Dear viewer, these subtitles were generated by a machine via the service Trint and therefore are (very) buggy. If you are capable, please help us to create good quality subtitles: https://c3subtitles.de/talk/332 Thanks!
Thank you.
I hope I will calm them soon, so I'm
able actually to operate, so let's try.
So first of all, we will
have a shared history lesson
about the platform processes
and the history of the
platform protesters.
Then obviously, we will have a look how
it looks today.
And most of the lecture we will
spend together doing the
hardware and the analyzes of
the ecosystem management unit.
And so
excited, six protester.
As you might know, it is quite
old process from late 70s.
And what is interesting
is that this protester always
had a little small protesters,
which we try to help helping think big
speak protester.
It is really quite all the time
from nineteen eighty four
and also nineteen eighty three.
Those protesters were the platform
protesters without possibility
to change the firmware, but they
had a lot of important functions
which in that time was a keyboard
and also the resetting
the whole platform and the famous
820 hardware.
I want to just to make
sure what is the level
here. So who knows what is a 20?
Great. I am at the conference,
so it's OK.
Yes.
And so those
were the first processors.
And as you might know, the
laptops generally also include
one more processor, which is usually used
for the federal management and
plugging events and special keys
and so on.
And this this controller
has has
usually eight fifty one CPU
or something.
So that should be used and so on.
So this is
the sixth platform currently is
using such things.
And if we look
how it looks, looks in today,
that we will find that the
we will find that the border between
the hardware and software
somehow diminishes a little and
that there is a lot of firmware
present. If you look through the Linux
kernel, which has
this Finbar directory or the the package,
you will immediately spot that
virtually any peripheral today has
has kind of firmware
which needs to be uploaded and to
operate.
But in our like to
I would like to concentrate on
the platform processors
which are helping the main processor.
And let's start with the
with the input into the processor.
As you might know, there is
one which is remarkable, its
internal management engine.
When I was this one.
Great. So let's go let's go
to the AMD because maybe
it's not such not so many
known so
in AMD platform, which you can buy
today, you will find several
other processors.
The first one which I listed is the
System Management Unit, which
will be more on that
later today.
Then there is even a
small eight fifty one, which is located
in the Southbridge, which is called
Integrated Microcontroller.
And of course there is also
some other controller in
the USB, which you can
figure out in your homework what
kind of control it is.
And in the end, the very recent
AMD processor comes with
something which is called platform, the
security processor.
And this processor
is Cortex, a
five Aveda Trussoni, I
think. And the reason why AMD
introduced this processor is to
redo the chain of
the root of the trust.
So the idea perhaps
behind this is to
to have something else which
which gives the root of the trust
while booting the 86 processor.
So in fact, something which verifies
the bios before the even the BIOS is
starting.
But in this lecture, as I said, we will
concentrate on the system management
unit.
But this is not the only
platform which has such
kind of special platform processors.
If you look to our PC,
you will notice that there are special
channel or DMA processors which
which are also running their
there.
And that here is just the.
Funny table, I hope I have it correct,
so I'm not aware
if there is any malware running on
this kind of platform processors.
But as for today,
I can put the platform
processor has some bugs.
So let's have a look.
And to finish my introduction,
I think it's a good, good way
to increase kind of awareness
of this. And
because this platform providers are
in a very modern platform and
you cannot simply disable it
because it's a it's a
it's a genuine part of
the of the system.
So you have to live with it and that
it could be possible security
problems.
And this is, I think, a very
important point that the hardware
engineers are involved and
which means most of them are not the
software engineers.
So if you ever have
have looked to some
bios, assembly codes or
some small embedded system
platforms, you know how clumsy
they are. And this doesn't
help the security much.
And that is kind of
advent of some very special furnival's
which are found on
under which can be loaded
to the current platforms.
Most likely you are you
are aware of the bad USB
stuff, which I think
I have it.
It's not, in fact, in the US before zero
controller, but in the in the client,
in the USB device.
But what the what what you can
also run is that you
can run the Linux
in your hard drive because somebody
with the spritzed name
found out that the hard
drive KPCB contains three processors
and you can run MUMU less Linux
inside your hard drive and also
fix the shadow if
necessary, for example.
So as you can see now,
we live in an age where
those protesters are somehow bubbling
out and
something needs to be done.
