3 ms·

Gamers Nexus did a good video. Long story short, looks like an investment propaganda attempt to try and get a profit out of shorting AMD stock. Whether this is

Gamers Nexus did a good video. Long story short, looks like an investment propaganda attempt to try and get a profit out of shorting AMD stock. Whether this is a cover for anything else is getting deep into conspiracy. Edit: Not truly fake news

tptacek 9y ago
Except that we know it isn't fake, as Trail of Bits validated the findings and confirmed serious vulnerabilities.
- Level3Basic 9y ago
  Exactly. CTS May be sloppy or naive, but if the people they claim to have shared the vulnerabilities with have been verified, then there's no reason to think there's a Big Conspiracy of Stock Shorters here.
- Arbalest 9y ago
  Not truly fake, then again, a lot of propaganda is also based on an element of truth. Is there any meaningful distinction between propaganda and fake news?
  - tptacek 9y ago
    https://www.youtube.com/watch?v=Kh0Y2hVe_bw https://www.youtube.com/watch?v=Kh0Y2hVe_bw I accept with basically no questions that the announcement was coordinated to enable a stock-shorting scheme. You might be interested to know: this isn't the first time that's happened. I don't care. I don't think these stock-shorting schemes work. I agree with Matt Levine: attempts to profit from stock declines are far from the worst things people can do with vulnerability research --- for instance, they could collude with vendors to withhold disclosure for months or years, which is something that happens. Where I have problems: * When AMD fanatics try to spin the confusion about the story into a claim that CTS-Labs didn't find anything, which we know now to be false. * When anybody reacts to the confusion by announcing to Hacker News that there are immutable norms of vulnerability disclosure that were broken in this case, especially when those supposed norms are false and most especially when they assert obligations researchers have to vendors.
    - ComputerGuru 9y ago
      I don’t even have a problem with shorting. It’s fair game, and a company’s bug bounty should reflect what they stand to lose by not paying top dollar to preempt exactly that. Any talk about the company being “entitled” to anything is BS. If someone had a vulnerability that would get them access into anyone’s Dropbox as their IPO rolls out.. they’ve earned it. I just think if that’s your plan, you best not be bluffing and had better have something really good up your sleeve. I do have a problem with overstating your case and spreading FUD to try to make a quick buck off of at best B+ attempt.
- xeeeeeeeeeeenu 9y ago
  No, they didn't confirm serious vulnerabilities. Excerpt from their blog: >There is no immediate risk of exploitation of these vulnerabilities for most users. Even if the full details were published today, attackers would need to invest significant development efforts to build attack tools that utilize these vulnerabilities. This level of effort is beyond the reach of most attackers
  - cthalupa 9y ago
    None of that discounts these from being serious vulnerabilities. If you are utilizing the secure coprocessor on a machine that is tasked with keeping secrets secure, and you are worried about sophisticated attackers, then this is incredibly serious. Just because it doesn't impact you, or the majority of users, does not mean it is not a severe issue. The majority of users are quite likely to be of low interest to attackers wanting to exploit the secure coprocessor in the first place.
    - hoistbypetard 9y ago
      > If you are utilizing the secure coprocessor on a machine that is tasked with keeping secrets secure, and you are worried about sophisticated attackers, then this is incredibly serious. If you are worried about sophisticated attackers, and you are trusting a "secure coprocessor" with such an unspecified and undocumented interface as this, I'd argue that you have no reason to think that the tool you have chosen to defend against the threat you're worried about is adequate. Contrast a coprocessor with no documented security boundary (if I'm missing something on that front, please post a link!) against a traditional HSM. Sure, the latter have had some flaws too, historically, but the well-defined boundary is key to even being able to assess suitability. I've not seen any documentation of this coprocessor's interface/boundaries at all. Let alone any that approaches the level of detail you'd get with an HSM.
      - cthalupa 9y ago
        I'd agree there - but that doesn't stop AMD from advertising this as a function these CPUs provide, so if you've taken them at their word, this is a big deal.
- ComputerGuru 9y ago
  I have no doubt that the findings are real, but they are more along the lines of bugs rather than “halt the press” gaping security holes. We’ve all publicly disclosed and written patches for countless security vulnerabilities in open source code that’s widely distributed with zero fanfare - not even a cve - because we realize the difference between a security bug and a world-stopping, corporation-killing security bug. And the arrogance of saying something along the lines of “if I gave them a day or a million years it wouldn’t matter because this bug is too big to fix,” is beyond comment. At no point did I give RedHat 24 hours to patch something before coming out with a well-orchestrated PR campaign with the hype engine on overdrive. Just submit a patch, make sure they admit they’re wrong and will take the appropriate measures, and move on. Now if they found a remote exploit that could let me run arbitrary code on any AMD processor even in a sandboxes environment... we’d be having a different discussion altogether.
  - tptacek 9y ago
    If you have admin access to these machines, you can persist into the secure coprocessor. In the presence of these vulnerabilities, it is actually worse to have a secure coprocessor than not to have one at all. They are serious vulnerabilities; about the worst you can have in an enclave scheme. If SGX had a comparable problem, it would be headline news. Does that mean the stock should head to zero, like some crazy prop trading firm claimed they should? The fuck should I know? I am cynical about the impact vulnerabilities have on stock prices and don't think consumers generally care.
    - ComputerGuru 9y ago
      I’m with you, but again, context. A compromised machine used to be a hosed machine until you reinitialized the drive and started clean. People are just starting to wake up to the fact that there’s another computer in your computer to which the same maxims apply. Anyone that is serious about security hopefully knows this. (I have no skin in the AMD/Intel CPU game. Too many machines running both to bother. I can’t believe I have to say this on HN, it’s what I’d expect of [H]ard in 2004.)
    - fencepost 9y ago

tptacek 9y ago

Except that we know it isn't fake, as Trail of Bits validated the findings and confirmed serious vulnerabilities.

