Sábado, 19 Octubre 2019
Ultimas noticias
Casa » AMD Processors Have 'Critical' Security Flaws, Say Researchers

AMD Processors Have 'Critical' Security Flaws, Say Researchers

26 Marcha 2018

"The Ryzen chipset, a core system component that AMD outsourced to a Taiwanese chip manufacturer, ASMedia, is now being shipped with exploitable manufacturer backdoors inside", reads the whitepaper put out by CTS Labs, the company that discovered the vulnerabilities. The 13 different vulnerabilities affect processors found in desktops, laptops, and servers.

While the flaws do not make servers or computers running AMD chips accessible to remote hackers, they could make it more hard for security staff to find or remove malicious code. AMD says it's studying the findings and is committed to protecting its customers. Such malware could allow attackers to take complete control of AMD processors, steal network credentials, install malware and read and write on protected memory areas, among other risks. AMD is now facing another big security headache, with no immediate cure available.

"We may have, either directly or indirectly, an economic interest in the performance of the securities of the companies whose products are the subject of our reports", the disclaimer says. That may be unfair to CTS Labs, but optics and decorum are important to perception, and perception is reality for many. Questions are being raised against the researchers as well. Fortunately, specific technical details that could be used to exploit the vulnerabilities have been omitted. A team of Israeli researchers has published a paper outlining critical security flaws in AMD chips, much like the vulnerabilities in Intel and Apple's silicon.

Ryzenfall, Chimera and Fallout are less of a direct threat, because they each require that an attacker must "be able to run a program with local-machine elevated administrator privileges" and supply "a driver that is digitally signed by the vendor", according to the researchers' white paper.

AMD confirmed it's been made aware of the potential vulnerabilities. In the case of the Meltdown and Spectre vulnerabilities impacting multiple CPUs that were publicly reported on January 3, vendors including Intel worked on fixes for months ahead of the public disclosure. He has published an editorial on PCPer this morning that takes a look at what some are seeing as an attack on AMD yesterday, by CTS-Labs. AMD said, "We are actively investigating and analysing its findings".

AMD has gotten a 24-hour notice, even though it's standard procedure to give the company a lot more time.

The other piece of good news is that the security firm CTS-Labs made a decision to redact the technical information around the vulnerabilities.

The flaws in question were discovered by CTS Labs, a cybersecurity research outfit in Israel, and given a set of catchy names: Ryzenfall, Masterkey, Fallout, and Chimera, with associated logos, a dedicated website, and a whitepaper describing them.

"CTS believes that networks that contain AMD computers are at a considerable risk", the report said. Regardless of the research company's motives for dealing with the issue in such a questionable manner, the revelation of more than a dozen vulnerabilities is a serious problem for AMD to deal with. Instead, the company says it handed technical information over to AMD, security companies and U.S. regulators. This is a far cry from typical security research practice.

An odd outfit calling itself Viceroy Research was remarkably quick off the mark with a 25-page research report declaring that AMD was as good as dead. What is suspect, however, is that a separate website called Viceroy Research put out a report based on the startup's findings, with the ridiculous conclusion that "AMD is worth $0.00 and will have no choice but to file for Chapter 11 bankruptcy in order to effectively deal with the repercussions of recent discoveries". Why was AMD given so little time to respond? But then again, there are concerns regarding the validity of these claims by CTS Labs because of the timing of their disclosure to AMD. We have reached out to Microsoft about this and will update if it gets back to us.

AMD Processors Have 'Critical' Security Flaws, Say Researchers