Yes, and I was speaking about
the open source,
Fininvest, and I believe there are also
perhaps some closer's fermata.
And here you can choose your right
permutation of
the vendor.
OK, so this was just
the first part of my story.
And the second part
is how it's
about how I went through the SMU
stuff. And as usual,
it begins that people read books
and some, but it's also datasheet.
And if you do that and have a look to
this document, which is very nice,
it describes how most of the stuff,
how the modern amde.
But this is where I think it's called
Amde Bias and Developers
Guide.
And if you have a look
into this document for the very recent
familias, you will find
this quote that there is something
which is called the assistant management,
you name it, and it takes
responsibility for the power of
management and system related tasks.
And the last sentence is quite a
nice it says the SMU
contains a microcontroller to assist.
And
this is the point where I started
to think, let's have a look
how it what is it?
And if I can get some fun,
fun on it. So and because
I like the, uh,
the stuff like cyphers and
so, so thing, it was very ideal
topic for me.
And this thing
is also very special because
it lives in those channels, but it
is the part of the system of ship
and it means in the end that
it lives in the CPU.
And this was the reason why I put
the name Matryoshka processor.
And while
I was preparing my lecture, then I
noticed that the Western
people are not
and they simply don't know what the
matryoshka is.
And so I brought one
to show you also, this is the main CPU
and if you open it, there is a
small one.
And so
but this is not a part of the
Czech culture because
we were the Soviet satellites
some 20 years ago
and there were not other
presents available.
So we kind of have still some
of them.
In our homes, but please
do not buy them in Prague as a tourist
souvenir because they
it's a tourist trap and please don't
do that then.
OK, so
now back to an election.
So what kind of microcontroller
is there?
Of course, nowadays
the Google knows quite a lot
of answers. And if you put this to the
Google, you will get some
more data sheets, which you
we will need later.
But also
you will get something from LinkedIn
and not just this one, but
also a lot of other pages, which
describes a
lot about what the SAMU
is, in fact, doing.
So here I want to read
it at all or at all.
But in fact, as you
can see, it is a lot like this
11 32 processor.
It's doing some dynamic power
stuff.
And this guy apparently
implemented the adaptive
algorithm to deal with the
power management. But please don't blame
blame this one, because there that is
many more on LinkedIn, especially
for the Amde employees and other
employees.
OK, so if
you know that this is like
this, Michael, 11 thirty two,
then it
is quite a short introduction.
So it is I'd
say open car processor.
You can get SDK for
it or you can download it,
or you can compile your own toolchain
and you
can get also the reference manual.
So this is in general a very good start
to think about this.
And the 11 32 processor
really likes the number thirty two
because it's a little bit processor of
it, 32 bit instruction size.
And you can guess how many registers
inside processor it has.
Yes, it's thirty two.
And because
in the next part of the lecture
I will need this information.
So just quickly
we have the R zero which should hold
the zero and
the rest is quite obvious.
This architecture is not like exciting.
Six It uses link register
to save the return.
I need an address from the function
s and
so so far we know what kind of
architecture we have, but we don't know
where to look for the firmware.
So the hard way is
of course, this old the flash
of the flash chip, which is on the
to read it out in some
program and
look, if there is not the firmware, but
in fact there is an easy way because
on these platforms,
the the BIOS image is a complete
image of the flash.
So you can have a look for the film
in this in this image.
So you don't need to do this ordering
stuff and reading out.
And I put some
glue here that the film
is part of something which is called
just this is
Amde platform initialization
blowoff, which initialize
the the every aspect of
the and the platform.
And this is included from Amde into
the vendor bios and it is called
during the BIOS execution to perform
the initialization steps.
And to get the
film where you can download virtually
anybody else
from the from the Net, for example, for
the film to motherboard, which I
was using
for my experiments, and
now because I already told you it's
in the biosynthesis so you can try
the text search and
the search is for SMU.
And if you do that, you will
find something like this.
If you look to the slide that
is underscore SMU, underscore SMU,
and this thing
is most likely just an encore to
allow other perhaps AMD
people to find it more easily inside the
blob. I have no other explanation
of this.
Then the bullet text
is actual firmware,
which is for the SMU
SMU part, and
you have many famous
many, many like three or four.
And in it just because
one, it just supports different
CPUs like Trinity or Ridgeland
and also others like
you. So for example.
So the next thing is that
we are on the communication Congress, so
we have to communicate also with
this process and
we would like to communicate from the 86
process. So and this
is about the document I mentioned
is again, helping because
it is described and documented in the
public documentation that there are these
two registries, which you can use as kind
of a gateway to this
other space of this process.
And here, let me take a little detour
that if it is not documented,
it doesn't mean it doesn't exist, it's
just a delay.
And on the other hand, I do appreciate
that AMD is putting a lot
of effort to have documented
platforms way more than the Entel.
So please try to support them
at least like this.
So let's write
some simple utility to them.
The address space of the System
Management Unit from running system
I use to Linux.
So if you do that, I
know it's rather small, but
I will fix it later.
If you do that, you will see that is
kind of strange data.
It's repeating fifty five,
fifty five and again,
and this is for the first
64 kilobytes.
So then it's getting a little
bit better because you will immediately
see that at the offset
of 64 kilobytes, it starts
to be the same as you have found
already in the BIOS.
It makes you you or I
analyzed.
But what is strange is that after
the five hundred
the three 256 bytes
data is again this fifty five
fifty five a,
which means that the runtime for where
it's most likely hidden from you
so you cannot modify it and then
some random garbage follows.
So this is how it looks.
If you dump froster 64
kilobytes segment,
I put it into the nice table.
So it is more, more
easily
understandable.
We will look now to the
to the header and then we can go back to
them and to the Finbar.
OK. And I need to drink
some water because.
OK, so this
is quite easy stuff in the film about
Hadra, you will find what you think it
should be, that you will find out that
there is a version number
that is the length of the headroom.
There is the length of the
of the film where there
is also something which looks like entry
point and that see,
and then the offset
is certain in the hexadecimal.
There is something which looks like
a checksum. It looks like very random
data.
And in the end of the header there is
five five five five a
signature. And then it continues
with some Finbar,
which we don't know yet.
It could be the first construction.
So let's have a look
at the inspection stuff, so
as I said, it immediately follows
the header.
And if you if you
disassemble the this instruction,
this zero zero zero
like three zeros and ninety eight at the
end and the second one is the same.
So you will get this instruction which is
quite unhappy
and it is garbage, but you
have to try something else and it's
like big. And then for example,
and if you do that you will
get something which is very promising
because as I have shown you, it
is expected that in the register our
zero is in fact a zero.
So it looks good.
And is there
some one which can
do something with the radar software?
Oh, yes, please, I will
need some kickstarts to this
because, as you will see,
I did it in very
own way, so I decided
I will convert the film over to the Elf
file. And I did it with the
object copy like this.
So I created one section
which I marked.
It is executable.
And then I used Object Dump
to dump it back. And if I have done
it, so I got this
first step. So here, as you can see,
it's just zeroth.
I don't know why waste time but this
so they are zero.
Then it disables, interrupts and stops
the exception and less
and then it sets
another other place in the routine set
ups, the stakes and zeros, the VSS
and it's classic CRT zero startup.
So I decided
I will put back some more symbols
so I can use nicer object
and exception and
letters were described in the
11 32 manual so I
could add more data to my linker
script and identify the exception in
letters of the film. But.
And if you look to the functions,
they look pretty, pretty standard.
They have some prolog and epilog, so I
just skip this for now.
And here, I think
it was a great idea,
and I said
that like this as the SDK and I looked
into the SDK and found out that
the year zero
s and some C functions which were
handling the entraps and
entraps routine's allocation
and the registration and so on.
And I also checked the
the binary image
of the example of each letter is included
in the in the SDK.
And I found out that and the in
fact, uses this also.
So I was able to feel my
escaped again with some more functions.
It's it's not exactly the same because
of the different VXI most likely,
but it's very similar.
OK, so let's,
let's see how to communicate with
the media firmware from uh
from the operating system or from the
BIOS.
Uh, you can read in the manual that it
is possible to invoke something which is
called SMU Film Request
and this is documented
again and it
will just write some request.
No to the registrar.
Then you will just go
to the interruptive inside the
register and
the SMU will get the draft
and proceed
with the with this kind of
interrupt and then
also return if the entrapments
already 17 was successful or not.
So.
In the detail, this is what I
found out is that most of
the stuff is power management related.
