AMD Security Vulnerability – The Day After - Seems Financially Motivated

It has been a day after the news broke on the claimed AMD Security Vulnerabilities. In this news item, I wanted to recap and report on the current status and overview, as well as sharing my view on things.

Yesterday on the 13^th, my phone started to make more noises than usual, the news broke that AMD processors based on Zen would potentially have 13 security flaws. After some quick checks, a self-proclaimed company called CTS Labs posted a paper disclosing as what we now know as Masterkey, Ryzenfall, Fallout and Chimera attack vectors and vulnerabilities, potentially in the Zen architecture.

When the news arrived I started an initial news item, and then started further checking up the validity of the information. Press-releases from CTS Labs where posted by a PR agency on the big media PR outlets like Businesswire. The security firm has a professional looking website, and the website AMDFlaws was filled with information. Thus far all seemed legit. After an hour or so more background checks that we performed indicated weird stuff. Everything seems and felt ‘too convenient’, smooth produced videos with what look like actors, Israel based, coincidentally Intel has a big presence and fab there, which instantly will raise suspicion. It all felt like this information was designed in an effort to inflict damage of some kind. A security research firm would want to deal with their finding carefully, protecting the company and its end-users.

The white paper published by the firm reads nicely but lacks factual technical info. At that time I was thinking this might be a hoax, or an information release to inflict damage. In my responses in the forums I called this news-release a payload, a means to an end to inflict some sort of damage by way of a viral.

Further checking raised more red flags, some media had been pre-briefed or informed by the security firm. Some of them confirmed the flaws reported. However, all flaws require elevated privileges, e.g. there are still design flaws but you need to hand out the keys to your PC (admin level) or be compromised in some sort for these flaws to be exploitable. So if the flaws exist, these are a category 2 vulnerability, certainly not the level of Meltdown and Spectre. Somebody needs access to the PC/Server through administrator rights and access. Now if you give somebody admin level account access, you’re exposed anyway and you can probably think of 100 more,  if not thousands of things you can exploit.

Further checking on AMDFlaws and the CTS Labs website lead to curiosities.

• The 24-hour disclosure opposed to the industry standard 90/180 day is just wrong, completely unprofessional.
• 13 flaws announced on the 13^th of March?
• Domain records for "amdflaws.com" has been created on Feb, 22, 2018.
• Company is listed only since 2017, linked-in shows very poor company info.
• Domain registered not directly but through "domainsbyproxy.com".
• Domain is registered at GoDaddy, privately. No contact information of the domain is public.
• Their official Youtube Channel with that video, was created March this year. That would be the official company YT channel.
• Video looks marketed, too well produced.
• Names like Ryzenfall sounds like somebody from marketing made that up?
• Precisely 13 flaws? An unlucky number?
• Whitepaper shows no specific technical detail.
• Earlier today when the news broke and info was released I did some Google searches on CTS-Labs, it revealed very little, for a proclaimed established security agency.
• Parts of www.cts-labs.com website are copied from public PDF documents
• As a security firm, cts-labs website does not even have an SSL certificate active? Thus no https available as an option?
• cts-labs does not disclose address on website.

Let me ask you, if you would own a security firm with 16 years of expertise, would your website not have SSL (HTTPS) protection?  Click here to see what happens? Also, parts of their website on their business offering, have been copied from public accessible PDF documents.

There’s more though, within two hours of the news release, a short seller by the name of Viceroy Research published a claim that the 'revelations' would be the death blow for AMD. The timing of this is weird, hours after the info got out they already have a 32-page document ready on this. Can you fabricate such a paper in an hour or two? From the looks of this was produced beforehand. Could this be a purpose-built stock shorting scheme trying to devaluate AMD?

In the end, most of the news-release nearly looks to be a hoax or plot to damage AMD or for self-benefit (manipulating stock exchange), and as more time passes it seems to be the case that all this is just that. All this raises suspicion of the highest grounds, that by itself, however, doesn’t mean the vulnerabilities aren’t there, some parties have confirmed some of the flaws. If so, how did a non-security agency get access to that info and was able to produce it as such? Yeah, everything about this information release seems, feels and looks wrong. It seems to have been designed as a viral payload to inflict damage, and I feel the statements greatly exaggerate the impact of the vulnerabilities, perhaps even up-to-the level where I'd need to call it BS, the findings, however, are for AMD to answer.

We expect more info from AMD soon enough as they are the ones to either confirm and/or deny things, we’ll see what they have to say.