Dubious Research Discovers Ryzen vulnerabilites

[Mercutio]

We've been reading your one sided nonsense for days. No-ones seeing this anything like as blinkered as you are.

If you had some self moderation and middle ground, folks would be happier to hear the rest. It's quite clear you're of the same mindset as these parasites in CTS.

 

[Rroff]

We've been reading your one sided nonsense for days. No-ones seeing this anything like as blinkered as you are.

If you had some self moderation and middle ground, folks would be happier to hear the rest. It's quite clear you're of the same mindset as these parasites in CTS.

Nothing I'm talking about is nonsense. Only some people's failure to understand a broader technical perspective.

People still seem to think for instance that just having these controllers on a board = automatically vulnerable - it isn't true not even remotely.

 

[Panos]

Not entirely true - gaining admin access to the OS does not necessarily allow you to work around hardware mitigations against exploitation - due to the Zen architecture that was made possible.

On other systems using those same controllers you very well might actually need physical access to the machine to be able to exploit that 3rd party hardware.

IT DOESN'T AFFECT ZEN DUDE.

(someone had to write this because your crusade slandering AMD in this very forum hit the damn ceiling)

 

[CAT-THE-FIFTH]

https://www.bloomberg.com/news/arti...-vulnerability-says-report-exaggerated-danger

"Company asking for investigation of unusual stock trading" - I wonder if AMD wants to find who commissioned all of this??

 

[Rroff]

IT DOESN'T AFFECT ZEN DUDE.

(someone had to write this because your crusade slandering AMD in this very forum hit the damn ceiling)

You are misunderstanding (the mention of not Zen near the start is referencing a couple of earlier exploits including the google one that have already been disclosed and fixed) - Zen facilitates the exploitation of problems in 3rd party hardware THIS IS FACTUAL - AMD are of course deflecting from Zen itself but its problems related to Zen that allow you to impose yourself in the boot loader to then take over control of the secure processor for instance but then also do something useful with it once you have control of it - just taking control of it isn't enough on its own (although that is pretty bad).

Admin access isn't the barrier for entry people think it is either - WannaCry and many other malware require admin access - while using EternalBlue to tunnel within infected networked machines it then managed to install itself as a service via the dropper - these vulnerabilities facilitate features that your average software rootkit doesn't for instance the fact that it can overtake multiple areas of software and hardware once on a system means it can use circular reinforcing to maintain its grip on a system despite attempts to remove it - as quickly as you remove it from one area other areas reinfect it. Plus it has better ability to avoid detection making it far more useful, albeit taking a lot of resources, than most known software malware.

 

[Panos]

You are misunderstanding - Zen facilitates the exploitation of problems in 3rd party hardware THIS IS FACTUAL - AMD are of course deflecting from Zen itself but its problems related to Zen that allow you to impose yourself in the boot loader to then take over control of the secure processor for instance but then also do something useful with it once you have control of it - just taking control of it isn't enough on its own (although that is pretty bad).

Admin access isn't the barrier for entry people think it is either - WannaCry and many other malware require admin access - while using EternalBlue to tunnel within infected networked machines it then managed to install itself as a service via the dropper - these vulnerabilities facilitate features that your average software rootkit doesn't for instance the fact that it can overtake multiple areas of software and hardware once on a system means it can use circular reinforcing to maintain its grip on a system despite attempts to remove it - as quickly as you remove it from one area other areas reinfect it. Plus it has better ability to avoid detection making it far more useful, albeit taking a lot of resources, than most known software malware.

Rroff your drivel against AMD in this very thread is so much that, I will follow the majority and add you to the ignore list.
I feel this discussion is ending up like the Brexit discussion lately.

 

[Rroff]

Rroff your drivel against AMD in this very thread is so much that, I will follow the majority and add you to the ignore list.
I feel this discussion is ending up like the Brexit discussion lately.

No offence but you were the one still banging on about physical access long after it was shown that physical access is not required.

If you see the detailed AMD table of the issue, all the "vulnerabilities" require physical administrator access to the machine, some of them to the bios!!
And couple go even further. It require direct hardware access....

Aside from needing elevated privileges none of that is true yet you accuse me of drivel - you don't need BIOS access as in sitting there changing settings - you can commit a new compromised BIOS from the Windows desktop remotely once you've made use of a first stage attack to gain access to the desktop. That it is a second stage attack doesn't mean it is insignificant though it does diminish it from the kind of threat level CTS Labs were initially trying to portray it as - attempting by association to make it look like something of the level of Meltdown. Most crypto malware for instance are second stage using another stage for remote intrusion/worming and compromising OS security to drop the malware.

(The biggest barrier here is that you need to create customised software that in some cases will need a library of customised firmware versions for different hardware which means that most of these vulnerabilities are beyond the reach of all but state level actors, etc. to actually put into practise - but that doesn't mean they aren't serious and that those kind of players won't try to use them if the pay off is big enough).

There are unfortunately a few people talking drivel in this thread but it certainly isn't me (while I'm far from an expert in the field and pretty rusty these days at putting any of it into practise I think the WannaCry thread shows that I have above average understanding of these kind of security issues).

