- Joined
- Mar 31, 2017
- Messages
- 52 (0.02/day)
Could be Nvidia as well.- should be "CTS Labs, the Intel-based IT security research company"
Could be Nvidia as well.- should be "CTS Labs, the Intel-based IT security research company"
Processor | Intel i7 8700K 5GHz |
---|---|
Motherboard | Asus Z370 Prime |
Cooling | Swiftech H220X |
Memory | G.Skill Trident Z 32GB DDR4 3000 |
Video Card(s) | Asus Strix GTX 1080 Ti |
Storage | Samsung 850 Pro |
Display(s) | Sony Bravia 75" 75X900 4K HDR |
Case | Corsair Graphite 760T |
Power Supply | EVGA 1300W |
Software | Windows 10 64bit Pro |
There's nothing to defend here when there are zero evidence and obviously the whitepaper barely makes any sense. You need a signed bios in one attack to run the malicious code.
It's like saying that MS is potentially distributing malware, because they sign their and their partners' drivers with a key and if that key is available, then you could sign your malware and spread it as MS software.
This has happened before and the key was published by mistake by microsoft... that's how you get those rights to produce and run signed s/w.
What has this become, the JIDF?
The guy said that Jew politics are shady, and reality shows that they claimed Palestine's land as theirs, they built a Wall to keep the natives away from their territory, they keep expanding their borders with various methods, including bombing and they kill on sight anyone who seems not to happy about those israeli soldiers who walk around with rifles.
You should not disagree with the jews, goy, that's antisemetic.
You have 0, that's zero, idea what you are talking about. Malware is many things, it's adware, trojan, virus, rootkit. Most malware doesn't run with root priviledges in many systems, it just needs a certain type of privileges to do its work. Most malware doesn't get planted magically on a PC, and it is usually a user's fault.
I could go on and on, but it's a lost cause, with people who have already shaped opinions and specific dislikes, not even mentioning the theoretical background.
Anyhoo, here's a simple example about the "rm -rf /" malware.
System: Loonix distro w/ systemd.
Systemd mounts Bios partitions in /dev/ and some versions mount it with write privileges for the root user...
If you "run rm -rf /" , you delete parts of your memory mapped bios. what does this mean? It means for for the motherboard to get bricked.
2 bios chips? you have a great chance that you will get it to POST in the next reboot.
1 bios chip? either you have to bring your soldering iron, or try an SPI programmer and there might be a chance for that motherboard.
How does this example align with the current situation?
You could for example take that file pointer from /dev/ and fill it with your "crafted bios"
then from the paper:
>Exploiting MASTERKEYrequires an attacker to be able to reflash the BIOS with a specially crafted BIOS update
nice, and how do you do that
>we suspect an attacker couldoccasionally still succeed in reflashing the BIOS
"suspect"... so you are not very sure.
let's go forth
>This could be done by first exploiting RYZENFALL or FALLOUT
nice, so I have to read Ryzenfall (that's a big claim there on the name) first
let's go to Ryzenfall's technique.
>Accessing the Secure Processor is done through a vendor supplied driver that is digitally signed
What?
So you tell me that asrock, asus, asmedia, american bios, can haz malware with their AMD supplied key?
so, you get the sign, you sign your code and this means that you can have either some microcode running on the cpu in ring -X, or on the bios itself.
How do you obtain the key? well someone has to provide it to you.
So there's no flaw there, a CPU, a peripheral, an embedded system _must_ run digitally signed firmware.
Where's the flaw? I have no idea? MS mistakenly had debug symbols on one of their supplied drivers, they lost a key, they invalidated it and its past.... we had good laughs.
But how come the almighty hack4z0rd W2zzard come up with "malware?
let's see the paper: a 20 page whitepaper that has zero facts, many mistakes, some ridiculous assumptions and some repetitive charts has 32 occurrences of the word "malware".
They are talking about the Arm Trustzone security "flaws", which ofc you have to exploit(if any) in order to gain access to the AMD PSP processor and there's hardly any mention of "Arm flaw".
