Intel Tried to Bribe Dutch University to Suppress Knowledge of MDS Vulnerability

[JaymondoGB]

Intel (just like Boeing) finds itself in a terrible position, everything they touch goes wrong. its time to relise your not leader of the pack anymore.

 

[mtcn77]

No. I generally stay away from anything 'Hollywood'.

You know, all prophets had day jobs prior to their enlightenment. Harrison Ford was a carpenter. I won't spoil the fun. It is a good movie with cliche conspiracies.

 

[Dexiefy]

It's fair to view things that way.
But hen again, considering the security context part of it, in which the said information could eventually publicly persuade hackers into an even more intensive attack towards those vulnerabilities, possibly putting companies who pack Intel hardware into a even more fragile situation, then it's also kind of logical that another 6 months could be for the better good overall. That is, giving more time to spread possible fixes so when things got out to the public most of the affected clients would be already protected. When the group refused, only thing Intel could do was to try make things not so dangerous for their products and their customers/clients, avoiding a possible attack escalation. But for that to happen, the research group would have to agree to something. Question is, what would it take for them to accept?
- accepting just "for the better good" if Intel asked?
- accepting any type of non-monetary favor/benefit for the Uni?
- accepting more money?
Considering they already accepted money $100k for the initial Intel reward program, but refused to wait any longer, then it's fair to assume Intel could at least try offer some more to try get a different type of secondary deal.
Obviously this gets much more complicated and shady when we consider all the possible background intentions for Intel to try downplay the problem and protect itself as a big company (apart from the obvious security one).

 

[jmcosta]

Their fix is going to cripple performance, Intel's lead in IPC is based on lack of security and checks that cost IPC in real world application switching.

There is no fix that won't cost IPC degredation.

It's a sad situation but gamers are lucky, this vulnerability fix doesn't seem to impact game's performance

Gaming Performance Only Faintly Touched By MDS / Zombie Load Mitigations - Phoronix

phoronix.com

 

[HwGeek]

MDS / Zombieload Mitigations Come At A Real Cost, Even If Keeping Hyper Threading On - Phoronix

www.phoronix.com

This with HT ON, I'm afraid to imaging with OFF.

Edit: He just posted complete test:

The Performance Impact Of MDS / Zombieload Plus The Overall Cost Now Of Spectre/Meltdown/L1TF/MDS - Phoronix

www.phoronix.com

Can someone give us some info how the Big Data Center clients react for such decrease in performance? Loosing 10%~40% in 1 day should make some noise, what they gonna do now to get back to 100% ? Add more Cabinets or what? who is paying for this? Intel?

 

[toxzl2]

Intel stock is going to crash so hard when AMD releases Ryzen 3K and Epyc 2 Rome... Short Intel, Long AMD

 

[hat]

Someone needs to do a 99 problems meme on this.

 

[mtcn77]

Intel stock is going to crash so hard when AMD releases Ryzen 3K and Epyc 2 Rome... Short Intel, Long AMD

Any mice I met, have already debarked the ship for the AMD hypewagon, considering there are only '2' choices to consider...

 

[Splinterdog]

Here's a link to the Dutch publication and I used Google to translate to English.

VU ontdekt megalek in Intel-chips

Lekke hardware: Dankzij een foutje bracht de VU een megalek in Intel-chips aan het licht. Intel betaalt de prijs voor een snel maar risicovol ontwerp.

www.nrc.nl

I don't see that as bribery as it probably falls under the Bug Bounty program umbrella.

 

[t34mki11]

They didn't "bribe" the research team, this is literally how bug bounty programs work. The team just thought the bug was worth more than 80k, Intel didn't, so they preemptively released information on it themselves as damage control. Nothing to see here.

 

[Patriot]

They didn't "bribe" the research team, this is literally how bug bounty programs work. The team just thought the bug was worth more than 80k, Intel didn't, so they preemptively released information on it themselves as damage control. Nothing to see here.

No... the bug bounty was 100k, Intel offered additional money to be less than honest about the severity of the bugs and delay release of information past industry norms. No information was released early.

 

[Smartcom5]

Confirmed! It's the very same Dutch Vrije Universiteit Amsterdam that Intel tried to bribe six month ago in offering money for de·lay·ing said informations for some additional six months!
Good Lord, Intel. How you have fallen …
Now we know what they tried to sweep under the carpet!

Smartcom

 

[Xzibit]

Intel: Just take the money and be quiet
Researchers: We already did but you haven't fixed the issues yet.