Security Researchers Publish Ryzen Flaws, Gave AMD 24 Hours Prior Notice
1–10 of 359 posts
Re: Security Researchers Publish Ryzen Flaws, Gave AMD 24 Hours Prior Notice
#2>All of the exploits require elevated administrator access, with MasterKey going as far as a BIOS reflash on top of that. CTS-Labs goes on the offensive however, stating that it ‘raises concerning questions regarding security practices, auditing, and quality controls at AMD’, as well as saying that the ‘vulnerabilities amount to complete disregard of fundamental security principles’. This is very strong wording indeed, and one might have expected that they might have waited for an official response.
Extremely fishy. 1-day notice? Such aggressive wording without even the chance for AMD to address the concerns?
Re: Security Researchers Publish Ryzen Flaws, Gave AMD 24 Hours Prior Notice
#3>All of the exploits require elevated administrator access, with MasterKey going as far as a BIOS reflash on top of that. CTS-Labs goes on the offensive however, stating that it ‘raises concerning questions regarding security practices, auditing, and quality controls at AMD’, as well as saying that the ‘vulnerabilities amount to complete disregard of fundamental security principles’. This is very strong wording indee…
I wonder if this is could be Intel up to its old tricks again.
Re: Security Researchers Publish Ryzen Flaws, Gave AMD 24 Hours Prior Notice
#4>All of the exploits require elevated administrator access, with MasterKey going as far as a BIOS reflash on top of that. CTS-Labs goes on the offensive however, stating that it ‘raises concerning questions regarding security practices, auditing, and quality controls at AMD’, as well as saying that the ‘vulnerabilities amount to complete disregard of fundamental security principles’. This is very strong wording indee…
I wonder if this is could be Intel up to its old tricks again.
This is so fishy to me, it's so unprofessional of a security researcher. My tinfoil hat is already rattling...
Re: Security Researchers Publish Ryzen Flaws, Gave AMD 24 Hours Prior Notice
#5> AMD is in the process of responding to the claims, but was only given 24 hours of notice rather than the typical 90 days for standard vulnerability disclosure. No official reason was given for the shortened time.
90 days is not a standard. Nothing was shortened. People are allowed to publish their research whenever they like. Vendor advance notification is optional.
Full, immediate disclosure is responsible.
Re: Security Researchers Publish Ryzen Flaws, Gave AMD 24 Hours Prior Notice
#6Did anyone verify any of these? The whole thing reeks.
Re: Security Researchers Publish Ryzen Flaws, Gave AMD 24 Hours Prior Notice
#7>All of the exploits require elevated administrator access, with MasterKey going as far as a BIOS reflash on top of that. CTS-Labs goes on the offensive however, stating that it ‘raises concerning questions regarding security practices, auditing, and quality controls at AMD’, as well as saying that the ‘vulnerabilities amount to complete disregard of fundamental security principles’. This is very strong wording indee…
Yeah it's suspicious. The website[1] has many fancy infographics, marketable names and fear mongering but you have to dig into the whitepaper[2] to find any details about the actual vulnerabilities. And even then it starts only on page 8 of 20 and you discover that it's vulnerabilities targeting the secure boot infrastructure and you need local admin to exploit them. It's not good but it's not a new Spectre or Meltdown.
If I was the tinfoil hat type I'd guess that Intel is trying to spread FUD but maybe it's just security researchers trying to generate a bit of buzz for their company at the expense of AMD.
[1] https://www.amdflaws.com/ [2] https://safefirmware.com/amdflaws_whitepaper.pdf
Re: Security Researchers Publish Ryzen Flaws, Gave AMD 24 Hours Prior Notice
#8> AMD is in the process of responding to the claims, but was only given 24 hours of notice rather than the typical 90 days for standard vulnerability disclosure. No official reason was given for the shortened time. 90 days is not a standard. Nothing was shortened. People are allowed to publish their research whenever they like. Vendor advance notification is optional. Full, immediate disclosure is responsible.
"Full, immediate disclosure is responsible." says who?
Re: Security Researchers Publish Ryzen Flaws, Gave AMD 24 Hours Prior Notice
#924hrs notice is unheard of.
Who works for CTS-Labs? Attaching your name to a company like that should disqualify you from any future jobs in the security space.
Re: Security Researchers Publish Ryzen Flaws, Gave AMD 24 Hours Prior Notice
#10This is FUD. The original post was flagged, because the domain and website are far from trustworthy. Technically, the accusations seem to be more of a joke.
Hello, Intel?