Dubious Research Discovers Ryzen vulnerabilites

[Rroff]

Well that in itself isn't surprising, a lot of security experts come from a less than an unimpeachable background. In all honesty that's the least dubious thing about the entire affair. It's the exploits themselves which people should be focusing on.

All we can really do is wait for AMD to say something - hopefully it is an unambiguous statement this time. Anyone else can only really say yes its theoretically possible or shoot it down entirely in flames if its complete nonsense at a technical level - actually putting it into practise to test would require a lot of time and expertise.

 

[Silent_Scone]

All we can really do is wait for AMD to say something - hopefully it is an unambiguous statement this time. Anyone else can only really say yes its theoretically possible or shoot it down entirely in flames if its complete nonsense at a technical level - actually putting it into practise to test would require a lot of time and expertise.

https://twitter.com/dguido/status/973629551606681600

On or off the payroll, it would seem from these comments that the exploit code is very much real. It simply wasn't exposed in the white paper.

Honestly, I very much believe that Intel has a big hand in this, personally. Whether the exploits are a reason to be alarmed or not. That said, to put a blunter point on it - screw all of them. They're all as bad as each other. AMD twist their own knives (instigating stories regarding GPP). Technology progresses, but these companies never change.

 

[Rroff]

https://twitter.com/dguido/status/973629551606681600

On or off the payroll, it would seem from these comments that the exploit code is very much real. It simply wasn't exposed in the white paper.

Honestly, I very much believe that Intel has a big hand in this, personally. Whether the exploits are a reason to be alarmed or not. That said, to put a blunter point on it - screw all of them. They're all as bad as each other. AMD twist their own knives (instigating stories regarding GPP). Technology progresses, but these companies never change.

If this is real https://twitter.com/c7zero/status/973668833092288513 we are only one step away (hopefully not possible) from a pretty serious exploit being possible remotely via the ARM Coretex used for the secure engine - see buffer overrun disclosure and patch around a month ago.

 

[CAT-THE-FIFTH]

https://twitter.com/dguido/status/973629551606681600

On or off the payroll, it would seem from these comments that the exploit code is very much real. It simply wasn't exposed in the white paper.

Honestly, I very much believe that Intel has a big hand in this, personally. Whether the exploits are a reason to be alarmed or not. That said, to put a blunter point on it - screw all of them. They're all as bad as each other. AMD twist their own knives (instigating stories regarding GPP). Technology progresses, but these companies never change.

Well he was paid $16000 for some work,so OFC he was going to defend it to the end and it turns out Viceroy research said someone randomly sent the article to them,and and journalists were informed before AMD of the problem.

It makes me wonder,how many similar Intel vulnerabilities,Intel might have not patched quietly if given less than 24 hours before the disclosure.

Intel had 6 months to sort their issue out,not less than 24 hours.

Edit!!

Plus for those trying to downplay their crap - remember what if Intel or Nvidia have similar issues in the future,and some startup gives them less than 24 hours to look at them,whilst paying people and alerting the media yonks before,to try and screw over the stock price.

If this is real https://twitter.com/c7zero/status/973668833092288513 we are only one step away (hopefully not possible) from a pretty serious exploit being possible remotely via the ARM Coretex used for the secure engine - see buffer overrun disclosure and patch around a month ago.

Maybe it is - but it also says ex-Intel employee too,and their ex-chief engineer still moans at AMD even if he does not work for Intel anymore.

Better to wait and see what the consensus is,and also for AMD to actually properly look at things.

 

[opethdisciple]

So all this is just nonsense or there is some truth to it?

 

[Panos]

Pff, first page of this thread are a handful of replies falling for the face value that its bad news for AMD and that's all they needed or wanted to hear.

Some continue to page 6 also, but the AMD haters are known on this forum.
Ignore them.

