Intel breathes a sigh of relief as the spotlight moves off of them for a beat.

  • j4k3@lemmy.world
    link
    fedilink
    English
    arrow-up
    33
    arrow-down
    1
    ·
    3 months ago

    Funny. No. This is not remotely comparable to CPU’s crashing because of a lack of R&D and half ass quarter earnings profiteering culture’s lack of intelligent long term thinking. It is not remote accessible. This is just corporate psyops in an attempt to coverup their overwhelming neo feudal incompetence. If they had the staff and invested reasonably, the problems wouldn’t happen. Paint the world in shit to continue the claim that yours does not stink. Only idiots buy into that.

  • Except the AMD exploit requires ring 0 access and is almost irrelevant to most users, whereas the Intel issues are physically destroying people’s computers. The scale of the issues are utterly incomparable.

    I’m much more angry with whatever dipshit at AMD decided to revoke permission for ZLUDA, and that they haven’t yet been fired.

    • ngwoo@lemmy.world
      link
      fedilink
      English
      arrow-up
      14
      ·
      3 months ago

      People grant kernel access all the time without thinking. Video game anti-cheat is a good example. It’s a pretty potent vector of attack since you can never trust these companies to keep themselves secure.

      • Didn’t the author confirm the takedown came from AMD and not NVidia? AMD isn’t responsible for third party software running on their hardware.

        Although, IIRC they either sanctioned it or provided some initial funding, which might have put them in a more culpable position. Still, I’m pretty sure the takedown came from AMD, and it doesn’t make sense that they’re doing NVidia’s policing for then.

          • Yeah, that’d do it. Although, again, it looks like the restriction wasn’t in the NVIDIA licensing wording until recently. IANAL, but you it both parties are required to agree to contract changes; if AMD’s contributions were all pre-wording change, they merely need to dust their hands; it’s OSS. Why are they doing NVIDIA’s dirty work for them?

            I’m not convinced.

      • Evilcoleslaw@lemmy.world
        link
        fedilink
        English
        arrow-up
        4
        ·
        3 months ago

        ZLUDA was an open source translation layer for CUDA. So basically developers could take code from projects written for Nvidia’s CUDA and use ZLUDA to run them on other hardware. Originally the dev was focused on Intel but AMD started paying him and he focused on AMD hardware. They stopped funding him earlier in the year and now it appears AMD legal has gone back on their earlier permission for him to keep distributing the code.

    • 1984@lemmy.today
      link
      fedilink
      English
      arrow-up
      1
      ·
      3 months ago

      I’m thinking there are more things like this, and maybe even some are intentionally put in to please government actors. Intels management engine is like a small computer inside the computer, and amd has something simular. This computer can work completely independent of what the main computer does and has network access.

      • ichbinjasokreativ@lemmy.world
        link
        fedilink
        English
        arrow-up
        1
        ·
        3 months ago

        Difference is that Intel’s Management engine can be controlled via the network whereas AMD’s platform security processor is local-only.

        The much bigger problem is Microsoft’s Pluton coprocessor, which they plan on making mandatory for using windows in the future.

        • 1984@lemmy.today
          link
          fedilink
          English
          arrow-up
          0
          ·
          3 months ago

          I didn’t know amd is local only, that’s amazing. Another huge reason to go for amd.

          And yeah, Pluton… I don’t use windows anymore and I encourage everyone to switch to Linux. But only a few people care about their privacy and not being tracked.

          • ichbinjasokreativ@lemmy.world
            link
            fedilink
            English
            arrow-up
            2
            ·
            edit-2
            3 months ago

            It used to be a major pro-AMD reason for me too, but it’s become irrelevant since pluton. Weird thing is, pluton was announced with much fanfare for Ryzen 6000, but I’ve not heard about it since.

            Edit: I just read up on this topic again and found out that both purism and system76 disable the Intel ME in all their products (don’t know if all of it is disabled, since it normally controls a lot of necessary components)

            Edit 2: they can either remove most of its code from the flash, or use a disabling system that Intel had literally developed for the NSA.