It's something which is called budget a
of power management, and that
the custom registrars are usually located
at the end of the second
64 kilobytes segment.
And this is not
only this, there were also some
functions or some service functions
which were quite easy to understand.
There were some from for the
flashing of the data issues and
instructions.
There was also a very special request,
which I nickname Pink
Request, because it just incremented
by one register and this was
all what it was in fact doing
so.
Now we know quite a lot about
this as a new and
no need to ask some
questions.
So if it is possible to run
some program, our own
program on it and with all of
the problems.
So the obvious problems
could be that there is this protection
thing which doesn't,
which means that the code is protected
from the runtime modification.
Plus there is something which looks like
the checksum.
Plus, if we would modify the bios,
it would mean that the bios on its own
has some kind of checksums.
So this
this is the problem we need somehow to
solve. So this is, again,
just from the film about as I was
telling in in the beginning.
So there
is this 20 bytes or something
which still needs to find out.
And this is
in fact one hundred sixty bits.
So.
Well, this could be yes,
that could be h a one.
So I tried really hard with
many permutations like computed
from the firmware without
the header, with the header a little bit
and then with zeros instead
of the places where it is.
And I simply felt
I didn't, I didn't
find out how to do that.
Yes, and this is what I said already.
So the second thing is runtime
code injection.
So how to do
that?
We have this problem that the code and
data segment is hidden.
And, uh, and so
it looks like it's
protected.
So but there are also ranges
which are not protected.
And this was seen
in the big dump I showed you
in the beginning.
And let's examine
this further and see if
if you can write there something.
So in this light, you'll
see that
there is this five, five and
so on again.
And at the of the DC
50, it stops
and there is some random stuff.
And the headline,
as I have told you, already, is also
visible. So these are
these two regions and in the end
of the of the of the 64
kilobyte segment, there is this
communication area with some random
garbage.
So if you look
to the data on which are
which are to be seen in
right after the protection and
it looks like something like this and
there are some
there is some strange things happening
here.
So they said the data matches some
functions in
the film, which I need
to tell.
What is it?
So I don't know.
And what is
more strange is that this part
is still part
of the BIOS image.
So somehow
something went wrong with that
even more than terrible.
So there is a first problem that
there is some problem that the
256 bytes
is missing in the protection
and there is also
the same length.
So it looks like it's
kind of problem that
this this part is not not covered
because someone forgot to add it
over there.
So because of this, we
need to ask more, can we change
this of the daytime during runtime
and answer is yes.
And is there something
which invokes this function pointer
from the of the data?
And answer is also yes.
In fact, there is I
see this
there is this this picture which handles
various interest requests from the SMU.
And one of the requests
is also which is present
this SMU request function handler,
which gets involved.
So now we can
think about how to run the program.
So I took
the obvious approach to allow this
to a new start over the
second 64 kilobytes segment,
I put that to the quotes
because I don't know if it was really
unused place or I was just lucky.
So we can modify the pointer
in the offset data and
then when the finished.
We return the control to
the original function to handle the
request and also the Iraqi request,
so it's cleanly done
and violated.
I also included here the
this is actually the function which
which is invoked
for the SMU request.
And now we can also
go through this one.
So first, it acknowledges
this SMU request interrupter,
which came because of this register
with the request number, which was stored
in some other register then myself
and shifted, and then
it loads the base of the function
pointer table, which is different from
previous. This is another function
and allow this to go to the
registrar R2 and
then call it.
So is there anyone who sees
already the problem?
No. OK, so.
I give you more time.
OK, so so there is
no check for the bounce, so
in fact, it means that you can
run something which is not
in the in the array
for the pointers.
And this is bad.
So something
went wrong again.
Um, because we control this
this 15 base value, which we are
passing through the request to this
function, then
the offsets where the pointer
stable starts is also known.
So we can simply
simply load to some other
as a pointer to our
function, which we retrieved, which we
can load there.
And if we call the
SMU request with the
right number, which matches,
then we can again execute
our own code.
Yes, including governor injected
functions, the.
So
in this case, it means that we can
execute our own code inside
the SMU, but
there are still some regions which
are not available
to us and I was interested
what I can find there.
So in this case, it is the
region for the
for the first 64
kilobytes.
Yes, so.
Everything begins like, but I think
a program, so let's start and some
and this one will be quite easy.
