Security Researchers Publish Ryzen Flaws, Gave AMD 24 Hours Prior Notice • Hacker News Board

Re: Security Researchers Publish Ryzen Flaws, Gave AMD 24 Hours Prior Notice

#71

Post by travmatt » Tue, Mar 13, 2018, 5:34 PM UTC

tptacek wrote: post #38

andrepd wrote: post #2

>All of the exploits require elevated administrator access, with MasterKey going as far as a BIOS reflash on top of that. CTS-Labs goes on the offensive however, stating that it ‘raises concerning questions regarding security practices, auditing, and quality controls at AMD’, as well as saying that the ‘vulnerabilities amount to complete disregard of fundamental security principles’. This is very strong wording indee…

Independent researchers don't owe AMD a chance to address anything. They bought the chips on the open market where AMD makes them available, and then used their own time and materials to conduct their own research. Their work product is their own, and AMD has no claim to it. There are, as I see it, two rational, coherent ways to be outraged about this story: 1. The vulnerabilities are fabricated and the report is fra…

I wonder if the unusually short disclosure process was related to their disclosure of related financial interests.

If it was, it’d seem that this research was in support of a financial play similar to how Muddy Waters shorted St. Jude Medical on the basis of insecure medical devices. That would appear to be a legitimate strategy, but if the market didn’t punish Intel for their processor vulnerabilities it seems likely they’d react similarly here and the research would fail to move the stock price in any significant way.

Re: Security Researchers Publish Ryzen Flaws, Gave AMD 24 Hours Prior Notice

#72

Post by [deleted] » Tue, Mar 13, 2018, 5:35 PM UTC

tptacek wrote: post #38

andrepd wrote: post #2

>All of the exploits require elevated administrator access, with MasterKey going as far as a BIOS reflash on top of that. CTS-Labs goes on the offensive however, stating that it ‘raises concerning questions regarding security practices, auditing, and quality controls at AMD’, as well as saying that the ‘vulnerabilities amount to complete disregard of fundamental security principles’. This is very strong wording indee…

Independent researchers don't owe AMD a chance to address anything. They bought the chips on the open market where AMD makes them available, and then used their own time and materials to conduct their own research. Their work product is their own, and AMD has no claim to it. There are, as I see it, two rational, coherent ways to be outraged about this story: 1. The vulnerabilities are fabricated and the report is fra…

[deleted]

Re: Security Researchers Publish Ryzen Flaws, Gave AMD 24 Hours Prior Notice

#73

Post by vzlwe2399 » Tue, Mar 13, 2018, 5:35 PM UTC

dnautics wrote: post #13

simias wrote: post #7

Earlier quoted context omitted.

Yeah it's suspicious. The website[1] has many fancy infographics, marketable names and fear mongering but you have to dig into the whitepaper[2] to find any details about the actual vulnerabilities. And even then it starts only on page 8 of 20 and you discover that it's vulnerabilities targeting the secure boot infrastructure and you need local admin to exploit them. It's not good but it's not a new Spectre or Meltdo…

It's possibly even more nefarious than that: 1) execute a series of puts on AMD, 2) release exploit 3) profit. If you execute an option with a far time horizon and give the company enough time to mitigate their vulns, then I think this is not an irresponsible thing to do (as it incentivises the company to actually do something), but with 24 hours notice...

It's almost as if how government and economy operate aren't well suited to instant revelation of weaponized information

I for one, welcome the impending collapse when the wrong information is released immediately

Re: Security Researchers Publish Ryzen Flaws, Gave AMD 24 Hours Prior Notice

#74

Post by dsacco » Tue, Mar 13, 2018, 5:35 PM UTC

tyfon wrote: post #33

mizzack wrote: post #22

Earlier quoted context omitted.

Seeing as CTS-Lab's CFO also founded a hedge fund you're probably on the right track. >Yaron co-founded CTS-Labs in 2017, and previously served as an intelligence analyst in the Israeli Intelligence Corps Unit 8200. He is also the founder and Managing Director of NineWells Capital, a hedge fund that invests in public equities internationally. He holds a B.A. and M.A. from Yale University.

Basically a follow the money situation. Could something like this be considered inside information? Or is it legal to actively manipulate stock prices to ones benefit in this way?

> Could something like this be considered inside information?

No, illegal insider trading refers to trading on inside information when you have a confidentiality agreement or a fiduciary duty. Information asymmetry is insufficient (or else it would be virtually impossible to profitably trade at all).

> Or is it legal to actively manipulate stock prices to ones benefit in this way?

The way you're presenting this is a false dichotomy. It's not "manipulating" stock prices except insofar as people broadcast news all the time which alters stock prices. Strictly speaking, it's not market manipulation if it's true. If it's false, it can be, which is why you really try not to do it unless it's true.

Re: Security Researchers Publish Ryzen Flaws, Gave AMD 24 Hours Prior Notice

#75

Post by tgsovlerkhgsel » Tue, Mar 13, 2018, 5:35 PM UTC

vesrah wrote: post #28

https://amdflaws.com/disclaimer.html "you are advised that we may have, either directly or indirectly, an economic interest in the performance of the securities of the companies whose products are the subject of our reports"

Doesn't seem to have a noticeable impact though, and based on the (lack of) impact of most previous security issues, I wouldn't have expected it either.

