Slashdot Mirror
Can AMD Vulnerabilities Be Used To Game the Stock Market? (vice.com)
Earlier this week, a little-known security firm called CTS Labs reported, what it claimed to be, severe vulnerabilities and backdoors in some AMD processors. While AMD looks into the matter, the story behind the researchers' discovery and the way they made it public has become a talking point in security circles. The researchers, who work for CTS Labs, only reported the flaws to AMD shortly before publishing their report online. Typically, researchers give companies a few weeks or even months to fix the issues before going public with their findings. To make things even stranger, a little bit over 30 minutes after CTS Labs published its report, a controversial financial firm called Viceroy Research published what they called an "obituary" for AMD. Motherboard reports: "We believe AMD is worth $0.00 and will have no choice but to file for Chapter 11 (Bankruptcy) in order to effectively deal with the repercussions of recent discoveries," Viceroy wrote in its report. CTS Labs seemed to hint that it too had a financial interest in the performance of AMD stock. "We may have, either directly or indirectly, an economic interest in the performance of the securities of the companies whose products are the subject of our reports," CTS Labs wrote in the legal disclaimer section of its report.
On Twitter, rumors started to swirl. Are the researchers trying to make money by betting that AMD's share price will go down due to the news of the vulnerabilities? Or, in Wall Street jargon, were CTS Labs and Viceroy trying to short sell AMD stock? Security researcher Arrigo Triulzi speculated that Viceroy and CTS Lab were profit sharing for shorting, while Facebook's chief security officer Alex Stamos warned against a future where security research is driven by short selling.
[...] There's no evidence that CTS Labs worked with Viceroy to short AMD. But something like that has happened before. In 2016, security research firm MedSec found vulnerabilities in pacemakers made by St. Jude Medical. In what was likely a first, MedSec partnered with hedge fund Muddy Waters to bet against St. Jude Medical's stock. For Adrian Sanabria, director of research at security firm Threatcare and a former analyst at 451 Research, where he covered the cybersecurity industry, trying to short based on vulnerabilities just doesn't make much sense. While it could work in theory and could become more common in the future, he said in a phone call, "I don't think we've seen enough evidence of security vulnerabilities really moving the stock for it to really become an issue." Further reading: Linus Torvalds slams CTS Labs over AMD vulnerability report (ZDNet).
On Twitter, rumors started to swirl. Are the researchers trying to make money by betting that AMD's share price will go down due to the news of the vulnerabilities? Or, in Wall Street jargon, were CTS Labs and Viceroy trying to short sell AMD stock? Security researcher Arrigo Triulzi speculated that Viceroy and CTS Lab were profit sharing for shorting, while Facebook's chief security officer Alex Stamos warned against a future where security research is driven by short selling.
[...] There's no evidence that CTS Labs worked with Viceroy to short AMD. But something like that has happened before. In 2016, security research firm MedSec found vulnerabilities in pacemakers made by St. Jude Medical. In what was likely a first, MedSec partnered with hedge fund Muddy Waters to bet against St. Jude Medical's stock. For Adrian Sanabria, director of research at security firm Threatcare and a former analyst at 451 Research, where he covered the cybersecurity industry, trying to short based on vulnerabilities just doesn't make much sense. While it could work in theory and could become more common in the future, he said in a phone call, "I don't think we've seen enough evidence of security vulnerabilities really moving the stock for it to really become an issue." Further reading: Linus Torvalds slams CTS Labs over AMD vulnerability report (ZDNet).
The last time this shit was posted, we established that the prerequisites for those "vulnerabilities" were ridiculous, requiring *at least* admin access, or even installing a hacked bios first! We also established that CTS labs were in bed with Intel had created the domain for this only right before publishing it. Apart from the fact that everyone agreed that giving AMD only such a short time to react befor publishing it, was completely unprofessional and a "hit job". (To which I agree.)
So, do you plan on posting it until people believe it because we have given up on remindig everyone, or have you now brought your sock puppet troll army to silence everyone?
Seriously, in my world, you need to go to prison over this!
THIS is what people need to go prison over?
Nice fucking priorities.
So a guy in shipping or recieving needs to have 'root access' to the cpu chip. Or a guy in the parts crib has a zif socket 'burner' to inject the malware into a tray of processors before they are ever plugged into a board to go in the server.