We will use the methods I told
you right now to
actually program some kind
of function.
Sure. Which allows us to copy four
bytes from any place inside the
firmware and copy it
to to someplace which is not protected,
which we can read.
And we can use this number
as many times as we like.
And it means we can dump the first 64
kilobytes to see what is there.
Yes, so let's have a look.
What is there?
I do think it's most likely
around.
I like my processor and
I have written data there
only once, very covertly,
and nothing happens.
So most likely this this is the wrong
part.
What is interesting is that it has the
same structure as the runtime
firmware and but
with more complex initialization.
And it implements only
a small request, zero,
which which
verifies the firmware,
which is loaded by the BIOS.
So while the computer is starting,
most likely that this gets executed
first, then it waits for this request
and BIOS will load
Biosphere to load the firmware from the
BIOS image to the
to the second 64 with 64
kilobytes then invokes this
and the
firmware in the in the Romeoville
will ultimately figure
this kind of.
So and if we can analyze
it, we can also see what went wrong with
this 256
byte of said.
And, of course, what kind of issues is.
So this function.
If you look, it is not one function,
in fact, it's much more than one function
and there are some strange constants
like this,
anyone knows what these concerns
are.
I didn't know either, so I had to
help, and
if you look, there is another
clue that essential one or
each Mac.
And I had
no difficulties because I didn't have any
properties assembler, so
how to make sense of these big
functions and well, and I
found out I can use something which is
obviously known.
It's called KYAM, so
it has support for you.
And I had it a little bit to
have support for this memory layout,
which was like they will change to
one file.
So I allowed it in the QM or the wrong
part Forever and Rampa forever.
And I also
I started UQM until executing
the authentification function.
And I was able to debunk it with the
GDB and to see what's really
happening.
So now what I have found
out is here, so
the authentification function.
It loads the data from the
film where it
flashes the DataCash is computing's the
hash function flashes DataCash
is again and
then it checks.
If the hash is matching
in the film, in the film header.
Here it is using the Konstanz
Time algorithm.
So it means if the hash is different, you
cannot use the timing attack as
it was possible, I believe, on the
Nintendo Wii or some something
like this.
So, so far so good.
It's also the protection
registers.
And here is the problem, because
the size of the firmware does not include
the header. So they thought
it's included, but it was
not. And that this explains why there
is these are 256
bytes gap on the part which should
be covered, but it is not.
And it changes.
Also the research director of the
of the eleven thirty two.
So next time the
room is not executed anymore and
the often difficult firmware
is run and
in the end it signals back
the results to the bios.
So how it looks with the
header some, so
it is not a check, Sombat Ash
and debugging
helped and this
is what I was telling you last time.
And it is also it also
means it is a symmetric key.
And if it is symmetric key,
if there is anyone with a key,
he can or she can sign on
firmware.
I know that this question will
arise, so I will answer it with the
second.
I do have some keys.
Yes, OK.
So now you can close your eyes.
Yes.
Yes, so who has closed the eyes?
It's great to know. Close your eyes,
really. I'm watching you and wait
for the next flight.
So
the sights now, you can open them so
you can actually read that it's
called The Secret.
So now I will press the space.
Now, you can see that it was a little
spoiler because the 42
is, in fact the slight number of.
So let's move on
to slide number 43, there will be No
43,
there will be some jokes which
are which will
be fun, at least
for someone.
Is there anyone from Czech Republic
so great.
This is not a secret in Czech Republic
and it is not a secret anymore here.
So I will also skip it.
And
the secret, of course, remains a secret.
So.
But now it is time to
write some email to Amde
and we need to write them something.
So this is what I have done.
I wrote to whom it may concern.
I have discovered a security
vulnerability in the recent AMD
processor, which allows arbitrary code
execution on the system management
unit, and I have
a trouble to find out whom to write.
So I decided to use LinkedIn
to find some context to some
sensible engineers which looked
like they are responsible for this
and how to support the claim.
I changed the pink function to
add instead of one to at
two in hexadecimal
and I fix the hash
and then I send it to the Andy
and so and now
something about how it went.
So I analyzed the
during the Christmas 2013
while I was watching
Chaos Communication Congress in a little
window, but in the big window, the Finbar
and sometimes
later I found
the box I presented to you.
And I put
it return to Andy on the last days
of the, uh, of the
April and in like
two weeks, I received
a response.
