Surely one could use the same exploit to restore the original boot code as the malware used to corrupt it
someguy3@lemmy.world
on 09 Aug 2024 18:46
nextcollapse
Requires kernel-level access
What does that mean to the rest of us?
dosse91@lemmy.trippy.pizza
on 09 Aug 2024 18:59
nextcollapse
It means it’s what we in the trade call “a nothingburger”. On Windows you need to explicitly install a malicious driver (which in turn requires to you to disable signature verification), on Linux you’d have to load a malicious kernel module (which requires pasting commands as root, and it would probably be proprietary since it has malware to hide and as every nvidia user knows, proprietary kernel modules break with kernel updates)
avidamoeba@lemmy.ca
on 09 Aug 2024 19:49
nextcollapse
mox@lemmy.sdf.org
on 09 Aug 2024 20:15
nextcollapse
No, it does not mean you would need to do that.
The more likely scenario is an attacker using another vulnerability, either in the OS itself or in a vendor-supplied component like a driver or anti-cheat module, to gain a foothold for this one. Chaining exploits is a very common technique. (What “trade” are you in, exactly?)
Apply the mitigations when they become available for your hardware, folks.
conciselyverbose@sh.itjust.works
on 09 Aug 2024 21:23
nextcollapse
So install a multiplayer game, it has kernel level anticheat that opens a bunch of security holes, game over.
Kernel level access is absolutely achievable in the real world.
SupraMario@lemmy.world
on 10 Aug 2024 00:00
nextcollapse
This article should say, with this one easy hack you can control an AMD users PC, all you gotta do is break into their home at 10pm right before they log off from browsing reddit and bam access.
floofloof@lemmy.ca
on 09 Aug 2024 19:48
nextcollapse
It means that a malicious actor would already need to have hacked your computer quite deeply through some other vulnerability (or social engineering) before they could take advantage of this one. But I don’t agree with another commenter here that this is a “nothingburger”: this vulnerability enables such a hacker to leave undetectable malware that you just can’t remove from the computer even if you replace everything but the motherboard. That’s significant, particularly for anyone who might be a target of cyber-espionage.
Bjornir@programming.dev
on 09 Aug 2024 21:29
collapse
If you have kernel access you can already do almost everything so a vulnerability on top of that isn’t that bad since no one should have kernel access to your computer
randompasta@lemmy.today
on 10 Aug 2024 03:06
nextcollapse
You mean like Crowdstrike?
HauntedCupcake@lemmy.world
on 10 Aug 2024 08:33
collapse
Most All antivirus software runs at kernel level
Bjornir@programming.dev
on 11 Aug 2024 05:46
collapse
Which is precisely the reason you shouldn’t use an AV apart from the one packaged with Windows
rob_t_firefly@lemmy.world
on 10 Aug 2024 13:54
collapse
AMD hadn’t published a list when the article was first run, but it has since been updated:
but it pointed to a full list of affected products that can be found on its website’s [security bulletin page](but it pointed to a full list of affected products that can be found on its website’s security bulletin page..
jlh@lemmy.jlh.name
on 09 Aug 2024 18:06
nextcollapse
Similar vulnerability threat as the Intel ME bug. Annoying for security-critical applications where you start worrying about hardware security, but virtually no real-world threat. Might be useful for users wishing to disable security processors though.
vikingtons@lemmy.world
on 09 Aug 2024 19:21
collapse
Unfortunately PSP is required for x86 core initialisation. I’m not sure if this can actually be bypassed.
Rayspekt@lemmy.world
on 09 Aug 2024 18:31
nextcollapse
So what do I exactly need to do if I have ine if the affected CPUs? What specifically do I need to patch?
dogslayeggs@lemmy.world
on 09 Aug 2024 19:12
nextcollapse
I’m not an expert, but reading the posts here the answer seems to be “nothing.” The only people affected by this already know how to prevent it.
vikingtons@lemmy.world
on 09 Aug 2024 19:20
nextcollapse
You’ll want to upgrade your system BIOS when your board vendor makes this fix available.
FangedWyvern42@lemmy.world
on 09 Aug 2024 19:47
collapse
Nothing. It sounds like it only affects a very small number of people, but the general public has no need to worry.
LainTrain@lemmy.dbzer0.com
on 09 Aug 2024 18:40
nextcollapse
More “cybersecurity” clickbait with red/blue/green images of processors and skulls. That’s the real “infection”
notnotmike@programming.dev
on 09 Aug 2024 19:00
nextcollapse
I mean, I’m not much of a tinfoil hat, but this article feels extremely conveniently timed for Intel, who is currently going through a massive ordeal with their chips. Especially considering that the vulnerability is so extremely difficult to exploit that there’s borderline no story here for 99% of people but the headline will still drive clicks and drama.
Drathro@dormi.zone
on 09 Aug 2024 19:31
nextcollapse
Difficult to exploit, already in the process of being patched. Truly, the most breaking of news.
httperror418@lemmy.world
on 10 Aug 2024 08:15
collapse
How does the patch actually get delivered? Via windows update or using something else?
Passerby6497@lemmy.world
on 10 Aug 2024 13:24
nextcollapse
Most likely. Windows update (or the Linux equivalent on your platform) will download updated microcode to load at boot time to basically be a software patch for hardware issues. At least, that’s how it was explained when the original speculative execution flaw was discovered and Intel was releasing foxes and shit for it.
amanda@aggregatet.org
on 12 Aug 2024 05:22
collapse
and Intel was releasing foxes and shit
I realise this is an autocorrect error, but it’s still funny 🦊
On windows the article mentioned being a microcode patch via Windows update. Linux would be similar- but via a kernel update most likely. I’d assume that a general BIOS update would also do the trick, but then you’re relying on motherboard vendors and it’s unlikely many would provide such an update to older hardware, even if it’s still widely used.
heavy@sh.itjust.works
on 09 Aug 2024 23:11
nextcollapse
I loathe what part of the security community has become with the stunt hacking and vuln naming. That being said, I doubt it’s some conspiracy. I don’t know all the details but it wouldn’t be exceptional to identify a bug that has existed in processor firmware or legacy code for a long time.
People are looking at this stuff all the time, both professionally and for fun. You could make the case that it’s inevitable that there will be exploits found that affect a huge population.
In the end, as long as the layman gets smarter about computer security, the better people will react to vuln drops.
ruse8145@lemmy.sdf.org
on 10 Aug 2024 03:30
nextcollapse
Was there a real user risk to any of the flaws since heart bleed? Or did people mostly want to hate on Intel? I’m no tinfoil hatter either I’m just asking questions.
🙄
Passerby6497@lemmy.world
on 10 Aug 2024 13:25
collapse
13th and 14th generation Intel processors can be physically damaged and degrade over time on the latest issue from Intel.
Yep. Reminds me of when ubiquiti damaged the radios on the unifi pro through dodgy firmware.
We ended up replacing them all just in case because we didn’t want customers affected
The Intel issue is far worse because they’re not even patching it quickly, and it is slowly frying cpus
sudo42@lemmy.world
on 10 Aug 2024 04:03
nextcollapse
Not too unusual. There have been a lot of new vulnerabilities announced lately. A few months ago they announced one that exposed all (?) mainstream CPUs, even Apple’s new chips.
Some of the vulns are serious, but many require very specific circumstances to actually work.
TheGrandNagus@lemmy.world
on 10 Aug 2024 08:12
nextcollapse
Intel has literally done this, and stuff like it before.
They back “independent” researchers who twist themselves in knots to make AMD look bad.
Look up the multiple counts of bullshit from a “research group” called Principled Technologies.
Sidenote: the guy who ran it was Ryan Shrout, who used to work for PC Perspective, and would usually give favourable reviews to Intel. After leaving Principled Technologies, he became head of technical marketing at… drumroll… Intel!
Principled Technologies isn’t the only scam “independent researcher” Intel has set up or paid handsomely either.
deuleb_biezelbob@programming.dev
on 11 Aug 2024 05:54
collapse
I thought switching to AMD should’ve kept me save from Intel ME (I used ME_cleaner if I had too) :(
beefbot@lemmy.blahaj.zone
on 10 Aug 2024 21:36
nextcollapse
Every last news article you see, you must ask: who benefits from this article’s appearance?
It’s not just judges who can be bought.
megaman@discuss.tchncs.de
on 10 Aug 2024 23:53
collapse
The folks who found it are presenting at Defcon this weekend, according to the article.
I imagine some of the industry press (i.e. Wired) are just looking through the Defcon agenda to figure out what to write. I saw two or three other articles about hacks or exploits and things like that that also mentioned it was bring presented at Defcon.
mox@lemmy.sdf.org
on 09 Aug 2024 20:04
nextcollapse
Notable quote:
“It’s going to be nearly undetectable and nearly unpatchable.” Only opening a computer’s case, physically connecting directly to a certain portion of its memory chips with a hardware-based programming tool known as SPI Flash programmer and meticulously scouring the memory would allow the malware to be removed, Okupski says.
Let’s hope a microcode or BIOS update can prevent it from happening in the first place.
threaded - newest
Requires kernel-level access. Also AMD is “releasing mitigations,” so is it “unfixable?”
I think they meant it as “once infected may be impossible to disinfect.” But it sure doesn’t read that way at first glance.
Did they change it? Because now it says "Allows Deep, Virtually Unfixable Infections" and that seems to say exactly what you are.
Surely one could use the same exploit to restore the original boot code as the malware used to corrupt it
What does that mean to the rest of us?
It means it’s what we in the trade call “a nothingburger”. On Windows you need to explicitly install a malicious driver (which in turn requires to you to disable signature verification), on Linux you’d have to load a malicious kernel module (which requires pasting commands as root, and it would probably be proprietary since it has malware to hide and as every nvidia user knows, proprietary kernel modules break with kernel updates)
nvidia: loading out-of-tree module taints kernel
No, it does not mean you would need to do that.
The more likely scenario is an attacker using another vulnerability, either in the OS itself or in a vendor-supplied component like a driver or anti-cheat module, to gain a foothold for this one. Chaining exploits is a very common technique. (What “trade” are you in, exactly?)
Apply the mitigations when they become available for your hardware, folks.
So install a multiplayer game, it has kernel level anticheat that opens a bunch of security holes, game over.
Kernel level access is absolutely achievable in the real world.
This article should say, with this one easy hack you can control an AMD users PC, all you gotta do is break into their home at 10pm right before they log off from browsing reddit and bam access.
Sounds like a plan!
Not to be contrarian, but hackers have signed malicious code with compromised Microsoft driver certificates, so it’s not out of the question that it could be snuck in without having to turn off signing.
It means that a malicious actor would already need to have hacked your computer quite deeply through some other vulnerability (or social engineering) before they could take advantage of this one. But I don’t agree with another commenter here that this is a “nothingburger”: this vulnerability enables such a hacker to leave undetectable malware that you just can’t remove from the computer even if you replace everything but the motherboard. That’s significant, particularly for anyone who might be a target of cyber-espionage.
Festivus
If you have kernel access you can already do almost everything so a vulnerability on top of that isn’t that bad since no one should have kernel access to your computer
You mean like Crowdstrike?
MostAll antivirus software runs at kernel levelWhich is precisely the reason you shouldn’t use an AV apart from the one packaged with Windows
“They’re going for the kernel!”
"Colonel who?"
Cancer. Brain. Brain cancer.
A list of the effected processors would’ve been nice, Wired.
The article links to this:
www.amd.com/en/resources/…/amd-sb-7014.html
If attacker has a ring 0 access he can already screw you up any way he wants
that’s all well and good, I was just responding to someone who wanted the list of affected products
It only mentions ring 0 access in your link, ergo they responded to your post because it was the most appropriate. At least that's how I see it.
The link includes ‘CVE-2023-31315’
True. This does allow for persistent recurring infection post clean and cold boot.
Interesting flaw to keep an eye on.
AMD hadn’t published a list when the article was first run, but it has since been updated:
Similar vulnerability threat as the Intel ME bug. Annoying for security-critical applications where you start worrying about hardware security, but virtually no real-world threat. Might be useful for users wishing to disable security processors though.
Unfortunately PSP is required for x86 core initialisation. I’m not sure if this can actually be bypassed.
So what do I exactly need to do if I have ine if the affected CPUs? What specifically do I need to patch?
I’m not an expert, but reading the posts here the answer seems to be “nothing.” The only people affected by this already know how to prevent it.
You’ll want to upgrade your system BIOS when your board vendor makes this fix available.
Nothing. It sounds like it only affects a very small number of people, but the general public has no need to worry.
More “cybersecurity” clickbait with red/blue/green images of processors and skulls. That’s the real “infection”
I mean, I’m not much of a tinfoil hat, but this article feels extremely conveniently timed for Intel, who is currently going through a massive ordeal with their chips. Especially considering that the vulnerability is so extremely difficult to exploit that there’s borderline no story here for 99% of people but the headline will still drive clicks and drama.
Difficult to exploit, already in the process of being patched. Truly, the most breaking of news.
How does the patch actually get delivered? Via windows update or using something else?
Most likely. Windows update (or the Linux equivalent on your platform) will download updated microcode to load at boot time to basically be a software patch for hardware issues. At least, that’s how it was explained when the original speculative execution flaw was discovered and Intel was releasing foxes and shit for it.
I realise this is an autocorrect error, but it’s still funny 🦊
On windows the article mentioned being a microcode patch via Windows update. Linux would be similar- but via a kernel update most likely. I’d assume that a general BIOS update would also do the trick, but then you’re relying on motherboard vendors and it’s unlikely many would provide such an update to older hardware, even if it’s still widely used.
I loathe what part of the security community has become with the stunt hacking and vuln naming. That being said, I doubt it’s some conspiracy. I don’t know all the details but it wouldn’t be exceptional to identify a bug that has existed in processor firmware or legacy code for a long time.
People are looking at this stuff all the time, both professionally and for fun. You could make the case that it’s inevitable that there will be exploits found that affect a huge population.
In the end, as long as the layman gets smarter about computer security, the better people will react to vuln drops.
Was there a real user risk to any of the flaws since heart bleed? Or did people mostly want to hate on Intel? I’m no tinfoil hatter either I’m just asking questions.
🙄
13th and 14th generation Intel processors can be physically damaged and degrade over time on the latest issue from Intel.
Yep. Reminds me of when ubiquiti damaged the radios on the unifi pro through dodgy firmware.
We ended up replacing them all just in case because we didn’t want customers affected
The Intel issue is far worse because they’re not even patching it quickly, and it is slowly frying cpus
Not too unusual. There have been a lot of new vulnerabilities announced lately. A few months ago they announced one that exposed all (?) mainstream CPUs, even Apple’s new chips.
Some of the vulns are serious, but many require very specific circumstances to actually work.
Intel has literally done this, and stuff like it before.
They back “independent” researchers who twist themselves in knots to make AMD look bad.
Look up the multiple counts of bullshit from a “research group” called Principled Technologies.
Sidenote: the guy who ran it was Ryan Shrout, who used to work for PC Perspective, and would usually give favourable reviews to Intel. After leaving Principled Technologies, he became head of technical marketing at… drumroll… Intel!
Principled Technologies isn’t the only scam “independent researcher” Intel has set up or paid handsomely either.
I thought switching to AMD should’ve kept me save from Intel ME (I used ME_cleaner if I had too) :(
Every last news article you see, you must ask: who benefits from this article’s appearance?
It’s not just judges who can be bought.
The folks who found it are presenting at Defcon this weekend, according to the article.
I imagine some of the industry press (i.e. Wired) are just looking through the Defcon agenda to figure out what to write. I saw two or three other articles about hacks or exploits and things like that that also mentioned it was bring presented at Defcon.
Notable quote:
Let’s hope a microcode or BIOS update can prevent it from happening in the first place.
Original source:
info.defcon.org/event/?id=54863
Relevant links:
ioactive.com/…/def-con-talk-amd-sinkclose-univers…
www.youtube.com/watch?v=xSp38lFQeRE
www.youtube.com/watch?v=lR0nh-TdpVg&t=2s
bleepingcomputer.com/…/new-amd-sinkclose-flaw-hel…
(I found the Bleeping Computer article more informative and concise than the Wired one.)
Oopsy!
who is naming this shit