AMD CPU Attack Vectors and Vulnerabilities

I got a good laugh from their codenames for the flaws. These CTS Labs scam artists should get Adele to do a "Ryzenfall" cover for them.
 
gigaxtreme1 said:
Watch this blow up. Here comes another shitstorm. SEC and the DOJ just took an interest.
Click to expand...

This is a very interesting situation. I say "interesting" because this example of probable corporate guerilla warfare does not directly affect me. I'm curious to see how SEC and DOJ proceed and to see what type of tools they have and use to combat this.


Edited to add: Oh, this also reinforces my decision to make my next build a Ryzen/Threadripper. If these guys are shorting AMD, I want assist in their failure.
 
Last edited:
Well, here is something:

The company changed its name from Flexagrid Systems Inc. to Catenoid Security then to CTS-Labs

1aw3gXG.png

6PSWGZ4.png
 
So the report is their opinion which they claim is not bias, but opinions by nature are not objective.

So as an Attorney if Law operated on opinion then if you are of the opinion that person X killed person Y then you should be able to get a conviction on opinion. We all know that this kind of allegation is needed to be founded on fact, if not it is then a sabotage attempt.

Find them, put them under oath and squeeze them until they are blue.
 
Pages like IntelRocks.com, AMDrules.com, Samsungsucks.com, AppleBlows.com These, these are all legit sites I tell you!!!!! /s
When a website says the specific company names in the URL it tends to be a bit biased. AMDflaws is so obvious they are just playing those who are ignorant and don't to care to be right.
 
Does this site stink to high heaven? Yes. But you need proof to say "intel did it" I find it hilarious that everyone instantly thinks Intel is behind it, especially without any real proof.

I don't think Intel would be stupid enough to try a smear campaign like this.
 
viscountalpha said:
Does this site stink to high heaven? Yes. But you need proof to say "intel did it" I find it hilarious that everyone instantly thinks Intel is behind it, especially without any real proof.

I don't think Intel would be stupid enough to try a smear campaign like this.
Click to expand...
Intel's past behavior and losses in the court of law for this type of crap are the reasons why people immediately jump to this conclusion. its not a fanboy thing, Intel just plays dirty and its well known.

EDIT: Intel plays dirtier ;) and doesn't hide it well. All businesses cheat and steal and generally do whatever they can to make the most money. "Ya aint cheatin, ya aint trying".
 
SomeoneElse said:
Pages like IntelRocks.com, AMDrules.com, Samsungsucks.com, AppleBlows.com These, these are all legit sites I tell you!!!!! /s
When a website says the specific company names in the URL it tends to be a bit biased. AMDflaws is so obvious they are just playing those who are ignorant and don't to care to be right.
Click to expand...
Amdsuxthebig1one1oneone.com has legitimate information on it.
 
viscountalpha said:
Does this site stink to high heaven? Yes. But you need proof to say "intel did it" I find it hilarious that everyone instantly thinks Intel is behind it, especially without any real proof.

I don't think Intel would be stupid enough to try a smear campaign like this.
Click to expand...
Sure.
I will give you that the entity of Corporation "Intel" is likely NOT behind this.
I am willing to bet hard cash that an Unnamed ex-employee" or "unnamed but soon to be terminated employee" IS behind this.

let me explain.
Here on this forum and many other hardware site, MOST people are neutral in picking a processor, basing it on price/performance ect. Then we have brand loyal Neanderthals that throw rocks at others who don't share their fanaticism.
Think this doesn't happen when it's also your employer? Think again.
They even named their exploits in an Intel Fanboi fashion. "Ryzenfall"?
Also of note: This "research company" has produced ONE report against ONE company, AMD. Add to all of this a VERY murky and obfuscated "transparency" of a research company and you don't have scientists, you have charlatans.
 
Meh. Just 5 years ago this would have been huge. Today it's just expected... normal. Who here is surprised? Fake news and high level scams are part of our accepted cultural norms now. Morals, ethics, laws, and models of behavior used to constrain capitalism. Now the only question is, does it make money? If yes then proceed.
 
bsbllclown said:
Intel's past behavior and losses in the court of law for this type of crap are the reasons why people immediately jump to this conclusion. its not a fanboy thing, Intel just plays dirty and its well known.

EDIT: Intel plays dirtier ;) and doesn't hide it well. All businesses cheat and steal and generally do whatever they can to make the most money. "Ya aint cheatin, ya aint trying".
Click to expand...

Then there's the obvious that the cts-labs.com domain was registered in June of last year, right around the time Intel was notified about Meltdown and Spectre.

The question is who approached who. Did CTS-Labs approach Viceroy Research because they are known for their unscrupulous behavior?
 
viscountalpha said:
Does this site stink to high heaven? Yes. But you need proof to say "intel did it" I find it hilarious that everyone instantly thinks Intel is behind it, especially without any real proof.

I don't think Intel would be stupid enough to try a smear campaign like this.
Click to expand...
luckily we are not in court and i am not a journalist writing a story, i am just a nobody voicing an opinion, at first when i read the statements from CTS and Viceroy, it brought that familiar feeling when reading Intel's PR statement, the wording, the point of focus, the overall BS, the timing, i swear when i did read the title ryzen flaws, i told my self this would be funny if it's an israeli firm, and few lines down, it was just what i suspected, and the more i read the more i saw intel's fingerprint everywhere.
they have the means to do it and the lack of ethics to follow up on it, if you are going to wait for proofs to fall on your laps before you form an opinion then good luck, and that's the game they play they will do dozen of things lik this, but as long as you can't prove it, you can't talk about it, and once they are proven, get a small fine, and move on to plan B, now you shackle your own opinion to a standard that is being used and abused by ppl who have the means and they always win.
seriously i might be wrong, but i just can't shake that feeling, not out of bias but simple instinct.
 
shpankey said:
All this did is make me hate Intel. A long time loyal Intel buyer, but I'm done w/ these ridiculous nefarious shenanigans. Definitely buying AMD next time until Intel rights the ship.
Click to expand...
I just wanted to point out that I liked your post not because I feel you should hate Intel for this specific situation, but because Intel has been doing this crap to AMD for a long long time, and it's incredibly childish behavior. While I'm really really glad that Intel was eventually caught and fined for their 'ridiculous nefarious shenanigans', rumor has it that AMD has not seen much (or any) of that Billion Dollar+ fine that Intel was supposed to pay them. If true that's even worse, that they have still basically gotten away with what they had done. Sure they were caught, and found guilty, but unfortunately the damage was done already. That's why I have not purchased anything Intel, and why I often suggest AMD when the situation doesn't call for the most performance needed to justify the price to buy the Intel part.

I've never been one to paint a picture of Intel's products that was anything but the truth. They indeed had the superior product for quite a long time, but was it fair? I don't think so, given their antics that kept AMD from making money, meaning they weren't able to put in the R&D that they needed in order to compete. THANKFULLY, they managed to get something together that is competitive, despite what they've had to face the whole time.

Sadly, nVidia plays with the same 4th Grade tactics, and they are actually who I figured may have been behind this. Intel may have already done this BS, but that's exactly why I don't see them trying to do that again, as they are now on people's radar for this sort of behavior. Nevertheless, while I don't actually feel like this is nV behind it, the timing of it is curious, coming short on the heels of their GeForce Partner Program nonsense... Which it's crap like that which is why I won't purchase or suggest their products, despite the fact that I'll admit they have the superior gaming cards :\

4saken said:
lol...poor AMD fanbois thought they had an edge for a few months. *poof*
Click to expand...
We know you're a troll. And I know you're not supposed to feed them...
So I'll give you the benefit of the doubt and just assume you're one of those Intel Fanboys wearing a blue blindfold, who is flexing his sub-par IQ by talking shit before reading the entire thread. Otherwise you would've realized that nothing has gone "*poof*", except for this leverage by Intel fanboys.


#TheRyzenFallOfIntel amirite!? :shame:
 
Why are these companies not hiring external testing companies as part of their R&D process.. it would save so many headaches..

Time for a class action lawsuit against AMD now..
 
thesmokingman said:
Your link is basically a paid advert, ie. the guy that got paid wrote that.
Click to expand...
I've watched a few Vice documentaries and while they do have some interesting content I was always left with the feeling that there was an agenda behind it / slanted.
 
Mega6 said:
Who is going to the slammer for insider trading?
Click to expand...
Depends how connected the persons are. Elizabeth Holmes, CEO of Theranos, was just fined $500k and no jail time for $700 million in fraud. Not to mention the medical fraud endangering thousands of peoples lives.

If i had a genie bottle, wish number one, all crooks would pay dearly.

Off topic, my bad...
 
Teenk9 said:
Extremetech has an article on CTS-Labs' CEO latest statement.

https://www.extremetech.com/computi...ith-amd-security-disclosures-digs-deeper-hole
Click to expand...

I get the impression CTS-Labs has an agenda to push, probably whoever is backing them giving them the direction to take. They are too dedicated since they are actually replying to criticism instead of disappearing as a fly-by-night company created by Viceroy Research would. It's becoming more of a possibility that Viceroy Research is a company specifically contracted by other companies to bring down corporations.
 
Interesting, so it's not specific to AMD chipsets/CPUs but to ASMedia chips that are used in a bunch of motherboards.

I'm still curious what exactly these alleged bugs exactly allow someone to do that makes them a concern since they require elevated admin access at the minimum. Their joke of a whitepaper isn't only light on details but is also very unclear about some key points, for instance in regards to one of the flaws they mention signed drivers but the way it's worded could mean that the flaw requires modified signed drivers to work or that it allows you to bypass requirements for signed drivers which is obviously a big difference.
 
If it requires Administrator rights on the target system does the rest even matter. The system is already in control of a Foreign entity it's a matter of time before all information on said system is compromised. That's like saying Windows or Linux has a security vulnerability if someone gets root or Administrator rights they can... DO ANYTHING.
 
Grimlaking said:
If it requires Administrator rights on the target system does the rest even matter. The system is already in control of a Foreign entity it's a matter of time before all information on said system is compromised. That's like saying Windows or Linux has a security vulnerability if someone gets root or Administrator rights they can... DO ANYTHING.
Click to expand...

That's my knee jerk reaction as well and will likely prove to be the case but it would be nice to see some clarification from a trustworthy source, unfortunately after reading the Anandtech article it sounds like they're only going to release details to a handful of entities that are unlikely to say much publicly.

Being able to bypass signed drivers sounds like it could potentially be worse than normal admin stuff. One article I read made it sound like with admin privileges someone could install malicious code to the trusted processor that would persist through fresh OS installs and BIOS flashes, that sounds like hogwash especially the latter(and I suspect they actually meant the alleged bug that requires a modified BIOS flashed to the MB) but it would be nice to know for sure.

So far the only thing that's clear is that the whole thing seems fishy, their continued defense of this along with the inconsistencies in their statements does make me suspect that the viceroy angle is simply a smokescreen but I suppose it's at least possible that they're doing it because they're worried about the SEC or other legal repercussions.
 
alamox said:
luckily we are not in court and i am not a journalist writing a story, i am just a nobody voicing an opinion, at first when i read the statements from CTS and Viceroy, it brought that familiar feeling when reading Intel's PR statement, the wording, the point of focus, the overall BS, the timing, i swear when i did read the title ryzen flaws, i told my self this would be funny if it's an israeli firm, and few lines down, it was just what i suspected, and the more i read the more i saw intel's fingerprint everywhere.
they have the means to do it and the lack of ethics to follow up on it, if you are going to wait for proofs to fall on your laps before you form an opinion then good luck, and that's the game they play they will do dozen of things lik this, but as long as you can't prove it, you can't talk about it, and once they are proven, get a small fine, and move on to plan B, now you shackle your own opinion to a standard that is being used and abused by ppl who have the means and they always win.
seriously i might be wrong, but i just can't shake that feeling, not out of bias but simple instinct.
Click to expand...

So not once did you cite an actual fact or give a single supposition based on fact. SMH.

Just maybe you might want to reconsider even saying anything unless you can base it on a fact.

One final note, Intel licenses technology from amd, amd licenses technology from Intel. You don't slander someone you have deals with. It doesn't make sense.
 
Last edited:
thesmokingman said:
ToB seems specious like they don't know whose side they stand on. They're sensationalist at first and but then reserved at the conclusion. And that conclusion is that to pull off an attack it would require significant efforts to develop attack tools. That suggests that the attack tools do not exist therefor this is theoretical.
Click to expand...
It doesn't read as sensational to me. Looks like a rather frank statement of facts, with little or no exaggeration or hyperbole. It's a much better representation of the situation than provided by cts labs, imo. The stuff you see on your local news or even an advertisement is more sensational than this.
 
SighTurtle said:
https://www.anandtech.com/show/12536/our-interesting-call-with-cts-labs

Anandtech did a interview call with CTS. Really interesting, and after reading it, I wouldn't be surprised if Intel was funding this as a hitjob against AMD.
Click to expand...
"DK: I think the biggest question that I still have is that ultimately who originated this request for analysis – who was the customer that kicked this all off?

ILO: I definitely am not going to comment on our customers.

DK: What about the flavor of customer: is it a semiconductor company, is it someone in the industry, or is it someone outside the industry? I don’t expect you to disclose the name but the genre seems quite reasonable.

ILO: Guys I’m sorry we’re really going to need to jump off this call but feel free to follow up with any more questions.



[End of Call]"
 
Ebernanut said:
Interesting, so it's not specific to AMD chipsets/CPUs but to ASMedia chips that are used in a bunch of motherboards.
Click to expand...

Which is, in relation to Ryzen, specific to AMD's chipsets/CPUs, as they licensed ASMedia's USB controller to be integrated into Ryzen, while Promontory probably has ASMedia PCIe multiplexers, and I'd assume SATA relation functions by them, too. (Apparently ASMedia designed, or is at least manufacturing, the Promontory chipset)
 
You must log in or register to reply here.
Back
Top