 

[Hotwired]

All we can really do is wait for AMD to say something - hopefully it is an unambiguous statement this time. Anyone else can only really say yes its theoretically possible or shoot it down entirely in flames if its complete nonsense at a technical level - actually putting it into practise to test would require a lot of time and expertise.

How about it being entirely possible but grossly exaggerated for maximum smear effect.

"no, it's not even the 24 hours. I dislike the "give vendors all the time in the world" model of security disclosure enough that I very much understand why some people then give them no time at all.
You can be corrupt by being too chummy with vendors too.
It's the advisory itself that is garbage, and the attention whoring about it. And how it's lapped up.
When was the last time you saw a security advisory that was basically "if you replace the BIOS or the CPU microcode with an evil version, you might have a security problem"? Yeah.
No, the real problem is the mindless parroting of the security advisory (it's "Top Story" on at least one tech news site right now), because security is so much more important than anything else, and you can never question it.
Security people need to understand that they look like clowns because of it. The whole security industry needs to just admit that they have a lot of **** going on, and they should use - and encourage - some critical thinking."

The requirements to do something bad in all of these situations are farcical and yet it's being picked up and run with because clickbait.

Someone is physically at your computer and has admin access. Everyone with a brain knows you're screwed right there but this is the starting point for the claims that something bad can be done.

So all this is just nonsense or there is some truth to it?

You'd have to wait a decent amount of time for AMD to look at what they've been given and reply.

But my money is on grains of truth greatly distorted.

 

[Freddie1980]

"legitimate conerns"

I must admit when I saw the news my first thought was 'this is all Intel's doing' but after watching his video on YT it's more a case of someone trying manipulate the AMD stock position (it wouldn't surprise me if this Yaron Luk-Zilberman was a part of Viceroy as well which is an anonymous group, Yaron is also president of Ninewells Captial Management).

 

[jigger]

I can't see this coming from Intel considering Intel and AMD are partnered up. Seems more Nvidia style, especially looking at the commenters.

 

[Rroff]

The requirements to do something bad in all of these situations are farcical and yet it's being picked up and run with because clickbait.

Someone is physically at your computer and has admin access. Everyone with a brain knows you're screwed right there but this is the starting point for the claims that something bad can be done.

For a home user yes - this starts to become another matter though in a multi-user, mixed privileges environment as these exploits won't be picked up on by normal security audits and can survive normal wipes of the system and a bit of a wildcard but might be possible to exploit remotely inside some networked environments.

 

[LoadsaMoney]

https://wccftech.com/low-down-amd-security-exploit-saga-cts-labs/

 

[humbug]

"legitimate conerns"

Bloody hell, you know, this is an example of why i don't like Gamers Nexus, on the one hand they say these exploits are hyperbole and fake because what they are doing is hacking into the machiene locally, which would effect any computer with any vendors chip inside it but then 5 minutes later contradict that and say the finding are not invalid and its of serious concern.

I mean for #### sake its like they can't do anything other than call it out because you know its so obviously anything other than utter none sense and an unjustified attack on AMD but at the same time actually want to remind the reader 'there is no smoke without fire'

Its like when he reviewed Threadripper, stood there laughing at AMD for making a 16 core CPU telling his viewers "that many cores are pointless because of CUDA" he's also one of these people who perpetuated the myth that "you don't use more than 4 cores for gaming".

He's a prat.

 

[SiDeards73]

For a home user yes - this starts to become another matter though in a multi-user, mixed privileges environment as these exploits won't be picked up on by normal security audits and can survive normal wipes of the system and a bit of a wildcard but might be possible to exploit remotely inside some networked environments.

