Im stating that this is the highest trending topic/news on TPU. I cant call it objective, sorry.





How am I trolling, exactly?

eidairaman1It's obvious what cts is trying to do, so i denounce anything they do. I trust the developer of the arch on fixes before a 3rd party such as CTS.

I wonder if AMD might pursue a lawsuit for libel.

I do hope AMD sues, it would be like a free publicity stunt for them.

CTS were just a tool , someone else is behind them. Either Viceroy or someone else.

R-T-BI'm actually of the opinion that as an exploitable issue, these don't amount to much. There are very targeted use cases in which some very select users may be concerned, but that's it.

To be fair, Meltdown & Spectre are in the same boat. As with most vulnerabilities, they are difficult for the general user base to pull off but that is not why they should taken seriously. These are things that are still possible to pull off and presents a distinct danger to data/system security.

JadawinNo, it is not serious. If you are already in a privilidged shell, nothing else matters anymore.

You do realize that software seeking elevated privileges doesn't need you to key in admin password, don't you?

Imagine you're just another desktop PC user running a Ryzen processor, and have the average joe's understanding of computers. You download a harmless looking free software (something that makes GIFs, converts videos, etc., to help you post dank memes). You run its installer, the installer seeks elevated privileges (in order to install software). You give it those privileges at the click of a button. That's it. You just gave something from the internet elevated privileges, enough to install a remote shell for a haxxor sitting across the globe, to access your hardware, and plant exploits that survive reboots and re-installs.

Vya DomusCTS were just a tool , someone else is behind them. Either Viceroy or someone else.

They themselves admitted that they're a for-profit company that's paid by stock research firms (not Viceroy, but someone with an identical modus operandi).

btarunrImagine you're just another desktop PC user running a Ryzen processor, and have the average joe's understanding of computers. You download a harmless looking free software (something that makes GIFs, converts videos, etc., to help you post dank memes). You run its installer, the installer seeks elevated privileges (in order to install software). You give it those privileges at the click of a button.

No regular user (in domain/work network) should/will ever have admin access. In environment with security protocols in place this is impossible.

(any users in my domain try something like this I'll just have a talk with them and point out the obvious, "you do not click on random stuff/files downloaded from the internet")

ikekeNo regular user (in domain/work network) should/will ever have admin access.

That is a huge assumption on your part and is incorrect. Additionally, there are fine grained levels of admin access that can and are granted for various tasks within a company/network. Then there are IT admins themselves who often don't use proper security methodologies either out of ignorance or incompetence.

ikekeIn environment with security protocols in place this is impossible.

Incorrect again. There are many ways around network security, even in a Unix/Linux based environment.

Again, if Joe Average in your network has (unrestricted) admin access then Amdflaws is the least of your worries.

And yet again, we add a lot of "if" in order to make the CTS-Labs claims viable. Still no "staggering thirteen critical security vulnerabilities for AMD's "Zen" CPU microarchitecture" (quote from TPU original post).

ikekeAgain, if Joe Average in your network has (unrestricted) admin access then Amdflaws is the least of your worries. And yet again, we add a lot of "if" in order to make the CTS-Labs claims viable. Still no "staggering thirteen critical security vulnerabilities for AMD's "Zen" CPU micro-architecture" (quote from TPU original post).

You're not getting it. The "if" is at the core of these problems. Just because they are difficult to exploit doesn't mean you can dismiss them as harmless. And if you are, or may become, a target, would you want them fixed or left as-is to be taken advantage of? If you say anything other than "fixed", you are completely unqualified to be offering IT/network security advice and certainly unqualified to be a IT/network administrator. You're lucky you don't work for me. You'd already be out of a job as the attitude displayed here is completely intolerable.

I am lucky indeed, true that.

lexluthermiesterJust because they are difficult to exploit doesn't mean you can dismiss them as harmless.

vs

ikeke"staggering thirteen critical security vulnerabilities for AMD's "Zen" CPU microarchitecture" (quote from TPU original post)

Leaving them "as-is" is something i cant recall i've ever said...

ikekeAgain, if Joe Average in your network has (unrestricted) admin access then Amdflaws is the least of your worries.

Your dank meme generator installer running on elevated privileges will create a remote shell, haxxor then uses Ryzenfall-enhanced mimikatz to see your unhashed admin password. It's cake from there on.