EDIT: It is also sad that aside from a couple of people like Vince and Humbug (albeit he is mostly parroting from information elsewhere which has been skewed in defence of AMD) few are debating from a technical perspective and mostly just parroting the headline keywords with very little interpretation of what is and isn't possible from the details.

Or you can just stick your hands over your ears and ignore me rather than engage in a debate of the technical details as to why I'm talking "drivel".

When you want to do something bad to the machine, having already administrator access to it, you dont faffle around trying to bother with CPU internals or the firmware, you do your job......

This will highly depend on what you are trying to accomplish - for some tasks there are plenty of off the shelf malware or even just directly fiddling with the OS such as configuring a proxy server - if you are trying to use that initial intrusion to gain a deeper foothold into a network then the game changes again and exploits like this are a much bigger deal.

 

[humbug]

Not physical - all require elevated privileges but that can be done remotely in combination with another exploit.

Having admin access isn't always enough - in a reasonably secure network for instance the vast bulk of software rootkits and the like are unlikely to be able to evade security protocols and have any chance of staying persistent to say sniff the credentials of someone later logging in with higher network privileges, etc. allowing elevation of access to company data and the likes - these issues ostensibly allow that though it seems require a level of resources you won't see from your average hacking group.

Its the same for Intel and has been for many years, so how is this anything new?

BTW what are Intel doing about this?

 

[Rroff]

Its the same for Intel and has been for many years, so how is this anything new?

BTW what are Intel doing about this?

Who said anything about it being new?

There are specific twists to this one though that you can't just pick up and transpose to other instances that people keep overlooking.

While it isn't a perfect analogy there are aspects of this that are like having an engine that is known to blow up above 60mph used in vehicles that physically can't exceed 60mph until someone does put it in a vehicle capable of exceeding 60mph - that doesn't mean the other vehicles are susceptible to blowing up.

 

[humbug]

Who said anything about it being new?

There are specific twists to this one though that you can't just pick up and transpose to other instances that people keep overlooking.

You're behaving as if this is something new and specific to AMD.

Of course it isn't, you can exploit an Intel system to the same extent, its why these idiots have been discredited, they took an exploit true for both AMD and Intel and targeted AMD specifically with it in order to profit from any INTENDED adverse effect that might have on AMD's stock price.

Do you intend to buy shares in AMD? are prices just a little too high at the moment to guarantee you a profit in the next quarter?

Given CTS-Labs intent i have to ask.

 

[Rroff]

You're behaving as if this is something new and specific to AMD.

Of course it isn't, you can exploit an Intel system to the same extent, its why these idiots have been discredited, they took an exploit true for both AMD and Intel and targeted AMD specifically with it in order to profit from any INTENDED adverse effect that might have on AMD's stock price.

Do you intend to buy shares in AMD? are prices just a little too high at the moment to guarantee you a profit in the next quarter?

Only you can't - Intel uses a different setup for its secure processor that isn't (currently) vulnerable to imposing into its boot sequence and you can't just transpose the current attack against AMD into it.

Similar/same controllers that have known security issues are used elsewhere but as I said above just having them present doesn't satisfy the requirements (this is a misunderstanding on your part) of (A) being able to get to those problems (B) using them to take control of the controller (C) using that compromised controller to manipulate the main system and again you can't just make some slight adjustments to the approach possible against Zen because of the way it uses these controllers to carry out the same thing against other implementations of these controllers and that includes Intel and older AMD chipsets (none the least they've been used this way for decades so if it was possible it is unlikely they've have survived this long without being exploited).

 

[humbug]

Only you can't - Intel uses a different setup for its secure processor that isn't (currently) vulnerable to imposing into its boot sequence and you can't just transpose the current attack against AMD into it.

Similar/same controllers that have known security issues are used elsewhere but as I said above just having them present doesn't satisfy the requirements (this is a misunderstanding on your part) of (A) being able to get to those problems (B) using them to take control of the controller (C) using that compromised controller to manipulate the main system and again you can't just make some slight adjustments to the approach possible against Zen because of the way it uses these controllers to carry out the same thing against other implementations of these controllers and that includes Intel and older AMD chipsets (none the least they've been used this way for decades so if it was possible it is unlikely they've have survived this long without being exploited).

You're describing rout kits, they have been around for both Intel and AMD for years, you're ranting on in some deluded fashion that using BIOS hacks to take control of the Chip Controller doesn't take control if its an Intel system, people have been doing for years, Roff.

 

[Rroff]

You're describing rout kits, they have been around for both Intel and AMD for years, you're ranting on in some deluded fashion that using BIOS hacks to take control of the Chip Controller doesn't take control if its an Intel system, people have been doing for years, Roff.

Rootkits generally are at the software level replacing system files, firmware level ones are much much rarer. Infact aside from the supposed NSA HDD one the only significant ones have been very recent discoveries.

There is this that is generally similar https://www.scmagazineuk.com/intel-...alware-updates-detection-tool/article/643799/ but AFAIK it doesn't have a way to compromise the secure processor itself. It could be used in some of the ways I've talked about in this thread.

