Il Circolino di Schede Video

Security Researchers Publish Ryzen Flaws, Gave AMD 24 hours Prior Notice

Come indicato nel articolo, questa puzza... forte...

Incredibile Intel cosa si inventa. :rotfl:

Ma figuriamoci se c'entra qualcosa intel, che di amd se ne frega bellamente

Ciao a tutti come va il mercato?
Si stanno abbassando i prezzi?

Citazione:

---

Originariamente Scritto da Covin

Incredibile Intel cosa si inventa. :rotfl:

---

A prescindere dalla puzza emanata dall'articolo, che cazzo c'entra intel? Sei drogado? GENTODIGIOTTOOOOO

Citazione:

---

Originariamente Scritto da Guido

A prescindere dalla puzza emanata dall'articolo, che cazzo c'entra intel? Sei drogado? GENTODIGIOTTOOOOO

---

Un po' di rispetto per i morti. :sisi:

Diversi hanno associato la cosa ad Intel per via di Israele dove ha una certa presenza (più ovviamente la diretta concorrenza).
Ma se ci fossero stati dietro loro avrebbero fatto una cosa decisamente migliore...

Citazione:

---

Originariamente Scritto da Covin

Un po' di rispetto per i morti. :sisi:

---

Ah già, mi ero dimenticato... dovrebbe essere morta non molti giorni fa tra l'altro :sisi:

- - - Aggiornato - - -

Citazione:

---

Originariamente Scritto da GeeGeeOH

Diversi hanno associato la cosa ad Intel per via di Israele dove ha una certa presenza (più ovviamente la diretta concorrenza).
Ma se ci fossero stati dietro loro avrebbero fatto una cosa decisamente migliore...

---

Tipo le scie chimiche? :bua:

Anandtech - Our Interesting Call with CTS-Labs

Citazione:

---

Originariamente Scritto da Commentary and Clarification

All processors and chips have flaws – some are critical, others are simple, some can be fixed through hardware and software. There are security issues and errata in some processors that are several years old.

CTS-Labs’ reasoning for believing that AMD cannot patch within a reasonable period, coming from ‘industry experts’, seems off – almost as if they believe that when they enter a responsible disclosure time-frame, they cannot reveal the vulnerabilities until they are fixed. The response to the question about Meltdown and Spectre, if they would have the same attitude to the fact that the industry had several months before publication for a coordinated effort, means that despite offering a unilateral reasoning for 0-day disclosure, they would not apply it unilaterally but on a case-by-case basis. The language used is clearly not indicative of their actual feeling and policy.

Blaming the lack of CVE numbers on them being ‘new’ to it, yet citing repeatedly many years of security experience and in cyber-security is also in opposition. It may be their first public disclosure, even as individuals, but I find it hard to believe they were not prepared on the CVE front. Using our own experts, it can take hours for a well-known company to be issued a CVE number, or weeks for an unknown entity. Had CTS-Labs approached a big security firm, or AMD, then these could have been issued relatively easily. CTS-Labs stated that they are waiting for CVE numbers to be issued to going to be an interesting outcome, especially if they appear and/or the time of submission is provided.

It seems a bit odd for a company looking into ASMedia related flaws to then turn their focus onto AMD’s secure processor, using the chipset vulnerabilities as a pivot point. ASMedia chips, especially the USB host controllers cited by CTS-Labs, are used on literally tens of millions of Intel-based motherboards around the world, from all the major OEMs. For a large period of time, it was hard to find a system without one. The decision to pivot on newer AMD platforms is a weak argument, the wishy-washy language when discussing projects at the start of the company’s existence, and the abrupt ending to the call when asked to discuss the original customer could be construed (this is conjecture here) that the funding for the product was purposefully directional towards AMD.

The discussion about the understanding of how vulnerabilities can be mitigated certainly piqued David’s interest. The number of things that can be done through microcode, or that are undocumented to third-party chip analysts, means that it came across as highly strange that CTS-Labs were fervent in their believe that AMD could not patch the issue in reasonable time to warrant a longer reasonable disclosure period (one of many arguments used). As seen in recent vulnerabilities and responsible disclosures, chip designers have implemented a number of significant methods to enable/disable/adjust features that were not known to be able to be adjusted, such as resetting a branch predictor. All it takes is for the chip company to say ‘we can do this’ and for it to be implanted, so the use of high-impact language was certainly noted. The confusion between microcode and FPGA in the discussion also raised an eyebrow or three.

