Dubious Research Discovers Ryzen vulnerabilites

[Hotwired]

No - something detailing a bit more about their position, what if any action end users can take to mitigate or that they can't recommend such at this time and something a bit more regular in the way of updates even if it is just a very general sense and so on.

The first thing most people are going to want to know is "Am I exposed?" and look to an official source for "reliable" information.

At the moment everything is being dominated by hype and hysteria and it isn't doing AMD's position any good at all - silence in these cases never does anything but hurt a company.

Why are you ignoring the timescale.

It's actually ludicrous to give a company a list of claims then immediately publish the claims with the note that you mentioned it yesterday to AMD.

For an official source to give reliable information to the public time is necessary.

There's more milage in talking about this being backed by people that openly say they short shares in the companies they talk about than demanding AMD give a solid reply after a days notice.

The claims themselves are openly deried because of the massive security failures required to even perform them. This is before AMD even works through what they were given.

 

[Rroff]

Why are you ignoring the timescale.

It's actually ludicrous to give a company a list of claims then immediately publish the claims with the note that you mentioned it yesterday to AMD.

For an official source to give reliable information to the public time is necessary.

There's more milage in talking about this being backed by people that openly say they short shares in the companies they talk about than demanding AMD give a solid reply after a days notice.

The claims themselves are openly deried because of the massive security failures required to even perform them. This is before AMD even works through what they were given.

I'm not ignoring the timescale - sure some of it they can only give preliminaries or that they don't know or whatever but we don't really know what they do and don't know and some things they should be able to advise such as temporarily turning off feature X or whatever as a possible mitigation just in case - they need to be dealing with their customers directly not leaving them to try and make the best they can of 3rd party sites that may or may not have the best interests of AMD's customers in mind.

Something of this scale they should have people tasked with dealing with it on an ongoing basis who are actually interacting with AMD customers even if it is limited what they can do and say at the moment.

 

[TrixP10]

Not really - it far simplifies once you've got it in place over stuff like swapping out HDDs - though it would be similar in nature to taking the HDD out, embedding a custom firmware with something like the NSA firmware hack that takes over the OS system files even after a clean wipe and replacing it.

It gives a possible escalation angle that is less easy to discover or protect against than your typical rootkit, etc.



You probably wouldn't want to bet against me - its not something I'm particularly upto speed with these days - none the less because of the legal angle - but it is within my skill set given enough time.



Reminds me of one place I worked - they had a decently secure network - but a corporate screensaver that ran on all machines that was a nasty hacked up outsourced job (IIRC it even used Macromedia runtimes internally which were pretty insecure as well) that was possible to exploit a buffer overrun to execute code via settings in its config file which was writeable due a mixture of the way Windows permissions worked in the transition to Vista/7 versus older OSes and the shoddy way it was produced.

OK, but if someone loosens the wheels nuts on their car it isn't the company who made the engines fault if the wheel comes off.

FFS AMD is not responsible if the machine is tampered with. Meltdown on the other hand . . . . . . . .

 

[Killer7xx]

CTS-Labs response to all of this:

http://www.tomshardware.com/news/cts-labs-amd-ryzenfall-ryzen-epyc,36660.html

"CTS Labs told us that it bucked the industry-standard 90-day response time because, after it discussed the vulnerabilities with manufacturers and other security experts, it came to believe that AMD wouldn't be able to fix the problems for "many, many months, or even a year." Instead of waiting a full year to reveal these vulnerabilities, CTS Labs decided to inform the public of its discovery."

Literally wtf. So they thought AMD couldn't fix it in a couple of months but they decided to tell the public instead without even contacting AMD and getting a response first?

No legitimate business does that in computer security. No one. If you find a vulnerability you go to the manufacturer, name your price, make a NDA with a deadline and then release the vulnerability details after the deadline.

Just shows how much of a fraud those CTS guys are. If the vulnerabilities were truly as bad as they make out, they could have made millions from AMD but instead they went to "industry experts" and didn't get a penny.