  • tal@lemmy.today
    link
    fedilink
    English
    arrow-up
    22
    arrow-down
    1
    ·
    edit-2
    3 months ago

    Now onto some better news. Despite being potentially catastrophic, this issue is unlikely to impact regular people. That’s because in order to make full use of the flaw, hackers would already need deep access to an AMD-based PC or server. That’s a lot of work for a random home PC, phew, but could spell trouble for corporations or other large entities.

    Hmm.

    It does mean that any secondhand computer or CPU (or even CPU from a sketchy source) could be compromised prior to being physically sold.

    I have worried a bit before about the physical supply chain. Consider this case, earlier in the year, about someone selling counterfeit Cisco hardware (not intending to compromise computers, just make a buck):

    https://www.justice.gov/opa/pr/leader-massive-scheme-traffic-fraudulent-and-counterfeit-cisco-networking-equipment

    “Aksoy sold hundreds of millions of dollars’ worth of counterfeit computer networking equipment that ended up in U.S. hospitals, schools, and highly sensitive military and other governmental systems, including platforms supporting sophisticated U.S. fighter jets and military aircraft,” said Principal Deputy Assistant Attorney General Nicole M. Argentieri, head of the Justice Department’s Criminal Division. “Criminals who flood the supply chain with low-quality networking equipment from China and Hong Kong harm U.S. businesses, pose serious health and safety risks, and compromise national security. This case—one of the largest counterfeit trademark cases ever prosecuted in the United States—demonstrates the Criminal Division’s commitment and capacity to prosecute the most complex counterfeiting schemes and bring the perpetrators to justice.”

    “Through an elaborate, years-long scheme, Aksoy created and ran one of the largest counterfeit-trafficking operations ever,” said Attorney for the United States Vikas Khanna for the District of New Jersey. “His operation introduced tens of thousands of counterfeit and low-quality devices trafficked from China into the U.S. supply chain, jeopardizing both private-sector and public-sector users, including highly sensitive U.S. military applications like the support platforms of U.S. fighter jets and other military aircraft. Yesterday’s sentence, made possible by the investigation and prosecution of this office and our department and agency partners, now brings Aksoy to justice and holds him accountable for the breathtaking scale of his operation.”

    According to court documents and statements made in court, Aksoy ran at least 19 companies formed in New Jersey and Florida, as well as approximately 15 Amazon storefronts and at least 10 eBay storefronts (collectively, the Pro Network Entities). The Pro Network Entities imported from suppliers in China and Hong Kong tens of thousands of low-quality, modified computer networking devices with counterfeit Cisco labels, stickers, boxes, documentation, and packaging, all bearing counterfeit trademarks registered and owned by Cisco that made the goods falsely appear to be new, genuine, and high-quality devices manufactured and authorized by Cisco. The devices had an estimated total retail value of hundreds of millions of dollars. The Pro Network Entities generated over $100 million in revenue from the scheme, and Aksoy personally received millions of dollars.

    I remember that that hardware made it into even Cisco’s own authorized partners’ inventory.

    And that’s not something that’s gonna be far up in the supply chain. People don’t build Cisco hardware into a lot of other products.

    So you gotta wonder what can happen if someone has a good way to undetectably compromise CPUs and insert them into the supply chain.

    • db2@lemmy.world
      link
      fedilink
      English
      arrow-up
      6
      arrow-down
      1
      ·
      3 months ago

      It does mean that any secondhand computer or CPU (or even CPU from a sketchy source) could be compromised prior to being physically sold.

      It’s worse than that, any AMD chip from any source except maybe AMD directly is suspect. Mine is a few years old from Amazon supposedly new, for all I know it came compromised and is sitting there doing what I tell it to until it triggers and I won’t even know when or if it happens.

      • rhombus@sh.itjust.works
        link
        fedilink
        English
        arrow-up
        1
        ·
        3 months ago

        If I understand it correctly, the chip has the vulnerability, but the malware would be installed on the motherboard in the form of a bootkit. So getting a used CPU is not a threat, but getting a used motherboard is (and kind of always has been) a risk.

        • db2@lemmy.world
          link
          fedilink
          English
          arrow-up
          2
          ·
          3 months ago

          It allows for adulteration of firmware, the CPU has firmware. 🤷

          • rhombus@sh.itjust.works
            link
            fedilink
            English
            arrow-up
            2
            ·
            3 months ago

            CPU firmware exploits are incredibly rare, if there even are any that exist beyond proof-of-concept. The chances of getting an infected CPU from this is so unlikely it’s practically impossible.

              • rhombus@sh.itjust.works
                link
                fedilink
                English
                arrow-up
                1
                ·
                3 months ago

                Which, again, is an incredibly unlikely attack vector unless you have some government secrets on your computer. And chances are that any attack through the IME or PSP is trying to do an implant into the UEFI/BIOS and not the processor itself.

    • rc__buggy@sh.itjust.works
      link
      fedilink
      English
      arrow-up
      2
      ·
      3 months ago

      Oh man, the Pro Networking scandal is so funny to me. I wonder how many of those machines are out there running IOS right now and no one is the wiser. AFAIK there aren’t allegations of backdoors or anything, just fake Cisco gear.

    • DrDominate@lemmy.world
      link
      fedilink
      English
      arrow-up
      1
      ·
      3 months ago

      Unless I’m mistaken, the malware isn’t on the CPU. The exploit is CPU, but the firmware is stored on the bios chip. Used motherboards are a potential for having malware on them, but then again they always have been a risk

    • Cocodapuf@lemmy.world
      link
      fedilink
      English
      arrow-up
      1
      ·
      3 months ago

      It does mean that any secondhand computer or CPU (or even CPU from a sketchy source) could be compromised prior to being physically sold.

      Does it mean that? I mean a computer bought from a sketchy source, sure. But just a cpu alone? Do these raptor lake cpus have any non volatile memory? Because if not, then a second hand cpu is totally safe.

  • AnUnusualRelic@lemmy.world
    link
    fedilink
    English
    arrow-up
    20
    ·
    3 months ago

    It was really just a matter of time before someone figured a way to exploit those stupid deep management engines. It was so predictable.

    And each intel chip runs a minix system behind the scenes that I’m sure someone will soon find a way to play with if it’s not already compromised.

  • umbrella@lemmy.ml
    link
    fedilink
    English
    arrow-up
    8
    ·
    3 months ago

    Despite being potentially catastrophic, this issue is unlikely to impact regular people. That’s because in order to make full use of the flaw, hackers would already need deep access to an AMD-based PC or server.

  • jet@hackertalks.com
    link
    fedilink
    English
    arrow-up
    7
    arrow-down
    1
    ·
    edit-2
    3 months ago

    Sinkclose

    Impacted systems: https://www.amd.com/en/resources/product-security/bulletin/amd-sb-7014.html

    Original presentation details. https://ioactive.com/event/def-con-talk-amd-sinkclose-universal-ring-2-privilege-escalation/

    This is a big f****** deal. If you get kernel access to a system, which is not uncommon, you can install a persistent back door that subverts the rest of the system forever. That’s huge. It does not require physical access, requires kernel access… different things

    Steam games that ask for admin privileges, a USB stick that boots, normal virus infection that can never be uninstalled,. persistent RAT…

    • flying_sheep@lemmy.ml
      link
      fedilink
      English
      arrow-up
      5
      ·
      3 months ago

      Negative rings are a horrible proprietary liability.

      That’s been clear from their inception, and this changes nothing.

  • cpw@lemmy.ca
    link
    fedilink
    English
    arrow-up
    1
    ·
    3 months ago

    I’ll bet the Intel management engine is just as “vulnerable”. The only context this is likely a concern is large scale corpo deployments, without verified supply chains to the source. Love how the security researcher handwaves that there’s “plenty of existing exploits” that can be used to install the exploit into the SMM, without giving any suggestions of how.

  • Imgonnatrythis@sh.itjust.works
    link
    fedilink
    English
    arrow-up
    1
    ·
    3 months ago

    I was troubled by how many times this article used the word “deep”. Also, what was the bit about the hack likely surviving a reinstall of the OS? Why in the world wouldn’t it if it’s a cpu bios firmware hack?