Security Researchers Publish Ryzen Flaws, Gave AMD 24 Hours Prior Notice
31–40 of 359 posts
Re: Security Researchers Publish Ryzen Flaws, Gave AMD 24 Hours Prior Notice
#32Re: Security Researchers Publish Ryzen Flaws, Gave AMD 24 Hours Prior Notice
#33Earlier quoted context omitted.
It's possibly even more nefarious than that: 1) execute a series of puts on AMD, 2) release exploit 3) profit. If you execute an option with a far time horizon and give the company enough time to mitigate their vulns, then I think this is not an irresponsible thing to do (as it incentivises the company to actually do something), but with 24 hours notice...
Seeing as CTS-Lab's CFO also founded a hedge fund you're probably on the right track. >Yaron co-founded CTS-Labs in 2017, and previously served as an intelligence analyst in the Israeli Intelligence Corps Unit 8200. He is also the founder and Managing Director of NineWells Capital, a hedge fund that invests in public equities internationally. He holds a B.A. and M.A. from Yale University.
Basically a follow the money situation.
Could something like this be considered inside information? Or is it legal to actively manipulate stock prices to ones benefit in this way?
Re: Security Researchers Publish Ryzen Flaws, Gave AMD 24 Hours Prior Notice
#34> AMD is in the process of responding to the claims, but was only given 24 hours of notice rather than the typical 90 days for standard vulnerability disclosure. No official reason was given for the shortened time. 90 days is not a standard. Nothing was shortened. People are allowed to publish their research whenever they like. Vendor advance notification is optional. Full, immediate disclosure is responsible.
And at other times 90 days maybe inadequately short. But 90 is just a round number someone at Google thought is a good idea. And now it's become 'standard'.
I can go with immediate, or I can go with never. But realize that every vuln is different, and their impact (or hardship of writing or applying patches) may not always be fully understood by stakeholders involved before or immediately after the details are released [CVE-2015-0235].
[CVE-2015-0235] https://nvd.nist.gov/vuln/detail/CVE-2015-0235
Re: Security Researchers Publish Ryzen Flaws, Gave AMD 24 Hours Prior Notice
#35One of the co-founders runs a hedge fund.
The website's disclaimer says "you are advised that we may have, either directly or indirectly, an economic interest in the performance of the securities of the companies whose products are the subject of our reports".
Just sayin.
Re: Security Researchers Publish Ryzen Flaws, Gave AMD 24 Hours Prior Notice
#36Re: Security Researchers Publish Ryzen Flaws, Gave AMD 24 Hours Prior Notice
#37Earlier quoted context omitted.
Yeah it's suspicious. The website[1] has many fancy infographics, marketable names and fear mongering but you have to dig into the whitepaper[2] to find any details about the actual vulnerabilities. And even then it starts only on page 8 of 20 and you discover that it's vulnerabilities targeting the secure boot infrastructure and you need local admin to exploit them. It's not good but it's not a new Spectre or Meltdo…
It's possibly even more nefarious than that: 1) execute a series of puts on AMD, 2) release exploit 3) profit. If you execute an option with a far time horizon and give the company enough time to mitigate their vulns, then I think this is not an irresponsible thing to do (as it incentivises the company to actually do something), but with 24 hours notice...
Well, if it was having an effect I'd be buying AMD right now against the market but it doesn't seem to.
Re: Security Researchers Publish Ryzen Flaws, Gave AMD 24 Hours Prior Notice
#38>All of the exploits require elevated administrator access, with MasterKey going as far as a BIOS reflash on top of that. CTS-Labs goes on the offensive however, stating that it ‘raises concerning questions regarding security practices, auditing, and quality controls at AMD’, as well as saying that the ‘vulnerabilities amount to complete disregard of fundamental security principles’. This is very strong wording indee…
Independent researchers don't owe AMD a chance to address anything. They bought the chips on the open market where AMD makes them available, and then used their own time and materials to conduct their own research. Their work product is their own, and AMD has no claim to it.
There are, as I see it, two rational, coherent ways to be outraged about this story:
1. The vulnerabilities are fabricated and the report is fraudulent, in which case, by all means, slag the researchers.
2. The vulnerabilities are real, in which case. AMD is an 11 billion dollar company that got outmaneuvered by what appears to be 4 dudes in a basement.
Re: Security Researchers Publish Ryzen Flaws, Gave AMD 24 Hours Prior Notice
#3924hrs notice is unheard of. Who works for CTS-Labs? Attaching your name to a company like that should disqualify you from any future jobs in the security space.
What's wrong with full disclosure? Ryzen owners ought to be informed ASAP that they're (possibly) vulnerable.
Then why any notice? 24 hours is useless; it almost sounds like they want to claim they disclosed in advance without usefully doing so.
Re: Security Researchers Publish Ryzen Flaws, Gave AMD 24 Hours Prior Notice
#40https://amdflaws.com/disclaimer.html "you are advised that we may have, either directly or indirectly, an economic interest in the performance of the securities of the companies whose products are the subject of our reports"
That’s... sort of ok? It’s not perfect, but it opens up another avenue to finance security audits besides selling exploits to intelligence services, attacking end-users (both worse), and collecting rewards from the companies (better).