Please, can you give us more information?
And so I started
to encrypt the communication between
me and Andy.
Uh, I've written in the detail
what is the problem?
And then in July,
they acknowledged the problem.
In the meanwhile, there was some
communication, and
in November at the end, I received
a list of version which
will contain the fix.
So now it is fixed and
the conclusion is that they
responded like to the next day and
because they are on another continent
than me. So it was fun,
too.
And fast. So fast to speak
with them.
And that's it.
And yes, the fixed problems,
both issues are now
fixed.
So the family is now padded.
So that is not a problem.
Again, with this with this
with this problem inside the
inside the routine, which is
authenticating the film where
the the problem with the
SAMU request, the function
I check it is also fixed.
And some other unrelated fix
to this will vulnerability's in
some other processes that are also fixed.
So now it looks
as you as I already told you, the
where is part of the amde ageism.
And now it
is time to ask your vendor
for updated ages.
And I think
it is a good idea to do
that and to support
to support this, because
it's the Bandera's which are
delivering the bills, bios, updates
to you, not the amde.
And this is perhaps
the only way to force them
to update. Also the all the other
platforms is
to simply bag them and ask them for
the fix the HSM,
which is here.
So in this table you can see the
protesters names which are affected by
these problems.
Also the Egis version number,
which you can get if you
search in the BIOS image for a
just a string, then there is this
thing like to begin with one
point one and the SAMU
versions which are
listed over
here in my presentation
in the slides, if you go back, then
later I use the version
a A which means Tanton.
So you will see now its version 10
14, which already includes the fix.
And I use this,
let's say, some nicknames
of the processors, but it is easy to find
them using Wikipedia.
So
you will find it or just ask me
or drop me an email if you have some
problems with that.
So thank you for the attention.
Rudolph agreed to a
Q&A session.
So please line up on the microphones,
microphone, screen and so forth.
I need another microphone.
I have my own. Yes, I know.
Um, so to two simple questions.
First of, what can you actually do from
the you can you read any
anything for memory? Can you actually
do anything else than just respond
to it?
Well, it was not the purpose
to analyze this for me.
I simply took
my journey and
I, I didn't want to damage my process
that I'm not sure if it is even possible
to physically damage it.
I don't know if that
if there is a name and
a DMA available inside this process
that I would bet it's in the USB three
controller which needs to use DMA.
I don't know if this processor uses the
DMA.
Um, but I forgot
to tell you that I have a
guess from Amde.
I mean, can most likely help me to
answer them. Please welcome David.
Hi, David.
Hi, everyone.
Yeah, with regard to
that specific question, the
SMU appears to
software as a PCI device, and it
has the same capabilities
that you would generally expect a PCI
device, which includes the DMA.
It has, of course, some additional
capabilities with regard to its specific
function within the FCC regarding power
management and things like that.
But yes, it is able to read
and write memory.
OK, so so the thing is,
how persistent is firmware
once a year actually puts anything in it?
It's basically volatile, right?
So if I override the the
like, if I'm malicious and patch
be the hosts firmware,
the bias blob to have
a malicious piece of code
in in that blob that I recalculate
the the checksum for that I
now can, since I do know that all the
CPUs allow me to read
it out and the ROM
doesn't change since the last time
I can basically just infiltrate
any random CPU.
You can die.
All right, I guess so your questions
about the window of vulnerability right
between tower on and when the firmware
was loaded? Yep, yeah,
that exists.
And that's
unfortunately not something that we can
really patch in the field.
I guess our response to that would be
that if
if you are able to have more trust in
your early BIOS code to correctly load
that firmware, then that will
help address that.
And so some of the technologies that
we are working on with our newer products
include things like Harbor Validated
Boot, where we have
the reference platform security
processor, verify
the integrity of that first bio spot that
executes so that you can have that chain
of trust going forward.
But yes, I agree.
There is a window here that makes sense.
Thanks.
The IOC has a question,
yes, thank you. The question is, what
is exactly the same you and the
Starpower Management Unit also in
it? Could it be used to overclock or
activate more cost?
Well, I think
it is used for the power management stuff
like the
dynamic or adaptive power management.
I don't know if you can overclock
way more or if you can unlock
some other, cause that's I don't
think they will though
this to us.
So I don't know.
