AMD's Future Chips & SoC's: News, Info & Rumours.

Page 61 - Seeking answers? Join the Tom's Hardware community: where nearly two million members share solutions and discuss the latest tech.
Toggle sidebar Toggle sidebar
Status
Not open for further replies.
So, you're going to tell me Intel planned, designed, and produced 6 core dies in a few months? If that's the case, then they're MOD EDIT: LANGUAGE unstoppable. You're wrong, anyhow, since they started planning Coffee Lake since 2015.

Also, Cannonlake was meant to be released in 2016, and it was going to feature Intel's first mainstream 8 core processor. That did not happen, and we got plan B, Kaby Lake and Coffee Lake.

<Watch Your Language!>
 


I note you seem more concerned about number of cores then actual performance numbers, given that despite your complaining Intel has continued to remain ahead of AMD in performance.
 
in fact I think Ryzen release had caused a panic throughout Intel. because even its single core performance was behind intel (not that much) with more cores it beats the best intel was offering back then. Do you know how many people out there use their computers not only for gaming but also for multi core bound applications? Yes, alot. And with Ryzen people had the opportunity to beat Intel's beast with half price and was a threat to the intel's market share. So urgently they needed to reply back however the only way seemed back than was to increase the core count. Yep even they knew that their new architecture won't be ready in time to compete Ryzen so hastly they increased the core count. increased the frequency. And just like ryzen 2 they add some minor tweaks, I beleive which were already ready for the new iteration yet not planned to be released till cannonlake or other desktop CPU line, And you have a fast reply to AMD.

For the people that would comment the time needed to develop the product etc. I know all of these processes and what I would say do not underestimate the power of Intel both regarding the finances and human resources. So a company like Intel, if already developed the technology, can create a new product line within a very short period of time. They have the money, they have the head count, may be the best you can find in the industry, so it is not as difficutl as you may think. Of course still it is not an easy task however as I said before with highly experienced staff this is achievable.

Also please keep in mind that all companies in all the sectors all around the world benchmarks and controlls their competitors. By means of products and development and technology level and patents etc. So before the release of Ryzen, Intel would have a good view of the product. What I mean here is not all the details of the product or so. What I mean is approximate performance figures of the product. This is what marketing and innovation departments do. So They have already see what the product would be like and created a new development plan and so on. I can talk more about this yet it is not the aim of this topic. What I basically say is Inte, and AMD all alike, are monitoring each other. To forecast what their next product will be like. So that they can compete in their own way.

Intel, like nVidia, is now holding back the technologies they have developed. As there is no competition they are enjoying the good income with minor effort. So this can also be expressed as "milking their customers" I can add some slides and marketin terms here about what a "cash cow" product means however they are easy to find in the internet. Right now the life cycle of their "cash cow" products are increased due to lack of competition. If Ryzen was a failure Intel would have never released the coffeee lake.

So if we want more competitive products with competitive prices in graphics and desktop CPU market the only way right now seems to be the success of AMD. I wish there were more competition like Cyrix and so. However this business needs high investments both in hardware and human resources. so right now we are left with literally two companies both in graphic cards and CPU's in desktops. AMD must survive.

I will not be talking about this anymore as I think I made myself clear.
 
AMD Ryzen 7 2700X/2700 and Ryzen 5 2600X/2600 benchmarks leak out
Published: 15th Mar 2018, 10:15 GMT
https://videocardz.com/75305/amd-ryzen-7-2700x-2700-and-ryzen-5-2600x-2600-benchmarks-leak-out
AMD Ryzen 2000 series are roughly a month away.

From AMD Ryzen 7 2700X to Ryzen 5 2600
Multiple leaks have appeared over the course of this week at various benchmarking databases. More importantly, though, they align with the slide deck leak from last week, meaning that the specs we are aware of are most likely correct.
Click to expand...
 
Do yis reckon well see a 2800x ... It does kinda look like some clever marketing move calling the top chip a 2700x.
But I'd say a 2800x may rear it's head when they ramp up production.

Can't wait to see some real bench's, I would love to see some numbers for 3200mhz, 3600mhz & 4000mhz memory with low latency access times 😀
 


I complement it with the written piece: https://www.anandtech.com/show/12536/our-interesting-call-with-cts-labs

You know, the security vulnerabilities might exist and be exploitable as they say, but... They lost face on how they tackled the issue so hard, that the real message got diluted to the point of not even being the main focus of everything. This just smells like a big "publicity stunt" to get them on the map. Problem is, they got on the bad side of the map.

Oh welp, carry on then.

Cheers!
 
