Dubious Research Discovers Ryzen vulnerabilites

[Rroff]

Its very clear what the quote is.



The Intel system was not "used as a debugging test-bed" its the platform the problem was originally found on and then tested for on AMD's system.

That is literally exactly what it says.

For one the quote says likely it was on an Intel system and is an assumption in the original article for another there is no indication in the wording there as to the approach used whether it was exploited on a target machine or used as a debugging test-bed for validation. For that you have to dig a bit deeper.

Lets repeat that again...

"(likely on Intel (NASDAQ:INTC) x86 systems)."

 

[humbug]

For one the quote says likely it was on an Intel system and is an assumption in the original article for another there is no indication in the wording there as to the approach used whether it was exploited on a target machine or used as a debugging test-bed. For that you have to dig a bit deeper.

Could have been on an IMB PC but that's unlikely given how rare they are, they say its likely to be an Intel system because it is, in politics things are never absolute even if it can't 'realistically at least' be anything else.

The rest of its context is just as telling, IE the criticism for not reporting on the same issue with Intel.

The quote again. It couldn't be more plain.

"It appears that CTS Labs first found vulnerabilities in Asustek’s chipsets and validated them (likely on Intel (NASDAQ:INTC) x86 systems). Then, the Company went to look for those same errors and others in AMD x86-based systems. However, instead of pointing out that security problems existed in tens, if not hundreds, of millions of systems with Intel and AMD chips, CTS decided to target AMD."

What-else uses Asustek’s chipsets? Asustek = ASmedia BTW.

 

[Rroff]

Could have been on an IMB PC but that's unlikely given how rare they are, they say its likely to be an Intel system because it is, in politics things are never absolute even if it can't 'realistically at least' be anything else.

The rest of its context is just as telling, IE the criticism for not reporting on the same issue with Intel.

The quote again. It couldn't be more plain.

Or it could have been an older AMD machine and that is only a guess because they say they went out and bought a Ryzen system - but it might have just been they didn't want to use a "production" Ryzen system for testing things potentially able to brick the system.

I say again just because you are able to identify flaws in some hardware doesn't mean that whole system is necessarily vulnerable to them being exploited. Its perfectly possible and the way security researchers normally do it to discover these issues while using some kind of debugging or simulated environment then move to real hardware to validate.

Your whole premise is extremely flimsy and based on reading something the way you want it to read.

 

[Scougar]

The whole thing is just BS anyway. Just look at some of their statements:

What is this site for?
This site is to inform the public about the vulnerabilities and call upon AMD and the security community to fix the vulnerable products.


Why are you doing this?
To bring these issues to public attention, and to warn users and organizations. In particular, we urge the community to pay closer attention to the security of AMD devices before allowing them on mission-critical systems that could potentially put lives at risk.

My guesses are:
1) They are paid/created to try and discredit AMD by a party linked to (or themselves) Intel/Nvidia.
2) Attempt at affecting stock prices.
3) Attempt to penis wave their own company in a get rich quick scheme (trying to market themselves) based on the popularity of spectre/meltdown analysis.

The 'why are we doing this'... just really brings points 1 and 2 home in my opinion. I severely doubt you will ever see 'CoreCollapse' from these guys.

 

[humbug]

Or it could have been an older AMD machine and that is only a guess because they say they went out and bought a Ryzen system - but it might have just been they didn't want to use a "production" Ryzen system for testing things potentially able to brick the system.

I say again just because you are able to identify flaws in some hardware doesn't mean that whole system is necessarily vulnerable to them being exploited. Its perfectly possible and the way security researchers normally do it to discover these issues while using some kind of debugging or simulated environment then move to real hardware to validate.

Your whole premise is extremely flimsy and based on reading something the way you want it to read.

They didn't get discredited for bringing up flaws on Ryzen found on AMD systems Roff come off it, they got discredited for the reasons the people discrediting CTS-Labs say they have, for not disclosing the same issues on Intel systems.

 

[Rroff]

The whole thing is just BS anyway. Just look at some of their statements:

What is this site for?
This site is to inform the public about the vulnerabilities and call upon AMD and the security community to fix the vulnerable products.


Why are you doing this?
To bring these issues to public attention, and to warn users and organizations. In particular, we urge the community to pay closer attention to the security of AMD devices before allowing them on mission-critical systems that could potentially put lives at risk.

My guesses are:
1) They are paid/created to try and discredit AMD by a party linked to (or themselves) Intel/Nvidia.
2) Attempt at affecting stock prices.
3) Attempt to penis wave their own company in a get rich quick scheme (trying to market themselves) based on the popularity of spectre/meltdown analysis.

The 'why are we doing this'... just really brings points 1 and 2 home in my opinion. I severely doubt you will ever see 'CoreCollapse' from these guys.

