Slashdot Mirror
Can AMD Vulnerabilities Be Used To Game the Stock Market? (vice.com)
Earlier this week, a little-known security firm called CTS Labs reported, what it claimed to be, severe vulnerabilities and backdoors in some AMD processors. While AMD looks into the matter, the story behind the researchers' discovery and the way they made it public has become a talking point in security circles. The researchers, who work for CTS Labs, only reported the flaws to AMD shortly before publishing their report online. Typically, researchers give companies a few weeks or even months to fix the issues before going public with their findings. To make things even stranger, a little bit over 30 minutes after CTS Labs published its report, a controversial financial firm called Viceroy Research published what they called an "obituary" for AMD. Motherboard reports: "We believe AMD is worth $0.00 and will have no choice but to file for Chapter 11 (Bankruptcy) in order to effectively deal with the repercussions of recent discoveries," Viceroy wrote in its report. CTS Labs seemed to hint that it too had a financial interest in the performance of AMD stock. "We may have, either directly or indirectly, an economic interest in the performance of the securities of the companies whose products are the subject of our reports," CTS Labs wrote in the legal disclaimer section of its report.
On Twitter, rumors started to swirl. Are the researchers trying to make money by betting that AMD's share price will go down due to the news of the vulnerabilities? Or, in Wall Street jargon, were CTS Labs and Viceroy trying to short sell AMD stock? Security researcher Arrigo Triulzi speculated that Viceroy and CTS Lab were profit sharing for shorting, while Facebook's chief security officer Alex Stamos warned against a future where security research is driven by short selling.
[...] There's no evidence that CTS Labs worked with Viceroy to short AMD. But something like that has happened before. In 2016, security research firm MedSec found vulnerabilities in pacemakers made by St. Jude Medical. In what was likely a first, MedSec partnered with hedge fund Muddy Waters to bet against St. Jude Medical's stock. For Adrian Sanabria, director of research at security firm Threatcare and a former analyst at 451 Research, where he covered the cybersecurity industry, trying to short based on vulnerabilities just doesn't make much sense. While it could work in theory and could become more common in the future, he said in a phone call, "I don't think we've seen enough evidence of security vulnerabilities really moving the stock for it to really become an issue." Further reading: Linus Torvalds slams CTS Labs over AMD vulnerability report (ZDNet).
On Twitter, rumors started to swirl. Are the researchers trying to make money by betting that AMD's share price will go down due to the news of the vulnerabilities? Or, in Wall Street jargon, were CTS Labs and Viceroy trying to short sell AMD stock? Security researcher Arrigo Triulzi speculated that Viceroy and CTS Lab were profit sharing for shorting, while Facebook's chief security officer Alex Stamos warned against a future where security research is driven by short selling.
[...] There's no evidence that CTS Labs worked with Viceroy to short AMD. But something like that has happened before. In 2016, security research firm MedSec found vulnerabilities in pacemakers made by St. Jude Medical. In what was likely a first, MedSec partnered with hedge fund Muddy Waters to bet against St. Jude Medical's stock. For Adrian Sanabria, director of research at security firm Threatcare and a former analyst at 451 Research, where he covered the cybersecurity industry, trying to short based on vulnerabilities just doesn't make much sense. While it could work in theory and could become more common in the future, he said in a phone call, "I don't think we've seen enough evidence of security vulnerabilities really moving the stock for it to really become an issue." Further reading: Linus Torvalds slams CTS Labs over AMD vulnerability report (ZDNet).
The last time this shit was posted, we established that the prerequisites for those "vulnerabilities" were ridiculous, requiring *at least* admin access, or even installing a hacked bios first! We also established that CTS labs were in bed with Intel had created the domain for this only right before publishing it. Apart from the fact that everyone agreed that giving AMD only such a short time to react befor publishing it, was completely unprofessional and a "hit job". (To which I agree.)
So, do you plan on posting it until people believe it because we have given up on remindig everyone, or have you now brought your sock puppet troll army to silence everyone?
Seriously, in my world, you need to go to prison over this!
Markets have shown little care in the face of computer security issues. You may get a few day drop but nothing lasting. Look at Intel, Target, or anyone else. It's just not that big of a deal to investors or consumers.
