Security Researchers Publish Ryzen Flaws, Gave AMD 24 Hours Prior Notice

Re:Security Researchers Publish Ryzen Flaws, Gave AMD 24 Hou... by HelloNurse on Tuesday March 13, 2018 @06:39PM (#16580518)

3. The vulnerabilities are minor, barely worse than normal expected behaviour; just enough to call them vulnerabilities. All these "exploits" consist of using ultra-privileged access (signed device drivers, or flashing the BIOS) for bad purposes.

In the white paper, many attacks are hypothetical and many phrases are vague and slippery, suggesting the "researchers" barely achieved execution of something, not real payloads.

I hope AMD invests the little money needed to fund this sort of PR campaign, er, research initiative, against Intel. The net result would be a greater awareness of the perils of "sponsored" science and of the poor state of PC security.

[ Parent | on HN ]

Re:Security Researchers Publish Ryzen Flaws, Gave AMD 24 Hou... by tptacek on Tuesday March 13, 2018 @06:42PM (#16580539)

You're recapitulating an argument that Arrigo Triulzi posted on Twitter based on his reading of the CPS-Labs white paper. The white paper doesn't include technical information about the flaws.

Dan Guido and Trail of Bits got to read the actual report, and vouched for them as real vulnerabilities. The fact that there are vulnerabilities in signed drivers is a bad thing: it means that AMD shipped cryptographically signed versions of vulnerabilities. Arrigo's twitter thread implied that the use of signed code somehow mitigated the vulnerabilities, but the opposite thing is true.

[ Parent | on HN ]

Re:Security Researchers Publish Ryzen Flaws, Gave AMD 24 Hou... by bigiain on Tuesday March 13, 2018 @07:08PM (#16580715)

Pwn2own, iOS jailbreaking, and Playstation hacking have shown time and time again that chaining up seemingly innocuous exploits to get to the stage where you can run a "minor exploit which requires ultra-privileged access" is definitely within the reach of bored/smart teenagers with no more motivation than a new laptop or gaining the ability to pirate or cheat at games...

Suggesting this is "just hypothetical" because "nobody is going to get physical access or code execution in a signed driver" is pretty shortsighted in my opinion...

[ Parent | on HN ]

Re:Security Researchers Publish Ryzen Flaws, Gave AMD 24 Hou... by HelloNurse on Wednesday March 14, 2018 @04:20AM (#16583169)

When the enemy manages to install a signed driver or flash the BIOS, the difference between being 100% owned by design and being 105% owned because of this sort of vulnerability is the last thing to worry about.

[ Parent | on HN ]