13 Major Vulnerabilities Discovered in AMD Zen Architecture, Including Backdoors

[R-T-B]

Viceroy posting FUD right after amdflaws went public, though, is.

Proof?

I think you and I define "proof" differently.

It's fishy, I'll hand you that.

Are personally at the machine

Again, not required.

 

[ikeke]

Proof?

I think you and I define "proof" differently.

It's fishy, I'll hand you that.

https://amdflaws.com/
https://safefirmware.com/amdflaws_whitepaper.pdf
and
https://viceroyresearch.org/2018/03/13/amd-the-obituary/
https://viceroyresearch.files.wordpress.com/2018/03/amd-the-obituary-13-mar-2018.pdf

Viceroy published ~180 minutes after amdflaws went public, publish included 25 page "analysis". I'd call that orchestrated.

 

[lexluthermiester]

I'd call that orchestrated.

And the Meltdown/Spectre wasn't coordinated/orchestrated? Come on, take off the tin-hat..

 

[ikeke]

What are you talking about? No, really?

Meltdown/Spectre - industry as a whole had months to prepare the fixes, no public disclosure.
"Amdflaws" - 24h notification to AMD since "these are unfixable issues", then amateurish public FUD campaign.

 

[lexluthermiester]

"Amdflaws" - 24h notification to AMD

We've been over this. There is huge difference between making a public announcement and full disclosure to the public. CTS did not and has not disclosed the full technical details to the public. They only announced the existence of them. Have you actually read the links you've been posting?

 

[ikeke]

Neither You or I or anyone but CTS-Labs knows who the details were shared with.

You take their word? Good for you. Thusfar they have less than stellar reputation on being factual.

 

[lexluthermiester]

Neither You or I or anyone but CTS-Labs knows who the details were shared with.

It only matters that they did not share it with the general public. You're picking nits again..

You take their word? Good for you. Thus far they have less than stellar reputation on being factual.

People make mistakes. It's not the end of the world. Get over it.

 

[trparky]

OK then, I was wrong. These issues can be fixed and unlike Spectre and Meltdown there's no performance degradation that will be seen when it's fixed.

 

[anubis44]

So you admit you're biased and unable to be objective. If you'd said that to begin with..

No. I'm not 'admitting' anything. I'm not 'guilty' of something, so admission is the wrong word. I'm merely stating my position on this matter. The fact that I own shares of AMD isn't a source of bias for me in my determination on whether these 'flaws' are a serious problem. I would argue the same thing if somebody had levelled this accusation at Intel-based computers, too.

 

[EarthDog]

Are you now able to admit they are real at least?

 

[John Naylor]

As with the Spectre / Meltown scenario, It would be great if at some point we could have a thread focusing on the potential impact of these flaws on users ... Id rather skip having to read thru 100s of brand bashing posts to get any useful information. While it's certainy too early at this point to ascertain the impact of the new Zen flaws, it's been hard to find any instances of actual "typical user" impact of Spectre and Meltdown because of all the "noise".

 

[bug]

As with the Spectre / Meltown scenario, It would be great if at some point we could have a thread focusing on the potential impact of these flaws on users ... Id rather skip having to read thru 100s of brand bashing posts to get any useful information. While it's certainy too early at this point to ascertain the impact of the new Zen flaws, it's been hard to find any instances of actual "typical user" impact of Spectre and Meltdown because of all the "noise".

All of these require admin rights to exploit.
As a home user, if someone gets into a position to exploit these, you're already royally screwed. But, as CTS Labs have noted, these are more of a danger to organizations where, by phising or other means, someone exploits these to plant almost undetectable malware that can be used to further compromise the organization.

 

[lexluthermiester]

But, as CTS Labs have noted, these are more of a danger to organizations where, by phising or other means, someone exploits these to plant almost undetectable malware that can be used to further compromise the organization.

Exactly correct. It's a risk that must be taken seriously no matter how difficult it is to accomplish.

No. I'm not 'admitting' anything.