There's some claim on twitter by one of the CTS guys, that ASMedia has an open windows on their firmware and there's no "ASMedia flaw" (they even say that asmedia's flaw exists because a few years ago asmedia lost a key :facepalm: )
conclusion:
there are some people out there, like w2zzard, who feel that it is their duty to bash some companies... and this has an impact on their sites. I found this thread because w2zzard wrote what he thinks is plausible, backlinks to amdflaws.com, then amdflaws.com backlinks here to say that this is a credible source(someone's opinion) so go read the "article on tpu or vice(uke: ) or other yellow sites.
If there's some PoC that does this, e.g. they get the key from a signed f/w with debug symbols still on the binary( doubt it coz of many embedded system reasons), then you just gain the ability to talk to the cpu. the Arm trustzone and the AMD PSP is well documented on some extend, therefore there's no "security by obscurity" as e.g. in the Intel ME where they didn't even said to the people that they ran on minix.
Unlike the PSP, ME has security flaws, that's why they found many parts of that system, that's how they found the OS it's running, the TCP/IP stack and so forth... that's how the documentation for the ME was written.
Arm trustzone IPs and f/w is available for purchase via Arm holdings. There's nothing to hide, the system has perfect documentation and there's a sh-tload of companies using it and debugging it. You set your own key and the system is secured.
That's a totally different approach and to be quite honest security by obscurity was a method they used in the 50s and 60s.
bonus:
the fail overflow team managed to get priviledges on the ps4 to run linux. how did they did it? there's a video on yt about this. The most interesting thing is that they had physical access to the board, a soldering iron, cables, programmers and a southbridge that was not made by AMD and had privileges to do IOMMU/DMA with the cpu.
They could easily claim "amdead" "ambankrupt" "$0 stock value" and what not, but they are professionals, first, and foremost they are people who have the background to do such exploits.
They knew it's not a Jaguar flaw when your southbridge rights on the memory of the system which is supposed to alter.
grats TPU, you gained, for another time, a few cheap Clicks.
clap();
wait(2000);
clap();
wait(2000);
clap();
return;
P.S.: I might be a Jew, you don't know. Disagreeing with me makes you an potential anti-semite. How does that make you feel? How are you going to sleep tonight?
P.S.: I wonder if there's an occurrence of code running so close to the metal and called malware. If my memory serves me right, this term is not used in bare metal situations and requires an OS and a security flaw to be called malware by researchers (those who submit papers, not those with a credit card and internet access to namecheap for a domain), but I am not sure. Food for thought anyways. See ya in several years again when another bubble hits the market.
Benchmark Scores | Faster than yours... I'd bet on it. :) |
---|
Update 3/14 5:00am ET
Reported by Ars Technica, a second security firm has now spoken publicly about being contacted by CTS-Labs for verification of the vulnerabilities. Gadi Evron, CEO of Cymmetria, stated in a series of tweets that:
Quoted by Ars is David Kanter, founder of Real World Technologies and industry consultant, who verifies that even though these are secondary stage attacks, they can still be highly important. David states that while
- He knows CTS-Labs and vouches for their technical capabilities, but has no knowledge of their business model
- All the vulnerabilites do not require physical access (a simple exe is all that is needed)
- Fallout does not require a reflash of the BIOS
- CTS-Labs believes that the public has a right to know if a vendor they are using makes them vulnerable, which is why no substantial lead time was given.
"All the exploits require root access - if someone already has root access to your system, you're already compromised. This is like if someone broke into your home and they got to install video cameras to spy on you".Ars also quotes Dan Guido, who states that all that is needed to enable these exploits is the credentials of a single administrator:
"Once you have administrative rights, exploiting the bugs is unforunately not that complicated."
Impersonating a public safety officer has very severe penalties.