When approaching the subject of virtualized environments, the short sharp acceptance that these vulnerabilities were less of an issue in VMs and with cloud providers was quickly overshadowed by the doom and gloom message for if a system was already compromised, even when it was stated that analyst expect 10% market share for EPYC by 2020. It was clear that the definitions of enterprise deployments seemed to differ between AnandTech and CTS-Labs, again partnered with amounts of doom and gloom.

Lastly, the legal argument of not being able to share the details outside of Israel, or only to registered security companies outside of Israel, was an interesting one we were not expecting. This being coupled with the lack of knowledge on the effect of an open disclosure led us to reach out to our legal contacts that are familiar with the situation. This led to the line:

Citazione:

---

“It’s BS, no restrictions.”

---

Some of our contacts, and readers with security backgrounds, have privately confirmed that most of this is quite fishy. The combination of the methodology and presentation with a new company that both claims to have experience but can’t do CVE numbers is waving red flags.

---

Citazione:

---

Originariamente Scritto da Opinion

Going back to the two original questions, here is where I personally stand on the issue:

Citazione:

---

One What are the vulnerabilities, how bad are they, and what can be done?

---

One, if the vulnerabilities exist: It is very likely that these vulnerabilities are real. A secondary attack vector that could install monitoring software might be part of a multi-layer attack, but offering a place for indiscriminant monitoring of compromised systems can be seen as an important hole to fix. At this point, the nearest trusted source we have that these vulnerabilities are real is from Alex Ionescu, a Windows Internals Expert who works for CrowdStrike, one of the companies that CTS-Labs says has the full disclosure documents. That is still a stage a bit far from us to warrant a full confirmation. Given that Trail of Bits required 4-5 days to examine CTS-Labs work, I suspect it will take AMD a similar amount of time to do so. If that is the case, AMD might have additional statements either on Friday or Monday, either confirming or rebutting the issues, and discussing future action.

Citazione:

---

Two Who are CTS-Labs, how come their approach to reasonable responsible disclosure differs to other security firms, how come a number of elements about the disclosure are atypical of a security firm, what is thier financial model, and who are their clients?

---

Two, the status of CTS-Labs: I’m more than willing to entertain the fact that as a first public high-level disclosure, a security company can be out of step with a few of the usual expected methods of responsible disclosure and presentation. A number of new security companies that want to make a name for themselves have to be bold and brash to get new customers, however we have never quite seen it to this extent – normally the work speaks for itself, of the security company will develop a relationship with the company with the vulnerability and earn its kudos that way. The fact that CTS-Labs went with a polished website (with nine links to download the whitepaper, compared to the Meltdown/Spectre websites that had one), and a PR firm is definitely a different take. The unilateral reasoning for a 0-day/1-day disclosure, followed by a self-rebuttal when presented with a more significant issue, shows elements of inconsistency in their immediate judgement. The lack of CVEs ready to go, despite the employees having many years of experience, as well as experience in the Israeli equivalent of the NSA in Unit 8200, does seem as opposites; an experienced security team would be ready. The swift acceptance that cloud-based systems are vulnerable but then going straight into doom and gloom, despite the limited attack surface in that market, shows that they are focusing on the doom and gloom. The reluctance for CTS-Labs to talk about clients and funding, or previous projects, was perhaps to be expected.

The initial downside of this story coming into the news was the foreboding question of ‘is this how we are going to do security now?’. Despite the actions of CTS and their decision to go with a 24-hour period, after speaking to long-term industry experts at high profile technology companies, a standard 90-180 day pre-disclosure period is still the primary standard that manufacturers would expect security companies to adhere with to actively engage with responsible information and verification. We were told that to go beyond/behind this structure ultimately formulates a level of distrust between the company, the security agency, and potentially the clients, regardless of the capabilities of the security researchers or the severity of the issues found; moreso if the issues are blown out of proportion in relation to their nature and attack surface.

---

Citazione:

---

Originariamente Scritto da Guido

A prescindere dalla puzza emanata dall'articolo, che cazzo c'entra intel? Sei drogado? GENTODIGIOTTOOOOO

---

I domain relativi a 'sta cazzata sono stati registrati casualmente esattamente durante i giorni nei quali Intel veniva a conoscenza di Meltdown e Spectre.

