Hardware AMD Ryzen & EPYC Security Flaws - Ryzenfall, Masterkey, Fallout & Chimera

eva2000 · Mar 14, 2018

Looks like AMD EPYC & AMD Ryzen cpus have a few security flaws exposed code named, Ryzenfall, Masterkey, Fallout and Chimera. Details at AMDFLAWS

AMD Secure Processor
Critical Security Vulnerabilities in the AMD Secure Processor

AMD Secure Processor, responsible for maintaining security within EPYC and Ryzen processors, is currently being shipped with critical security vulnerabilities allowing malicious actors to install malware inside the chip.

The vulnerabilities may allow malicious actors to proliferate through corporate networks using stolen network credentials, by allowing Microsoft Windows Credential Guard to be bypassed.

Secure Encrypted Virtualization, a key feature that AMD advertises to cloud providers, could be defeated as soon as attackers obtain malicious code execution on the EPYC Secure Processor.

A malicious actor can gain full access to the compromised system, its physical memory, peripherals and to the secrets stored inside (fTPM).

Attackers could execute malicious code on the EPYC Secure Processor.

Click to expand...

AMD Ryzen Chipset
Outsourced Chip Design Contains Backdoors

The chipset is a central component on Ryzen and Ryzen Pro workstations: it links the processor with hardware devices such as WiFi and network cards, making it an ideal target for malicious actors.

The Ryzen chipset is currently being shipped with exploitable backdoors that could let attackers inject malicious code into the chip, providing them with a safe haven to operate from.

AMD’s outsource partner, ASMedia, is a subsidiary of ASUSTeK Computer, a company with poor security track record that has been penalized by the Federal Trade Commission for neglecting security vulnerabilities, and must now undergo independent security audits for the next 20 years.

The Chipset backdoors exist on virtually all Ryzen and Ryzen Pro workstations on the market today.

USB, SATA, PCI-E, and network traffic may flow through the chipset. Malware could leverage this position of power.

Click to expand...

RYZENFALL

RYZENFALL allows malicious code to take complete control over the AMD Secure Processor.

Secure Processor privileges could be leveraged to read and write protected memory areas, such as SMRAM and the Windows Credential Guard isolated memory.

Attackers could use RYZENFALL to bypass Windows Credential Guard, steal network credentials, and then potentially spread through even highly secure Windows corporate networks.

Attackers could use RYZENFALL in conjunction with MASTERKEY to install persistent malware on the Secure Processor, exposing customers to the risk of covert and long-term industrial espionage.

FALLOUT

The vulnerabilities allow attackers to read from and write to protected memory areas, such as SMRAM and Windows Credential Guard isolated memory (VTL-1).

An attacker could leverage these vulnerabilities to steal network credentials protected by Windows Credential Guard.

An attacker could leverage these vulnerabilities to bypass BIOS flashing protections that are implemented in SMM.

CHIMERA

Two sets of manufacturer backdoors discovered: One implemented in firmware, the other in hardware (ASIC). The backdoors allow malicious code to be injected into the AMD Ryzen chipset.

The chipset links the CPU to USB, SATA, and PCI-E devices. Network, WiFi and Bluetooth traffic often flows through the chipset as well. An attacker could leverage the chipset’s middleman position to launch sophisticated attacks.

Chipset-based malware could evade virtually all endpoint security solutions on the market.

Malware running on the chipset could leverage the latter’s Direct Memory Access (DMA) engine to attack the operating system. This kind of attack has been demonstrated.

MASTERKEY

Multiple vulnerabilities in AMD Secure Processor firmware allow attackers to infiltrate the Secure Processor.

Enables stealthy and persistent malware, resilient against virtually all security solutions on the market.

Allows tampering with AMD’s firmware-based security features such as Secure Encrypted Virtualization (SEV) and Firmware Trusted Platform Module (fTPM).

Facilitates network credential theft by allowing Windows Credential Guard to be bypassed.

Physical damage and bricking of hardware. Could be used by attackers in hardware-based "ransomware" scenarios.

Click to expand...

eva2000 · Mar 14, 2018

Looking at their disclaimer page, they these folks didn't wait for verification from AMD at all and published these security vulnerabilities first Disclaimer !

We conducted research and analysis based on public information in a manner that any person could have done if they had been interested in doing so. You can publicly access any piece of evidence cited in this report or that we relied on to write this report. Although we have a good faith belief in our analysis and believe it to be objective and unbiased, you are advised that we may have, either directly or indirectly, an economic interest in the performance of the securities of the companies whose products are the subject of our reports. Any other organizations named in this website have not confirmed the accuracy or determined the adequacy of its contents.
Click to expand...

eva2000 · Mar 14, 2018

OK, deep breath, relax... Let's have a sober look at these 'ere annoying AMD chip security flaws

CTS-Labs, a security startup founded last year in Israel, sent everyone scrambling and headlines flying today – by claiming it has identified "multiple critical security vulnerabilities and manufacturer backdoors in AMD’s latest Epyc, Ryzen, Ryzen Pro, and Ryzen Mobile processors."

Tuesday's glitzy advisory disclosed no technical details – but described 13 "critical" security vulnerabilities that span four bug classes in AMD chips. The biz apparently gave AMD only one day of advance notice it was going public, an amount of time that precludes addressing the flaws prior to publication and deviates from security industry norms of responsible disclosure. Typically, organizations are given up to 30 to 90 days to fix their products.
Click to expand...

