This is getting even more dodgier:
https://www.cnbc.com/2018/03/13/reu...israeli-firm-says-it-finds-amd-chip-flaw.html
"New York-based cyber security firm Trail of Bits told Reuters that it had verified the findings from CTS, which paid $16,000 for a review of the AMD vulnerabilities.
A Trail of Bits analyst spent a week reviewing detailed technical reports from CTS, along with "proof of concept" code that could be used to launch attacks on computers running vulnerable AMD chips, Trail of Bits Chief Executive Dan Guido told Reuters.
"These are real security issues in AMD code and processors" that hackers could exploit to manipulate or steal secure data, he said.
For the attacks to work, an attacker must first obtain administrator access to a targeted network, Guido said. ( Reporting by Jim Finkle in Toronto, Arjun Panchadar; Additional reporting by Noel Randewich in New York, Saqib Ahmed in New York and Shariq Khan in Bengalure; Editing by Susan Thomas and Grant McCool)"
In case it wasn't posted earlier, Dan Guido was paid by this "security company" to have his second opinion ready in time for the short sales scam press release:
https://twitter.com/dguido/status/973629551606681600
The AnandTech article should be updated to point out he is not really independent since they're paying him.
Now he decides that there's something fishy after already posting the article? How long did it take people here and other places to do the ground work, a couple of hours?The fact that this crap is still up in the front page is disturbing.
https://twitter.com/IanCutress/status/973598276925689856
Am I reading this right? AMD allows unsigned code to execute in the Secure Enclave?
That's a king sized f-up.
If this turns out to be true, than yes..
Dan Guido, a chip security expert and the CEO of security firm Trail of Bits, told Ars that whatever ulterior motives it may have, the paper accurately describes a real threat. After spending much of last week testing the proof-of-concept exploits discussed in the paper, he said, he has determined that the vulnerabilities they exploit are real.
"All the exploits work as described," he said. "The package that was shared with me had well-documented, well-described write-ups for each individual bug. They're not fake. All these things are real. I'm trying to be a measured voice. I'm not hyping them. I'm not dismissing them."
Ars has a source saying the vulnerabilities are real.
https://arstechnica.com/information...-in-amd-chips-make-bad-hacks-much-much-worse/
Persistent, undetectable.
In case it wasn't posted earlier, Dan Guido was paid by this "security company" to have his second opinion ready in time for the short sales scam press release:
https://twitter.com/dguido/status/973629551606681600
The AnandTech article should be updated to point out he is not really independent since they're paying him.
Ars has a source saying the vulnerabilities are real.
https://arstechnica.com/information...-in-amd-chips-make-bad-hacks-much-much-worse/
Persistent, undetectable.
Sounds like Intel's PR attack... is too weird that the attacks requieres Admin tier permissions.https://www.cnet.com/news/amd-has-a-spectre-meltdown-like-security-flaw-of-its-own/
I'll wait for third party confirmation of the issues before panicking. If it's legit, then it's very bad for AMD- but these guys seem more than a little shady.
The white paper ends by saying all of these vulnerabilities require admin-level privileges.
The reddit thread is pretty fun. I havnt had so much fun in a long time. Tears is running...
So you were completely surprised by the fact that once the murmurs regarding the PSP would finally be subject to independent audits, these issues wouldn't have been discovered?Am I reading this right? AMD allows unsigned code to execute in the Secure Enclave?
That's a king sized f-up.
The fact that this garbage was posted in the way it was by Anandtech is disturbing. Looks like Ian Cutress had the information for awhile before it was made public. Did he even contact AMD himself or prefer to post a nice dramatic article for page hits?
Am I reading this right? AMD allows unsigned code to execute in the Secure Enclave?
That's a king sized f-up.
It says "Beit El Al" on the sign between Super Yuda and Mizrahi Tfahot. Beit roughly means "Home of", and ElAl is an Israeli Airliner.
Lol
I haven't bothered to read the white paper, but since this is supposed to be a flaw in the PSP, the risk would be if you have encrypted your drive using the TPM, then someone steals your whole PC. Normally they won't be able to decrypt the drive, but if they can pwn the PSP then they can.how is this even a exploit then...