Non-volatile embedded malware can be injected into the processor in many ways.
You guys need to update your concept of 'root access'.
Markets have shown little care in the face of computer security issues. You may get a few day drop but nothing lasting. Look at Intel, Target, or anyone else. It's just not that big of a deal to investors or consumers.
Why is parent modded down? Itâ(TM)s the truth.
Invulnerabilities of the Security Processor had been reported to AMD last year by researchers from Google. Apparently AMD found a workaround by letting people disable the entire PSP. Considering that both the "Masterkey" and "Ryzenfall" vulnerability groups allegedly depend on exploiting the PSP, these problems already appear to be fixed by AMD, somewhat.
So if someone with a Ryzen is concerned there's something they can do about it. Source: https://www.bleepingcomputer.c...
Just in case it isn't clear enough to you, buying a security with insider knowledge of an unannounced problem with the company, then announcing the problem in the expectation that the announcement will manipulate the price of the stock, and attempting to profit from that, is securities fraud. It is the kind of thing that should be investigated by the Securities and Exchange Commission, and charges should be filed if appropriate.
Bruce Perens.
So far, it does not seem to work against AMD, good. And the attempt was on low amateur level in addition, like a lot of crime. Of course, a lot of the press response was also on low amateur level (whatever happened to verifying stories before publishing?), so some small-time investors may have gotten spooked. I hope the SEC and others looks into this ruthlessly.
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
As of this posting, AMD is down by a whopping -0.06. I do not think this does what you wanted it to do.
And Dan Guido is prime helper number one in this crime.
Still waiting on Serviscope_minor to wake up to fucking reality and realize that Jessica Price isn't going to fuck him.
What about that suggests he has his priorities mixed up? I agree that, perhaps, he's showing a lack of perspective, but at no point did he suggest that we should pursue these bullshit pushers over, say, serial murderers. It's not clear how you arrived at this conclusion; please explain.
Hey guys, I'm one of you, a neutral third party financially uninvolved in any of this.
Let's all go and buy Intel processors because they don't have any of these critical security flaws that are just so much more noteworthy than boring and harmless Spectre and Meltdown. And who even remembers those? They are so 2017, am I right?
Also did you know that when you support Intel you support small independent security researchers of the highest ethical and moral standards? Wow, if that isn't standing up for the little guy (just like you and me!) I don't know what is.
Manipulating markets with lies. Actually I thought that *was* grounds for prison.
-- I ignore anonymous replies to my comments and postings.
Someone wants the world to use intel only processors on pcs. We must make them responsbile for this vandalism. A couple of security vulnablities shoudn't bankrupt a company. Intel never went under when they got FOOFed. It looks like all the dirty work in the cryptocurrency markets is spreading into stocks as well.
Not without your help, duche!
I can't believe this is still being spread...
Only if Goldman Sachs is using AMD based computers.. ;-)
Just in case it isn't clear enough to you, buying a security with insider knowledge of an unannounced problem with the company, then announcing the problem in the expectation that the announcement will manipulate the price of the stock, and attempting to profit from that, is securities fraud. It is the kind of thing that should be investigated by the Securities and Exchange Commission, and charges should be filed if appropriate.
Who says that when an outside organization finds security flaws it constitutes insider trading? I strongly dispute that opinion.
If the flaws are real, anyone in the marketplace with sufficient smarts and motivation could buy a stack of Ryzen and EPYC chips and find the flaws. I see nothing "insider" about that.
While I don't approve of CTS giving AMD less than 24 hrs notice, and I am not yet convinced CTS has found real flaws, I don't see it as criminal when your business model is based on finding real flaws, investing to capitalize on them, and announcing them.
Suppose Goldman Sachs had a big division that investigated consumer products for dangerous flaws and both announced and invested accordingly. As long as the flaws are real, wouldn't that be a service to society? Wouldn't we all be better off if the VW diesel cheating had been found sooner, even if it were found by a competitor who then profited?
So someone is going to hire a crew of thousands in some mythical shipping department to individually inject malware into chips individually so that it actually becomes much of a threat. You don't happen to with for the mythological Intel associated CTS labs so you? What a fucking moron.