Level3Basic 9y ago
Exactly. CTS May be sloppy or naive, but if the people they claim to have shared the vulnerabilities with have been verified, then there's no reason to think there's a Big Conspiracy of Stock Shorters here.
Arbalest 9y ago
Not truly fake, then again, a lot of propaganda is also based on an element of truth. Is there any meaningful distinction between propaganda and fake news?
- tptacek 9y ago
  https://www.youtube.com/watch?v=Kh0Y2hVe_bw https://www.youtube.com/watch?v=Kh0Y2hVe_bw I accept with basically no questions that the announcement was coordinated to enable a stock-shorting scheme. You might be interested to know: this isn't the first time that's happened. I don't care. I don't think these stock-shorting schemes work. I agree with Matt Levine: attempts to profit from stock declines are far from the worst things people can do with vulnerability research --- for instance, they could collude with vendors to withhold disclosure for months or years, which is something that happens. Where I have problems: * When AMD fanatics try to spin the confusion about the story into a claim that CTS-Labs didn't find anything, which we know now to be false. * When anybody reacts to the confusion by announcing to Hacker News that there are immutable norms of vulnerability disclosure that were broken in this case, especially when those supposed norms are false and most especially when they assert obligations researchers have to vendors.
  - ComputerGuru 9y ago
    I don’t even have a problem with shorting. It’s fair game, and a company’s bug bounty should reflect what they stand to lose by not paying top dollar to preempt exactly that. Any talk about the company being “entitled” to anything is BS. If someone had a vulnerability that would get them access into anyone’s Dropbox as their IPO rolls out.. they’ve earned it. I just think if that’s your plan, you best not be bluffing and had better have something really good up your sleeve. I do have a problem with overstating your case and spreading FUD to try to make a quick buck off of at best B+ attempt.
xeeeeeeeeeeenu 9y ago
No, they didn't confirm serious vulnerabilities. Excerpt from their blog: >There is no immediate risk of exploitation of these vulnerabilities for most users. Even if the full details were published today, attackers would need to invest significant development efforts to build attack tools that utilize these vulnerabilities. This level of effort is beyond the reach of most attackers
- cthalupa 9y ago
  None of that discounts these from being serious vulnerabilities. If you are utilizing the secure coprocessor on a machine that is tasked with keeping secrets secure, and you are worried about sophisticated attackers, then this is incredibly serious. Just because it doesn't impact you, or the majority of users, does not mean it is not a severe issue. The majority of users are quite likely to be of low interest to attackers wanting to exploit the secure coprocessor in the first place.
  - hoistbypetard 9y ago
    > If you are utilizing the secure coprocessor on a machine that is tasked with keeping secrets secure, and you are worried about sophisticated attackers, then this is incredibly serious. If you are worried about sophisticated attackers, and you are trusting a "secure coprocessor" with such an unspecified and undocumented interface as this, I'd argue that you have no reason to think that the tool you have chosen to defend against the threat you're worried about is adequate. Contrast a coprocessor with no documented security boundary (if I'm missing something on that front, please post a link!) against a traditional HSM. Sure, the latter have had some flaws too, historically, but the well-defined boundary is key to even being able to assess suitability. I've not seen any documentation of this coprocessor's interface/boundaries at all. Let alone any that approaches the level of detail you'd get with an HSM.
    - cthalupa 9y ago
      I'd agree there - but that doesn't stop AMD from advertising this as a function these CPUs provide, so if you've taken them at their word, this is a big deal.
ComputerGuru 9y ago
I have no doubt that the findings are real, but they are more along the lines of bugs rather than “halt the press” gaping security holes. We’ve all publicly disclosed and written patches for countless security vulnerabilities in open source code that’s widely distributed with zero fanfare - not even a cve - because we realize the difference between a security bug and a world-stopping, corporation-killing security bug. And the arrogance of saying something along the lines of “if I gave them a day or a million years it wouldn’t matter because this bug is too big to fix,” is beyond comment. At no point did I give RedHat 24 hours to patch something before coming out with a well-orchestrated PR campaign with the hype engine on overdrive. Just submit a patch, make sure they admit they’re wrong and will take the appropriate measures, and move on. Now if they found a remote exploit that could let me run arbitrary code on any AMD processor even in a sandboxes environment... we’d be having a different discussion altogether.
- tptacek 9y ago
  If you have admin access to these machines, you can persist into the secure coprocessor. In the presence of these vulnerabilities, it is actually worse to have a secure coprocessor than not to have one at all. They are serious vulnerabilities; about the worst you can have in an enclave scheme. If SGX had a comparable problem, it would be headline news. Does that mean the stock should head to zero, like some crazy prop trading firm claimed they should? The fuck should I know? I am cynical about the impact vulnerabilities have on stock prices and don't think consumers generally care.
  - ComputerGuru 9y ago
    I’m with you, but again, context. A compromised machine used to be a hosed machine until you reinitialized the drive and started clean. People are just starting to wake up to the fact that there’s another computer in your computer to which the same maxims apply. Anyone that is serious about security hopefully knows this. (I have no skin in the AMD/Intel CPU game. Too many machines running both to bother. I can’t believe I have to say this on HN, it’s what I’d expect of [H]ard in 2004.)
  - fencepost 9y ago