System Name | BY-2021 |
---|---|
Processor | AMD Ryzen 7 5800X (65w eco profile) |
Motherboard | MSI B550 Gaming Plus |
Cooling | Scythe Mugen (rev 5) |
Memory | 2 x Kingston HyperX DDR4-3200 32 GiB |
Video Card(s) | AMD Radeon RX 7900 XT |
Storage | Samsung 980 Pro, Seagate Exos X20 TB 7200 RPM |
Display(s) | Nixeus NX-EDG274K (3840x2160@144 DP) + Samsung SyncMaster 906BW (1440x900@60 HDMI-DVI) |
Case | Coolermaster HAF 932 w/ USB 3.0 5.25" bay + USB 3.2 (A+C) 3.5" bay |
Audio Device(s) | Realtek ALC1150, Micca OriGen+ |
Power Supply | Enermax Platimax 850w |
Mouse | Nixeus REVEL-X |
Keyboard | Tesoro Excalibur |
Software | Windows 10 Home 64-bit |
Benchmark Scores | Faster than the tortoise; slower than the hare. |
System Name | Pioneer |
---|---|
Processor | Ryzen R9 7950X |
Motherboard | GIGABYTE Aorus Elite X670 AX |
Cooling | Noctua NH-D15 + A whole lotta Sunon and Corsair Maglev blower fans... |
Memory | 64GB (4x 16GB) G.Skill Flare X5 @ DDR5-6000 CL30 |
Video Card(s) | XFX RX 7900 XTX Speedster Merc 310 |
Storage | 2x Crucial P5 Plus 2TB PCIe 4.0 NVMe SSDs |
Display(s) | 55" LG 55" B9 OLED 4K Display |
Case | Thermaltake Core X31 |
Audio Device(s) | TOSLINK->Schiit Modi MB->Asgard 2 DAC Amp->AKG Pro K712 Headphones or HDMI->B9 OLED |
Power Supply | FSP Hydro Ti Pro 850W |
Mouse | Logitech G305 Lightspeed Wireless |
Keyboard | WASD Code v3 with Cherry Green keyswitches + PBT DS keycaps |
Software | Gentoo Linux x64 / Windows 11 |
Still, when you have admin access, does it really matter at that point anymore?
The real vulnerability right there. What if I told you there is a vulnerability in the wild that allows anyone to do anything to a system no matter the OS. Its called the login/password.
While everyone is speculating on this "revelation",
did we notice who did not get the package???
Rather telling don't you think?
Why didn't the Linux foundation receive it?
They're usually the first to come out with
corrective code. If we're doing a "public service"
why not give it to the parties most likely to
correct the problem first? Oh... it becomes
open source and everyone gets to see what
it is... or isn't... anyone ever try to get root
access on a Linux box lately?
Processor | Intel® Core™ i7-13700K |
---|---|
Motherboard | Gigabyte Z790 Aorus Elite AX |
Cooling | Noctua NH-D15 |
Memory | 32GB(2x16) DDR5@6600MHz G-Skill Trident Z5 |
Video Card(s) | ZOTAC GAMING GeForce RTX 3080 AMP Holo |
Storage | 2TB SK Platinum P41 SSD + 4TB SanDisk Ultra SSD + 500GB Samsung 840 EVO SSD |
Display(s) | Acer Predator X34 3440x1440@100Hz G-Sync |
Case | NZXT PHANTOM410-BK |
Audio Device(s) | Creative X-Fi Titanium PCIe |
Power Supply | Corsair 850W |
Mouse | Logitech Hero G502 SE |
Software | Windows 11 Pro - 64bit |
Benchmark Scores | 30FPS in NFS:Rivals |
System Name | Pioneer |
---|---|
Processor | Ryzen R9 7950X |
Motherboard | GIGABYTE Aorus Elite X670 AX |
Cooling | Noctua NH-D15 + A whole lotta Sunon and Corsair Maglev blower fans... |
Memory | 64GB (4x 16GB) G.Skill Flare X5 @ DDR5-6000 CL30 |
Video Card(s) | XFX RX 7900 XTX Speedster Merc 310 |
Storage | 2x Crucial P5 Plus 2TB PCIe 4.0 NVMe SSDs |
Display(s) | 55" LG 55" B9 OLED 4K Display |
Case | Thermaltake Core X31 |
Audio Device(s) | TOSLINK->Schiit Modi MB->Asgard 2 DAC Amp->AKG Pro K712 Headphones or HDMI->B9 OLED |
Power Supply | FSP Hydro Ti Pro 850W |
Mouse | Logitech G305 Lightspeed Wireless |
Keyboard | WASD Code v3 with Cherry Green keyswitches + PBT DS keycaps |
Software | Gentoo Linux x64 / Windows 11 |
All and all, I think this is good that all those vulnerabilities are disclosed now, or in the recent months, since all of those most likely were already known by the governments.
