Dan Guido sur Twitter : "This is my favorite take on the AMD Flaws. They are effectively a "jailbreak" for AMD CPUs. https://t.co/kbdsKxHpYa"

Pays	Code	Pour les clients de
États-Unis	40404	(tous)
Canada	21212	(tous)
Royaume-Uni	86444	Vodafone, Orange, 3, O2
Brésil	40404	Nextel, TIM
Haïti	40404	Digicel, Voila
Irlande	51210	Vodafone, O2
Inde	53000	Bharti Airtel, Videocon, Reliance
Indonésie	89887	AXIS, 3, Telkomsel, Indosat, XL Axiata
Italie	4880804	Wind
3424486444	Vodafone
» Voir les numéros courts SMS des autres pays

Regardless of the hype around the release, the bugs are real, accurately described in their technical report (which is not public afaik), and their exploit code works.

21 réponses 65 Retweets 78 j'aime

Afficher cette discussion

Dan Guido‏ @dguido 13 mars

I initially responded to their request out of curiosity -- "Hey, do you want to see our new processor bugs before we release them?" "hell yes I do" -- but after their asks continued to grow billed them our week rate for the work.

7 réponses 5 Retweets 19 j'aime

Afficher cette discussion

Dan Guido‏ @dguido 13 mars

Dan Guido a retweeté Arrigo Triulzi

I spent all morning talking to reporters, mostly to correct twitter hot takes. Yes, all the flaws require admin privs but all are _flaws_ not expected functionality.https://twitter.com/cynicalsecurity/status/973595697902706688 …

Dan Guido ajouté,

Arrigo Triulzi @cynicalsecurity

Now onto the “vulnerabilities”: 1) MASTERKEY: if you allow unauthorised BIOS updates you are screwed. Threat level: No shit, Sherlock! 2) RYZENFALL: again, loading unauthorised code on the Secure Processor as admin. Threat level: No shit, Sherlock!

Afficher cette discussion

14 réponses 20 Retweets 46 j'aime

Afficher cette discussion

Dan Guido‏ @dguido 13 mars

You can find a measured take that includes my commentary on these vulnerabilities from @lorenzoFB @motherboard:https://motherboard.vice.com/en_us/article/kzpm5x/amd-secure-processor-ryzen-epyc-vulnerabilities-and-backdoors …

7 réponses 51 Retweets 63 j'aime

Afficher cette discussion

Dan Guido‏ @dguido 14 mars

Dan Guido a retweeté Dan Guido

Adding a FAQ based on the last 24 hours: - "Tell me more about how you were paid"https://twitter.com/dguido/status/973687926692466689 …

Dan Guido ajouté,

Dan Guido @dguido

En réponse à @IanCutress

It was driven by curiosity first and a favor. However, once we received the technical report and fielded their first set of questions, we realized it went beyond a favor. We anticipated 1 bug, not 13, so we asked to get paid.

2 réponses 0 Retweet 0 j'aime

Afficher cette discussion

Dan Guido‏ @dguido 14 mars

"In a situation like this, would it be common for your firm to discuss disclosure with the vendor?" Yes, and we did. I discussed pros/cons of various options with them and recommended that they report the vulnerabilities to a CERT.

1 réponse 0 Retweet 0 j'aime

Afficher cette discussion

Dan Guido‏ @dguido 14 mars

Dan Guido a retweeté Dan Guido

"Were you made aware of the plans to go public?" No.https://twitter.com/dguido/status/973633990639878144 …

Dan Guido ajouté,

Dan Guido @dguido

En réponse à @chronic

I did not see the whitepaper, video, media release, or anything else until a reporter sent it to me. Unlike everyone else, I only had the technical report and none of the media info.

1 réponse 1 Retweet 1 j'aime

Afficher cette discussion

Dan Guido‏ @dguido 14 mars

Dan Guido a retweeté Dan Guido

"How did CTS Labs find you? What is your relationship to them?" Mutual friend. No ongoing relationship.https://twitter.com/dguido/status/973675763319885825 …

Dan Guido ajouté,

Dan Guido @dguido

En réponse à @IanCutress

They found us through a mutual friend. I had never spoken to them before, and I have no ongoing relationship with them. They sought us out because they were concerned about the validity of their findings.

3 réponses 0 Retweet 0 j'aime

Afficher cette discussion

Dan Guido‏ @dguido 14 mars

Dan Guido a retweeté Dan Guido

"Do you have any financial position or interest in AMD or Intel stock?" No.https://twitter.com/dguido/status/973986464789868547 …

Dan Guido ajouté,

Dan Guido @dguido

En réponse à @audiemmm

No, I do all my investing with an automated portfolio from @Betterment. I have no positions on AMD stock, and I have no arrangement to benefit with a 3rd party. Thanks for asking.

3 réponses 1 Retweet 4 j'aime

Afficher cette discussion

Dan Guido‏ @dguido 15 mars

Dan Guido a retweeté Trail of Bits

If you're looking for clear, technical information about the flaws then see the blog we just published:https://twitter.com/trailofbits/status/974345028498804737 …

Dan Guido ajouté,

Trail of Bits @trailofbits

We published a technical summary of the "AMD Flaws" so they can be of use to the security community without the distraction of the surrounding disclosure issues. https://blog.trailofbits.com/2018/03/15/amd-flaws-technical-summary/ …

Afficher cette discussion

1 réponse 8 Retweets 8 j'aime

Afficher cette discussion

Dan Guido‏ @dguido 15 mars

Dan Guido a retweeté OSTIF Official

This is my favorite take on the AMD Flaws. They are effectively a "jailbreak" for AMD CPUs.https://twitter.com/OSTIFofficial/status/974348788163928064 …

Dan Guido ajouté,

OSTIF Official @OSTIFofficial

En réponse à @trailofbits

Wait, back up for a second... Does this mean that MasterKey provides a way to disable the AMD PSP? Is this the way to @coreboot_org and @libreboot that we have been waiting for?

11:24 - 15 mars 2018

17 Retweets
35 J'aime

4 réponses 17 Retweets 35 j'aime

1. Wladimir ‏ @orionwl 16 mars
  En réponse à @dguido
  
  This^ made me somewhat excited too. I'd been trying to break into the PSP of my AMD laptop, but no luck yet. Spent some time re'ing a similar ARM PSP bootloader (https://github.com/coreboot/blobs/tree/master/soc/amd/stoneyridge/PSP …). Then two week later this announcement goes out! Too bad there's so little details.
  
  1 Retweet 4 j'aime
  Merci. Twitter en tiendra compte pour améliorer votre fil. Supprimer
  
  Supprimer
1. Loki Verloren‏ @l0k1_smiren 15 mars
  En réponse à @dguido
  
  Remember, these things tend to cut both ways. 'trusted computing' has a lot in common with DRM - ultimately somewhere there is a way for the owner to break the lock, because it's on his property. In the end, the only secure, trustworthy operating system is by nature open.
  
  1 Retweet 2 j'aime
  Merci. Twitter en tiendra compte pour améliorer votre fil. Supprimer
  
  Supprimer

Le chargement semble prendre du temps.

Twitter est peut-être en surcapacité ou rencontre momentanément un incident. Réessayez ou rendez-vous sur la page Twitter Status pour plus d'informations.

Tweets

Dan Guido

@dguido

Tweets

Le chargement semble prendre du temps.

false

Recherches sauvegardées

Tweets

Dan Guido

@dguido

Tweets

Voir le profil d'une personne

Recherches sauvegardées

Sponsoriser ce Tweet

Bloquer

Tweeter avec une localisation

Vos listes

Créer une nouvelle liste

Copier le lien du Tweet

Intégrer ce Tweet

Embed this Video

Aperçu

Pourquoi vous voyez cette publicité

Se connecter à Twitter

S'inscrire sur Twitter

Vous n'êtes pas encore sur Twitter ? Inscrivez-vous, restez connecté à vos centres d'intérêts, et recevez des mises à jour en temps réel.

Codes bilatéraux (envoyer et recevoir) :

Confirmation

Bienvenue chez vous !

Les Tweets ne fonctionnent pas pour vous ?

Dites beaucoup avec peu

Faites passer le mot

Rejoignez la conversation

Découvrez les toutes dernières actualités

Obtenez davantage de ce que vous adorez

Trouvez ce qui se déroule maintenant

Ne manquez jamais un Moment

Le chargement semble prendre du temps.

Tweet sponsorisé

false