News Intel Confirms 6GB Alder Lake BIOS Source Code Leak, New Details Emerge

coromonadalix

Distinguished
Nov 26, 2006
122
37
18,610
Can't understand why in 2022 with all of this kind of events, companies will not be better prepared ... always seem a cost issue to implement more securities ... in the end the customer receive all the problems with products who became less and less secure
 
  • Like
Reactions: purple_dragon

LastStanding

Prominent
May 5, 2022
75
27
560
Seems to me since the code was leaked by one of the AIB partners (probably Lenovo in China), that person had elevated access to the code. Can't really protect against that IMO.

My thoughts exactly but many sites still refuses to cover this very concerning story (shocking, right) buuuut... many so-called tech (only in their name ;)) "dictator" site staff are protecting such conversations as branded "low-quality" to protect and secure their stance so they could keep receiving those free-samples and extra perks from those very same unethical questionable companies, in my opinion.

The rule of thumb is - high-risk leaks/infiltrations = 98.9999% an inside job!
 
Last edited:
Nvidia also suffered a recent attack that resulted in the theft of 1TB of its data, but the GPU-making giant retaliated with its own operations to render the stolen data useless.
How was the data rendered useless? Even according to that article, the hacking group claimed to have a backup of the data, which shouldn't even have to be said for an organized extortion group holding stolen data likely valued at millions of dollars. It seems unlikely that they would have actually lost access to it.
 
Oct 9, 2022
5
3
10
Does this not seem like a blatant purposeful leak to see if it would be beneficial to be open source in the future? Or like, an attempt to get the benefits of open source while still retaining the ability to sue whomever they want if they use the code for say, coreboot..... Their official statement seemed more like a request to secure the platform more than address the leak
 

Fates_Demise

Distinguished
Sep 28, 2015
79
36
18,560
Can't understand why in 2022 with all of this kind of events, companies will not be better prepared ... always seem a cost issue to implement more securities ... in the end the customer receive all the problems with products who became less and less secure
Because there are about a million times more hackers
Can't understand why in 2022 with all of this kind of events, companies will not be better prepared ... always seem a cost issue to implement more securities ... in the end the customer receive all the problems with products who became less and less secure
Because its 10x easier to break a door down than build one. There are far more hackers in the world than security design people working for any single company.
Any company trying to fully stop hacking would have to spend billions, only to find out it still wouldn't work and the only true way to keep data in is having zero access to the net.
 

Fates_Demise

Distinguished
Sep 28, 2015
79
36
18,560
Does this not seem like a blatant purposeful leak to see if it would be beneficial to be open source in the future? Or like, an attempt to get the benefits of open source while still retaining the ability to sue whomever they want if they use the code for say, coreboot..... Their official statement seemed more like a request to secure the platform more than address the leak
They addressed the leak just fine, patched the hole, not worried about any issues with the leaked info but just in case anyone finds something we are offering a reward so we can fix it.
Pretty straightforward to me.
 
Oct 9, 2022
5
3
10
How was the data rendered useless? Even according to that article, the hacking group claimed to have a backup of the data, which shouldn't even have to be said for an organized extortion group holding stolen data likely valued at millions of dollars. It seems unlikely that they would have actually lost access to it.
Google is your friend, took me 5 seconds to research his claim...

View: https://twitter.com/BrettCallow/status/1497627779755438083
 
Oct 9, 2022
5
3
10
They addressed the leak just fine, patched the hole, not worried about any issues with the leaked info but just in case anyone finds something we are offering a reward so we can fix it.
Pretty straightforward to me.
Yes you've repeated what I said minus my opinion, congratulations.
 
Oct 9, 2022
5
3
10
Can't understand why in 2022 with all of this kind of events, companies will not be better prepared ... always seem a cost issue to implement more securities ... in the end the customer receive all the problems with products who became less and less secure

An Open source makes code less secure how exactly? Can't understand how someone could think hiding potential flaws from eyes that could recognize and fix them is more secure somehow. And cant understand how keeping it behind a flawed security system (all are) so only someone determined enough to break the security and law and steal the code, so they can recognize the flaws and exploit them, is safer. Also, an open source allows for updates after the company stops support. There is no valid argument for closed source software in my opinion.

You're not safe until you can read the code that you're executing and understand it yourself. Period. Full stop. A good compromise is letting millions of neckbeards scroll through GitHub and wait till they trust it before you use software.
 
