AMD Gaslights Security Researcher, Changes Rules Retroactively [video]

22 pointsposted 2 hours ago
by SockThief
(youtube.com)

13 Comments

tptacek

an hour ago

AMD didn't deny it was a vulnerability; they denied it was in the scope of the bounty program.

Remember that at giant tech companies, the incentive is to pay out bounties --- there are people on the vendor's team whose performance is measured in part by how much the program pays out.

odyssey7

an hour ago

What hair is this splitting? The issue was that AMD allowed a known and serious security vulnerability to exist within their customers’ systems, for months, and acted with a lack of candor while doing so.

tptacek

an hour ago

It's not hair-splitting; it's central to the idea of a bug bounty. Too many people have weird ideas about what bug bounties are for.

Hizonner

an hour ago

Yeah, like the weird idea that those programs are intended to in some way reduce the number of exploitable bugs actually out there.

tptacek

38 minutes ago

That's in fact often not their core purpose!

Hizonner

23 minutes ago

... which is why the rest of us should give them, and those who operate them, zero respect.

Nobody but AMD gives a fuck about AMD's internal policies or motivations.

sakkura

an hour ago

They wanted to keep it quiet. As if they did not mind if it was exploited by those with access to international network links.

bri3d

37 minutes ago

Actual write-up rather than overwrought YouTube drama: https://mrbruh.com/amd2/

A non-default-installation set of AMD tools (Ryzen Master and probably others) had an auto-updater which used HTTP instead of HTTPS. It's clear this is a feature they'd basically forgotten about; it even pointed to an ATI domain. A third-party bug bounty company rejected it because MITM was out of scope. AMD are incompetent at making software (news at 11), kept asking for extensions, and took an incredible amount of time to deal with it. Eventually they removed this updater entirely and replaced it with one in the app (rather than the installer) that uses HTTPS + a CRC32 (for some reason). The initial vuln was very stupid and should have been fixed faster. As for the current system, if you're mad about HTTPS-protected auto-updaters (which is valid), you've probably got a lot of them to go to war against.

thesuitonym

15 minutes ago

Gaslighting does not mean lying.

sakkura

an hour ago

Such a bug could have been exploited by certain big state actors.

Those that have access to international network links.

Those that have the ability to generate new firmware that simply passes the CRC32 checksum.