TrailofBits, which performed a third-party analysis and verification of the bugs CTS located, writes:
There is no immediate risk of exploitation of these vulnerabilities for most users. Even if the full details were published today, attackers would need to invest significant development efforts to build attack tools that utilize these vulnerabilities. This level of effort is beyond the reach of most attackers…
These types of vulnerabilities should not surprise any security researchers; similar flaws have been found in other embedded systems that have attempted to implement security features. They are the result of simple programming flaws, unclear security boundaries, and insufficient security testing.
The flaws are real, require updates, and need to be dealt with — but they do not represent a cataclysmic security failure. They certainly do not represent the company-ending apocalypse that CTS Labs’ suspected partner-in-crime, Viceroy Research, said they did. Meanwhile, there’s no sign of any effort by CTS Labs to address the backdoors and critical security flaws baked into tens of millions of Intel motherboards courtesy of their onboard Asmedia controllers, even though the ASM1042 and ASM1142 have shipped on Intel products for the past six years.
Bad Faith Doesn’t Excuse Bad Security
CTS Labs entire effort, start to finish, appears to have been an attempt to weaponize security disclosures and harm a company in the name of earning money for unscrupulous investors. It’s a textbook example of why security analysis and disclosure must be handled carefully. But none of this changes the fact that these security issues shouldn’t have existed in the first place.
Both AMD and Intel have asked computer users to accept the presence of black box security implementations in the name of increased security. Intel has its Intel Management Engine, AMD has its TrustZone processor. AMD uses an ARM solution with a Cortex-A5 integrated processor, Intel uses its own Quark CPU. Both companies have resisted calls to provide documentation and/or open source code for these solutions, and yet the security of both has repeatedly been found wanting. As devices become more tightly integrated and the number of components and IP blocks integrated into SoCs rises, it’s increasingly important manufacturers follow best security practices from start to finish. Both Intel and AMD have more work to do in this regard.