-- I ignore anonymous replies to my comments and postings.
Seriously? AMD has to go bankrupt? They're going to pull that out of their ass and report it as news? Fuck out of here....
So where is Aiden Pearce?
maybe CTS Labs can find out what happens when you drop the soap!
Yes, cool down little anonymous (greatparent).. cool down..
Anyway, what it is clear is that the way the PSP was designed by AMD, IS a serious security concern for users. I for one stopped buying AMD processors since they introduced PSP, before that I was an AMD fanboy, but nevermind... (BTW, the same could be said about Intel with their ME..)
My point is that features like PSP and ME should be thoroughly investigated by the security research comunity, because of their immense (devastating!) potential of destruction if exploited by malicious entities!
The key problem is that the owner of the system (with features like PSP or ME) has ABSOLUTELY no mean (zero, nil, nada!!..) to mitigate the threat, other that have trust in AMD or Intel for doing well their job... (explanation for the non experts : nobody outside Intel or AMD is authorised to touch the code of ME or PSP....)
Now for the fact that some people used the pretext of a legitimate security research for leveraging stock market manipulations is an another story which should concern primarily the judicial authorities..
Why the hyperbolic attack? The guy in the parts crib knows exactly which boxes those processors are going into. Other guys on his team are ready and waiting. Why would the team care about thousands of processsors? They have specific targets.
The SEC went after Mark Cuban and Cuban won. The Cuban case is an example of what is NOT insider trading.
Also if you look at the SEC web site it says illegal insider trading is:
--
buying or selling a security, in breach of a fiduciary duty or other relationship of trust and confidence,
--
The fiduciary duty is the duty that corporate officers, the company's lawyer, etc, have to look out for the interests of the company (stockholders) rather than their own personal gain. I have no "relationship of trust and confidence", no fiduciary duty, with Intel or AMD. Therefore, according to the SEC I can buy and sell AMD or Intel stock based on WHATEVER information I have, as long as I didn't get that information secretly from someone who has a "relationship of trust and confidence" with the company, such as a corporate officer.
I for one stopped buying AMD processors since they introduced PSP
So: who did you warn about the PSP (introduced about 2013) ? If you did not use AMD or Intel processors, what were you using ?
and the should all be in jail. This is not the first time they have done this type of thing. I hope the SEC nails them to the wall and hands the case over to the justice department for criminal charges and extradition (they are foreign nationals - two Aussies and one Britt).
Probably they will get a slap on the wrist and be free to try again with another stock on another exchange. If they do it in China, maybe we as a species will be lucky and see them put up against a wall and shot as they well deserve.
The statute, and the SEC, disagree with you.
If you look at the SEC web site it says illegal insider trading is:
--
buying or selling a security, in breach of a fiduciary duty or other relationship of trust and confidence,
--
The fiduciary duty is the duty that corporate officers, the company's lawyer, etc, have to look out for the interests of the company (stockholders) rather than their own personal gain. I have no "relationship of trust and confidence", no fiduciary duty, with Intel or AMD. Therefore, according to the SEC I can buy and sell AMD or Intel stock based on WHATEVER information I have, as long as I didn't get that information secretly from someone who has a "relationship of trust and confidence" with the company, such as a corporate officer.
I can decide to sell my Intel stock today because I haven't pooped yet, or because a groundhog saw his shadow. What's prohibited is people employed to take care of the company (corporate officers, etc) must not abrogate that responsibility for their own personal gain.
PrePSP processors..
AMD investors are down a few 100 million dollars right now. The lab is an "insider" in this case. If any portion of that ended up in pockets of people who were given information ahead of time that enabled them to make money on shorts, they committed insider trading. There is no reason why this form of stealing should get different time than any other. It would certainly have involved enough money to qualify as grand larceny.
" IS a serious security concern for users"
No it really isn't. It only becomes a concern if there has been wide spread exploitation that directly harms the users. The flaw reported requires a long list of prerequisites before you can even attempt to exploit it. The research firm and the hedge fund firm have opened themselves up to SEC scrutiny and contrary to popular belief the SEC has a history of not only prosecuting but leveling serious punishments to those it deems guilty. The SEC evaluates and enforces it's regulations and associated federal laws using both the letter and spirit of the law.
