Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The RCE that AMD won't fix

mrbruh.com

Post reply on HN
Print view View original

91–100 of 182 posts

Re: The RCE that AMD won't fix

#91

Post by jbstack »

lloeki wrote: post #78
da_chicken wrote: post #43

Earlier quoted context omitted.

Sure. New sales means new revenue. Maintenance and support is just overhead. It's shortsighted, but modern capitalism is more shortsighted than Mr. Magoo.

It's a cost vs benefit. As long as the cost of such blatant violation of security principles doesn't outweight the benefit of focusing on something else, nothing is done. https://www.legalexaminer.com/lestaffer/legal/gm-recall-defe... https://www.youtube.com/watch?v=IA2EBWFCULg

I don't buy it. It makes sense for a small company where the cost of fixing it might be noticed. But AMD generates some ~$30bn in annual revenues. How much of a developer's time does it take to change the code to use HTTPS? $1000? $5000? Let's be extreme and call it $10,000. That's 0.00003% of AMD's annual revenue. It's barely even a rounding error on their accounts.

Re: The RCE that AMD won't fix

#92

Post by xattt »

digiown wrote: post #22

One good thing we can say about Linux bundling all the drivers is that it obviates the need to run almost all of this type of low quality (if not outright spyware) driver management software. They are especially problematic because they can't be sandboxed easily like most other proprietary crap. For whatever reason, distro maintainers working for free seem a lot more competent with security than billion dollar hardwa…

Aren’t vendors moving to a browser-based control model, where the hardware runs on a local web server that exposes various settings? It sounds terrible for security.

Re: The RCE that AMD won't fix

#93

Post by kasabali »

digiown wrote: post #22

One good thing we can say about Linux bundling all the drivers is that it obviates the need to run almost all of this type of low quality (if not outright spyware) driver management software. They are especially problematic because they can't be sandboxed easily like most other proprietary crap. For whatever reason, distro maintainers working for free seem a lot more competent with security than billion dollar hardwa…

Ryzen master isn't a driver. Most of its functionality isn't even available in Linux, even with 3rd party tools or drivers.

Re: The RCE that AMD won't fix

#94

Post by kasabali »

pooper wrote: post #82
pixl97 wrote: post #24

Earlier quoted context omitted.

As someone that works security, the whole "A compromised DNS on the network" would be a total excuse not to pay. The fact is allowing any type of unsigned update on HTTP is a security flaw in itself. >someone would probably point out a much easier way to compromise the networ No, not really. That's why every other application on the planet that does security of any kind uses either signed binaries or they use HTTPSON…

> The fact is allowing any type of unsigned update on HTTP is a security flaw in itself. Reminds me about ten years or so ago when I was installing Debian or something and I noticed the URL for the apt install mirrors were http and not https. People helpfully pointed out this is a non issue because the updates are signed. Ok I guess but then why did Debian switch to https?

> Ok I guess but then why did Debian switch to https?

Because security people kept bullying them?

Re: The RCE that AMD won't fix

#95

Post by dns_snek »

bb88 wrote: post #11

It's not directly an RCE unto itself, it requires something else. A compromised DNS on the network, e.g. So no surprise they ignored it. Also, if AMD is getting overwhelmed with security reports (a la curl), it's also not surprising. Particularly if people are using AI to turn bug bounties into income. Lastly if it requires a compromised DNS server, someone would probably point out a much easier way to compromise the…

You're completely misunderstanding the impact. If you run AMD's software you're effectively giving root access to your computer to any wifi network you connect to and any person who happens to be on that network.

Re: The RCE that AMD won't fix

#96

Post by hpdigidrifter »

account42 wrote: post #85
dbtablesorrows wrote: post #70

Earlier quoted context omitted.

Ah I think I never had to do connect to a public open hotspot because by the time I grew up 4G and then 5G internet were commonplace.

Never travelled to another country and needed internet before you could get a local sim working?

Airport is prime for this but in general the average person keeps wifi on and the click through on an Android to use open networks is so seamless

Re: The RCE that AMD won't fix

#97

Post by scott_w »

jbstack wrote: post #91
lloeki wrote: post #78

Earlier quoted context omitted.

It's a cost vs benefit. As long as the cost of such blatant violation of security principles doesn't outweight the benefit of focusing on something else, nothing is done. https://www.legalexaminer.com/lestaffer/legal/gm-recall-defe... https://www.youtube.com/watch?v=IA2EBWFCULg

I don't buy it. It makes sense for a small company where the cost of fixing it might be noticed. But AMD generates some ~$30bn in annual revenues. How much of a developer's time does it take to change the code to use HTTPS? $1000? $5000? Let's be extreme and call it $10,000. That's 0.00003% of AMD's annual revenue. It's barely even a rounding error on their accounts.

Because that's not how corporate maths works. The comparison is not "what is the cost of this vs our current revenue?" The calculation is "what could that engineer be doing instead and what is that worth vs fixing this issue?"

Will fixing this issue bring in more revenue than ignoring it and building a new feature? Or fixing a different issue? If the answer is "no" then the answer is that it doesn't get fixed.

Re: The RCE that AMD won't fix

#98

Post by dns_snek »

krater23 wrote: post #83

Auto Update is EVERYTIME a RCE. When the software checks a signature, you just need the key. And the delivering enterprise have the key. EVERYTIME. Don't understand why most people mean auto updating software would in any way create more security. It just creates more attack vectors for every software that has a auto updater.

Remote Code Execution (RCE) is a type of vulnerability. Intentionally running code from a developer you trust is not a vulnerability.

An auto-update mechanism only becomes an RCE if it allows unauthorized third parties to execute code on your machine by failing to verify that the code comes from a legitimate source.

> you just need the key

Secrecy of cryptographic keys is the basis of all cryptography we use. There's no "just", you need the key and you don't have it.

Re: The RCE that AMD won't fix

#99

Post by tw04 »

jbstack wrote: post #91
lloeki wrote: post #78

Earlier quoted context omitted.

It's a cost vs benefit. As long as the cost of such blatant violation of security principles doesn't outweight the benefit of focusing on something else, nothing is done. https://www.legalexaminer.com/lestaffer/legal/gm-recall-defe... https://www.youtube.com/watch?v=IA2EBWFCULg

I don't buy it. It makes sense for a small company where the cost of fixing it might be noticed. But AMD generates some ~$30bn in annual revenues. How much of a developer's time does it take to change the code to use HTTPS? $1000? $5000? Let's be extreme and call it $10,000. That's 0.00003% of AMD's annual revenue. It's barely even a rounding error on their accounts.

You don’t believe it? It took until the early 2000s for Microsoft to take security seriously and they were a money printing machine.

Re: The RCE that AMD won't fix

#100

Post by hulitu »

Kodiack wrote: post #74
hulitu wrote: post #63

Earlier quoted context omitted.

> Like couldn't you just sit in an airport and open up a wifi hotspot and almost immediately own anyone with ATI graphics? Some of us do not enable automatic updates (automatic updates are the peak of stupidity since Win98 era). And, when you sit in an airport, you don't update all your programs.

Automatic updates are absolutely not peak stupidity. Most users’ devices would have nasty security vulnerabilities wide open for a much longer period of time without automatic updates.

This asuming Automatic updates fix security vulnerabilities, which is almost never the case.
Post reply on HN