From everything I've read and followed up on - doing a bit of digging into the past of some of the employees (there is plenty to go on via their Linkedin profiles) and having a look at what their previous enterprises have been, etc. I suspect 3 is where it started.

At some point someone has weaponised this in some way against AMD but that is most likely opportunistically done after the fact either by the media they went to trying to make a name for themselves and/or maybe one of the employees acting in bad faith.

They didn't get discredited for bringing up flaws on Ryzen found on AMD systems Roff come off it, they got discredited for the reasons the people discrediting CTS-Labs say they have, for not disclosing the same issues on Intel systems.

I don't think you understand what has happened here. They've loaded up a target ASMedia controller(s) in some kind of debugging environment and peeked/poked memory/registers to see what happens, etc. and identified some weaknesses in mitigation against exploitation - that doesn't mean that automatically every system using that controller is necessarily exposed because of that.

You need to be able to expose those vulnerabilities in some way to then take advantage of them and then once you have compromised the controller then use that to escalate to doing something useful with it. Just having that controller on a system does not satisfy all the requirements to use it in some useful way for malicious purposes.

 

[humbug]

From everything I've read and followed up on - doing a bit of digging into the past of some of the employees (there is plenty to go on via their Linkedin profiles) and having a look at what their previous enterprises have been, etc. I suspect 3 is where it started.

At some point someone has weaponised this in some way against AMD but that is most likely opportunistically done after the fact either by the media they went to trying to make a name for themselves and/or maybe one of the employees acting in bad faith.

I think they are not very bright if they didn't think this would turn round and bite them very hard, i say that because problem solving is only a couple of steps different to foreseeing an outcome based on consequential reaction. it takes actual intelligence to realize the pieces and then put them together.

With that in mind perhaps these people were simply used and abused by someone with a motive and intelligence.

These people will never get to do what they most likely wanted in life, their reputation as professionals is now wrecked.

 

[Rroff]

While doing digging I found this

https://www.magicleap.com/#/home

One of the cooler uses of page scrolling this company acquired a previous venture by one of the employees of CTS Labs apparently.

 

[Rroff]

I think they are not very bright if they didn't think this would turn round and bite them very hard, i say that because problem solving is only a couple of steps different to foreseeing an outcome based on consequential reaction. it takes actual intelligence to realize the pieces and then put them together.

With that in mind perhaps these people were simply used and abused by someone with a motive and intelligence.

These people will never get to do what they most likely wanted in life, their reputation as professionals is now wrecked.

The whole thing is silly in that respect - regardless of ulterior motives or not they've turned what should have been a routine security disclosure mostly handled behind the scenes into destroying their company name (and I'm fairly sure they set out to make a serious company despite the incompetence) and potentially making people less safe in the off chance some state level actor decided to put it into practise say against a bank or something (though pulling that off would be quite a feat) before mitigations were in places.

EDIT: Though even there looks like they are misrepresenting the connection to previous companies by the looks of it - one claiming to be a co-founder at NorthBit but aside from dubious connections, seems to be friends with the actual founders, seems to have at best worked there briefly before probably being fired.

 

[Scougar]

Seeking Alpha calls it an attempt at failed stock market manipulation.

 

[Rroff]

Seeking Alpha calls it an attempt at failed stock market manipulation.

There is certainly an element of that.

Someone needs to do a proper deep dive into the background of the people involved - I've done a bit of digging but the picture changes significantly if you narrow the date range so you aren't getting results from the past 2 years i.e. they claim to have founded companies which appears to be the case at face value but if you go back beyond very recently their names suddenly don't appear in the original announcements about the companies, etc. in some cases with a trail of social media friendship between the people named as the actual founders at the time and that employee at CTS Labs or that they were only an intern at the company for a brief period rather than the senior position they claim they held.

Seems these security issues aren't the only thing they've inflated.

 

[pete910]

While doing digging I found this

https://www.magicleap.com/#/home

One of the cooler uses of page scrolling this company acquired a previous venture by one of the employees of CTS Labs apparently.

OK, I admit, that is kinda cool

 

[Rroff]

OK, I admit, that is kinda cool

Turns out the company they acquired probably wasn't a previous venture by someone at CTS Labs - though they've portrayed themselves as the CEO go back a bit and they worked there briefly and definitely not in a senior position.

EDIT: Hope someone does a proper deep dive on this one as I don't have the time to more than skim the background stuff - there is some really interesting background details that have been skipped over by all but 1-2 people on Reddit.

 

[kitfit1]

Turns out the company they acquired probably wasn't a previous venture by someone at CTS Labs - though they've portrayed themselves as the CEO go back a bit and they worked there briefly and definitely not in a senior position.

EDIT: Hope someone does a proper deep dive on this one as I don't have the time to more than skim the background stuff - there is some really interesting background details that have been skipped over by all but 1-2 people on Reddit.

I'm Guessing Ian did do more than, Just a background skim. It wasn't until David hit Ido Li On with the last question they realized the game was up.
The silence from CTS-Labs has been deafening ever since, even the requests from Ian with extra questions has resulted in no answer.

DK: I think the biggest question that I still have is that ultimately who originated this request for analysis – who was the customer that kicked this all off?

ILO: I definitely am not going to comment on our customers.

DK: What about the flavor of customer: is it a semiconductor company, is it someone in the industry, or is it someone outside the industry? I don’t expect you to disclose the name but the genre seems quite reasonable.

ILO: Guys I’m sorry we’re really going to need to jump off this call but feel free to follow up with any more questions.



[End of Call]



This call took place at 1:30pm ET on 3/14. After the call, we sent a series of 15 questions to CTS-Labs at 6:52pm ET on the same day. As of 7:10pm ET on 3/15, we have not had a response. These questions included elements related to

• The use of a PR firm which is non-standard practice for this (and the PR firm were not involved in any way in our call, which is also odd),
• Viceroy Research, a company known for shorting stock, and their 25-page blowout report published only three hours after the initial announcement,
• And the 2018 SEC listing of the CFO as the President of NineWells Capital, a hedge fund based in New York, that has interests in equity, corporate debt investments, and emphasis on special situations.

There really is nothing more to see here Rroff and humbug. This is a non story and was designed as a scam from start to finish. CTS-Labs has not replied to Ian's questions...........................they can't because the whole thing was designed as a scam from start to finish. That also explains AMD's silence as well, because they know it's a scam as well.

 

[humbug]

^^^^ +1

 

[Rroff]

I'm Guessing Ian did do more than, Just a background skim. It wasn't until David hit Ido Li On with the last question they realized the game was up.
The silence from CTS-Labs has been deafening ever since, even the requests from Ian with extra questions has resulted in no answer.

DK: I think the biggest question that I still have is that ultimately who originated this request for analysis – who was the customer that kicked this all off?

ILO: I definitely am not going to comment on our customers.

DK: What about the flavor of customer: is it a semiconductor company, is it someone in the industry, or is it someone outside the industry? I don’t expect you to disclose the name but the genre seems quite reasonable.

ILO: Guys I’m sorry we’re really going to need to jump off this call but feel free to follow up with any more questions.



[End of Call]



This call took place at 1:30pm ET on 3/14. After the call, we sent a series of 15 questions to CTS-Labs at 6:52pm ET on the same day. As of 7:10pm ET on 3/15, we have not had a response. These questions included elements related to

• The use of a PR firm which is non-standard practice for this (and the PR firm were not involved in any way in our call, which is also odd),
• Viceroy Research, a company known for shorting stock, and their 25-page blowout report published only three hours after the initial announcement,
• And the 2018 SEC listing of the CFO as the President of NineWells Capital, a hedge fund based in New York, that has interests in equity, corporate debt investments, and emphasis on special situations.

There really is nothing more to see here Rroff and humbug. This is a non story and was designed as a scam from start to finish. CTS-Labs has not replied to Ian's questions...........................they can't because the whole thing was designed as a scam from start to finish. That also explains AMD's silence as well, because they know it's a scam as well.

It is more complicated than this.

They are still only skimming the surface - though its more than most sites seem to have dug into it. Considering all the facts I don't think this was a scam from start to finish even though undeniably it has at the very least been appropriated as such at least by Viceroy, at the moment there isn't enough information to connect the CFO other than circumstantially.

CTS Labs had been trying to project a visage of being a successful company that line of questioning was also dangerously close to piercing that and revealing that they might not even have a customer let alone customers as they were trying to make it appear - what that actually means though I could only guess at and that is assuming someone hasn't put them up to it which is still a possibility though if it is the case IMO its been hijacked after the fact to that end rather than designed from the start that way.

You've got a bunch of what appear to be misfits - all with a fairly common past:

-Claimed and at least to some level demonstrated background in computer security.
-Most of them claim to have co-founded a company
-Dig a bit deeper and they claim to have founded company X with person Y or held a senior position at company X but this is where it gets weird as the trail for that stops around 1-2 years ago - person Y seems to be real and one of the original founders but hit up older cached data or filter out newer results and most of these companies appear to have been co-founded by person Y and person Z where person Z is different to the person at CTS Labs and doesn't seem to exist prior or after the company founding and at best if there is any connection to the person at CTS Labs it is as a more junior position.
-The legitimate co-founder Y of these companies has in most cases an active social media presence going back years and in some cases has retweeted or shared the recent news about this but made no attempt to correct the record as to the status of the person from CTS Labs supposedly connected to them - maybe friends or family?
-Vastly inflated previously employment record but some of it checks out at a more junior level - some of it doesn't check out at all.

