Numerous vulnerabilities in AMD processors [LWN.net]

Numerous vulnerabilities in AMD processors

Posted Mar 14, 2018 7:41 UTC (Wed) by garloff (subscriber, #319)
Parent article: Numerous vulnerabilities in AMD processors

I'm not convinced that the whitepaper does describe anything new nor do does it contain anywhere near enough details to show how a security boundary that should be protected can be crossed.
Reading the "whitepaper", whenever I thought that the interesting section should come now, explaining how a security boundary can be overcome, the paper jumped to conclusions how this would endanger windoze...

Can I trust a computer after I flash untrusted BIOS? Hell, no. But I never expected that either...

I disregard this along with the "research" company behind it.

to post comments

Numerous vulnerabilities in AMD processors

Posted Mar 14, 2018 10:12 UTC (Wed) by ballombe (subscriber, #9523) [Link] (3 responses)

> Can I trust a computer after I flash untrusted BIOS? Hell, no. But I never expected that either...

I expect you pickup your servers straight from the factory, then.

Numerous vulnerabilities in AMD processors

Posted Mar 14, 2018 13:54 UTC (Wed) by oldtomas (guest, #72579) [Link]

Actually, that makes sense (yeah, just one of many results of a search "NSA intercept hardware", FWIW. This one had pics, so it did happen ;-).

Since Snowden we know that the NSA does manipulate hardware on its way to the customer.

Numerous vulnerabilities in AMD processors

Posted Mar 15, 2018 0:21 UTC (Thu) by lsl (subscriber, #86508) [Link]

If someone malicious and determined gets a hold of your computer on the way between the factory and your datacenter, I don't think you stand a chance anyway.

Numerous vulnerabilities in AMD processors

Posted Mar 23, 2018 15:01 UTC (Fri) by walex (guest, #69836) [Link]

«I expect you pickup your servers straight from the factory, then.»

Well, I know even mildly security-minded people who build their own computers only from parts bought in random physical shops. In this way any adversary has to use either a "generic" backdoor (and risk losing it) or implant a target-specific device or backdoor one by burglarizing their office or home, without taking the cheap and easy option to install a target-specific device or backdoor before delivery.