If you already have root access the machine is compromised before the exploit is applied it's supposed to be the other way round, the exploit normally gives you the access right....

If you already have admin access to a workstation I mean you can more or less do whatever ya want from there. Install viruses, malware, even exclude said viruses from the virus scan, tracking software can be installed well ya get the point, whatever you want basically can be installed or modified at this point without the exploit !

How is it an exploit at that point when you already have admin privileges like come on the job is done before you implement any exploit, it doesn't make sense ? ?

An you you have to flash with a modified BIOS as well haha..(hello sounds pretty secure to me).. it's ridiculous any machine would be compromised with similar steps EVEN MACHINES WITH INTEL CPU's ! With any CPU for that matter.

If that's the best they could come up with looks like Zen is pretty dam secure lol...

Edit:
One user say's.."There is a new exploit called RyzenVsBaseballBat in which a hacker can cause physical damage to the CPU and subsystems." haha lmfao, what will they come up with next eh. Watch out for those exploits guy's !
 
Our Interesting Call with CTS-Labs
by Ian Cutress on March 15, 2018 7:30 PM EST
IC: Who are CTS-Labs, and how did the company start? What are the backgrounds of the employees?
This is our first major publication. Mostly we do not go public with our results, we just deliver our results to our customers. I should say very importantly that we never deliver the vulnerabilities themselves that we find, or the flaws, to a customer to whom the product does not belong. In other words, if you come to us with a request for an audit of your own, we will give you the code and the proof-of-concepts, but if you want us to audit someone else’s product, even as a consumer of a product or a competitor’s product, or a financial institution, we will not give you the actual code – we will only describe to you the flaw that we find.
Click to expand...
So, they are open to auditing your "competitor's product!" For a small fee I'm sure 😉!

This is our business model. This time around in this project, we started with ASMedia, and as you probably know the story moved to AMD as they imported the ASMedia technology into their chipset. Having studied one we started studying the other. This became a very large and important project so we decided we were going to go public with the report. That is what has brought is here.
Click to expand...

ASMedia is also used in all of Intel's USB 3.0 host controllers and hubs.
Ian Cutress
And every Intel board that uses ASMedia USB 3.0 host controllers and hubs. From all the vendors. Over the last 5+ years. That's 10s of millions.

5:03 PM - 15 Mar 2018
Click to expand...
https://twitter.com/IanCutress/status/974436048641118208

IC: You said that you do not provide flaws to companies that are not the manufacturer of what you are testing. Does that mean that your initial ASMedia research was done with ASMedia as a customer?

ILO: No. So we can audit a product that the manufacturer of the product orders from us, or that somebody else such as a consumer or a third interested party audits from us and then we will provide the part of the description about the vulnerabilities much like our whitepaper but without the technical details to actually implement the exploit.

Actually ASMedia was a test project, as we’re engaged in many projects, and we were looking into their equipment and that’s how it started.
Click to expand...

Really, they will audit a product for a interested party... Like they mentioned above, maybe a competitor's product!

DK: If you are not providing Proof of Concept (PoC) to a customer, or technical details of an exploit, with a way to reproduce it, how are you validating your findings?

YLZ: After we do our validation internally, we take a third party validator to look into our findings. In this case it was Trail of Bits, if you are familiar with them. We gave them full code, full proof of concept with instructions to execute, and they have verified every single claim that we have provided to them. They have gone public with this as well.

In addition to that, In this case we also sent our code to AMD, and then Microsoft, HP, and Dell, the integrators and also domestic and some other security partners. So they have all the findings. We decided to not make them public. The reason here is because we believe it will take many many months for the company, even under ideal circumstances, to come out with a patch. So if we wanted inform consumers about the risks that they have on the product, we just couldn’t afford in our minds to not make the details public.
Click to expand...

And why are they so worried about the customers? Hmmm!!!

C: Can you confirm that money changes hands with Trail of Bits?

(This was publicly confirmed by Dan Guido earlier, stating that they were expecting to look at one test out of curiosity, but 13 came through so they invoiced CTS for the work. Reuters reports that a $16000 payment was made as ToB’s verification fee for third-party vulnerability checking)

YLZ: I would rather not make any comments about money transactions and things of that nature. You are free to ask Trail of Bits.
IC: The standard procedure for vulnerability disclosure is to have a CVE filing and a Mitre numbers. We have seen in the public disclosures, even 0-day and 1-day public disclosures, have relevant CVE IDs. Can you describe why you haven’t in this case?

ILO: We have submitted everything we have to US Cert and we are still waiting to hear back from them.

IC: Can you elaborate as to why you did not wait for those numbers to come through before going live?

