News for hackers. Stuff that matters.
Re:Security Researchers Publish Ryzen Flaws, Gave AMD 24 Hou... by simias on Tuesday March 13, 2018 @01:01PM (#16577603)
Yeah it's suspicious. The website[1] has many fancy infographics, marketable names and fear mongering but you have to dig into the whitepaper[2] to find any details about the actual vulnerabilities. And even then it starts only on page 8 of 20 and you discover that it's vulnerabilities targeting the secure boot infrastructure and you need local admin to exploit them. It's not good but it's not a new Spectre or Meltdown.

If I was the tinfoil hat type I'd guess that Intel is trying to spread FUD but maybe it's just security researchers trying to generate a bit of buzz for their company at the expense of AMD.

[1] https://www.amdflaws.com/ [2] https://safefirmware.com/amdflaws_whitepaper.pdf

Re:Security Researchers Publish Ryzen Flaws, Gave AMD 24 Hou... by dnautics on Tuesday March 13, 2018 @01:05PM (#16577643)
It's possibly even more nefarious than that: 1) execute a series of puts on AMD, 2) release exploit 3) profit. If you execute an option with a far time horizon and give the company enough time to mitigate their vulns, then I think this is not an irresponsible thing to do (as it incentivises the company to actually do something), but with 24 hours notice...
Re:Security Researchers Publish Ryzen Flaws, Gave AMD 24 Hou... by mizzack on Tuesday March 13, 2018 @01:09PM (#16577674)
Seeing as CTS-Lab's CFO also founded a hedge fund you're probably on the right track.

>Yaron co-founded CTS-Labs in 2017, and previously served as an intelligence analyst in the Israeli Intelligence Corps Unit 8200. He is also the founder and Managing Director of NineWells Capital, a hedge fund that invests in public equities internationally. He holds a B.A. and M.A. from Yale University.

Re:Security Researchers Publish Ryzen Flaws, Gave AMD 24 Hou... by tyfon on Tuesday March 13, 2018 @01:14PM (#16577717)
Basically a follow the money situation.

Could something like this be considered inside information? Or is it legal to actively manipulate stock prices to ones benefit in this way?

Re:Security Researchers Publish Ryzen Flaws, Gave AMD 24 Hou... by dsacco on Tuesday March 13, 2018 @01:35PM (#16577940)
> Could something like this be considered inside information?

No, illegal insider trading refers to trading on inside information when you have a confidentiality agreement or a fiduciary duty. Information asymmetry is insufficient (or else it would be virtually impossible to profitably trade at all).

> Or is it legal to actively manipulate stock prices to ones benefit in this way?

The way you're presenting this is a false dichotomy. It's not "manipulating" stock prices except insofar as people broadcast news all the time which alters stock prices. Strictly speaking, it's not market manipulation if it's true. If it's false, it can be, which is why you really try not to do it unless it's true.

Re:Security Researchers Publish Ryzen Flaws, Gave AMD 24 Hou... by tyfon on Tuesday March 13, 2018 @02:12PM (#16578324)
Might the latter also depend on how you present it?

As far as I can see this is only an exploit of secure boot if you are already on ring 0 level auth. Making a whole webpage with lots of graphics and whatnot, sending press releases all over and in general present it like a security flaw on the level of meltdown seems .. false?

Probably court level material.. In any case it seems to have backfired as the stock is up.

Re:Security Researchers Publish Ryzen Flaws, Gave AMD 24 Hou... by dsacco on Tuesday March 13, 2018 @02:30PM (#16578526)
I think the difference in facts you're talking about is a difference of degree, not category. In other words, it's not plainly false, there certainly is a vulnerability, it's just perhaps exaggerated. I could see a case being brought against the researchers on those grounds, but I'd be really surprised if anything came of it.
Re:Security Researchers Publish Ryzen Flaws, Gave AMD 24 Hou... by kbenson on Tuesday March 13, 2018 @04:35PM (#16579547)
It could be interesting. Some of the flaws presented require you flash your bios, if I understand correctly. They are included with what are likely real flaws, but maybe it's enough for a case of misleading the public in part. To me it seems sort of like saying Ford engines have a tendency to blow up, but only after you've overwritten some engine firmware. By itself, not much to talk about, but when attached to something that has indications of being used to make money through stock changes, maybe is more likely to be looked at unfavorably by the SEC?
Re:Security Researchers Publish Ryzen Flaws, Gave AMD 24 Hou... by ek750 on Wednesday March 14, 2018 @02:00AM (#16582692)
Hopefully someone with more experience can answer this, but could the stock be going up due to high short interest?

Maybe not technically a short squeeze (https://en.m.wikipedia.org/wiki/Short_squeeze) but related?

Re:Security Researchers Publish Ryzen Flaws, Gave AMD 24 Hou... by noobermin on Tuesday March 13, 2018 @03:28PM (#16578999)
What if it's not false but misleading? That sounds closer to what they are doing here. Sure they included a ridic disclosure agreement that you apparently agree to have read if you continue to read their webpage, and it says something along the lines of "this is our opinion".

It feels slimy and gross.

Re:Security Researchers Publish Ryzen Flaws, Gave AMD 24 Hou... by dsacco on Tuesday March 13, 2018 @03:46PM (#16579139)
"Slimy" and "gross" are not nearly sufficient for either insider trading or market manipulation. I don't particularly like the way these researchers are acting either, but that's actually because I don't like vulnerability impact being exaggerated and over-hyped. The other stuff doesn't bother me too much.