 

[drunkenmaster]

I'm not ignoring the timescale - sure some of it they can only give preliminaries or that they don't know or whatever but we don't really know what they do and don't know and some things they should be able to advise such as temporarily turning off feature X or whatever as a possible mitigation just in case - they need to be dealing with their customers directly not leaving them to try and make the best they can of 3rd party sites that may or may not have the best interests of AMD's customers in mind.

Something of this scale they should have people tasked with dealing with it on an ongoing basis who are actually interacting with AMD customers even if it is limited what they can do and say at the moment.

Right, I remember how Intel released information to help mitigate attacks in June 2017..... oh wait.

You're talking completely and utter nonsense and it's becoming more and more frequent. You take the alternate side of every argument possible just because... well, that's you.

AMD should be putting out official statements of how to mitigate attacks they can't verify are real? Are you insane, what professional company will come out and make a statement that their products are potentially unsafe before they actually know that to be true.

Also your ridiculous assumption in a previous post that this report didn't contain technical details but you presume they gave such technical details to AMD... what is that assumption based on? Their insane statements of AMD going bankrupt to deal with these flaws, the unprofessional nature of their disclosure of this information, their unprofessional website, their unprofessional statements that they have a financial interest in the companies involved... but despite all that you both believe they gave a detailed technical report to AMD and that AMD should respond instantly to tell people how to prevent attacks they can't confirm even exist yet?

 

[CAT-THE-FIFTH]

"CTS Labs told us that it bucked the industry-standard 90-day response time because, after it discussed the vulnerabilities with manufacturers and other security experts, it came to believe that AMD wouldn't be able to fix the problems for "many, many months, or even a year." Instead of waiting a full year to reveal these vulnerabilities, CTS Labs decided to inform the public of its discovery."

Literally wtf. So they thought AMD couldn't fix it in a couple of months but they decided to tell the public instead without even contacting AMD and getting a response first?

No legitimate business does that in computer security. No one. If you find a vulnerability you go to the manufacturer, name your price, make a NDA with a deadline and then release the vulnerability details after the deadline.

Just shows how much of a fraud those CTS guys are. If the vulnerabilities were truly as bad as they make out, they could have made millions from AMD but instead they went to "industry experts" and didn't get a penny.

They can make a big song and dance about it,with some nice graphics and a marketing company which uses "social media influencers" and finding the "right reporters, bloggers, analysts and influencers who will understand your business". Screw consequences,as long as you have your 5 minutes of fame,its all cushty,right?? So basically computer security for a social media generation.

If this is allowed to stand,even if you have a love for Intel/Nvidia,etc - what if this sets a precedent for other cowboys to start doing the same for them for loads of tech companies?? Instead of doing what security researchers are meant to do,which is find flaws,inform companies of said flaws,and only then talk about it,once the companies can at least have some time to act(or not act on it).

After all companies do pay security firms for this kind of information AFAIK.

These people seem more interested in causing a blind panic. Thats not to say there isn't a potential set of issues,but funny how Intel got six months grace period for an issue that has existed for 20 years apparently.

At some point,what happens when one oversteps the mark,to outdo another cowboy competitor,and it leaks a big issue that no one has any time to try and do anything about?? Will we all be saying "cool" then??

Instead they just make clickbait names,articles and flashy websites,which seem more like easy consumption for the general public and non-technical investors,and the general echo chamber.

 

[Rroff]

Right, I remember how Intel released information to help mitigate attacks in June 2017..... oh wait.

You're talking completely and utter nonsense and it's becoming more and more frequent. You take the alternate side of every argument possible just because... well, that's you.

AMD should be putting out official statements of how to mitigate attacks they can't verify are real? Are you insane, what professional company will come out and make a statement that their products are potentially unsafe before they actually know that to be true.

