Wednesday, March 21st 2018
CTS-Labs Posts Ryzen Windows Credential Guard Bypass Proof-of-concept Video
CTS-Labs, following up on Tuesday's "Masterkey" exploit proof-of-concept video, posted a guide to bypassing Windows Credential Guard on an AMD Ryzen-powered machine. We once again begin in a privileged shell session, of an AMD-powered machine whose Secure Processor that has been compromised using admin privileges, by exploiting it using any of the 13 vulnerabilities chronicled by CTS-Labs. Mimikatz, a tool that is used by hackers to steal network credentials, should normally not work on a machine with Windows Credential Guard enabled. Using a modified version of Mimikatz, the CTS-Labs researchers are able to bypass Windows Credential Guard (which relies on hardware-level security features present on the processor), leveraging the AMD Secure Processor malware microcode they wrote.The proof-of-concept video follows.
88 Comments on CTS-Labs Posts Ryzen Windows Credential Guard Bypass Proof-of-concept Video
Who knows it would be sweet to see a Roxen or Ryxen475 Chipset lol (made up name)
(Fortunatly 99,99999% of these cases are handled by adults/professionals, issues are reported to respective organizations who start working on fixes and general public learns of them usually when patch is made available.)
There is no such thing as problem-free hardware or software. There are and always will be bugs in code/design. Humans are the weak link.
I think people forget AMD's financials. Especially before Ryzen and miners. For years people expect from AMD to be equal to everything it is doing to Intel and Nvidia because they forget that AMD financially is much much more weak compared to the other two. In the past, when Nvidia wasn't even a 1Billion per quarter company, AMD could compete with them. Today Nvidia is making from GPUs more money than AMD is doing from every business it does. No reason to do any kind of comparison with Intel here I believe.
Intel's own chips are full of vulnerabilities and Intel is a huge company that builds everything. Intel had 6-8 months to create patches and the first versions where unstable.
Nvidia's own departments messed up - if we believe Nvidia's official explanation - with the GTX 970 specs. No miscommunication between two different companies.
AMD needed to outsource chipsets, because of financial problems. If Ryzen keeps selling and if miners keep the GPU department profitable, then we will get better products from AMD. Until then we shouldn't have higher expectations from them, than the ones we have from the other two, much bigger and much more profitable companies.
They do have to be more careful, but until now they had no other option but to trust other companies.