OK, i get it. It's a cake.

blog.trailofbits.com/2018/03/15/amd-flaws-technical-summary/

I quote:

"There is no immediate risk of exploitation of these vulnerabilities for most users. Even if the full details were published today, attackers would need to invest significant development efforts to build attack tools that utilize these vulnerabilities. This level of effort is beyond the reach of most attackers (see www.usenix.org/system/files/1401_08-12_mickens.pdf, Figure 1)

These types of vulnerabilities should not surprise any security researchers; similar flaws have been found in other embedded systems that have attempted to implement security features. They are the result of simple programming flaws, unclear security boundaries, and insufficient security testing. In contrast, the recent Meltdown and Spectre flaws required previously unknown techniques and novel research advances to discover and exploit."

community.amd.com/community/amd-corporate/blog/2018/03/21/initial-amd-technical-assessment-of-cts-labs-research

I quote:

The security issues identified by the third-party researchers are not related to the AMD “Zen” CPU architecture or the Google Project Zero exploits made public Jan. 3, 2018. Instead, these issues are associated with the firmware managing the embedded security control processor in some of our products (AMD Secure Processor) and the chipset used in some socket AM4 and socket TR4 desktop platforms supporting AMD processors.

I find it weird to have continued discussion on this topic at the same original "staggering thirteen critical security vulnerabilities for AMD's "Zen" CPU microarchitecture " topic, since the magnitude of these issues was played as something they clearly werent. And this continues even after outside evaluation and AMDs reply. Somehow any bone CTS-Labs throws has so much weight to it..

For a fact, these exploits, based on POC, would be undeployable in environments i know of.

There are safeguards in place, for a reason.

I came back to see if there were any updates here and see the back and forth temper tantrums continue. Why is there even debate anymore? AMD already acknowledged the vulnerabilities in whole. AMD is crafting fixes for those vulnerabilities. If there was no risk there would be no fix but fixes are coming. Are these high risk? No, but there is risk so it needs a fix. Chips have flaws. Intel chips have flaws. AMD chips have flaws. What is so hard to understand and accept?

btarunrYou do realize that software seeking elevated privileges doesn't need you to key in admin password, don't you?

Imagine you're just another desktop PC user running a Ryzen processor, and have the average joe's understanding of computers. You download a harmless looking free software (something that makes GIFs, converts videos, etc., to help you post dank memes). You run its installer, the installer seeks elevated privileges (in order to install software). You give it those privileges at the click of a button. That's it. You just gave something from the internet elevated privileges, enough to install a remote shell for a haxxor sitting across the globe, to access your hardware, and plant exploits that survive reboots and re-installs.

Ryzen processor detected. Installing malware.

You do realize that software seeking elevated privileges doesn't need you to key in admin password, don't you?

Imagine you're just another desktop PC user running a Coffee Lake processor, and have the average joe's understanding of computers. You download a harmless looking free software (something that makes GIFs, converts videos, etc., to help you post dank memes). You run its installer, the installer seeks elevated privileges (in order to install software). You give it those privileges at the click of a button. That's it. You just gave something from the internet elevated privileges, enough to install a remote shell for a haxxor sitting across the globe, to access your hardware, and plant exploits that survive reboots and re-installs.

Intel processor detected. Abort! Abort!! ABORT!!!



I love it how CTS managed to make the installation of malware synonym to having a Ryzen processor.
Any new videos from CTS for the front page?

ikekeIm stating that this is the highest trending topic/news on TPU. I cant call it objective, sorry.





How am I trolling, exactly?

Updated the first sentences in the article, good catch. It's highest trending because it has huge activity in every metric

W1zzardUpdated the first sentences in the article, good catch. It's highest trending because it has huge activity in every metric

I dont think there are any CVE IDs for any of these sofar, as well.

ikekeI dont think there are any CVE IDs for any of these sofar, as well.

reworded to "exploits"

R-T-BI'm actually of the opinion that as an exploitable issue, these don't amount to much. There are very targeted use cases in which some very select users may be concerned, but that's it.

What's more disturbing is that they point to lax practices inside AMD and ASMedia in general. I don't like that. Not that that's anything unusual these days, but that's even more disturbing.

Seriously, if you are going to push "hardware security" try and give a shit about how the hardware thinks, please?

How do you know they are "lax"? Processors aren't something you throw together in 6 hours. Especially considering Zen was put together from ground up. Just because CTS Labs gave them a ridiculous 24 hour timeframe to address it, that doesn't mean they are incompetent or clueless. Every device has potential issues, it's just a matter of when someone finds them.

Can't say the same for ASMedia. Then again, no one seems to have addressed them specifically as all the focus is on AMD for some dumb reason...