Yeah. I would say go and have fun.
Let me know what you find.
OK,
microphone for
thanks for your talk.
Just a quick question.
So currently the BIOS,
the actual BIOS, image boards that
submit their request to verify
the bisymmetry.
Yes.
So you could in fact just remove
that from the bios, assuming you could be
complete by checksum and.
Well, I passed the whole I'm not even
sure the computer can run without
that, so.
I think you have to you have to load
it.
I mean, bypassing the semi checks, I'm
not the simulating,
is it? Because if if it's
the buyers who started it, the main CPU
started first.
I'm sorry, I can't hear you.
Very sorry if the main CPU started
first and then it loads
the SMU image and
then it calls something to verify
the BIOS image was loaded correctly by
this image. Must have been already loaded
right. Oh am I getting it.
So the sequence is that the
main CPU except the six starts
to run with the and the
SMU and maybe the same moment
is running also, but it is running the
wrong firmware
and well when the boss
is doing its stuff, it will load
the image to the rim
of of the of the same unit,
the second 64 kilobytes, and
then it will invoke the authentification
function.
And unfortunately I don't
know any details what could happen
if this is wrong or if you don't do that.
So again, maybe David will.
Yeah, I think I may have created the
confusion, so I may try to trust that
the statement about verifying the BIOS
code, which loads the firmware, is
a statement with regard to
newer products, starting with the
Mullan's product that include a platform
security processor where the platform
security processor is the first
microcontroller that comes up out of
reset for the older parts that do not
have that.
What Rudolf just said was correct.
OK, thanks.
Microphone two.
OK. Um,
you notice that now we should
rely on the mainboard when
those to supply bios
updates containing the patch
firmware blob's.
From my experience with Intel members,
I have very little trust
in the mainboard vendors to
do proper H making in that
BYLES update.
So do you see any
chance and just swapping
those blocks and existing BIOS
updates? I mean, I know
for Intel that it's definitely possible
to patch files updates which are
not properly secured.
I think you
will it will face the problems with some
other bios checksums in
the end. And I would recommend you to use
the photo booth and because
that's the fix for this problem.
Also the
other might work as well.
Good point.
Thank you, Michael, for one.
Hi.
I was just wondering, you have heard from
companies like Facebook, Microsoft
and others that they put out
pretty huge bounties for security,
vulnerable vulnerabilities found.
So did Emdur reward
you for basically doing their job?
You know, and
why are you talking about.
Well,
well, of course, I didn't
want to sell this
because I thought if maybe
some other people know about
this. So let's make it public to balance
balance out the world,
our world.
And yes, it cost me
some money to get, in fact, here and
speak about you about this.
So I'm a little bit at the minus, but
I'm enjoying the Congress very much.
So it's OK for
you.
Number two, yes, thank you for your talk,
did AMD actually change the
salt they use for the shamokin?
Um, I think no,
it's still the same scheme.
So basically, if you can if you
take the same steps that you did, you
can just find the salt and
write your own firmware for it.
Yes. It's in general, it is possible that
there might be a ways to put
that to the new keys or the new salts.
Yes, but if they would, then
these would be supplied and bios updates
and you can just extract the new seats or
the new.
Yes, it's it's a
fairly good game.
Maybe they would sell something.
Right.
So obviously the fix, it was released
as new firmware.
And so if you take that out
and you write your own thing, they get
sort of before that or something like
that, then you're
running essentially with the same device
that Rudolph did.
Uh, the
the key or salt in question is
hard coded into the silicon itself.
So it's not something that unfortunately
can be changed.
OK, thanks.
Number two,
the first part of my question you already
answered, because it was just that
question, so after
applying the new firmware,
new vulnerabilities,
not withstanding the like
the Sam used, then safe
like.
Yes, so with
this fix, it's OK now because,
yes, the window is closed, you cannot
access the memory anymore and
you cannot load your own code into
it anymore.
And as long as you have the bias blob
in the chip, it's OK.
As far as we know, unless I find
something else.
Thanks.
And if you do I to say
since Rudolph's
encounter, where he had trouble
finding someone to talk to at our
company, we have set up a new email alias
that's listed on there.
So if if you do have time to experiment
and you find anything, we'd love to hear
about it. So please email us.
So thanks to Rudolph and
funding this background make us all safer
and go for the more.