My question is why give Intel a 6 month lead in with their vulnerabilities and not AMD, Im no security expert but why give a company like CTS so much validity when they themselves state on their website that they make money from the corporations they are investigating, if that isn't a red flag then what is?I think he takes exception to the delivery here, not the news itself.
Anyway, it may be a couple of days before we hear anything from AMD. As I understand things, third party validation took 4-5 days.
That said, I just noticed an update in the AT from this morning that may clarify one thing or another... or not.
My question is why give Intel a 6 month lead in with their vulnerabilities and not AMD, Im no security expert but why give a company like CTS so much validity when they themselves state on their website that they make money from the corporations they are investigating, if that isn't a red flag then what is?
Benchmark Scores | Faster than yours... I'd bet on it. :) |
---|
Cts answered that already. If you believe it or not is the issue...My question is why give Intel a 6 month lead in with their vulnerabilities and not AMD, Im no security expert but why give a company like CTS so much validity when they themselves state on their website that they make money from the corporations they are investigating, if that isn't a red flag then what is?
Processor | Intel Core i7 10850K@5.2GHz |
---|---|
Motherboard | AsRock Z470 Taichi |
Cooling | Corsair H115i Pro w/ Noctua NF-A14 Fans |
Memory | 32GB DDR4-3600 |
Video Card(s) | RTX 2070 Super |
Storage | 500GB SX8200 Pro + 8TB with 1TB SSD Cache |
Display(s) | Acer Nitro VG280K 4K 28" |
Case | Fractal Design Define S |
Audio Device(s) | Onboard is good enough for me |
Power Supply | eVGA SuperNOVA 1000w G3 |
Software | Windows 10 Pro x64 |
You have 0, that's zero, idea what you are talking about. Malware is many things, it's adware, trojan, virus, rootkit. Most malware doesn't run with root priviledges in many systems, it just needs a certain type of privileges to do its work. Most malware doesn't get planted magically on a PC, and it is usually a user's fault.
How is Ryzen more adversely impacted than a Core i7 once root access is gained? In either case, I'd argue you already lost the war. Why do these 13 vulnerabilities matter at all? It's like comparing the aftermath of an ant invasion versus a earwig invasion. Full damage control mode response is more or less the same, no?
Processor | Ryzen 7 5700X |
---|---|
Memory | 48 GB |
Video Card(s) | RTX 4080 |
Storage | 2x HDD RAID 1, 3x M.2 NVMe |
Display(s) | 30" 2560x1600 + 19" 1280x1024 |
Software | Windows 10 64-bit |
you are talking about the bios shadow copy? that's not memory mapped but copied to system ram at bootup, and thus writes do not affect the flash chip contentsmemory mapped bios. what does this mean? It means for for the motherboard to get bricked.
talk to the flash chip directly, to erase and write nand pages directly, the same way the flashing software does itrequires an attacker to be able to reflash the BIOS with a specially crafted BIOS update
nice, and how do you do that
I interpret "vendor supplied driver" as "the manufacturer of the chip has provided an (already signed) driver that's available to the public", that can be used for this purpose.>Accessing the Secure Processor is done through a vendor supplied driver that is digitally signed
What?
So you tell me that asrock, asus, asmedia, american bios, can haz malware with their AMD supplied key?
so, you get the sign, you sign your code and this means that you can have either some microcode running on the cpu in ring -X, or on the bios itself.
How do you obtain the key? well someone has to provide it to you.
System Name | Good enough |
---|---|
Processor | AMD Ryzen R9 7900 - Alphacool Eisblock XPX Aurora Edge |
Motherboard | ASRock B650 Pro RS |
Cooling | 2x 360mm NexXxoS ST30 X-Flow, 1x 360mm NexXxoS ST30, 1x 240mm NexXxoS ST30 |
Memory | 32GB - FURY Beast RGB 5600 Mhz |
Video Card(s) | Sapphire RX 7900 XT - Alphacool Eisblock Aurora |
Storage | 1x Kingston KC3000 1TB 1x Kingston A2000 1TB, 1x Samsung 850 EVO 250GB , 1x Samsung 860 EVO 500GB |
Display(s) | LG UltraGear 32GN650-B + 4K Samsung TV |
Case | Phanteks NV7 |
Power Supply | GPS-750C |
Well, now we know that AMD has a similar extra CPU core that does management on their processors.