Vya DomusCTS were just a tool , someone else is behind them. Either Viceroy or someone else.

have a look at who owns CTS and Viceroy, its a fund manager.

the first video on Gamers Nexus about this makes a mention about that that EVERYONE ignored.

the54thvoidWhile I find the focus on CTS distasteful, the rhetoric and accusations against TPU are something that should have been dealt with a long time ago. TPU has had militants rally against it for a while now (usually in AMD/Nvidia threads) and the constant "TPU is a shill" cry has gone unpunished, until now. If you invite someone into your house and they shit on your carpet - you really ought to kick them out before they've pulled their trousers up.

As for further coverage of CTS labs technical pieces, it should be noted that the majority of TPU members (from what I've seen) are not that tech savvy. This is not my site (nor do I own one) but as Anandtech and others have done, a fair reflection on the merits of CTS background funding and PR roadshow wouldn't go amiss. There is one thing that will be proven in time and that is a very viable path for discrediting this exploit expose:

CTS says it's not fixable
CTS gives AMD 24 hours notice that they have found said exploit.
AMD says a firmware patch will fix it and they are working on it.

so.....

If patch fixes problem, and it does so within 90 days (standard industry timescale for exploit announcement)...
There would be no issue at all. This is the crux of it all - by not giving due time as is normally allowed, CTS have used unfair media leverage to make AMD look bad. If AMD do patch this (apparently unfixable issue) it makes CTS look like opportunistic little scum bags. This exploit would be history before it was even news but CTS intentionally released the exploit reveal with as little time as possible for AMD to make them look crap.

Therefore, all the PR the tech sites are allowing CTS 'airtime' is actually helping them look better when we're not giving AMD time to work on it as Google gave Intel (and AMD) when Spectre/Meltdown were discovered.

So, even those doing this :banghead: at those saying there is no flaw, of course there's a flaw but it could have been dealt with 'properly' and had it been done so (been fixed by AMD), we would not have had all this hyperbolic forum activity.

Is there an exploit? YES. Did CTS stitch AMD up? YES. TPU has not sufficiently asked why that is, that is why there is a great resentment in the forums.
Then again, in 'x' weeks time, if AMD hasn't fixed it, then we can get all pissy again.....

VERY well said..

RejZoRHow do you know they are "lax"? Processors aren't something you throw together in 6 hours.

No, but outsourcing to a company known to put blatant backdoors in the chipsets they make was pretty avoidable. Heck, the PSP itself is an outsorced arm piece. All of that points to a lack of true caring at AMD.

R-T-BNo, but outsourcing to a company known to put blatant backdoors in the chipsets they make was pretty avoidable. Heck, the PSP itself is an outsorced arm piece.

That's why the focus is on AMD; It's not that their products are faulty, really, it is that they didn't vet their partner's products that hey integrated into their platform properly.

It's an interesting topic, to me. Like, this very clearly shows how AMD does things, and how they do business. In some ways they are an IP company, but they don't actually fully have enough of their own designs to provide a complete solution; they have to rely on other companies to complete things for them. It's kind of an "open-source" approach to hardware design, which can lead to all sorts of weird issues due to lack of communication between the separate teams at separate offices at separate companies...

cadavecaThat's why the focus is on AMD; It's not that their products are faulty, really, it is that they didn't vet their partner's products that hey integrated into their platform properly.

It's an interesting topic, to me. Like, this very clearly shows how AMD does things, and how they do business. In some ways they are an IP company, but they don't actually fully have enough of their own designs to provide a complete solution; they have to rely on other companies to complete things for them. It's kind of an "open-source" approach to hardware design, which can lead to all sorts of weird issues due to lack of communication between the separate teams at separate offices at separate companies...

That seems a bit unfair since the same is true for Intel: they also outsource chipsets to ASMedia, don't they?

cadavecaThat's why the focus is on AMD; It's not that their products are faulty, really, it is that they didn't vet their partner's products that hey integrated into their platform properly.

It's an interesting topic, to me. Like, this very clearly shows how AMD does things, and how they do business. In some ways they are an IP company, but they don't actually fully have enough of their own designs to provide a complete solution; they have to rely on other companies to complete things for them. It's kind of an "open-source" approach to hardware design, which can lead to all sorts of weird issues due to lack of communication between the separate teams at separate offices at separate companies...

Sort of like yhe Super 7 days

HTCThat seems a bit unfair since the same is true for Intel: they also outsource chipsets to ASMedia, don't they?

No, they don't. Mobo manufacturerers use ASMedia chips to add suplemental USB ports, but Intel designs it's own chipset and has no relationship really with ASMedia.

AMD literally had ASMedia design their entire chipset.