Id be more worried about this type of attack as a home user rather than a corporate entity, i know for ourselves, not only is there many physical layers of security that need bypassing to get near our servers, but then the virtual layers and sheer amount of monitoring on the network etc that happens, it would be near on impossible to pull this off without one of us knowing what was happening

 

[Rroff]

Id be more worried about this type of attack as a home user rather than a corporate entity, i know for ourselves, not only is there many physical layers of security that need bypassing to get near our servers, but then the virtual layers and sheer amount of monitoring on the network etc that happens, it would be near on impossible to pull this off without one of us knowing what was happening

It isn't (initially) so much the servers I'd be worried about - someone with low level clearance say manages to get this run on say a reception PC which allows them to acquire a supervisor password, which gets them into another system, repeat. Obviously there is a potential for the activity to be detected in doing so running software, etc. but the actual exploit itself once in place won't be picked up by normal security and will survive normal wiping of a system.

 

[Vince]

It isn't (initially) so much the servers I'd be worried about - someone with low level clearance say manages to get this run on say a reception PC which allows them to acquire a supervisor password, which gets them into another system, repeat. Obviously there is a potential for the activity to be detected in doing so running software, etc. but the actual exploit itself once in place won't be picked up by normal security and will survive normal wiping of a system.

I'm not convinced in this argument... Perhaps I am missing something but to get it to run would you not need a bit more than "low level clearance" as you put it. Effectively the only way this is working is if you have local admin rights over a machine. So you need that receptionist to be logged in on an account that has local admin and you need to leave it while some random stranger sits at your reception desk and deploys an exploit. Is this effectively what we are saying?

 

[humbug]

For a home user yes - this starts to become another matter though in a multi-user, mixed privileges environment as these exploits won't be picked up on by normal security audits and can survive normal wipes of the system and a bit of a wildcard but might be possible to exploit remotely inside some networked environments.

You need to modify the BIOS, you can't do that remotely namely because the compute is off, this is madness the only way you can replicate what they did is to do what they did, modify a BIOS in such a way that it disables the CPU's security features, i mean good grief at this point why not just pick the computer up and walk out with it and take the data you want off the drive when you get it home.

If anything, if you were to assume these people spent the last 6 months trying to hack into Ryzen's security and this is what you resorted to it just proves Ryzen is infact very secure and validates AMD's claim that you would have to be physically at the target machine, i don't think Intel are behind this but i do think Intel have spent vast amounts of money on real security firms trying to hack into AMD's CPU's and obviously failed.

 

[Rroff]

I'm not convinced in this argument... Perhaps I am missing something but to get it to run would you not need a bit more than "low level clearance" as you put it. Effectively the only way this is working is if you have local admin rights over a machine. So you need that receptionist to be logged in on an account that has local admin and you need to leave it while some random stranger sits at your reception desk and deploys and exploit. Is this effectively what we are saying?

Unless you are running something Linux based, etc. I'm yet to find a Windows system where it isn't possible to bypass local admin rights via one of various exploits - depending on the setup this may or may not be flagged in system logs.

 

[CAT-THE-FIFTH]

Outside the whole way this was leaked to the world,the fact that Viceroy research received the info before AMD,etc,why does this company need to employ a media company which does the following:

We specialize in a variety of communications areas. Our team of influencers will help you develop a customized communications plan that is uniquely designed to drive success for your business.

We are known for our extensive media relationships and network. Let us connect you with the right reporters, bloggers, analysts and influencers who will understand your business and share your perspective with the markets.

Right reporters and bloggers?? Influencers?? Why would you need to control the message to the media if the message has nothing to hide??

Surely if what you done is up to scratch the results will defend themselves. I mean in many cases,companies will pay people if you find an issue in their software or hardware too,and companies might even contract you for some services.

 

[opethdisciple]

Hang on. This has cropped up now because they want to steal Ryzen 2's thunder right?

 

[Vince]

Unless you are running something Linux based, etc. I'm yet to find a Windows system where it isn't possible to bypass local admin rights via one of various exploits - depending on the setup this may or may not be flagged in system logs.

So what your effectively saying is that not only do you need all these rights but you must rely on software exploits within windows to gain these rights? I would love for you to come to my office and bypass our domain security, gain local admin rights over a workstation and deploy exploits undetected. In fact I think I would pay good money to watch you try.