Requires kernel-level access. Also AMD is “releasing mitigations,” so is it “unfixable?”
If you have kernel access you can already do almost everything so a vulnerability on top of that isn’t that bad since no one should have kernel access to your computer
You mean like Crowdstrike?
I think they meant it as “once infected may be impossible to disinfect.” But it sure doesn’t read that way at first glance.
Did they change it? Because now it says “Allows Deep, Virtually Unfixable Infections” and that seems to say exactly what you are.
Surely one could use the same exploit to restore the original boot code as the malware used to corrupt it
Requires kernel-level access
What does that mean to the rest of us?
It means it’s what we in the trade call “a nothingburger”. On Windows you need to explicitly install a malicious driver (which in turn requires to you to disable signature verification), on Linux you’d have to load a malicious kernel module (which requires pasting commands as root, and it would probably be proprietary since it has malware to hide and as every nvidia user knows, proprietary kernel modules break with kernel updates)
So install a multiplayer game, it has kernel level anticheat that opens a bunch of security holes, game over.
Kernel level access is absolutely achievable in the real world.
Similar vulnerability threat as the Intel ME bug. Annoying for security-critical applications where you start worrying about hardware security, but virtually no real-world threat. Might be useful for users wishing to disable security processors though.
More “cybersecurity” clickbait with red/blue/green images of processors and skulls. That’s the real “infection”
I mean, I’m not much of a tinfoil hat, but this article feels extremely conveniently timed for Intel, who is currently going through a massive ordeal with their chips. Especially considering that the vulnerability is so extremely difficult to exploit that there’s borderline no story here for 99% of people but the headline will still drive clicks and drama.
Intel has literally done this, and stuff like it before.
They back “independent” researchers who twist themselves in knots to make AMD look bad.
Look up the multiple counts of bullshit from a “research group” called Principled Technologies.
Sidenote: the guy who ran it was Ryan Shrout, who used to work for PC Perspective, and would usually give favourable reviews to Intel. After leaving Principled Technologies, he got a high up marketing position at… drumroll… Intel!
Principled Technologies isn’t the only scam “independent researcher” Intel has set up or paid handsomely either.
I loathe what part of the security community has become with the stunt hacking and vuln naming. That being said, I doubt it’s some conspiracy. I don’t know all the details but it wouldn’t be exceptional to identify a bug that has existed in processor firmware or legacy code for a long time.
People are looking at this stuff all the time, both professionally and for fun. You could make the case that it’s inevitable that there will be exploits found that affect a huge population.
In the end, as long as the layman gets smarter about computer security, the better people will react to vuln drops.
So what do I exactly need to do if I have ine if the affected CPUs? What specifically do I need to patch?
You’ll want to upgrade your system BIOS when your board vendor makes this fix available.