This is a generally emerging area as it is much easier to exploit these days than in days gone by and increasingly things like IoT devices are being targetted to hide malware away in their firmware as it is harder to detect and people less often expect it - using that to re-emerge at a later date or avoid detection until some trigger condition.

 

[CAT-THE-FIFTH]

This is what this thread has now descended to:

https://www.youtube.com/watch?v=6lHgbbM9pu4

 

[humbug]

lol ^^^^

Rootkits generally are at the software level replacing system files, firmware level ones are much much rarer. Infact aside from the supposed NSA HDD one the only significant ones have been very recent discoveries.

There is this that is generally similar https://www.scmagazineuk.com/intel-...alware-updates-detection-tool/article/643799/ but AFAIK it doesn't have a way to compromise the secure processor itself. It could be used in some of the ways I've talked about in this thread.

This is a generally emerging area as it is much easier to exploit these days than in days gone by and increasingly things like IoT devices are being targetted to hide malware away in their firmware as it is harder to detect and people less often expect it - using that to re-emerge at a later date or avoid detection until some trigger condition.

At last.

Thanks to Wikileaks, eh?

Scanning the system after having been hacked is a response but its not ideal, stopping it happening in the first place would be better.

 

[Rroff]

At last.

Thanks to Wikileaks, eh?

Scanning the system after having been hacked is a response but its not ideal, stopping it happening in the first place would be better.

Sorry my bad didn't realise this was "Intel are just as bad a AMD thread" - I'm perfectly happy to play that game - I've been constantly critical of the Intel AMT implementation and possibilities to exploit it - that doesn't mean these issues should be downplayed or that there is nothing to them or that these issues have a direct equivalence or are possible to simply transpose to Intel.

 

[humbug]

Sorry my bad didn't realise this was "Intel are just as bad a AMD thread" - I'm perfectly happy to play that game - I've been constantly critical of the Intel AMT implementation and possibilities to exploit it - that doesn't mean these issues should be downplayed or that there is nothing to them or that these issues have a direct equivalence or are possible to simply transpose to Intel.

The point is CTS-Labs deliberately ignored this on Intel to target AMD, you have spent the entire thread trying to legitimise them and more importantly that.

 

[Rroff]

The point is CTS-Labs deliberately ignored this on Intel to target AMD, you have spent the entire thread trying to legitimise them and more importantly that.

As I said there is a reason for that - on the Intel side similar types of issues have already been disclosed or aren't possible to simply transpose these issues - the way the ASMedia controllers are used in Zen made it "easy" for them - there isn't any known way to transpose that knowledge to do anything useful on the Intel side currently and likewise the way of exploiting the secure processor on Zen couldn't be transposed to compromise an Intel system.

I don't think you are understanding the nature of these issues beyond the very general description.

Even older AMD chipsets you can't just make a few changes and use the way of exploiting these 3rd party modules on them - which is why I suspect that someone had appropriated and weaponised this knowledge rather than being the original intention of it - if you wanted to smear AMD for maximum effect and if it was so simple that the same issue could be utilised as effectively on other systems why not go for AMD's entire line up? that would be far more sensational than just Zen as they are widely used in the industry still and Piledriver CPUs, etc. are still on sale.

 

[humbug]

As I said there is a reason for that - on the Intel side similar types of issues have already been disclosed or aren't possible to simply transpose these issues - the way the ASMedia controllers are used in Zen made it "easy" for them - there isn't any known way to transpose that knowledge to do anything useful on the Intel side currently and likewise the way of exploiting the secure processor on Zen couldn't be transposed to compromise an Intel system.

I don't think you are understanding the nature of these issues beyond the very general description.

Even older AMD chipsets you can't just make a few changes and use the way of exploiting these 3rd party modules possible on them.

You're still toeing the debunked CTS-Labs line, For the 5'th time the firm CTS-Labs idiotically hired discredited them because they claimed the ASMedia Chip-Set provided easy access to the on socket controller, this firm concluded its likely the issue was first discovered on the ASMedia Chip-Set on the Intel system and then tested for on the AMD system because... well they use the same Chip-Set.

 

[Rroff]

this firm concluded its likely the issue was first discovered on the ASMedia Chip-Set on the Intel system and then tested for on the AMD system because... well they use the same Chip-Set.

The firm hired did not conclude it was discovered on an Intel system - that was an assumption by the author of an article covering the deeper dive into it by Dan. It is a huge misunderstanding on your part anyhow that the discovery of a vulnerability on one system means that system is susceptible to it in any way - you can analyse and find a problem with an engine in one car that isn't affected by it for instance but the way the engine is used in another car does fall foul of the problem.

Just because you might be able to load up a controller in debug mode on an Intel system for instance and peek/poke its operation in flight to see what happens and in doing so identify ways that it might be flawed mean that the system itself in that particular instance is vulnerable to that flaw being used against it.

I say again if it was that trivial its unlikely they wouldn't have used that against AMD's entire line up as that would make for an even more sensational claim.