System Name | Gaming Rig |
---|---|
Processor | AMD Ryzen 5900x |
Motherboard | ASRock X570 Taichi |
Cooling | Corsair Hydro Series H110i Icue Push/Pull |
Memory | G Skill TridentZ F4-3600C16-16GTZNC 64GB |
Video Card(s) | Nvidia RTX 3090 FE |
Storage | 1TB ADATA XPG SX8200 M.2 PCIe NVME |
Display(s) | AOC CU34G2X 34" Curved UltraWide QHD 3440x1440, VA Panel, 1ms 144MHz |
Case | Corsair Graphite Series 600T Mesh |
Power Supply | EVGA SuperNOVA 220-G3-1000-X1 |
Software | Windows 11 Pro |
Processor | Intel Core i7 10850K@5.2GHz |
---|---|
Motherboard | AsRock Z470 Taichi |
Cooling | Corsair H115i Pro w/ Noctua NF-A14 Fans |
Memory | 32GB DDR4-3600 |
Video Card(s) | RTX 2070 Super |
Storage | 500GB SX8200 Pro + 8TB with 1TB SSD Cache |
Display(s) | Acer Nitro VG280K 4K 28" |
Case | Fractal Design Define S |
Audio Device(s) | Onboard is good enough for me |
Power Supply | eVGA SuperNOVA 1000w G3 |
Software | Windows 10 Pro x64 |
Was that a secret ?
Processor | Ryzen 7 5700X |
---|---|
Memory | 48 GB |
Video Card(s) | RTX 4080 |
Storage | 2x HDD RAID 1, 3x M.2 NVMe |
Display(s) | 30" 2560x1600 + 19" 1280x1024 |
Software | Windows 10 64-bit |
I vaguely remember hearing about the Secure Processor being "ARM" during the first Zen briefings. Maybe it wasn't that widely communicated because wasn't really relevant until a few days ago.I don't think most knew about it until very recently. And we definitely didn't know the inner workings of it, like that it was ARM Cortex based.
System Name | BY-2021 |
---|---|
Processor | AMD Ryzen 7 5800X (65w eco profile) |
Motherboard | MSI B550 Gaming Plus |
Cooling | Scythe Mugen (rev 5) |
Memory | 2 x Kingston HyperX DDR4-3200 32 GiB |
Video Card(s) | AMD Radeon RX 7900 XT |
Storage | Samsung 980 Pro, Seagate Exos X20 TB 7200 RPM |
Display(s) | Nixeus NX-EDG274K (3840x2160@144 DP) + Samsung SyncMaster 906BW (1440x900@60 HDMI-DVI) |
Case | Coolermaster HAF 932 w/ USB 3.0 5.25" bay + USB 3.2 (A+C) 3.5" bay |
Audio Device(s) | Realtek ALC1150, Micca OriGen+ |
Power Supply | Enermax Platimax 850w |
Mouse | Nixeus REVEL-X |
Keyboard | Tesoro Excalibur |
Software | Windows 10 Home 64-bit |
Benchmark Scores | Faster than the tortoise; slower than the hare. |
Processor | Ryzen 7 5800X3D |
---|---|
Motherboard | Asus Prime X570 Pro |
Cooling | Deepcool LS-720 |
Memory | 32 GB (4x 8GB) DDR4-3600 CL16 |
Video Card(s) | Gigabyte Radeon RX 6800 XT Gaming OC |
Storage | Samsung PM9A1 (980 Pro OEM) + 960 Evo NVMe SSD + 830 SATA SSD + Toshiba & WD HDD's |
Display(s) | Samsung C32HG70 |
Case | Lian Li O11D Evo |
Audio Device(s) | Sound Blaster Zx |
Power Supply | Seasonic 750W Focus+ Platinum |
Mouse | Logitech G703 Lightspeed |
Keyboard | SteelSeries Apex Pro |
Software | Windows 11 Pro |
AMD has used and been open about ARM Trustzone based Secure Processor since 2013, it's not new in Zen.I vaguely remember hearing about the Secure Processor being "ARM" during the first Zen briefings. Maybe it wasn't that widely communicated because wasn't really relevant until a few days ago.