 

[Veradun]

Exactly correct. It's a risk that must be taken seriously no matter how difficult it is to accomplish.

Yep, correct. If companies are unable to isolate users and they give every employee admin rights on their PCs, well, being exploited is well deserved.

 

[las]

The danger of these flaws has been exaggerated ALOT.

Spectre and Meltdown are way more serious.

 

[bug]

The danger of these flaws has been exaggerated ALOT.

Spectre and Meltdown are way more serious.

How so? They may not require admin rights, but still in most cases the data you can sniff will be garbage.
Vulnerabilities are vulnerabilities. Just because you and I can't figure out how to exploit them doesn't make them less dangerous. Patch them and move on.

Also, I wonder who exaggerated these "A LOT" since very few parties actually had a chance to examine them properly. CTS Labs? We've already established they have little credibility, so I wouldn't put much weight on their assessment of how serious these are. And I'm not aware of anyone else saying these were serious flaws.

 

[lexluthermiester]

And I'm not aware of anyone else saying these were serious vulnerabilities.

Let's be fair, AMD themselves have said this with their actions.
https://www.techpowerup.com/242550/initial-amd-technical-assessment-of-cts-labs-research

When the company effected by these problems commits resources to releasing full bios revisions for said problems, they are automatically qualified as serious.

So AMD themselves have validated them and are taking these vulnerabilities seriously enough to release fixes for them.

 

[bug]

Let's be fair, AMD themselves have said this with their actions.
https://www.techpowerup.com/242550/initial-amd-technical-assessment-of-cts-labs-research

In case I wasn't clear before, any security vulnerability should be taken seriously. It's just that in this context I haven't understood where the "end of the world is drawing near" assessment came from in the first place. Therefore, I'm not getting the "these aren't as serious as previously thought" reasoning now.

I've been looking at these with the caution any person looks at an unknown quantity. Now that the quantity is known, I/we can relax.

 

[ikeke]

@bug

It was a mix of amdflaws and partly TPU original wording, which implied some possibly unfixable scenario.

Its updated now.

https://www.techpowerup.com/forums/...ss-proof-of-concept-video.242575/post-3817320

 

[hat]

In case I wasn't clear before, any security vulnerability should be taken seriously. It's just that in this context I haven't understood where the "end of the world is drawing near" assessment came from in the first place. Therefore, I'm not getting the "these aren't as serious as previously thought" reasoning now.

I've been looking at these with the caution any person looks at an unknown quantity. Now that the quantity is known, I/we can relax.

You really think so? I agree these flaws would be very hard to actually use, but imagine if somebody managed to pull it off at your bank, or anywhere else where you have sensitive information...

 

[ikeke]

I dont think organizations with sensitive information should have InfoSec holes that allow for such vulnerabilities to be used, unless bad actor/insider user can deploy them.

 

[r9]

At first take on CTS Labs I was thinking that provable somebody cough*intel* payed them to do it why else.
But if you think about it this is what they do, and you can't buy exposure like this.

 

[bug]

At first take on CTS Labs I was thinking that provable somebody cough*intel* payed them to do it why else.
But if you think about it this is what they do, and you can't buy exposure like this.

Yes, that's probably why they rushed disclosing all this. Even bad publicity is publicity and CTS Labs went from no-name to world famous. But I really, really hope they don't handle further discoveries like they did.

 

[mtcn77]

Cambridge Analytica is world famous, too. Guess, this is a good thing?

 

[ikeke]

I dont think that being in InfoSec/auditing business and having this clusterf*ck in resume will give you any credits in the future.

(oh, we found this issue while looking at this non-related thing, hmm, looks like something that could be sold to stockmarket for quick buck, ta-daaa, profit. Also, we don't know how to inform parties of our findings, hehe, no worries, happens, whoops...)

edit:In another news, Viceroy unmasked.

https://www.moneyweb.co.za/in-depth/investigations/viceroy-unmasked/

This all stinks to high heaven. They all look to be a front for someone else.