid confusing users, we
kindly ask you not to disclose this issue. [...]"](https://assets.chaos.social/media_attachments/files/116/126/053/536/385/352/original/3a36bc68acba4d69.png)
If you have a fediverse account, you can quote this note from your own instance. Search https://chaos.social/users/sleepyowl/statuses/116126064668115051 on your instance and quote it. (Note that quoting is not supported in Mastodon.)
