CTS Labs Speaks: Why It Blindsided AMD With Ryzenfall And Other Vulnerabilities

Page 3 - Seeking answers? Join the Tom's Hardware community: where nearly two million members share solutions and discuss the latest tech.
Toggle sidebar Toggle sidebar
Status
Not open for further replies.
So to all of those saying this is no big deal because it needs admin access...how's your supply chain? Do you buy straight from the mainboard manufacturer and guard the systems in transit? Or do you just trust that everyone that might have had local admin access BEFORE you got the system didn't put anything interesting in your firmware?

Basically, this turns a simple zero day (standard recovery: nuke from orbit, reload new OS) into a "buy new hardware" event *. Not good. And this doesn't even go into how it breaks AMD's vaunted secure VM isolation, basically meaning shady (or legally forced) cloud providers can hack you without you even knowing, despite AMD saying their technology would prevent this.

Remember, this was the exact scenario the PSP was supposed to prevent, but it used a permanently flawed central signing scheme, meaning that even if you wanted to rip out / replace any possibly compromised code, you can't, because the code containing the vulnerabilities is AMD signed and that signature is checked by the hardware. Dumb, dumb design. Intel's no better here with their ME, BTW, and in fact only small ARM chips really don't have this stupid centralized "security" design that keeps getting broken. 🙁

* Yes, technically IF you can get a known good complete ROM image (not just the UEFI update, but a full "golden" ROM for that specific board and CPU), and IF your mainboard allows the Flash to be externally programmed without power applied to the mainboard itself, or IF you can solder / desolder the Flash chip, you can eliminate the threat. That's a lot of ifs though, and in a normal organization there is no way management is going to say "have at our production servers with a soldering iron".
 
Ctsflaws.com

This is the ICO of vulnerabilities. You need super cow powers (admin privleges for the prolls) to execute any of these. Hope they like the money the made from over hyped short selling.

If CTS labs really wanted to help, they would have disclosed minimal information instead of naming all of them and throwing up catchy pictures. The satire site ctsflaws.com is even designed better than this so called tech company's...

Their only goal is to play on Spectre's coat tails with a minimally maliscious code fragment.. Malware has been around for awhile. I'm sure that when they stop degrading the same concept that they are using to keep the vulnerabilities back, another firm will prove that it can be done on any 64 bit system.

They probably got amd64 driver set confused with the AMD product :-D
 
I can't believe this article does not mention CTS' website disclaimer where they say they did no original research, that all information was in the public domain and that they have financial interests involved.
 


That's a bit oversimplified, no? From what I am reading it seems that if anyone had admin at any time on that system, it could be compromised basically forever (barring some rather extreme recovery methods that may or may not be possible and largely rely on vendor cooperation). Buy the hardware from eBay? Hope you like the crypto mining virus that was preinstalled and survives OS wipes / reinstalls and UEFI updates...
 
"CTS labs" is a buch of Israeli dickhead teenagers working for intel, or even sadder, just a buch of AMD haters. I don't think there is anything more to discuss about them. Hope AMD sends their lawyers after them.
 
So if you found out about these alledgedly "catastrophic vulnerabilities" from other sources but not in the regular places, you'd just shrug it off as "nothing to worry about"?

 


And there is no way Chrysler, Enron, GM, Nortel, Sears, PanAm, Eastern Airlines, TWA, etc. can fail in 100 years. Too big to fail is a myth.
 
I expect more from tom's hardware. If accurate, vulnerabilities would require direct access to computer. Both CTS and its PR firm have connections to stock shorting groups.
 
Phishing attacks of all sorts rely on deceiving the user into downloading and running something he dioesn't fully understand. Can you flash a BIOS this way? sure. or anything else for that matter. Could these be real vulnerabilities? absolutely -- assuming you posit the usual unaware users who blindly do what the voice on the telephone tells them "Windows Safety Advisors" [a scam firm, not a real MicroSoft operation] claim is for their benefit.

I think many of these comments are well overboard -- anti-Intel people with a position to defend. Let's wait and see what other researchers conclude about the "flaws".
 
I don't see any corporations wanting to work with CTS labs, ever. If they are going to release all their findings 1 day after informing the company. This has been totally unprofessional for a security firm and while they'll have a great deal of publicity for a little while their business is effectively sunk.
 