That's what I came here to ask. It seems like market manipulation - similar to the penny stock pump and dump schemes.
So is it? It's hard to believe that the folks at CTS et al aren't aware of SEC rules, esp brazenly including a comment in the disclosure. It's kind of like those YouTube disclaimers "I don't own this content - any Copyrighted material is owned by other entities" -- yeah that makes it all better.
And as somebody else above noted - the security holes aren't really all that concerning requiring too many pre-reqs to the point that "you've been pwned" already.
This is kind of interesting story within a story. Nothing to see here - except fake news and propaganda carried by news orgs that aren't capable to providing analysis, and wrapped in a possible fraud made possible by the Blogger fake news pipeline.
I was not speaking about the "flaws" CTS claims having discovered, but about the PSP feature per-se. .. feature!..
And more to the point : the user has absolutely no control about this
I know some people say that recently(?) AMD permited the disabling of the PSP, but I don't believe that...
The day when someone proves me that the PSP firmware has no backdors (or more generaly is NOT remotely exploitable), THEN I will trust again AMD..
hmm... you might want to ask Martha Stewart about that definition. She received a tip that the CEO of the company had sold all his shares - and she acted accordingly. But I don't believe she was an officer of the company.
Pump and Dump schemes are illegal too. https://en.wikipedia.org/wiki/...
Actually this CTS instance might be considered "Short and Distort"
What did everyone expect with all the rent seeking security 'researchers'. You pay them a bug bounty or they sell to someone else.
This is just the next step.
1. What is Intel's stake in putting AMD out of business.
2. How much is Intel paying for this hit piece?
IIRC someone did something similar for some Cisco routers. It was a targeted attack, not a global attack, but it wasn't narrowly targeted.
So the scenario isn't unreasonable. A state actor would be the most likely perpetrator, and the attacks would be mildly targeted (systems shipped from location X to foreign location Y between dates D1 and D2). Saying this can't be done is denying that things that have been detected once can happen again.
I think we've pushed this "anyone can grow up to be president" thing too far.
Martha Stewart was convicted of lying to an officer. She tried to cover up what she did. Also, she was on the board of directors of the Stock Exchange, which probably gave her a fiduciary duty (tangentially). But even that wouldn't have stuck if she'd just come clean.
Hi! I make Firefox Plug-ins. Check 'em out @ https://addons.mozilla.org/en-US/firefox/addon/youtube-mp3-podcaster/
Not denying it, but this is a (pretty much extreme) edge case. The only place where it would cause widespread issues is, per your example, at router manufacturers. Those are the only items where few instances can affect many. I don't see people doing this on every chip going into workstations or servers. It just isn't practical.
-- I ignore anonymous replies to my comments and postings.
The day when someone proves me that the PSP firmware has no backdors (or more generaly is NOT remotely exploitable), THEN I will trust again AMD..
Do you even science bro?
It also applies to anyone who receives the information from someone with a fiduciary duty.
Otherwise you'd be able to get away with it by simply getting your spouse, cat or buddy from the bar to do it.
Dumb fuck.
Manipulating markets with lies. Actually I thought that *was* grounds for prison.
They are not lying. They are stating facts and opinions, and mixing them to confuse naive investors. They preface many sentences with "We believe" and "We may". This "obituary" was almost certainly reviewed by lawyers, to ensure that it got as close to "the line" as possible, without crossing it.
You can fool some of the people some of the time, and for securities manipulation, that is enough.
The last time this shit was posted, we established that the prerequisites for those "vulnerabilities" were ridiculous, requiring *at least* admin access
All of which has nothing to do with TFA or TFS which is all about how perception can affect stock market changes. Take a breath, read the summary, participate in intellectual conversations and wipe the froth from your mouth.
I don't think regulators will let people hide behind 'opinions' anymore. Especially when they say it is such an extremely dire vulnerability, when in fact it is not so dire. Moderate at best. It seems pretty evident when (their lawyers obviously did tell them to include that) they have financial interest in AMD and are partnering with a financial brokerage. If they bought stocks hoping them to rise they wouldn't make such extreme (likely bullshit) proclamations and then give AMD only a day to look at them. They wouldn't do something that would make them lose money. So the only way they could make money doing something like this is to short the stock. So this is plainly manipulation and should be investigated by the regulators. Even more so if some comments are to be believed that the security researchers website is quite new.