ILO: It’s our first time around. We haven’t – I guess we should have – this really is our first rodeo.
Click to expand...
They said they have years of experience in the security sector, but don't know basic industry procedures. Hmmm....

IC: As some of these attacks go through TrustZone, an Arm Cortex A5, and the ASMedia chipsets, can you speak about other products with these features can also be affected?

ILO: I think that the vulnerabilities found are very much … Actually let us split this up between the processor and the chipset as these are very different.

For the secure processor, AMD built quite a thick layer on Trustonic t-Base. They added many features and they also added a lot of features that break the isolation between process running on top of t-Base. So there are a bunch of vulnerabilities there that are not from Trustonic. In that respect we have no reason to believe that we would find these issues on any other product that is not AMDs.

Regarding the chipset, there you actually have vulnerabilities that affect a range of products. Because as we explained earlier, we just looked first at AMD by looking at ASMedia chips. Specifically we were looking into several lines of chips, one of them is the USB host controller from ASMedia. We’re talking about ASM1042, ASM1142, and the recently released ASM1143. These are USB host controllers that you put on the motherboard and they connect on one side with PCIe and on the other side they give you some USB ports.

What we found are these backdoors that we have been describing that come built into the chips – there are two sets of backdoors, hardware backdoors and software backdoors, and we implemented clients for those backdoors. The client works on AMD Ryzen machines but it also works on any machine that has these ASMedia chipsets and so quite a few motherboards and other PCs are affected by these vulnerabilities as well. If you search online for motherboard drivers, such as the ASUS website, and download ASMedia drivers for your motherboard, then those motherboards are likely vulnerable to the same issues as you would find on the AMD chipset. We have verified this on at least six vendor motherboards, mostly the Taiwanese manufacturers. So yeah, those products are affected.
Click to expand...

Even though they focus on AMD, they slip and admit,"but it also works on any machine that has these ASMedia chipsets and so quite a few motherboards and other PCs are affected by these vulnerabilities as well." And what do you know three of my Asus (Intel) motherboards all have ASMedia controllers! By now I'm really curious who paid these guys to run this audit! 😉

IC: On the website, CTS-Labs states that the 0-day/1-day way of public disclosure is better than the 90-day responsible disclosure period commonly practiced in the security industry. Do you have any evidence to say that the paradigm you are pursuing with this disclosure is any better?
I estimate it will be many many months before AMD is able to patch these things. If we had said to them, let’s say, ‘you guys have 30 days/90 days to do this’ I don’t think it would matter very much and it would still be irresponsible on our part to come out after the period and release the vulnerabilities into the open.

So basically the choice that we were facing in this case was either we not tell the public and let the company fix it possibly and only then give it to the public and disclose, and in this circumstance we would have to wait, in our estimate, as much as a year, meanwhile everyone is using the flawed product. Or alternatively we never disclose the vulnerabilities, give it to the company, and then disclose at the same time we are giving it to the company so that the customers are aware of the risks of those products and can decide whether to buy and use them, and so on.

In this case we decided that the second option is the more responsible one, but I would say that in every case that this is the better method. But that is my opinion. Maybe Ilia (CTO) has a slightly different take on that. But these are my concerns.
Click to expand...
I think this is really telling of these guys right here! They choose the second option," so customers are aware of the risks of those products and decide whether to buy and use them, and so on." Yeah, because they are really worried about the consumer, and it's not that they are getting paid to perform this audit and release this information! Right! hahaha

IC: Would it be fair to say that you felt that AMD would not be able to mitigate these issues within a reasonable time frame, therefore you went ahead and made them public?

YLZ: I think that is a very fair statement. I would add that we saw that it was big enough of an issue for the consumer had the right to know about them.
Click to expand...
What a hack job!

IC: How many security researchers did you disclose with before going public?

YLZ: You mean the technical details in full? Trail of Bits was the only external party and then afterwards together with the company we disclosed to Microsoft, HP, Dell, Symantec, FireEye, and CrowdStrike. They have the whole she-bang.
Click to expand...
Interesting who they shared the details with before AMD.