If the news pushing a stock price is so misleading that it's categorically different from the truth, then I could see a case for market manipulation being brought against them. But I doubt that will happen, because unfortunately people have broad latitude to portray vulnerabilities however they'd like as long as they're convincingly authentic.

Re:Security Researchers Publish Ryzen Flaws, Gave AMD 24 Hou... by noobermin on Tuesday March 13, 2018 @03:59PM (#16579240)
I was just relaying my feelings in that last bit. But the misleading bit in my comment specifically refers to the fact it's an exaggeration as you put it. So you can flash a bios and make it do nefarious things: that is a true statement but it's hardly a "security flaw" and almost not even too surprising. They are however taking a flaw and spinning it out to be the massive security flaw which it isn't.

I guess that's my question. If you take a true statement and put it out with connotations that it's actually a terribly thing and worse than it is, just being "true" doesn't matter. Stupid analogy, say you go to a bakery and buy bread, then it goes stale in two hours or so by the time you get home. Then you go and write a negative yelp review that this bakery is terrible at baking and they sell subpar bread. You just don't know that the bakery doesn't bake in preservatives that bread you buy from the supermarket does. And it certainly isn't like the bakery is selling spoiled/poisoned bread or selling rocks painted to look like bread loaves.

Re:Security Researchers Publish Ryzen Flaws, Gave AMD 24 Hou... by chadash on Tuesday March 13, 2018 @01:43PM (#16578033)
To add to the other comments here, a recent high profile case of something similar was Bill Ackman shorting Herbalife. Basically, he shorted the stock and then went to the media with his research showing that he believed Herbalife to be a pyramid scheme. Ultimately, I believe he lost money on the whole fiasco, but it's not an uncommon strategy. The whole thing made the news after a particularly amusing exchange between Bill Ackman and Carl Icahn (who had the opposing view) on CNBC: https://www.youtube.com/watch?v=hCZRk1lL90Q. I worked on Wall Street at the time and I remember the entire trading floor at my bank was almost frozen as they were watching this live.
Re:Security Researchers Publish Ryzen Flaws, Gave AMD 24 Hou... by gruturo on Tuesday March 13, 2018 @03:47PM (#16579146)
Regarding Ackman vs Herbalife, the old adage comes to mind: The market can stay irrational longer than you can remain solvent.
Re:Security Researchers Publish Ryzen Flaws, Gave AMD 24 Hou... by tyfon on Tuesday March 13, 2018 @02:04PM (#16578242)
I see.. So it could be a viable business to do research like this, short stock and then release the information. It just has to be a bit more damning than this as the stock price is actually up today!

Seems a bit shady in any case if one were to do this in the same way as when companies pay researchers to make claims publicly that benefit the company like the process leading up to the banning of led in petrol etc.

Re:Security Researchers Publish Ryzen Flaws, Gave AMD 24 Hou... by matt4077 on Tuesday March 13, 2018 @01:22PM (#16577796)
No. Doing independent research is not “inside information”. This is actually pretty close to how a market is supposed to work.

It’s also not market manipulation to publish factual information or opinions. Only knowingly publishing false information would qualify.

Re:Security Researchers Publish Ryzen Flaws, Gave AMD 24 Hou... by Symmetry on Tuesday March 13, 2018 @01:16PM (#16577735)
Well, if it was having an effect I'd be buying AMD right now against the market but it doesn't seem to.

https://finance.yahoo.com/quote/AMD/

Re:Security Researchers Publish Ryzen Flaws, Gave AMD 24 Hou... by chrismorgan on Tuesday March 13, 2018 @11:07PM (#16581970)
I tend to imagine that if Intel were doing this they’d do a better job of it. Even if CTS-Labs are completely legit, the way it’s been done has led to immediate suspicion of the claims and people involved, in a way that feels much more like a small group straining for attention or to make a quick buck and making a bit of a mess of it. If Intel were involved, I’d expect it to be done more professionally and simply better, so that people don’t suspect foul play and go looking for problems. It is possible for a company to deliberately obfuscate the trail by doing it this way, at the probable cost of some effectiveness (though if the claims are overblown it might perhaps be more effective this way), but it seems less likely.
Re:Security Researchers Publish Ryzen Flaws, Gave AMD 24 Hou... by chrismorgan on Wednesday March 14, 2018 @02:18AM (#16582751)
A really fun interpretation of it is AMD doing it themselves, deliberately badly, so that they can come off as the wounded party that actually have really good hardware. Risky, but probably not impossible to carry off.
Re:Security Researchers Publish Ryzen Flaws, Gave AMD 24 Hou... by tripzilch on Friday March 16, 2018 @10:53AM (#16601061)
While fun, it would also mean they would be publicly disclosing vulnerabilities in their own systems and then deliberately withholding the patch, just to put on this shpiel in order to appear as the underdog?
Re:Security Researchers Publish Ryzen Flaws, Gave AMD 24 Hou... by chrismorgan on Friday March 16, 2018 @11:02PM (#16605397)
Confirmation that the vulnerabilities are legitimate pretty much writes this one off. At the time I wrote it this wasn’t entirely clear, though it seemed probable (though even then they could have been overstated).
Re:Security Researchers Publish Ryzen Flaws, Gave AMD 24 Hou... by jcranmer on Tuesday March 13, 2018 @01:45PM (#16578050)
Well, one good thing that could come out of this is that it might tamp down on the use of scaremongering names for security vulnerabilities.