Sicherheitsprobleme bei AMD Ryzen: CTS Labs veröffentlichen Stellungnahme, ignorieren Vorwürfe der Aktienmanipulation

DrNGoc schrieb:

Und irgendwann kommt raus, dass Intel da wieder seine Hände mit im Spiel hatte.

Zum Vergrößern anklicken....

DrNGoc schrieb:

Und irgendwann kommt raus, dass Intel da wieder seine Hände mit im Spiel hatte.

Zum Vergrößern anklicken....

By its own statements, CTS Labs tested and developed a proof of concept exploit for Asmedia controllers before it was aware these controllers were incorporated into Ryzen chipsets. Where, then, is the website AsmediaFlaws.com? Where’s the notification to tell Intel motherboard customers that the chips on their motherboards can be similarly backdoored and abused? This isn’t a theoretical; I’m writing this article from an Ivy Bridge-E system powered by an Asus X79-Deluxe motherboard with an Asmedia 1042 controller.

...

If CTS Labs has accurately characterized these flaws, the problems in Asmedia controllers affect millions of Intel motherboards worldwide going back six years. In the early days of USB 3.0, before Intel added its own native chipset support, Asmedia was one of the most common third-party providers. Chips like the ASM1142 are still used on Intel motherboards today. When we looked at Newegg, nearly every USB 3.0 PCI Express card we spot-checked used an Asmedia solution — typically the ASM1042 or ASM1142.

If these Asmedia flaws are common to Intel, AMD, and standalone cards, Intel users and expansion card users absolutely should’ve been notified. If they’re unique to AMD users, CTS Labs needed to explain why. It has not. Again, when security researchers describe flaws, they typically describe them across the entire set of hardware on which they are known to occur. Failing that, they at least acknowledge the use of these broken solutions in other contexts. CTS Labs did neither.

Zum Vergrößern anklicken....

There is no immediate risk of exploitation of these vulnerabilities for most users. Even if the full details were published today, attackers would need to invest significant development efforts to build attack tools that utilize these vulnerabilities. This level of effort is beyond the reach of most attackers (see https://www.usenix.org/system/files/1401_08-12_mickens.pdf, Figure 1)

These types of vulnerabilities should not surprise any security researchers; similar flaws have been found in other embedded systems that have attempted to implement security features. They are the result of simple programming flaws, unclear security boundaries, and insufficient security testing. In contrast, the recent Meltdown and Spectre flaws required previously unknown techniques and novel research advances to discover and exploit.
“AMD Flaws” Technical Summary | Trail of Bits Blog

Zum Vergrößern anklicken....

In the first part of the letter, Zilberman claims that his firm began researching Asmedia devices — the ASM1042, ASM1142, ASM1143 chips, specifically — and that this served as a jumping off point for an overarching investigation into AMD’s overall security practices.

Zum Vergrößern anklicken....

Crash-Over schrieb:

Wenn du richtig gelesen hast dann wäre ihre mainboards auch betroffen und nicht nur Amd Platinen

Zum Vergrößern anklicken....

yummycandy schrieb:

[...]
Der vielzitierte Dan Guido ist ziemlich darüber verärgert, daß er von CTS absichtlich falsch wiedergegeben worden ist. Er schreibt folgendes dazu:

There is no immediate risk of exploitation of these vulnerabilities for most users. Even if the full details were published today, attackers would need to invest significant development efforts to build attack tools that utilize these vulnerabilities. This level of effort is beyond the reach of most attackers (see https://www.usenix.org/system/files/...12_mickens.pdf, Figure 1)
[...]

Zum Vergrößern anklicken....

[...]

Zum Vergrößern anklicken....

yummycandy schrieb:

Ich mochte den Absatz besonders:





Die müssen aber nen komischen Auftraggeber haben.

Zum Vergrößern anklicken....