IC: It was stated that, and I quote, that ‘this is probably as bad as it gets in the world of security’. These vulnerabilities are secondary attack vectors and require admin level access and they also do not work in virtualized environments (because you can’t update a BIOS or chip firmware from a virtual machine) without having metal access which is typically impossible in a VM environment. What makes these worse than primary level exploits that give admin access?
Click to expand...
For the next few paragraphs Ian and David Kanter blast CTS hard about bare metal access, and enterprise machines using VRMs! CTS concedes they would have to be comprised systems before hand to have any affect!
DK: I think the biggest question that I still have is that ultimately who originated this request for analysis – who was the customer that kicked this all off?
ILO: I definitely am not going to comment on our customers.
DK: What about the flavor of customer: is it a semiconductor company, is it someone in the industry, or is it someone outside the industry? I don’t expect you to disclose the name but the genre seems quite reasonable.
ILO: Guys I’m sorry we’re really going to need to jump off this call but feel free to follow up with any more questions.
Click to expand...
[End of Call]
Click to expand...
So, they don't want to say who paid them to do this audit, and hang up immediately! What we have here is a couple scammers getting paid to try and crap on AMD! Look at the timing right before an AMD CPU launch! Who is paying them?
https://www.anandtech.com/show/12536/our-interesting-call-with-cts-labs?utm_source=twitter&utm_medium=social

Edit: I added a spoiler to shorten the length, click on the spoiler for more commentary.
 
I just can't imagine.. who would want AMD to look bad ? It's amateur hour as well though. Maybe someone just wanted to short the stock. (or else intel just got majorly ripped off...haha) Surely Intel would come up with something much better than this attempt.. it's a complete farce.
 


Skylake X was most certainly rushed even board manufacturers had no idea, I think coffeelake was probably rushed too however Intel did plan on upgrading their platform for more cores I feel they should have done this with the haswell refresh but hey.

Amd needs to stay on track and meet their goals increasing IPC and frequency should be their number one goal with Zen not just moar cores. Sooner or later one must think Intel will make a brand new architecture.

It's hard to get anywhere when companies like Dell undermine what Amd is doing I refuse to even buy anything Dell to be honest it's sad how big they are in the server market.

Looks like Amd is aiming the 2700x at the 8700k they should do total cost of platforms and performance per dollar comparisons
 


Two keywords: persistence and undetectability. The problem with AMDflaws is that once someone get administrative access, it can install a backdoor that is virtually undetectable, and even if it is detected after spending considerable time, it cannot be deleted, and the only mitigation consists on replacing the hardware.
 


What? They are paid for security checking work? This is a scandal! :sarcastic:



There are two kind of attacks reported: those based in ASMedia chipsets and those exclusive to AMD hardware/software. And for the former kind, having a ASMedia chipset is a needed but not enough requirement, because the chipsets can be implemented in a platform with workarounds to mitigate the flaws on the chipsets.

There is also a fundamental difference between AMD Zen systems and Intel boards with the ASMedia chipsets, as someone else wrote in another part:

Intel boards don't have the same problems because they use the ASM1142 as a USB controller, not their Security Processor.
Click to expand...

For the ASM1142, a USB and PCI interface is added on and you have a USB interface chip. I'm currently working on an ST Micro design that uses an ARM cell as the basis for a USB to serial converter. They use that same ARM cell in the Bluetooth controller attached to the converter. They just add different peripherals to the ARM, more memory, Bluetooth hardware, and encryption hardware for the Bluetooth protocol, etc.

Now what I'm suspecting AMD did was take an ASMedia ARM cell and build their Security Processor around it by adding an encryption engine and other peripherals. But it's that same ARM cell in the middle. And that is where the problem lies. AMD may have left the debug port on the cell open.

Go ahead and read all the articles on the problem again. My theory is consistent with everything that I've been able to find. And is it consistent with CTS finding the problem on Intel boards and AMD. The problem is with the ARM cell, likely the debug port. Its just that on Intel, it's just a USB controller. On AMD, it's the Security Processor with access to everything.
Click to expand...

So this is AMD flaw, not Intel flaw, neither ASMedia flaw.
 
Can AMD Vulnerabilities Be Used to Game the Stock Market?
A shady financial firm tried to bury and short sell AMD based on several security vulnerabilities discovered by CTS Labs. But the tactic appears to have failed.
Lorenzo Franceschi-Bicchierai
Mar 15 2018, 10:09am
Viceroy’s founder, Fraser Perring, was adamant about its company's intentions.

“We haven’t hidden the fact that we short the stock," Perring said in a phone call with Motherboard. "Where does a company with these serious issues go? For us you can’t invest in it."
Click to expand...

https://motherboard.vice.com/en_us/article/bj5wy4/amd-flaws-viceroy-short-selling-stock-market

Now we just wait for the announcement that the SEC and the FBI are investigating this for stock manipulation.