Then you have this guy connected to NineWells Capital of which there is little real detail - the site has some backend stuff going on though that appears to be linked to real activity (passworded logins, etc.) - maybe a front for something else? the only one that seems to claim a connection to a company that they appear to actually have founded but even that is a bit murky.

Then you have the PR firm - the weird use of the PR firm fits more than one possibility - it might indicate it was orchestrated from the start or it might not, and it doesn't necessarily narrow down what the goal was if it was orchestrated from the start. It also fits if this originally came out of them finding some vulnerabilities, possibly happened across by chance as they don't seem particularly competent, and going off half-cocked thinking they'd hit the big time.

There is too much bumbling around and attempts to backfill information to convince me this was designed as a scam from the start not to mention that these vulnerabilities aren't entirely conjured up from thin air or a proof of concept that was just something made up as being likely maybe sort of - the proof of concept at least checks out even if the ability to do anything useful with it gets shot down by AMD in the long run. They only needed to "link and run" to carry out a scam of the sort people are talking about and zero, less than zero, reason to engage with someone like Anandtech if it was a scam of that nature - at the most a quick PR piece not a long conversation where they at least, if somewhat incompetently, tried to cover technical information.

I don't buy it explaining AMD's silence either - there is no profit in it for AMD staying silent all the while they stay silent it works against them if it is a scam. Problem is AMD have a habit of staying silent when they should be saying something so that makes it even more murky.

 

[kitfit1]

No, No, NO Rroff..

It's just a SCAM....................................................nothing more to see here.................................nothing more to read into this..................................nothing more to disect and make it into something it isn't.................................yopu can look as far back into these scammers as you like....................they are still scammers. Move on , get a life.

 

[Rroff]

No, No, NO Rroff..

It's just a SCAM....................................................nothing more to see here.................................nothing more to read into this..................................nothing more to disect and make it into something it isn't.................................yopu can look as far back into these scammers as you like....................they are still scammers. Move on , get a life.

I wish the information all neatly fell into place in one narration or other - but it doesn't. You might wish it does but it doesn't.

I know an out and out scam when I see one - there is evidence of that all around these forums going back years - but this one doesn't sit neatly with me and I can't help but question the details.

There are certainly aspects of it that are attempts by people to gain financially or smear AMD in some way but it doesn't end there.

Why on earth would they even engage with Anandtech at any length or try and go into any detail if this was purely a scam and if it was purely a scam you can be **** sure the PR company actually would be on that call making sure it was all carefully played.

Why not smear AMD's whole lineup with the ASMedia stuff (other than obviously EPYC which doesn't use the controllers at all) instead of just Ryzen, etc.

EDIT: Seen this point on the Anandtech forums:

Is this perhaps because someone in the Israel government or system is trying to protect Israel jobs?

We know Israel feel betrayed by US after the Iranian nuclear deal.
They will try to protect themselves. They feel more alone than ever.

And that fight is now even more about jobs than military actions. Eg recently Netanyahu met the CEO of Teva a major company with demands he could not cut jobs.

Jobs is national safety.

We know the US used advanced virus and coding to blow up Iranian centrifuges.
We know the Israeli have that knowlege now. We also know the american is angry because the Israel blow the cover by using to agressive code. Didnt help the relationship.

Now one of these CTS guys is former Israel military intelligence agency. This agency certainly have the knowledge about all vulnerabilities eg in chipsets whatnot. And then some.

Now did someone from inside this agency tip these guys with the idea or some basic knowledge? Knowing full well it would go something like the "Viceroy" way. And that the net result would be favorably for Israel jobs via Intel.

The political climate and precedence is certainly there to take such actions.

I mean this is almost full on conspiracy nut level BS but at the same time in a very vague sense it would fit most of the facts better if some former low level analyst was fed just enough data for them to think they'd hit the jackpot knowing roughly how they'd then play it out although I'm not sure that would just be about jobs. It would also explain their conduct on the Anandtech call.

 

[Scougar]

I am more than prepared to accept ANY platform has security flaws if you dig deep enough. This whole thing has just been a poop show. I don't even mind the whole advertising thing tbh... Hell why not!

Just the bizarreness of it all, and such loose "stretching for something, anything" flaws was just dumb and extremely suspicious.

 

[Rroff]

Just the bizarreness of it all

A lot of it just doesn't make sense - someone went to great lengths over some aspects of it, while other bits were simply plagiarised from other web-sites, etc. without even any attempts to disguise the fact.