Re: Security Researchers Publish Ryzen Flaws, Gave AMD 24 Hours Prior Notice

#76

Post by eropple » Tue, Mar 13, 2018, 5:35 PM UTC

tptacek wrote: post #38

andrepd wrote: post #2

>All of the exploits require elevated administrator access, with MasterKey going as far as a BIOS reflash on top of that. CTS-Labs goes on the offensive however, stating that it ‘raises concerning questions regarding security practices, auditing, and quality controls at AMD’, as well as saying that the ‘vulnerabilities amount to complete disregard of fundamental security principles’. This is very strong wording indee…

Independent researchers don't owe AMD a chance to address anything. They bought the chips on the open market where AMD makes them available, and then used their own time and materials to conduct their own research. Their work product is their own, and AMD has no claim to it. There are, as I see it, two rational, coherent ways to be outraged about this story: 1. The vulnerabilities are fabricated and the report is fra…

People use AMD chips. It's about more than AMD's stock price.

I do not need to be a security researcher to understand that they, as with everyone else, have an obligation to the body politic to not be a dick (as in all things!). There are actors who may be aware of this attack already--but, as I mentioned elsethread, wider knowledge of attacks like this have a much higher chance of splashing back on end users who literally don't know any better than it does AMD. I mean, I couldn't give less of a shit about how AMD feels--they'll be fine regardless--but there are people downrange of this, not just some company.

This is shoot-the-hostages stuff, and I believe that you are better than to be OK with that.

Re: Security Researchers Publish Ryzen Flaws, Gave AMD 24 Hours Prior Notice

#77

Post by devy » Tue, Mar 13, 2018, 5:36 PM UTC

tptacek wrote: post #38

andrepd wrote: post #2

>All of the exploits require elevated administrator access, with MasterKey going as far as a BIOS reflash on top of that. CTS-Labs goes on the offensive however, stating that it ‘raises concerning questions regarding security practices, auditing, and quality controls at AMD’, as well as saying that the ‘vulnerabilities amount to complete disregard of fundamental security principles’. This is very strong wording indee…

Independent researchers don't owe AMD a chance to address anything. They bought the chips on the open market where AMD makes them available, and then used their own time and materials to conduct their own research. Their work product is their own, and AMD has no claim to it. There are, as I see it, two rational, coherent ways to be outraged about this story: 1. The vulnerabilities are fabricated and the report is fra…

What about responsible disclosure ethics? Yeah they don't owe AMD anything but all AMD users lose - since they claimed there is virtually impossible for any security product to mitigate those vulnerabilities in their televised security vulnerability disclosure interview.

https://www.iso.org/standard/45170.html

Re: Security Researchers Publish Ryzen Flaws, Gave AMD 24 Hours Prior Notice

#78

Post by ldayley » Tue, Mar 13, 2018, 5:38 PM UTC

stevievee wrote: post #50

vesrah wrote: post #28

https://amdflaws.com/disclaimer.html "you are advised that we may have, either directly or indirectly, an economic interest in the performance of the securities of the companies whose products are the subject of our reports"

This is too well organized and presented. My guess is that this has to be financed in some part by a group of short-sellers. They made a rookie mistake though - AMD is plagued by day-traders and algorithms who couldn't give a damn about the fundamentals. Boy the future of capital markets is looking grim.

A new twist on an old game. I hear people ask why short-selling exists, but’s a good check against corruption but prone to it’s own abuses. Citron Research (a short-sell shop) is a good example of this— they savaged companies like NQ Mobile, Lumber Liquidators, etc. and make a bundle doing it.

The security angle is a fascinating and concerning new development, however. That said it may encourage more secure practices (as opposed to theater) through the hardware/software lifecycle in response to serious fundamental design problems.

It will also serve to increase the premium on 0days...

Re: Security Researchers Publish Ryzen Flaws, Gave AMD 24 Hours Prior Notice

#79

Post by spott » Tue, Mar 13, 2018, 5:39 PM UTC

tptacek wrote: post #38

andrepd wrote: post #2

>All of the exploits require elevated administrator access, with MasterKey going as far as a BIOS reflash on top of that. CTS-Labs goes on the offensive however, stating that it ‘raises concerning questions regarding security practices, auditing, and quality controls at AMD’, as well as saying that the ‘vulnerabilities amount to complete disregard of fundamental security principles’. This is very strong wording indee…

Independent researchers don't owe AMD a chance to address anything. They bought the chips on the open market where AMD makes them available, and then used their own time and materials to conduct their own research. Their work product is their own, and AMD has no claim to it. There are, as I see it, two rational, coherent ways to be outraged about this story: 1. The vulnerabilities are fabricated and the report is fra…

>Independent researchers don't owe AMD a chance to address anything.

The goal of responsible disclosure windows have nothing to do with saving face for the company. The point is that it gives the company time to come out with a fix so that their customers aren't left with massive holes in the security of their systems.

Re: Security Researchers Publish Ryzen Flaws, Gave AMD 24 Hours Prior Notice

#80

Post by dsacco » Tue, Mar 13, 2018, 5:42 PM UTC

zitterbewegung wrote: post #42

vesrah wrote: post #28

https://amdflaws.com/disclaimer.html "you are advised that we may have, either directly or indirectly, an economic interest in the performance of the securities of the companies whose products are the subject of our reports"

AMD's stock was negative multiple times today ($11.38 on March 13, 2018 10AM,and at 12Noon on NASDAQ). Shorting the stock would be an obvious play. I have heard of people thinking about trading on security flaws in products but never seen it done in real life.

I've done it once or twice when I reported a vulnerability directly to a company and I knew they'd have to report it to downstream customers pretty quickly. I've also been in discussions for larger vulnerabilities with security-focused hedge funds such as Muddy Waters. Generally I'm weakly skeptical about profiting from it consistently. In particular, funds like Muddy Waters have a pretty high bar for the sort of vulnerability they're willing to work with. You need not only a severe vulnerability, but the right kind of vulnerability, so you know that it can't be swept under the rug.

That said, it's pretty striking to me how aggressive this disclosure is. It may be an attempt to narrow the window and increase the profitability of a short sell.