Oct 9, 2022
1
0
10
This is EXTREMELY SUSPICIOUS. I believe this leaks are done on purpose to scale back performance with patches and withold Gerenational leaps or Keep on par with competing brands. As most have observed, performance between brands are not that far apart, regardless of the lithography change and evolution in architecture.

Do you think that is coincidence? Why bring out your most powerful ace when less can get the job done? That is all strategy for future iterations.
 
Last edited:
Google is your friend, took me 5 seconds to research his claim...
I think you missed my point. It was a rhetorical question, since the data was clearly not "rendered useless" by Nvidia due to the fact that the hackers obviously had a backup. Even the link you posted includes an image of a post from the hackers claiming the data was backed up and safe, countering the title's claim that "Nvidia successfully hacked back." It can't really be considered a success if the hackers still have the data. Of course, one might not have noticed that if they only spent 5 seconds to read the headline.

And in fact, a few days following that, the hackers publicly released a portion of the data including the DLSS source code and credentials for over 70,000 Nvidia employees, among other things, proving that Nvidia didn't do much aside from possibly inconveniencing them for an afternoon. Yet the writer of this article seems to still be following the narrative that they somehow re-secured their data. The hackers were also claiming that they had more valuable data, like hardware schematics and firmware.

Also, google is not your friend. They are one of the world's largest data harvesting and advertising companies, and you shouldn't let them trick you into thinking otherwise.

An Open source makes code less secure how exactly? Can't understand how someone could think hiding potential flaws from eyes that could recognize and fix them is more secure somehow. And cant understand how keeping it behind a flawed security system (all are) so only someone determined enough to break the security and law and steal the code, so they can recognize the flaws and exploit them, is safer. Also, an open source allows for updates after the company stops support. There is no valid argument for closed source software in my opinion.

You're not safe until you can read the code that you're executing and understand it yourself. Period. Full stop. A good compromise is letting millions of neckbeards scroll through GitHub and wait till they trust it before you use software.
While I wouldn't say open-source is necessarily less secure, it's also questionable whether it's all that much more secure. While availability of the source code might make it easier for researchers to hunt for potential vulnerabilities, it could also make it easier for those looking for exploits to find and use them without ever reporting them. And if many different contributors are working on a piece of software, there may also be the possibility for an organization to incorporate obfuscated security holes that could fly under the radar, and that might not be easy to notice when examining the code. Many larger pieces of software can contain millions, or even tens of millions of lines of code, so any one person is not likely to have a firm grasp of how it all fits together.

In any case, closed-source software is less about ensuring security than it is about making it harder for competitors to copy it. Which, if a company wants to stay ahead of the competition, can make some sense.
 

neojack

Honorable
Apr 4, 2019
611
177
11,140
well, at this point, they may as well publish it officially on github or something, and make it an open-source project.

If enough eyes watch an open source project, they can potentially make it more secure than a close source project only reviewed by a corporate team.
 
well, at this point, they may as well publish it officially on github or something, and make it an open-source project.

If enough eyes watch an open source project, they can potentially make it more secure than a close source project only reviewed by a corporate team.
Not going to happen, they have to be protective of their IP or they risk loosing it and they are not going to loose any of their IP.
 

zszabo

Distinguished
Dec 18, 2008
8
4
18,515
Regarding this quote from the article:
Intel's statement that it doesn't rely upon information obfuscation as a security measure means it has likely scrubbed the most overly-sensitive material before releasing it to external vendors.

"Security through obscurity" is an Information Security term that means relying on secrecy to keep something secure. Intel stated that it does NOT rely on this type of strategy, which is probably because it has been demonstrated not to work in several significant security-related incidents over the last three decades. In other words, it's saying the opposite of what the statement above suggests—i.e. that it does NOT rely on a scheme like scrubbing sensitive information from their publications in order to keep their products secure. The point is, even if it's not published, with enough eyes on it eventually someone is probably going to figure it out anyways. That has been how it has frequently worked out in these cases.

If there is one company that is perhaps most likely to stubbornly insist on using this sort of scheme anyways, it is probably SONY. Anyone here remember the lengths to which it went when George Hotz (what was his moniker again...ah yes, GeoHot—the guy who was first to break the PS3 security mechanism) put up a website? SONY sued him in court, attempting to force release of the IP addresses that had accessed his website. Yes, you read that right. Before that, they were hacked and had tens of thousands of customer credit cards leaked. They apologized, we so deeply sorry, here's two free games, go f*ck yourself with it...and then did it again, within a year, IIRC. And that was even before GeoHot. So yeah, security through obscurity...
 
Last edited: