Dan Guido on Twitter: "AMD published an initial technical assessment of the flaws from CTS and, by all indications, it agrees with our own. They even linked to our blog post! https://t.co/ELyanbsE5Z"

Country	Code	For customers of
United States	40404	(any)
Canada	21212	(any)
United Kingdom	86444	Vodafone, Orange, 3, O2
Brazil	40404	Nextel, TIM
Haiti	40404	Digicel, Voila
Ireland	51210	Vodafone, O2
India	53000	Bharti Airtel, Videocon, Reliance
Indonesia	89887	AXIS, 3, Telkomsel, Indosat, XL Axiata
Italy	4880804	Wind
3424486444	Vodafone
» See SMS short codes for other countries

Dan Guido‏ @dguido 13 Mar 2018

Report Tweet
Report NetzDG Violation

Dan Guido Retweeted Arrigo Triulzi

I spent all morning talking to reporters, mostly to correct twitter hot takes. Yes, all the flaws require admin privs but all are _flaws_ not expected functionality.https://twitter.com/cynicalsecurity/status/973595697902706688 …

Dan Guido added,

Arrigo Triulzi @cynicalsecurity

Now onto the “vulnerabilities”: 1) MASTERKEY: if you allow unauthorised BIOS updates you are screwed. Threat level: No shit, Sherlock! 2) RYZENFALL: again, loading unauthorised code on the Secure Processor as admin. Threat level: No shit, Sherlock!

Show this thread

13 replies 16 retweets 44 likes

Show this thread

Dan Guido‏ @dguido 13 Mar 2018

Report Tweet
Report NetzDG Violation

You can find a measured take that includes my commentary on these vulnerabilities from @lorenzoFB @motherboard:https://motherboard.vice.com/en_us/article/kzpm5x/amd-secure-processor-ryzen-epyc-vulnerabilities-and-backdoors …

7 replies 47 retweets 60 likes

Show this thread

Dan Guido‏ @dguido 14 Mar 2018

Report Tweet
Report NetzDG Violation

Dan Guido Retweeted Dan Guido

Adding a FAQ based on the last 24 hours: - "Tell me more about how you were paid"https://twitter.com/dguido/status/973687926692466689 …

Dan Guido added,

Dan Guido @dguido

Replying to @IanCutress

It was driven by curiosity first and a favor. However, once we received the technical report and fielded their first set of questions, we realized it went beyond a favor. We anticipated 1 bug, not 13, so we asked to get paid.

2 replies 0 retweets 0 likes

Show this thread

Dan Guido‏ @dguido 14 Mar 2018

Report Tweet
Report NetzDG Violation

"In a situation like this, would it be common for your firm to discuss disclosure with the vendor?" Yes, and we did. I discussed pros/cons of various options with them and recommended that they report the vulnerabilities to a CERT.

1 reply 0 retweets 0 likes

Show this thread

Dan Guido‏ @dguido 14 Mar 2018

Report Tweet
Report NetzDG Violation

Dan Guido Retweeted Dan Guido

"Were you made aware of the plans to go public?" No.https://twitter.com/dguido/status/973633990639878144 …

Dan Guido added,

Dan Guido @dguido

Replying to @chronic

I did not see the whitepaper, video, media release, or anything else until a reporter sent it to me. Unlike everyone else, I only had the technical report and none of the media info.

1 reply 1 retweet 1 like

Show this thread

Dan Guido‏ @dguido 14 Mar 2018

Report Tweet
Report NetzDG Violation

Dan Guido Retweeted Dan Guido

"How did CTS Labs find you? What is your relationship to them?" Mutual friend. No ongoing relationship.https://twitter.com/dguido/status/973675763319885825 …

Dan Guido added,

Dan Guido @dguido

Replying to @IanCutress

They found us through a mutual friend. I had never spoken to them before, and I have no ongoing relationship with them. They sought us out because they were concerned about the validity of their findings.

3 replies 0 retweets 0 likes

Show this thread

Dan Guido‏ @dguido 14 Mar 2018

Report Tweet
Report NetzDG Violation

Dan Guido Retweeted Dan Guido

"Do you have any financial position or interest in AMD or Intel stock?" No.https://twitter.com/dguido/status/973986464789868547 …

Dan Guido added,

Dan Guido @dguido

Replying to @audiemmm

No, I do all my investing with an automated portfolio from @Betterment. I have no positions on AMD stock, and I have no arrangement to benefit with a 3rd party. Thanks for asking.

2 replies 1 retweet 4 likes

Show this thread

Dan Guido‏ @dguido 15 Mar 2018

Report Tweet
Report NetzDG Violation

Dan Guido Retweeted Trail of Bits

If you're looking for clear, technical information about the flaws then see the blog we just published:https://twitter.com/trailofbits/status/974345028498804737 …

Dan Guido added,

Trail of Bits @trailofbits

We published a technical summary of the "AMD Flaws" so they can be of use to the security community without the distraction of the surrounding disclosure issues. https://blog.trailofbits.com/2018/03/15/amd-flaws-technical-summary/ …

Show this thread

1 reply 8 retweets 8 likes

Show this thread

Dan Guido‏ @dguido 15 Mar 2018

Report Tweet
Report NetzDG Violation

Dan Guido Retweeted OSTIF Official

This is my favorite take on the AMD Flaws. They are effectively a "jailbreak" for AMD CPUs.https://twitter.com/OSTIFofficial/status/974348788163928064 …

Dan Guido added,

OSTIF Official @OSTIFofficial

Replying to @trailofbits

Wait, back up for a second... Does this mean that MasterKey provides a way to disable the AMD PSP? Is this the way to @coreboot_org and @libreboot that we have been waiting for?

2 replies 18 retweets 32 likes

Show this thread

Dan Guido‏ @dguido 15 Mar 2018

Report Tweet
Report NetzDG Violation

Dan Guido Retweeted wildcardNS

This is the truest comment anyone has made about my week so far:https://twitter.com/wildcardNP/status/973921044170989568 …

Dan Guido added,

wildcardNS @wildcardNP

Replying to @dguido

Man did you stumble into the hornet's nest! Better keep that phone on the charger this week lol

3 replies 1 retweet 7 likes

Show this thread

Dan Guido‏ @dguido 20 Mar 2018

Report Tweet
Report NetzDG Violation

AMD published an initial technical assessment of the flaws from CTS and, by all indications, it agrees with our own. They even linked to our blog post! https://community.amd.com/community/amd-corporate/blog/2018/03/20/initial-amd-technical-assessment-of-cts-labs-research …

3:29 PM - 20 Mar 2018

11 Retweets
12 Likes

2 replies 11 retweets 12 likes

1. Tonči Jukić‏ @toncijukic 20 Mar 2018
  
  Report Tweet
  
  Report NetzDG Violation
  Replying to @dguido
  
  Thanks for the report and congrats. Doesn't this report pretty much go against all the image CTSL tried to form? All the flaws look to be 3rd party firmware flaws that need root access to begin with? Looks significantly less dramatic.
  Thanks. Twitter will use this to make your timeline better. Undo
  
  Undo
1. Sam Varghese‏ @varghose 20 Mar 2018
  
  Report Tweet
  
  Report NetzDG Violation
  Replying to @dguido @daveaitel
  
  Your own report sounded like you were walking back your initial assessments. "There is no immediate risk of exploitation of these vulnerabilities for most users." https://www.itwire.com/security/82115-israeli-firm-was-advised-to-use-cert-to-disclose-amd-flaws.html …
  Thanks. Twitter will use this to make your timeline better. Undo
  
  Undo

Loading seems to be taking a while.

Twitter may be over capacity or experiencing a momentary hiccup. Try again or visit Twitter Status for more information.

Tweets

Dan Guido

@dguido

Tweets

Loading seems to be taking a while.

false

Saved searches

Tweets

Dan Guido

@dguido

Tweets

Go to a person's profile

Saved searches

Promote this Tweet

Block

Tweet with a location

Your lists

Create a new list

Copy link to Tweet

Embed this Tweet

Embed this Video

Preview

Why you're seeing this ad

Log in to Twitter

Sign up for Twitter

Not on Twitter? Sign up, tune into the things you care about, and get updates as they happen.

Two-way (sending and receiving) short codes:

Confirmation

Welcome home!

Tweets not working for you?

Say a lot with a little

Spread the word

Join the conversation

Learn the latest

Get more of what you love

Find what's happening

Never miss a Moment

Loading seems to be taking a while.

Promoted Tweet

false