But it's important to note that a software nasty has to have superuser powers to abuse the programming cockups found by CTS-Labs. At which point, the malware already can spy on its victim, steal their data, hold their files to ransom, and so on.

The flaws do not open AMD-powered PCs and servers to remote hijacking over the internet, nor allow malicious apps to commandeer systems. Instead, they can be leveraged to ensure that once malware is present, it's more difficult to find and remove.

Also, no code exploiting the security shortcomings has been made public, nor is any circulating right now in malware. The holes are also not necessarily unfixable.
Click to expand...

AMD in a statement issued a few hours ago said it was looking into the claims:

We have just received a report from a company called CTS-Labs claiming there are potential security vulnerabilities related to certain of our processors. We are actively investigating and analyzing its findings. This company was previously unknown to AMD and we find it unusual for a security firm to publish its research to the press without providing a reasonable amount of time for the company to investigate and address its findings.
Click to expand...

eva2000 · Mar 16, 2018

Linus Torvalds slams CTS Labs over AMD vulnerability report | ZDNet

It's that last part that ticks Torvalds off. The Linux creator agrees these are bugs, but all the hype annoys the heck out of him.

Are there bugs? Yes. Do they matter in the real world? No.

They require a system administrator to be almost criminally negligent to work. To Torvalds, inflammatory security reports are annoying distractions from getting real work done.

This is far from the first such case. A recent Linux "vulnerability," Chaos, required the attacker to have the root password. News flash: If an attacker has the root password, your system is already completely hosed. Everything else is just details.
Click to expand...

eva2000 · Mar 17, 2018

Anandtech coverage Security Researchers Publish Ryzen Flaws, Gave AMD 24 hours Prior Notice

At this point AMD has not confirmed any of the issues brought forth in the CTS-Labs whitepaper, so we cannot confirm in the findings are accurate. It has been brought to our attention that some press were pre-briefed on the issue, perhaps before AMD was notified, and that the website that CTS-Labs has setup for the issue was registered on February 22nd, several weeks ago. Given the level of graphics on the site, it does look like a planned ‘announcement’ has been in the works for a little while, seemingly with little regard for AMD’s response on the issue.
Click to expand...

eva2000 · Mar 18, 2018

Our Interesting Call with CTS-Labs

On the back of this, CTS-Labs has been performing a number of press interviews, leading to articles such as this at our sister site, Tom’s Hardware. CTS reached out to us as well, however a number of factors led to delaying the call. Eventually we found a time to suit everyone. It was confirmed in advance that everyone was happy the call was recorded for transcription purposes.

Joining me on the call was David Kanter, a long-time friend of AnandTech, semiconductor industry consultant, and owner of Real World Technologies. From CTS-Labs, we were speaking with Ido Li On, CEO, and Yaron Luk-Zilberman, CFO.
Click to expand...

eva2000 · Mar 21, 2018

AMD Confirms Newly-Found Security Flaws in Some of Its Chips, Fixes Coming Soon

AMD has confirmed today the security flaws discovered by the researchers from CTS Labs last week in some of its processors, promising that they will all be fixed in the coming days.
Click to expand...

AMD promises fixes for all issues in a few days

It took more than a week for AMD to respond to CTS Labs' report because the third-party security researchers gave the well-known semiconductor company only a day to read it. But despite this, AMD promises mitigations for all these CPU flaws in just a few days from the moment of publishing through BIOS updates, so all affected users are encouraged to update the BIOS of their systems as soon as possible.

The company also noted the fact that these newly disclosed flaws aren't related to the Meltdown and Spectre security vulnerabilities unearthed earlier this year by security researchers from Google Project Zero and various universities, nor the AMD "Zen" CPU architecture. AMD has assured users that the patches for these flaws won't affect the performance of their systems.
Click to expand...

Official response by AMD AMD Corporate: Initial AMD Technical Assessment... | Community

As described in more detail below, AMD has rapidly completed its assessment and is in the process of developing and staging the deployment of mitigations. It’s important to note that all the issues raised in the research require administrative access to the system, a type of access that effectively grants the user unrestricted access to the system and the right to delete, create or modify any of the folders or files on the computer, as well as change any settings. Any attacker gaining unauthorized administrative access would have a wide range of attacks at their disposal well beyond the exploits identified in this research. Further, all modern operating systems and enterprise-quality hypervisors today have many effective security controls, such as Microsoft Windows Credential Guard in the Windows environment, in place to prevent unauthorized administrative access that would need to be overcome in order to affect these security issues. A useful clarification of the difficulties associated with successfully exploiting these issues can be found in this posting from Trail of Bits, an independent security research firm who were contracted by the third-party researchers to verify their findings.
Click to expand...

Log in / Register

Forums

Want to subscribe to topics you're interested in?

Hardware AMD Ryzen & EPYC Security Flaws - Ryzenfall, Masterkey, Fallout & Chimera

eva2000 Administrator Staff Member

eva2000 Administrator Staff Member

eva2000 Administrator Staff Member

eva2000 Administrator Staff Member

eva2000 Administrator Staff Member

eva2000 Administrator Staff Member

eva2000 Administrator Staff Member

.

Log in / Register

Useful Searches

Want to subscribe to topics you're interested in?

Hardware AMD Ryzen & EPYC Security Flaws - Ryzenfall, Masterkey, Fallout & Chimera

eva2000 Administrator Staff Member

eva2000 Administrator Staff Member

eva2000 Administrator Staff Member

eva2000 Administrator Staff Member

eva2000 Administrator Staff Member

eva2000 Administrator Staff Member

eva2000 Administrator Staff Member

.