Analysis CTS-Labs, a security startup founded last year in Israel, sent everyone scrambling and headlines flying today – by claiming it has identified “multiple critical security vulnerabilities and manufacturer backdoors in AMD’s latest Epyc, Ryzen, Ryzen Pro, and Ryzen Mobile processors.”
Tuesday’s glitzy advisory disclosed no technical details – but described 13 “critical” security vulnerabilities that span four bug classes in AMD chips. The biz apparently gave AMD only one day of advance notice it was going public, an amount of time that precludes addressing the flaws prior to publication and deviates from security industry norms of responsible disclosure. Typically, organizations are given up to 30 to 90 days to fix their products.
The report describes the four classes of vulnerability, each of which has several variations. They all require local administrator access – or in one case, physical access – to exploit, which limits them as vulnerabilities useful for miscreants.
Essentially, the security holes can be exploited by malware already present in a computer to bury deep into its machinations to ensure it can’t be easily detected and removed – not even by wiping hard drives and reinstalling everything from scratch. The malware can inject itself into motherboard firmware to stay out of sight, all while meddling with or siphoning off files and other personal information, and interfering with system hardware.
But it’s important to note that a software nasty has to have superuser powers to abuse the programming cockups found by CTS-Labs. At which point, the malware already can spy on its victim, steal their data, hold their files to ransom, and so on.
The flaws do not open AMD-powered PCs and servers to remote hijacking over the internet, nor allow malicious apps to commandeer systems. Instead, they can be leveraged to ensure that once malware is present, it’s more difficult to find and remove.
Also, no code exploiting the security shortcomings has been made public, nor is any circulating right now in malware. The holes are also not necessarily unfixable.
What are the bug classes?
RYZENFALL allows malicious code to take over the AMD Secure Processor in Ryzen, Ryzen Pro, and Ryzen Mobile chips. Exploitation requires being able to run a program locally with administrator privileges. CTS-Labs claims there’s no mitigation, despite AMD’s recent released BIOS update that is supposed to disable the Secure Processor, thus killing off the whole thing.
The Secure Processor – aka the Platform Security Processor or PSP – is a coprocessor that ships with modern AMD chips that ensures a valid, untampered operating system is booted, among other tasks.
The RYZENFALL vulnerability may be related to a security issue in AMD’s Secure Processor reported by Google security researcher Cfir Cohen in January. RYZENFALL requires root-level access to attack. It can be used to commandeer the Secure Processor, boot backdoored operating systems, and extract, say, protected Bitlocker crypto-keys from the firmware to decrypt drives in seized Windows 10 machines.
FALLOUT, a flaw in the boot loader component of Epyc’s Secure Processor, allows attackers to read and write sensitive and protected memory areas, such as SMRAM and Windows Credential Guard isolated memory (VTL-1). As with RYZENFALL, local administrative access is necessary to exploit the issue.
CHIMERA is described as a pair of manufacturer backdoors, one in firmware and one in hardware (specifically in an ASIC), that allow code to be injected into AMD Ryzen chipsets. Again, you need root privileges to do this. This means the underlying motherboard firmware can be programmed to become a keylogger, send keypresses for passwords over the network, and so on.
The advisory claims the backdoors were introduced, accidentally or otherwise, by Taiwanese chip manufacturer ASMedia, owned by ASUSTeK, which used its own insecure integrated circuits in AMD’s Promontory chip, found in AMD’s Ryzen and Ryzen Pro lines.
MASTERKEY, allows the installation of persistent malware inside the Secure Processor, running in kernel-mode with administrative permissions. It requires the ability re-flash the motherboard BIOS with a malicious software update. This typically requires admin-level or physical access to a box, but CTS-Labs contends this could be done remotely through a command-line utility, again with the appropriate permissions.
The key thing with, er, MASTERKEY is that the system accepts modified BIOS images – when really, it ought to reject them, regardless of who is flashing them.
Eypc server chipsets are, we’re told, affected by FALLOUT and MASTERKEY. Ryzen workstation has CHIMERA, MASTERKEY and RYZENFALL. Ryzen Pro has CHIMERA and RYZENFALL. Ryzen mobile has RYZENFALL.
Questions of motivation
Some members of the online security community are characterizing the research as a hit piece designed to manipulate AMD’s stock price, presumably to benefit those intending to short company stock.
Dan Guido, CEO of security firm Trail of Bits, meanwhile contends the findings are valid. He said he was contacted by CTS-Labs ahead of today’s disclosures to check over the vulnerability discoveries to evaluate their impact, and said the blunders can be exploited. He was shown full technical details that have yet to be made public.
“Regardless of the hype around the release, the bugs are real, accurately described in their technical report (which is not public AFAIK), and their exploit code works,” he said via Twitter.
In a video published in conjunction with the research, Ido Li On, CEO of CTS-Labs, claimed many of Taiwanese chipmaker ASMedia’s products contain backdoors that could be used by hackers to inject malicious code. Fined by the FTC in 2016 for ignoring security flaws, ASMedia has helped build some AMD chipsets.
“When we looked at Ryzen computers, we saw that the very same backdoors that have existed on ASMedia chips for over six years are now on every Ryzen PC in the market,” Li On said. “This was deeply concerning to use and it got us to look at AMD security as a whole.”
Response
AMD in a statement issued a few hours ago said it was looking into the claims:
We have just received a report from a company called CTS-Labs claiming there are potential security vulnerabilities related to certain of our processors. We are actively investigating and analyzing its findings. This company was previously unknown to AMD and we find it unusual for a security firm to publish its research to the press without providing a reasonable amount of time for the company to investigate and address its findings.
In keeping with the practice cemented by the Spectre and Meltdown vulnerabilities in January, CTS-Labs is promoting the disclosure on a dedicated website, amdflaws.com – complete with logos, codenames, claims of public safety risks, and media briefings to create a big splash. No CVE ID numbers, though.
The website, and the white paper that accompanies it, includes a lengthy disclaimer advising not to use the research as investment advice. “The report and all statements contained herein are opinions of CTS and are not statements of fact,” the dot-com declared. “Organizations named in this website have not confirmed the accuracy or determined the adequacy of its contents.”
It also, curiously, acknowledges the possibility that those involved may have a financial interest in AMD stock:
Although we have a good faith belief in our analysis and believe it to be objective and unbiased, you are advised that we may have, either directly or indirectly, an economic interest in the performance of the securities of the companies whose products are the subject of our reports.
A separate website published under the name Viceroy Research meanwhile has cited CTS-Labs‘ work to claim, rather sensationally, “We believe AMD is worth $0.00 and will have no choice but to file for Chapter 11 (Bankruptcy) in order to effectively deal with the repercussions of recent discoveries.” Viceroy’s blog post and CTS’ findings went live today within a couple of hours of each other.
Reached by phone, John Fraser Perring, founder of Viceroy Research, which describes itself as “a group of individuals that see the world differently,” confirmed to The Register that his firm has a short position in AMD stock and that he intends to increase that position in light of support for CTS-Labs’ findings.
He said that technical experts he corresponded with who have verified the findings, specifically Dan Guido, have left him convinced that these flaws pose a serious risk to AMD customers.
Perring said he received a copy of report from an anonymous source and found the findings credible after consultation with internal and external technical experts.
Not everyone believes the flaws are quite so dire – certainly not enough to warrant a media blitz with claims of doom and death.
Sponsored:
Minds Mastering Machines – Call for papers now open
Article source: http://go.theregister.com/feed/www.theregister.co.uk/2018/03/13/amd_flaws_analysis/