Citazione:

---

Originariamente Scritto da Entreri

Ma figuriamoci se c'entra qualcosa intel, che di amd se ne frega bellamente

---

Se ne frega così tanto che nel panico totale dopo il lancio di Ryzen hanno anticipato di un anno il lancio delle loro cpu successive, mettendo insieme soluzioni a pene di segugio. :asd:

Non ci sono prove e (spero) non ci saranno per incolpare direttamente Intel, certo. Però puzza fin troppo.


edit: per chi non avesse visto il video di gamer nexus

https://www.youtube.com/watch?v=ZZ7H1WTqaeo

punti salienti:

- tutte le vulnerabilità richiedono accesso root. Non serve un genio per dire che se hai accesso admin con username e password al pc, le "vulnerabilità" sono un pelo na cazzata. :asd:

- non solo non viene presentato nessun dettaglio tecnico e l'unica prova dell'esistenza di uno degli exploit è uno screen con "1337" scritto nella schermata del BIOS al boot, ma vengono date 24 ore di anticipo ad AMD, al contrario della scoperta di Spectre e Meltdown dove, per buon senso, è stata prima di tutto avvisata Intel con mesi di anticipo, POI i media ed il pubblico generale.

- il paper presenta multipli attacchi personali ad AMD come compagnia, con tante frasi per generare panico e spostare soldi, proprio in maniera palese.

- il paper è fatto da gente sconosciuta a chi lavora nel settore, con video usando fondali di shutterstock, su siti registrati stranamente proprio mentre Intel veniva a conoscenza di Spectre e Meltdown

L'articolo di Anandtech basta per capire che questi ciarlatani sono stati pagati da qualcuno per mettere AMD in cattiva luce.

Citazione:

---

Originariamente Scritto da Covin

L'articolo di Anandtech basta per capire che questi ciarlatani sono stati pagati da qualcuno per mettere AMD in cattiva luce.

---

Oppure, probabilmente, è uno schema per giocare con il mercato.

Citazione:

---

Originariamente Scritto da Galf

I domain relativi a 'sta cazzata sono stati registrati casualmente esattamente durante i giorni nei quali Intel veniva a conoscenza di Meltdown e Spectre.

---

L'anno scorso? Intel e gli altri erano gia' stati informati da mesi prima di gennaio 2018. E si, di AMD se ne strafrega, considerandone la dimensione e le quote di mercato. Editato: coffee lake soluzione a pene di segugio? Mhhh

Lanciare Coffee Lake in fretta e furia indica proprio quanto poco tema un ritorno ai tempi del Athlon 64... :sisi:

Citazione:

---

Originariamente Scritto da Entreri

L'anno scorso? Intel e gli altri erano gia' stati informati da mesi prima di gennaio 2018. E si, di AMD se ne strafrega, considerandone la dimensione e le quote di mercato. Editato: coffee lake soluzione a pene di segugio? Mhhh

---

Ho scritto quello che ho scritto e non ho scritto quello che non ho scritto.

I domain relativi a 'sta cazzata sono stati registrati casualmente esattamente durante i giorni nei quali Intel (intel INTEL) veniva a conoscenza di Meltdown e Spectre.
Quindi sì l'anno scorso, non Gennaio 2018, come infatti non ho mai scritto nel mio post.

Eddaje.

edit: sì a pene di segugio, hanno buttato in un marasma totale tutti i produttori di mobo, con addirittura CPU che son praticamente uguali alla serie precedente ma senza la GPU integrata. :asd:

Citazione:

---

Originariamente Scritto da Galf

Ho scritto quello che ho scritto e non ho scritto quello che non ho scritto.

I domain relativi a 'sta cazzata sono stati registrati casualmente esattamente durante i giorni nei quali Intel (intel INTEL) veniva a conoscenza di Meltdown e Spectre.
Quindi sì l'anno scorso, non Gennaio 2018, come infatti non ho mai scritto nel mio post.

Eddaje.

edit: sì a pene di segugio, hanno buttato in un marasma totale tutti i produttori di mobo, con addirittura CPU che son praticamente uguali alla serie precedente ma senza la GPU integrata. :asd:

---

Il sito amdflaws non era stato registrato il 22 febbraio?

Citazione:

---

Originariamente Scritto da Entreri

Il sito amdflaws non era stato registrato il 22 febbraio?

---

"The CTS-labs.com domain name was registered on June 25, 2017, around when the Meltdown exploits were privately revealed to Intel. AMDFlaws.com, the domain that lists the exploit whitepaper, was registered on February 22, 2018. Both are GoDaddy domains."

Ripeto che dubito seriamente Intel centri in alcun modo, questa cosa è troppo pagliacciata... mi aspetterei qualcosa di più "fine".
Poi per Spectre erano stati informati tutti i big.

Citazione:

---

Originariamente Scritto da GeeGeeOH

Lanciare Coffee Lake in fretta e furia indica proprio quanto poco tema un ritorno ai tempi del Athlon 64... :sisi:

---

Il lancio frettoloso dei Pentium dual, che facevano cagare come dual core e le presero dagli Athlon X2? :asd: