
Security Researchers Publish Ryzen Flaws, Gave AMD 24 Hours Prior Notice - andrepd
https://www.anandtech.com/show/12525/security-researchers-publish-ryzen-flaws-gave-amd-24-hours-to-respond
======
goodmachine
Amazing coincidence!

On the very same day this information came out, 'Viceroy Research Group'
managed to release a 33-page 'analysis' of these results. With illustrations.

Headline:

>We believe AMD is worth $0.00 and will have no choice but to file for Chapter
11 (Bankruptcy) in order to effectively deal with the repercussions of recent
discoveries.

Viceroy Research lists no employees or contact address, but it appears they
are not a crack team of hardworking & incisive business analysts, but two
Australian teenagers and a former UK child social worker, struck off in 2014
for misconduct.

They have previous form in producing or plugging short-call stories (quite
effectively), and latterly investigated by South African media for similar
shady business.

[https://www.moneyweb.co.za/in-
depth/investigations/viceroy-u...](https://www.moneyweb.co.za/in-
depth/investigations/viceroy-unmasked/)

It took very little internet sleuthing to find this stuff out. None of the
tech press bothered to do so.

Disclaimer: I have no position in AMD.

Edit: link to Viceroy
[https://viceroyresearch.org/](https://viceroyresearch.org/)

~~~
chmod775
If you look at the metadata of both the white paper and the analysis, you can
see that the creation time of them is only 2 hours, 50 minutes apart.

And that's the creation date, not even when they were published.

[https://pastebin.com/CcDTz0hB](https://pastebin.com/CcDTz0hB)

~~~
chmod775
(Replying to myself because I can't edit my post anymore)

 _Edit:_ And it gets better! If you check the HTTP headers when requesting the
whitepaper from their servers, it will tell you that the file was placed there
(last-modified) at 13:22 GMT, so just 1 hour before Viceroy Research Group
created their analysis - and probably ages before the actual news broke.

[https://pastebin.com/gXVd9cff](https://pastebin.com/gXVd9cff)

------
andrepd
>All of the exploits require elevated administrator access, with MasterKey
going as far as a BIOS reflash on top of that. CTS-Labs goes on the offensive
however, stating that it ‘raises concerning questions regarding security
practices, auditing, and quality controls at AMD’, as well as saying that the
‘vulnerabilities amount to complete disregard of fundamental security
principles’. This is very strong wording indeed, and one might have expected
that they might have waited for an official response.

Extremely fishy. 1-day notice? Such aggressive wording without even the chance
for AMD to address the concerns?

~~~
tptacek
Independent researchers don't owe AMD a chance to address anything. They
bought the chips on the open market where AMD makes them available, and then
used their own time and materials to conduct their own research. Their work
product is their own, and AMD has no claim to it.

There are, as I see it, two rational, coherent ways to be outraged about this
story:

1\. The vulnerabilities are fabricated and the report is fraudulent, in which
case, by all means, slag the researchers.

2\. The vulnerabilities are real, in which case. AMD is an 11 billion dollar
company that got outmaneuvered by what appears to be 4 dudes in a basement.

~~~
eropple
People use AMD chips. It's about more than AMD's stock price.

I do not need to be a security researcher to understand that they, as with
everyone else, have an obligation to the body politic to not be a dick (as in
all things!). There are actors who may be aware of this attack already--but,
as I mentioned elsethread, wider knowledge of attacks like this have a much
higher chance of splashing back on end users who literally don't know any
better than it does AMD. I mean, I couldn't give less of a shit about how AMD
feels--they'll be fine regardless--but there are _people_ downrange of this,
not just some company.

This is shoot-the-hostages stuff, and I believe that you are better than to be
OK with that.

~~~
bigiain
> I do not need to be a security researcher to understand that they, as with
> everyone else, have an obligation to the body politic to not be a dick

So are you talking about AMD being dicks by releasing buggy chips, or the
researchers somehow being dicks for finding out?

Related question: if a "food security researcher" discovered a vendor was
selling contaminated produce - would it be reasonable for them to give the
vendor 90 days notice before telling the public?

While I think it's reasonable and appropriate professional practice for _some
people/teams_ to go down the "coordinated disclosure" path (I think the world
is a better place for having Tavis Ormandy disclose the way he chooses to), it
does without doubt benefit the company who's products are flawed more than the
researcher or the public. Anybody who knows they work at a firm that's going
to be described dismissively like AMD here did "This company was previously
unknown to AMD" is quite likely correct to publish-and-be-damned, because you
can bet there's a non-zero chance that AMD's response to non-public disclosure
is going to include either stonewalling and stringing the problem out as long
as possible, or lawyering up ad threatening to sue the "previously unknown to
AMD" company into oblivion.

If you don't want public disclosure of security flaws about your products,
either don't make flawed products or don't ship them to the public. Especially
if some of the key selling features of said product include bullet points like
"AMD Secure OS".

~~~
viraptor
> about AMD being dicks by releasing buggy chips

Everybody releasing chips releases buggy chips. It's the current reality of
both hardware and software. Unless they do it maliciously, they're not dicks.

~~~
tptacek
Does everyone who releases drivers release buggy drivers?

~~~
viraptor
Close to 100% of software has bugs. Almost all drivers have bugs. Anything
that prioritises company profit and release dates over complete correctness in
sectors where bugs == deaths, will have bugs. (And even those sectors are not
magically immune) So yes - I expect they do.

~~~
tptacek
So are vendors who release buggy drivers not "dicks" for the same reason that
chip manufacturers aren't?

~~~
viraptor
Unless they released it maliciously, I don't hold it against them. And
wouldn't call anyone a dick unless they _planned_ to do something evil.

Exceptions: issue was known but got ignored due to release schedule, or
security was never mentioned in the project and at no level was there any
security consideration. But that's for specific management issues, not
engineers or the vendor in general.

~~~
tptacek
That's an incredibly low bar. All you have to do to meet is is not actively
look for security vulnerabilities in your products.

------
vesrah
[https://amdflaws.com/disclaimer.html](https://amdflaws.com/disclaimer.html)

"you are advised that we may have, either directly or indirectly, an economic
interest in the performance of the securities of the companies whose products
are the subject of our reports"

~~~
stevievee
This is too well organized and presented. My guess is that this has to be
financed in some part by a group of short-sellers.

They made a rookie mistake though - AMD is plagued by day-traders and
algorithms who couldn't give a damn about the fundamentals.

Boy the future of capital markets is looking grim.

~~~
ldayley
A new twist on an old game. I hear people ask why short-selling exists, but’s
a good check against corruption but prone to it’s own abuses. Citron Research
(a short-sell shop) is a good example of this— they savaged companies like NQ
Mobile, Lumber Liquidators, etc. and make a bundle doing it.

The security angle is a fascinating and concerning new development, however.
That said it may encourage more secure practices (as opposed to theater)
through the hardware/software lifecycle in response to serious fundamental
design problems.

It will also serve to increase the premium on 0days...

~~~
dsacco
_> It will also serve to increase the premium on 0days..._

I strongly doubt that. I've seen incredibly serious vulnerabilities I've
reported firsthand have little to no impact on a company's valuation when
publicized.

~~~
kingbirdy
But did you create an entire website about the vulnerability, including
graphics and headline-friendly names, as well as sending out briefings to
major media outlets ahead of the disclosure? Because that's what this group
did

~~~
dsacco
Admittedly no, but considering AMD is up ~3.85% as of this writing, I'm not
sure I'd have benefitted from doing so.

------
adtac
I found this on /r/AMD haha:
[https://i.imgur.com/OkWlIxA.jpg](https://i.imgur.com/OkWlIxA.jpg)

------
dabeledo
"Although we have a good faith belief in our analysis and believe it to be
objective and unbiased, you are advised that we may have, either directly or
indirectly, an economic interest in the performance of the securities of the
companies whose products are the subject of our reports." from the disclaimer

------
bhouston
Why does it say this on the disclaimer:

"...we may have, either directly or indirectly, an economic interest in the
performance of the securities of the companies whose products are the subject
of our reports."

Are they shorting AMD?
[https://amdflaws.com/disclaimer.html](https://amdflaws.com/disclaimer.html)

------
ilkkao
Linus' reaction:
[https://plus.google.com/+LinusTorvalds/posts/PeFp4zYWY46](https://plus.google.com/+LinusTorvalds/posts/PeFp4zYWY46)

~~~
d33
It's quite unsettling that Linus thinks as much of security in general, given
that he maintains a kernel and he's responsible for accepting its security
modules that are next to unusable because of their complexity. Could his
general disbelief lead to a (kind of) dismissive attitude in this respect?
Keep in mind he's the one that would never properly disclose of a security fix
- instead of saying which problem is fixed, the general approach is to just
publish a new kernel minor release and say "some security bugs are fixed, go
figure".

~~~
tptacek
People who work in vulnerability research generally just point and laugh at
him. His opinion on this doesn't matter.

~~~
zokula
And the people who focus on real security point and laugh at the so called
"vulnerability research engineers", and agree with Linus point.

~~~
d33
I'll bite. What's "real security"?

------
notacoward
24 hours means they don't deserve to be called security researchers. They're
exploit creators. Given the material effect this would have on AMD's stock,
one might also reasonably speculate about their financial interests.

~~~
tptacek
One difference between security researchers and "exploit creators", which is a
term I think you just made up, is that exploit creators presumably _release
exploits_.

Don't tell HD Moore or the Metapsloit team about this, though. They may cry
themselves to sleep tonight.

~~~
notacoward
Creation and release are two different things. They have created the exploits,
or else AMD wouldn't be taking them seriously. They have also contributed more
to the re-creation of those exploits by others than they have to security. So
you can quibble over whether others use the exact jargon that you would have,
but that doesn't change the underlying reality.

~~~
tptacek
Every security researcher creates exploits, so I'm not really sure what the
distinction you're trying to make is.

------
rdl
If the vulnerabilities were real, I'd have no problem with a company using it
to promote themselves, trade and talk their book, etc. The issue here is the
vulnerabilities are very overhyped (some are fundamental things like "if you
reflash your BIOS with evil, you're screwed", some just make local root access
more persistent, etc.

The problem with something like TRO LLC is that markets don't move on security
info.

------
bsilvereagle
I think the economics/ethics of the researchers are overshadowing something
big:

"RYZENFALL allows malicious code to take complete control over the AMD Secure
Processor."

"Multiple vulnerabilities in AMD Secure Processor firmware allow attackers to
infiltrate the Secure Processor."

If this is legitimate, this is huge! The PSP could potentially be disabled!
Very little work has gone into handicapping the PSP compared to the IME.

~~~
kiddico
Well there was a big community push a while ago to have the new AMD cpus have
an option to disable the PSP.

I'm gonna wishfully think this was intentionally done to allow us to disable
the PSP.

------
robert_foss
24hrs notice is unheard of.

Who works for CTS-Labs? Attaching your name to a company like that should
disqualify you from any future jobs in the security space.

~~~
tptacek
Who do you think you speak for? Assuming the vulnerabilities aren't fabricated
--- it's happened before with other companies --- attaching your name to that
white paper probably guarantees you lifetime employment in security research.

"Unheard of"? People have dropped serious vulnerabilities with _zero_ warning
before.

~~~
gshulegaard
Perhaps this is my ignorance, but I was under the impression that security
disclosures are usually tightly coordinated to minimize exposure of innocent
users.

> "Unheard of"? People have dropped serious vulnerabilities with _zero_
> warning before.

Could you point me to an example of a zero warning disclosure that exposed a
large amount of users without first attempting to coordinate with the
responsible party?

~~~
tptacek
Some researchers coordinate, some researchers don't. For a project originally
organized around the principle of getting not just research results but
functioning exploit code deployed regardless of vendor preparedness, look no
further than Metasploit.

~~~
dahauns
Wait, Metasploit of all things? They have been doing coordinated disclosure
since forever.

------
slizard
Wild guess / conspiracy theory: Intel, afraid of the damage to their image
just made worse by diminished performance advantage compared to AMD )due to
Meltdown), fearing long-term market loss, quickly found ways to tackle the
issue by, instead of pedaling to regain trust, damaging a competitor's image.
It seems like a reasonable long game to support and perhaps steer the
disclosure of AMD vulnerabilities that CTS-labs had been investigating. Or
maybe is was Intel investigating themselves, had some cards up their sleeves,
but needed some other entity to do the public disclosure.

Other theories discussed here seem less far-fetched than the above, but in any
case, it does smell funny.

~~~
HelloNurse
My guess is that some researcher found something and decided to maximize
profits, scraping the bottom of the barrel of quasi-vulnerabilities,
creatively exaggerating, and bringing in the lawyers, the financiers and the
PR weasels needed to throw a scary web site and a misleading "white paper" at
AMD. We'll see what CTS works on next.

------
paulmd
A security researcher claims to have access to the full (non-public) technical
report as well as PoC exploits for it. He says they're legit, and they are
flaws, not just "you can do admin things with an admin password".

[https://twitter.com/dguido/status/973628511515750400](https://twitter.com/dguido/status/973628511515750400)

Sounds like the capabilities include the ability to jump outside a VM sandbox,
take over the PSP, and pivot to the firmware or BIOS exploits.

[https://www.techpowerup.com/242328/13-major-
vulnerabilities-...](https://www.techpowerup.com/242328/13-major-
vulnerabilities-discovered-in-amd-zen-architecture-including-backdoors)

~~~
pishpash
How do we know this guy's not a conspirator?

~~~
paulmd
Track record of research/publications in the field?

[https://www.trailofbits.com/research-and-
development/publish...](https://www.trailofbits.com/research-and-
development/published-research/)

Ian Cutress of Anandtech appears to be quasi-vouching for Dan Guido. Ian is
also interviewing CTS Labs tomorrow morning, and looking for questions.

[https://twitter.com/IanCutress/status/973678700687450113](https://twitter.com/IanCutress/status/973678700687450113)

[https://twitter.com/IanCutress/status/973697525071994880](https://twitter.com/IanCutress/status/973697525071994880)

------
chx
Did anyone verify any of these? The whole thing reeks.

~~~
cookiecaper
Good question. They call the "MASTERKEY attack" that requires a reflashed BIOS
"remotely exploitable" because on some systems, the BIOS can be flashed from
the OS. They then speculate "On motherboards where re-flashing is not possible
because it has been blocked, or because BIOS updates must be encapsulated and
digitally signed by an OEM-specific digital signature, we suspect an attacker
could occasionally still succeed in re-flashing the BIOS." Page 9 in the PDF.

I'm not a professional security researcher but this is looking pretty darn
flimsy. I also don't see any proof of concept code anywhere -- the
"whitepaper" seems to just claim these things exist with very little mention
of how to exploit them. Compare against Meltdown/Spectre, which was highly
technical and had lots of PoC code. This just says "Upload malware to the
processor" without further comment.

I'm not saying they didn't find anything, but whatever they found, they've
hardly disclosed it.

------
youseecomrade
[https://www.reddit.com/r/Amd/comments/84510f/call_to_action_...](https://www.reddit.com/r/Amd/comments/84510f/call_to_action_amd_share_price_manipulation_sec/)

------
mark-r
Apparently all these can only be exploited if you already have administrator
privileges. Raymond Chen calls that "being on the other side of the airtight
hatchway" and has written about it numerous times.

[https://blogs.msdn.microsoft.com/oldnewthing/20060508-22/?p=...](https://blogs.msdn.microsoft.com/oldnewthing/20060508-22/?p=31283)

------
peterpan31
Scammy site, see:
[https://news.ycombinator.com/item?id=16576516](https://news.ycombinator.com/item?id=16576516)

------
mjevans
Since all of this seems to be related to "Secure Boot" and other DRM related
crap, can we please just have the option of booting with minimal firmware
support, no hidden code, and go for a completely open, community maintained,
and audit-able by /anyone/ infrastructure?

No, I don't want HDCP or any similar crap; let me run my servers and desktops
in secure mode.

------
bitL
I'll still buy Threadripper/EPYC. There is nothing else on the market that is
comparable for my needs.

------
pishpash
I lol'ed at this in the "whitepaper" for a potential impact of a claimed
vulnerability:

 _Physical damage to hardware (SPI flash wear-out, etc.)_

Reminds me of little kids trying to fill out their 200-word essays.

------
eganist
Legal question:

Insider trading claims might be difficult since you can claim the
vulnerabilities were public knowledge waiting to be discovered, but...

Can you trade on knowing the security disclosure timeline prior to your
publication of the vulnerability? That would seem to be insider knowledge
until AMD authorizes publication. E.g. I've got knowledge that AMD likely
wouldn't be able to fix the flaws prior to my disclosure. That knowledge would
inherently be non-public.

Thoughts?

Disclosure: I've been long AMD for a while.

~~~
puzzlingcaptcha
Insider trading usually implies coming into possession of confidential
information and acting on it. Trading on non-public information that results
from your own research and then announcing it is not illegal.

Imagine someone buying stock and then saying the company is good. Not very
controversial is it. Warren Buffet does it. Shorting stock and saying the
company is bad is just the flip side of it.

In fact, there are equity research companies that do specifically that (e.g.
Muddy Waters). Whether that research holds water or not is for the market to
determine (AMD is up on the day).

~~~
eganist
> Trading on non-public information that results from your own research and
> then announcing it is not illegal.

Correct. I'm not referring to this. I'm referring to trading on information
discerned from communications with e.g. AMD but prior to disclosure of the
vulnerability, especially if those communications which establish e.g.
timelines are only disclosed after trading

Hence my point about trading upon understanding AMD's response timeline e.g.
from emailing them.

~~~
Rylinks
Generally speaking, a company communicating information to you does not bar
you from trading unless you explicitly agree to refrain from making trades.

~~~
eganist
This is fair. Thanks.

------
NKCSS
The 24h disclosure should not be too much of a problem, since they state:

> "we are letting the public know of these flaws but we are not putting out
> technical details and have no intention of putting out technical details,
> ever"

It's always a risk, because now people know where to look to recreate it
themselves, it's not like this is a full-disclosure release where you're SOL
as a manufacturer and have to race rampant public exploitation.

------
tcoppi
If anyone trades options, the IV on options expiring in March on AMD went up
significantly last week with no apparent news, probably because of these guys.

------
AstralStorm
The upside of this is that most of these vulns are ineffective after disabling
AMD "Secure" Processor at boot which is now an option in most firmware.
Without breaking manufactures firmware upgrade key you cannot execute the
first one to toggle the settings.

The interesting one is against Promontory. It still requires VM host access to
exploit so the impact is limited.

------
roselan
What shocks me is that most mainstream media report it. It's on top of
techmeme, and all major names are linked. sigh.

------
paulie_a
"One hit wonder" security firm is trying to make a name for itself.

------
fulafel
Does this enable auditing of the psp, or replacing the sw with trusted code?

------
bhouston
DUPE of
[https://news.ycombinator.com/item?id=16576516](https://news.ycombinator.com/item?id=16576516)

------
yAnonymous
This is FUD. The original post was flagged, because the domain and website are
far from trustworthy. Technically, the accusations seem to be more of a joke.

Hello, Intel?

~~~
Sephr
Dan Guido is backing up their claims.

------
sneak
> AMD is in the process of responding to the claims, but was only given 24
> hours of notice rather than the typical 90 days for standard vulnerability
> disclosure. No official reason was given for the shortened time.

90 days is not a standard. Nothing was shortened. People are allowed to
publish their research whenever they like. Vendor advance notification is
optional.

Full, immediate disclosure is responsible.

~~~
eropple
And the users downstream of bugs that are made more widely vulnerable--
because, as anyone who saw how, as an example, previously rare MitM attacks
became commonplace after Firesheep etc. were publicized, _obscurity is in fact
a component of security_ \--are...?

Well, fuck 'em, I guess.

Responsible disclosure, contrary to the super-cool leet kid notions expressed
by people with who choose to exhibit an underdeveloped social conscience, is
not doing a solid for the companies who have vulnerabilities. It's for the
users who consume things. Security researchers are effectively taking upon
themselves a role of public service. That comes with responsibilities to the
public, not to AMD or whoever.

Meanwhile, this crew looks like they briefed _the media_ before telling the
vendor, which is all kinds of fucked.

~~~
aeorgnoieang
Here's the strongest version of the claim that I understand:

1\. All of the relevant people, i.e. "the users downstream of bugs" are
_already vulnerable_.

2\. It's possible, maybe even _probable_ (or _likely_ ), that people, other
than the researchers that are disclosing the vulnerability, have also
discovered the same vulnerability and, furthermore, that those others can
_exploit_ the vulnerability.

3\. Every delay in disclosing the vulnerability prevents the victims from
protecting themselves from any bad actors mentioned in [2] thru means more
drastic than applying a patch or similar from the relevant vendors (e.g.
taking the affected components offline or otherwise making them unavailable).

The argument hinges on the _probable_ size of the bad actors mentioned in [2].
If you _assume_ that the disclosing researchers are the first people to
discover the vulnerability, then it would _possibly_ be best for them to first
disclose the vulnerability to the relevant vendor or vendors. But note that
even vulnerabilities disclosed to vendors can be leaked to bad actors.

And if you _don 't assume_ that the disclosing researchers are the first
people to discover the vulnerability, then _not_ disclosing ASAP prevents
people from protecting themselves.

~~~
eropple
I think that is a fair depiction. I think also that [3] requires that people
are capable, en masse, of protecting themselves from those bad actors.

I think a cursory look at the world indicates that this is not even adjacent
to reality.

~~~
JoachimSchipper
I think your perspective is a bit narrow. If you consider each individual
person, [3] is indeed nonsense. However, the impact of many hacks comes
disproportionally from high-value targets.

Some high-value targets (e.g. key infrastructure, parts of government, major
enterprises) have dedicated security teams, and can come up with a pretty
decent response if given the appropriate information. Divulging vulnerability
information widely, in particular, may or may not be a net benefit to them.
(Consider e.g. Linux vendor vulnerability lists.)

Other high-value targets (e.g. journalists, human-rights activists, etc.) are
utterly outgunned by their adversaries (who can afford to buy or find new
vulnerabilities), and can only hope that something causes vendors to
consistently write software that's sufficiently-uneconomic to exploit. In the
sufficiently-long run, proponents of full disclosure would argue, anything
that increases the cost of shipping vulnerable software should help these
users.

(Disclaimer: absolutely not speaking for my employer here.)

~~~
eropple
Nobody appointed these security researchers to the authority to which you
assign to their actions, though. Burning the immediate user on the off chance
that it helps the hypothetical future user is some very weak tea.

I agree that some proponents of immediate disclosure would claim that their
actions encourage vendors to ship less vulnerable hardware or software. I do
not believe that that, in the general case, is why it is being done. And I am
certain that that, in this specific case, is not why it was done.

~~~
mlyle
Well, the very idea that there is _some_ timelimit on mitigation before the
flaw is disclosed anyways is that "very weak tea".

However, overall, I agree with you. Person with exploit needs to compare the
probable consequences of disclosing at time N vs. disclosing at time N+1.

If it's being exploited in the wild and users can meaningfully self-protect,
disclose now!

If the vendor will probably have a patch in 2 weeks, there is not widespread
exploitation of the vulnerability, and disclosing now will _cause_ widespread
exploitation, disclose in 2 weeks.

If the vendor seems like they will never issue a patch on their own (because
significant time has elapsed), such that at some point in the future there's
going to be widespread exploitation and you're only hastening that a bit, go
ahead and disclose now.

------
kingwill101
something smells fishy... y 24hrs warning? whatever happened to the usual 90
days disclosure?

------
pishpash
No reaction from the stock market. I'm not interested.

------
otherme32
It seems to me a pretty mild security flaw one that requires local root
privileges or even reflashing the BIOS to be exploited. I cannot think of a
real world scenario where this can be a problem.

------
defmer
This is just Intel trying to muddy the AMD waters

------
pbhjpbhj
One thing that does strike me is that, after the Intel Co. situation, giving
only a little notice prevents execs from being able to short their own stock
on the vuln.

Is this confirmed yet?