That's a bit oversimplified, no? From what I am reading it seems that if anyone had admin at any time on that system, it could be compromised basically forever (barring some rather extreme recovery methods that may or may not be possible and largely rely on vendor cooperation). Buy the hardware from eBay? Hope you like the crypto mining virus that was preinstalled and survives OS wipes / reinstalls and UEFI updates...
Click to expand...

Rootkits aren't new
 
My personal opinion on this is that CTS-Labs gives legitimate security researchers a bad name, and each of their 13 flaws should be responded to in the following ways:

RYZENFALL -- Administrative credentials are powerful; protect them! Make sure what you run and install is trustworthy. Your system does not necessarily know the difference between beneficial and malicious code.

CHIMERA -- Using gamer RGB lighting, overclocking, fan control, and other features necessitates scanning for hotkeys and other shortcuts. Don't use these on sensitive systems as the features create user-level routes between the OS and hardware, plus involves scanning keystrokes for shortcuts.

FALLOUT -- UEFI administrator credentials and the Secure Boot Platform Key private key are powerful; protect them! Your system does not necessarily know the difference between beneficial and malicious firmware or UEFI environment changes.

MASTERKEY -- TPM endorsement and platform authorization are powerful; protect them! Don't let a car thief have your car keys -- they'll steal your car, duh!

Tom's (and other tech sites), please use this as a learning experience. People are paying attention to cybersecurity after Spectre and Meltdown. Organizations are going to try and cash in on any little thing they can find. Take a breather, evaluate the situation, and don't let outfits like CTS-Labs cry wolf before independent, unbiased verification has taken place. If you don't learn from this experience, then next week we'll have QualcommFlaws.com and IntelFlaws.com and NvidiaFlaws.com and so on.
 
I always liked Tom's Hardware, but after reading all I've read about this smearing campaing all over the Internet, it's hard to believe Tom's bought it...
 
So they saw fit to discuss the issue with other manufacturers, but couldn't be bothered to discuss it with the manufacturer in question. I'd like to know who these other manufacturers they discussed it with were and why they were privileged with foreknowledge of AMD's security vulnerabilities while AMD was not.
 


Rootkits that survive a "nuke from orbit" (wipe system disks, reinstall from known good media) are rather new and kind of a big deal. Especially when we're now talking accessibility to the "criminal masses" due to the widespread deployment of affected systems and modern tools for writing this kind of malware -- this isn't a one off targeted attack any more, and should be quite scary. Intel has the same problem, I'm not defending either one of these companies that don't care one bit about their users security. 😛
 
@Nathaniel Mott (article): "That, of course, creates a catch-22 of credibility, because with the details under wraps, most of us in the media (not to mention the curious public) can't examine and evaluate the findings and allegations for ourselves. And because CTS Labs is a new company with no track record to speak of, we can't simply give them the benefit of the doubt."

@Nathaniel Mott (article): "Altogether, it seems that AMD customers may be justified in worrying about these vulnerabilities. If CTS Labs' description of them is accurate, they are remotely exploitable flaws that could allow attackers to install persistent malware in the deepest recesses of a system. That puts consumers at risk, and it could also undermine businesses' secure networks simply because they rely on Ryzen or EPYC processors."

With this kind of warning to prospective buyers, it seems like you are giving an awful lot of benefit of the doubt.
 


Or how about the stock ARM processor that makes up the secure processing element in Ryzen. Not like anyone else is using that.
 


That's actually a very fair point. Rather than attacking the existence of the vulnerabilities, or giving conspiracy type theories on how AMD is a poor victim here (they are NOT, they were warned by the security community years and years ago that the PSP is a bad idea), the media should have latched on to two things:

1.) The vulnerabilities are likely real and nasty, but the disclosure process smells wrong.
2.) In support of the latter assertion, why weren't other systems affected by the same vulnerabilities also called out?
 


Straw man. The ARM processor isn't the problem, how the ARM processor is wired into the rest of the system in such a way as to create a near-perfect rootkit / spyware solution is the issue. Due to that design choice from AMD, getting control of the PSP is game over not just for the current OS install, but for *all future installs going forward* (barring specialist recovery of the firmware). It's also neatly undetectable without specialist attention.
 
Status
Not open for further replies.

TRENDING THREADS

Latest posts

Moderators online

Share this page

COMPANY
RESOURCES
FOLLOW
Top Bottom