Also your ridiculous assumption in a previous post that this report didn't contain technical details but you presume they gave such technical details to AMD... what is that assumption based on? Their insane statements of AMD going bankrupt to deal with these flaws, the unprofessional nature of their disclosure of this information, their unprofessional website, their unprofessional statements that they have a financial interest in the companies involved... but despite all that you both believe they gave a detailed technical report to AMD and that AMD should respond instantly to tell people how to prevent attacks they can't confirm even exist yet?

What Intel did or didn't do right or wrong doesn't exactly give AMD an excuse - what about Intel?

Just because you don't agree with what I say doesn't make it nonsense.

AMD should be atleast able to verify, very quickly, with their inside knowledge of their architecture if there is a glimmer of anything to it or complete rubbish even if they can't provide comprehensive advice immediately - to intimate anything else is ridiculous - some basic statements on that would go a long way to defuse the hysteria and blunt any potential impact.

What details AMD actually have are an assumption on my part but there are a small number of people reporting such as https://twitter.com/dguido/status/973629551606681600 so it would be a fair assumption AMD have similar information.

In this day and age staying (mostly) silent isn't an option - especially when something like this crops up - it doesn't take much to engage with your customers provide some ongoing reassurance and guidance as is practical and direct people to where they can get help even if there isn't much to say. Their press release isn't even on the main AMD news its filed away under the investor channel.

AMD should definitely be able to get a rough idea for possible attack avenues even if they only have the same basic details as published on the AMD flaws website and be able to advise things like maybe temporarily disabling PSP features in the BIOS if applicable.

 

[humbug]

OK, but if someone loosens the wheels nuts on their car it isn't the company who made the engines fault if the wheel comes off.

FFS AMD is not responsible if the machine is tampered with. Meltdown on the other hand . . . . . . . .

Pretty much this, as i said before.

The security flaws are simply no more real than me flashing a hacked BIOS onto Roffs Intel based system, if he allows me access to his home let alone his PC then the responsibility is with him, not Intel.

To be clear this is what they did to the Ryzen system, physically flashed a BIOS onto the system to disable the CPU's security features. its crazy to describe that as a security flaw with the vendors CPU's.

Roff, you're just talking non sense, period.

 

[humbug]

I would sum it up like this.

Don't let the authors of this Male Bovine Manure into your home to flash your Motherboards BIOS with their own.

For as long as you don't do that, you're completely safe.

 

[Rroff]

OK, but if someone loosens the wheels nuts on their car it isn't the company who made the engines fault if the wheel comes off.

FFS AMD is not responsible if the machine is tampered with. Meltdown on the other hand . . . . . . . .

That is hugely simplifying what some of these supposed flaws are potentially capable of. People keep looking at it in the context of the average home user but there are far wider uses of these CPUs than that some of them expect a level of security from the processor this potentially bypasses. Don't forget that you don't need physical access in many cases to update the BIOS - most systems can erase and reprogram the BIOS within Windows then force a reboot to apply it - in many cases it is also possible to work around BIOS protection when doing it this way.

EDIT: The BIOS angle though is one of the least concerning - some of the possible capabilities exposed by the "Chimera" angle potentially facilitate much more sophisticated attacks that can elude normal security measures far more so than your typical malware/rootkit, etc.

 

[humbug]

That is hugely simplifying what some of these supposed flaws are potentially capable of. People keep looking at it in the context of the average home user but there are far wider uses of these CPUs than that some of them expect a level of security from the processor this potentially bypasses. Don't forget that you don't need physical access in many cases to update the BIOS - most systems can erase and reprogram the BIOS within Windows then force a reboot to apply it - in many cases it is also possible to work around BIOS protection when doing it this way.

He's conflation this, this isn't some through windows access UEFI tweak, like desktop overclocking tools, what we are talking about here not possible through windows. The BIOS its self was physically replaced with an entirely different custom version, it was flashed off a USB stick in the BIOS its self.

Edit: Its the only way you can do it because Windows flashing utilities would first need to be installed and then ran with your permission, why would you grant something like that permission?

 

[labbby]

Some guy just came to my house stating he was from BT security and that there was an issue with my PC security. He flashed my bois and stole all the semi naked pictures of myself dressed up as pokemon. He then stole my goldfish.

I swear if AMD don't compensate me im going to sue them big time.

 

[Rroff]

Some guy just came to my house stating he was from BT security and that there was an issue with my PC security. He flashed my bois and stole all the semi naked pictures of myself dressed up as pokemon. He then stole my goldfish.

I swear if AMD don't compensate me im going to sue them big time.

Someone doesn't need to come to your house - tools like Gigabyte's @BIOS can do everything with the BIOS inside Windows that it is possible to do flashing a BIOS from bootable media.

 

[labbby]

Someone doesn't need to come to your house - tools like Gigabyte's @BIOS can do everything with the BIOS inside Windows that it is possible to do flashing a BIOS from bootable media.

Just on AMD products ?

 

[TrixP10]

That is hugely simplifying what some of these supposed flaws are potentially capable of. People keep looking at it in the context of the average home user but there are far wider uses of these CPUs than that some of them expect a level of security from the processor this potentially bypasses. Don't forget that you don't need physical access in many cases to update the BIOS - most systems can erase and reprogram the BIOS within Windows then force a reboot to apply it - in many cases it is also possible to work around BIOS protection when doing it this way.

EDIT: The BIOS angle though is one of the least concerning - some of the possible capabilities exposed by the "Chimera" angle potentially facilitate much more sophisticated attacks that can elude normal security measures far more so than your typical malware/rootkit, etc.

NOPE, I am not 'looking at it in the context of the average home user'.

At the end of the day YOU the end user - corporate or otherwise are responsible for their own security measures. These venerabilities require a degree of USER participated negligence. Meltdown on the other hand . . . . . . . . . .
(have you patched all of your intel systems yet? )

 

[Hotwired]

Just on AMD products ?

They're not shorting Intel shares obviously.

 

[Rroff]

have you patched all of your intel systems yet?

I haven't patched a single one of my Intel systems yet - I've taken measures to prevent exposure to online attacks using those avenues - once software is actually running on my machine there are far easier ways to exploit it if it has some malicious intent than making use of something like Meltdown - and note I'm saying that fully aware of that aspect and still posting what I have above - people aren't understanding the full implications of what these AMD flaws potentially enable.

EDIT: I suspect this is going to be like the WannaCry or Windows 10 threads, etc. were people were attacking everything I said and turned out I was right all along :s

 

[humbug]

There are several other problems with Roff's theory.

Other than the UAC, lets say you are one of those people who have that entirely disabled (never do that)

The Desktop flashing utility would have to understand your motherboard, so it would have to be a signed flashing utility because if it isn't signed it will not do what it wants anyway and Microsoft are not in the habit of certificating malware. then the BIOS also needs to be compatible with your Motherboard.

How many motherboards exist? the attacker would have to know your hardware, now that's not difficult but in that he would have to be targeting you specifically to hack into your specific hardware.

Not that this is possible if you have UAC running, but even if all of this was possible this does not make it an AMD specific problem, if it is possible its possible on any system no matter who the vendor.

 

[TrixP10]

They're not shorting Intel shares obviously.

It won't be long

 

[humbug]

I haven't patched a single one of my Intel systems yet - I've taken measures to prevent exposure to online attacks using those avenues - once software is actually running on my machine there are far easier ways to exploit it if it has some malicious intent than making use of something like Meltdown - and note I'm saying that fully aware of that aspect and still posting what I have above - people aren't understanding the full implications of what these AMD flaws potentially enable.

Yeah its starting to look to me like Roff, like CTS Labs is trying to conflate a potential vulnerability that the vendor themselves are not responsible for as a fault specifically with AMD.

Not for the first time, this is why he has me and many others on his ignore list.