All we can really do is wait for AMD to say something - hopefully it is an unambiguous statement this time. Anyone else can only really say yes its theoretically possible or shoot it down entirely in flames if its complete nonsense at a technical level - actually putting it into practise to test would require a lot of time and expertise.
-
Competitor rules
Please remember that any mention of competitors, hinting at competitors or offering to provide details of competitors will result in an account suspension. The full rules can be found under the 'Terms and Rules' link in the bottom right corner of your screen. Just don't mention competitors in any way, shape or form and you'll be OK.
Dubious Research Discovers Ryzen vulnerabilites
- Thread starter jwilliamson47
- Start date
All we can really do is wait for AMD to say something - hopefully it is an unambiguous statement this time. Anyone else can only really say yes its theoretically possible or shoot it down entirely in flames if its complete nonsense at a technical level - actually putting it into practise to test would require a lot of time and expertise.
Soldato
https://twitter.com/dguido/status/973629551606681600
On or off the payroll, it would seem from these comments that the exploit code is very much real. It simply wasn't exposed in the white paper.
Honestly, I very much believe that Intel has a big hand in this, personally. Whether the exploits are a reason to be alarmed or not. That said, to put a blunter point on it - screw all of them. They're all as bad as each other. AMD twist their own knives (instigating stories regarding GPP). Technology progresses, but these companies never change.
If this is real https://twitter.com/c7zero/status/973668833092288513 we are only one step away (hopefully not possible) from a pretty serious exploit being possible remotely via the ARM Coretex used for the secure engine - see buffer overrun disclosure and patch around a month ago.
Soldato
Well he was paid $16000 for some work,so OFC he was going to defend it to the end and it turns out Viceroy research said someone randomly sent the article to them,and and journalists were informed before AMD of the problem.
It makes me wonder,how many similar Intel vulnerabilities,Intel might have not patched quietly if given less than 24 hours before the disclosure.
Intel had 6 months to sort their issue out,not less than 24 hours.
Edit!!
Plus for those trying to downplay their crap - remember what if Intel or Nvidia have similar issues in the future,and some startup gives them less than 24 hours to look at them,whilst paying people and alerting the media yonks before,to try and screw over the stock price.
Maybe it is - but it also says ex-Intel employee too,and their ex-chief engineer still moans at AMD even if he does not work for Intel anymore.
Better to wait and see what the consensus is,and also for AMD to actually properly look at things.
Last edited:
Soldato
So all this is just nonsense or there is some truth to it?
Soldato
Some continue to page 6 also, but the AMD haters are known on this forum.
Ignore them.
How about it being entirely possible but grossly exaggerated for maximum smear effect.
The requirements to do something bad in all of these situations are farcical and yet it's being picked up and run with because clickbait.
Someone is physically at your computer and has admin access. Everyone with a brain knows you're screwed right there but this is the starting point for the claims that something bad can be done.
You'd have to wait a decent amount of time for AMD to look at what they've been given and reply.
But my money is on grains of truth greatly distorted.
Soldato
"legitimate conerns"
I must admit when I saw the news my first thought was 'this is all Intel's doing' but after watching his video on YT it's more a case of someone trying manipulate the AMD stock position (it wouldn't surprise me if this Yaron Luk-Zilberman was a part of Viceroy as well which is an anonymous group, Yaron is also president of Ninewells Captial Management).
For a home user yes - this starts to become another matter though in a multi-user, mixed privileges environment as these exploits won't be picked up on by normal security audits and can survive normal wipes of the system and a bit of a wildcard but might be possible to exploit remotely inside some networked environments.
Caporegime
Caporegime
"legitimate conerns"
Bloody hell, you know, this is an example of why i don't like Gamers Nexus, on the one hand they say these exploits are hyperbole and fake because what they are doing is hacking into the machiene locally, which would effect any computer with any vendors chip inside it but then 5 minutes later contradict that and say the finding are not invalid and its of serious concern.
I mean for #### sake its like they can't do anything other than call it out because you know its so obviously anything other than utter none sense and an unjustified attack on AMD but at the same time actually want to remind the reader 'there is no smoke without fire'
Its like when he reviewed Threadripper, stood there laughing at AMD for making a 16 core CPU telling his viewers "that many cores are pointless because of CUDA" he's also one of these people who perpetuated the myth that "you don't use more than 4 cores for gaming".
He's a prat.
Soldato
- Joined
- 19 Feb 2011
- Posts
- 5,849
Id be more worried about this type of attack as a home user rather than a corporate entity, i know for ourselves, not only is there many physical layers of security that need bypassing to get near our servers, but then the virtual layers and sheer amount of monitoring on the network etc that happens, it would be near on impossible to pull this off without one of us knowing what was happening
It isn't (initially) so much the servers I'd be worried about - someone with low level clearance say manages to get this run on say a reception PC which allows them to acquire a supervisor password, which gets them into another system, repeat. Obviously there is a potential for the activity to be detected in doing so running software, etc. but the actual exploit itself once in place won't be picked up by normal security and will survive normal wiping of a system.
I'm not convinced in this argument... Perhaps I am missing something but to get it to run would you not need a bit more than "low level clearance" as you put it. Effectively the only way this is working is if you have local admin rights over a machine. So you need that receptionist to be logged in on an account that has local admin and you need to leave it while some random stranger sits at your reception desk and deploys an exploit. Is this effectively what we are saying?
Caporegime
You need to modify the BIOS, you can't do that remotely namely because the compute is off, this is madness the only way you can replicate what they did is to do what they did, modify a BIOS in such a way that it disables the CPU's security features, i mean good grief at this point why not just pick the computer up and walk out with it and take the data you want off the drive when you get it home.
If anything, if you were to assume these people spent the last 6 months trying to hack into Ryzen's security and this is what you resorted to it just proves Ryzen is infact very secure and validates AMD's claim that you would have to be physically at the target machine, i don't think Intel are behind this but i do think Intel have spent vast amounts of money on real security firms trying to hack into AMD's CPU's and obviously failed.
Unless you are running something Linux based, etc. I'm yet to find a Windows system where it isn't possible to bypass local admin rights via one of various exploits - depending on the setup this may or may not be flagged in system logs.
Soldato
Outside the whole way this was leaked to the world,the fact that Viceroy research received the info before AMD,etc,why does this company need to employ a media company which does the following:
Right reporters and bloggers?? Influencers?? Why would you need to control the message to the media if the message has nothing to hide??
Surely if what you done is up to scratch the results will defend themselves. I mean in many cases,companies will pay people if you find an issue in their software or hardware too,and companies might even contract you for some services.
Right reporters and bloggers?? Influencers?? Why would you need to control the message to the media if the message has nothing to hide??
Surely if what you done is up to scratch the results will defend themselves. I mean in many cases,companies will pay people if you find an issue in their software or hardware too,and companies might even contract you for some services.
Soldato
Hang on. This has cropped up now because they want to steal Ryzen 2's thunder right?
So what your effectively saying is that not only do you need all these rights but you must rely on software exploits within windows to gain these rights? I would love for you to come to my office and bypass our domain security, gain local admin rights over a workstation and deploy exploits undetected. In fact I think I would pay good money to watch you try.