-- I ignore anonymous replies to my comments and postings.
Why this question?
Have you understood what was my point little guy?
I have a box of Pentium Pro processors, too, but no motherboards any longer. I was just saving them as collectables and for their significant scrap gold value.
I think I still have an AMD K5 motherboard, too.
You do it on the chips going into the Work Order for the workstations being shipped to the power plant.
Because you can't prove a negative. That applies to literally everything and everyone.
So I guess you won't be buying any electronics ever again because you could never prove that backdoors don't exist.
If root access allows you to hack the PSP that is bad, Intel Management Engine cant be hacked in that way. It means your hardware can never truly be clean, because once somebody hacks your PSP there is no way to fix it, whether thats from somebody intercepting your physical processor or what.
It depends on how the tip is conveyed. Recent rule changes at the SEC have been made after several court cases where the defense raised the trader's lack of knowledge that the trade used insider information. A trade done by an outsider can only be classified as insider trading if the person who trades on the basis of material nonpublic information is aware that it was material nonpublic information when making the purchase or sale.
Stewart wasn't held liable for most of the things in the SEC complaint because she was neither an officer of the company nor did she get the information from one. She basically went to prison for lying about the whole thing (obstruction of justice, etc.)
Pump and dump is covered under rule 10b-5: Employment of Manipulative and Deceptive Practices. What's illegal is to LIE about a company in order to fraudulently manipulate the stock price. Telling the truth about a company is not only okay, but encouraged. Several offenses related to investing are only offenses if you fail to reveal the truth about the issues. If a company has security risks, or any other risks, certain people are REQUIRED to publish that information. Publishing true statements not only isn't a crime, it's how you avoid being charged with other crimes. Here's the full text if Rule 10b-5, the pump and dump rule.
It shall be unlawful for any person, directly or indirectly, by the use of any means or instrumentality of interstate commerce, or of the mails or of any facility of any national securities exchange,
(a) To employ any device, scheme, or artifice to defraud,
(b) To make any untrue statement of a material fact or to omit to state a material fact necessary in order to make the statements made, in the light of the circumstances under which they were made, not misleading, or
(c) To engage in any act, practice, or course of business which operates or would operate as a fraud or deceit upon any person,
in connection with the purchase or sale of any security."
Another thing that's been done regarding pump and dump is restrictions on who can trade penny stocks and how, since fraudsters often use penny stocks.
AMD could open source the code for review to prove there are no backdoors.
So could Intel, Microsoft and everybody else for that matter. It is not going to happen.
CTS could be aware of the rules, but CTS isn't based in the USA.
For crying out loud, the unscrollable ad with it's annoying automation is making it freaking impossible to read this site.
It's almost like content providers are trying to make the reading experience as annoying as possible for their customers.
Remember the good old days (90s) when tech companies actually liked their customers and tried to do right by them?
Manipulating markets with lies. Actually I thought that *was* grounds for prison.
They are not lying. They are stating facts and opinions, and mixing them to confuse naive investors. They preface many sentences with "We believe" and "We may". This "obituary" was almost certainly reviewed by lawyers, to ensure that it got as close to "the line" as possible, without crossing it.
You can fool some of the people some of the time, and for securities manipulation, that is enough.
I have a Intel q9650 system. It has no EFI bios, it relies on Linux and Selinux security features. The TPM for my Asus P5Q is a plug in chip.
So, the TPM is replaceable by someone when a technician comes over and pretends he is installing new hardware, as opposed to replacing a Security chip with one allowing dual access.
Yes, anyone who has physical access to the computer can install new bios's, replace TPMs and even replace CPU Microcode fixes.
This problem is no different from my taking my car to a local garage which has a workaround diagnostic and programming machine usually provided to dealers. If I brought my system to Geek Squad, want to bet that they have put in software that indicates who in their organization handled the system last, and what is the bypass (insecure) password.
CTS had a financial interest in dropping the AMD stock prices. And when they hit bottom, to buy them back. AMD is ok, the problem or issue, if any, may rest with the mother board manufacturer.
Leslie Satenstein Montreal Quebec Canada