There is no immediate risk of exploitation of these vulnerabilities for most users. Even if the full details were published today, attackers would need to invest significant development efforts to build attack tools that utilize these vulnerabilities.
Click to expand...
https://twitter.com/lorenzoFB/status/974359370824867840
 


This is absolutely a scandal and a scam! Refer to post my post:
http://www.tomshardware.com/forum/id-3341285/amd-naples-server-cpu-info-rumours/page-31.html#20799561




All of these issues require admin/root user access to exploit, which on any system, Intel included, would be compromised and anyone would have free reign of your system anyway! Example: leaving your laptop in a public place with a sticky note attached displaying admin login password.
It doesn't matter that there is a payload with AMD's name on it.
 



Would ya stop same is true for Intel machines 10 million Intel MB use an AsMedia chip (also true for ones that don't use asmedia chips)... sure theirs lots of ways pretty sure thats undectable as well as no one knew Intel was accessing their machines either... Come on guy's if you have admin access you can do whatever ya want to machine. You can install anything any virus or exploit known to man..

Ya can change the password for remote access an use Intel's own backdoor in their built in OS, If IME is disabled sure just enable it.. An this without flashing a modded version of the BIOS !
I'm sure there's loads of other way's of doing it this one jus springs to mind without any research, so what does that tell you.
 


The problem with AMDflaws is that once someone get administrative access, it can install a backdoor that is virtually undetectable, and even if it is detected after spending considerable time, it cannot be deleted, and the only mitigation consists on replacing the hardware.
Click to expand...

The problem is you need admin/root access to begin with. On any system if someone already has that they can do anything they want. Spectre exploits a hardware flaw that allows 99% of CPUs in the last 20 years using speculative branch prediction , Intel included, to be continuously hacked at will without anyone knowing! In comparison these secondary vulnerabilities to AMD are a 1/10 vs. Spectre 10/10 on a threat scale. CTS is a scam security intelligence front company developed by viceroyresearch.org, which is a shell company for a hedge fund! This amounts to stock manipulation and an act punishable by law!
 


Of course, anyone with administrative login credentials cold enter any Intel/AMD syustem and steal info or install backdorrs. This is not the problem that is being reported, because the backdoors in your Intel laptop can be detected and easily eliminated with standard techniques. Unlike what happens with attacks exploiting AMDflaws.

On AMD-Zen system the backdoors are persistent and virtually undetectable. So someone can be accessing your laptop or your server and you almost unable to detect it, and in case you detect some backdoor installed in your AMD system, persistence implies it cannot be eliminated from the system. As experts mention the only mitigation would be to replace your laptop or your server by one new.



No. As explained before the the Intel mobos that use ASMedia chipset use it as USB controller, not as a security processor with access to everything. The flaw only exists on AMD systems. Reason why it is named AMDflaws.
 


Those AMD flaws are real, as confirmed by security experts external to CTS-labs. In fact a whole package research with full technical details and PoCs is on the hands of AMD, Microsoft, HP, Dell, Symantec, FireEye, and Cisco Systems, to help them develop patches and mitigation.
 


You mixed me up with Jaymc for that quote. But my motherboard, and a few others I have, are Asus motherboards that use ASMedia for PCI-E controllers. They are Intel motherboards.
 


CTS used a 3rd party, trail of bits, to evaluate the validity of the vulnerabilities, which they claim took them 5 days. Routers reports trail of bits was paid $16,000, their standard fee, for their consultation. While they did contact the above named companies, with AMD being the last informed, the origins of CTS and viceroyresearch.org has already been uncovered. Viceroyresearch.org develops paperwork in an attempt to devalue companies. They operate in the interests of a hedge fund. CTS white paper is not full of details. They claim to have given the details to the above named companies, and there is not response from any of them yet.
Three Anonymous Guys Wiped $3 Billion Off South Africa Stocks in Four Days
By
January 12, 2018, 5:23 AM EST Updated on January 12, 2018, 8:02 AM EST
https://www.bloomberg.com/news/articles/2018-01-12/faceless-men-upend-south-africa-stocks-on-fears-of-steinhoff-2-0

Their identities have since been exposed.

 


Corrected attribution to jaymc.

I already explained here

http://www.tomshardware.co.uk/forum/id-3341285/amd-naples-server-cpu-info-rumours/page-31.html#20799427

that AMD flaws don't affect to Intel mobos that use ASMedia chipsets for USB or PCie controllers. The problem is only on AMD Zen hardware because AMD uses those ASMedia chips as part of the Zen-platform Secure Processor with access to everything.
 


The CTS whitepaper is full of technical details and PoCs. It has not been published still for obvious security motives.

Trail of bits is not the only that confirmed the findings by CTS-labs.

What relevance has to mention that Trail of bits got paid for their consultancy work?
 
Status
Not open for further replies.

TRENDING THREADS

Latest posts

Moderators online

Share this page

COMPANY
RESOURCES
FOLLOW
Top Bottom