Invulnerabilities of the Security Processor had been reported to AMD last year by researchers from Google. Apparently AMD found a workaround by letting people disable the entire PSP. Considering that both the "Masterkey" and "Ryzenfall" vulnerability groups allegedly depend on exploiting the PSP, these problems already appear to be fixed by AMD, somewhat.
So if someone with a Ryzen is concerned there's something they can do about it. Source: https://www.bleepingcomputer.c...
Just in case it isn't clear enough to you, buying a security with insider knowledge of an unannounced problem with the company, then announcing the problem in the expectation that the announcement will manipulate the price of the stock, and attempting to profit from that, is securities fraud. It is the kind of thing that should be investigated by the Securities and Exchange Commission, and charges should be filed if appropriate.
Bruce Perens.
So far, it does not seem to work against AMD, good. And the attempt was on low amateur level in addition, like a lot of crime. Of course, a lot of the press response was also on low amateur level (whatever happened to verifying stories before publishing?), so some small-time investors may have gotten spooked. I hope the SEC and others looks into this ruthlessly.
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
As of this posting, AMD is down by a whopping -0.06. I do not think this does what you wanted it to do.
And Dan Guido is prime helper number one in this crime.
Still waiting on Serviscope_minor to wake up to fucking reality and realize that Jessica Price isn't going to fuck him.
Hey guys, I'm one of you, a neutral third party financially uninvolved in any of this.
Let's all go and buy Intel processors because they don't have any of these critical security flaws that are just so much more noteworthy than boring and harmless Spectre and Meltdown. And who even remembers those? They are so 2017, am I right?
Also did you know that when you support Intel you support small independent security researchers of the highest ethical and moral standards? Wow, if that isn't standing up for the little guy (just like you and me!) I don't know what is.
Manipulating markets with lies. Actually I thought that *was* grounds for prison.
-- I ignore anonymous replies to my comments and postings.
Not without your help, duche!
I can't believe this is still being spread...
So someone is going to hire a crew of thousands in some mythical shipping department to individually inject malware into chips individually so that it actually becomes much of a threat. You don't happen to with for the mythological Intel associated CTS labs so you? What a fucking moron.
-- I ignore anonymous replies to my comments and postings.
maybe CTS Labs can find out what happens when you drop the soap!
The SEC went after Mark Cuban and Cuban won. The Cuban case is an example of what is NOT insider trading.
Also if you look at the SEC web site it says illegal insider trading is:
--
buying or selling a security, in breach of a fiduciary duty or other relationship of trust and confidence,
--
The fiduciary duty is the duty that corporate officers, the company's lawyer, etc, have to look out for the interests of the company (stockholders) rather than their own personal gain. I have no "relationship of trust and confidence", no fiduciary duty, with Intel or AMD. Therefore, according to the SEC I can buy and sell AMD or Intel stock based on WHATEVER information I have, as long as I didn't get that information secretly from someone who has a "relationship of trust and confidence" with the company, such as a corporate officer.
I for one stopped buying AMD processors since they introduced PSP
So: who did you warn about the PSP (introduced about 2013) ? If you did not use AMD or Intel processors, what were you using ?
The statute, and the SEC, disagree with you.
If you look at the SEC web site it says illegal insider trading is:
--
buying or selling a security, in breach of a fiduciary duty or other relationship of trust and confidence,
--
The fiduciary duty is the duty that corporate officers, the company's lawyer, etc, have to look out for the interests of the company (stockholders) rather than their own personal gain. I have no "relationship of trust and confidence", no fiduciary duty, with Intel or AMD. Therefore, according to the SEC I can buy and sell AMD or Intel stock based on WHATEVER information I have, as long as I didn't get that information secretly from someone who has a "relationship of trust and confidence" with the company, such as a corporate officer.
I can decide to sell my Intel stock today because I haven't pooped yet, or because a groundhog saw his shadow. What's prohibited is people employed to take care of the company (corporate officers, etc) must not abrogate that responsibility for their own personal gain.
PrePSP processors..
AMD investors are down a few 100 million dollars right now. The lab is an "insider" in this case. If any portion of that ended up in pockets of people who were given information ahead of time that enabled them to make money on shorts, they committed insider trading. There is no reason why this form of stealing should get different time than any other. It would certainly have involved enough money to qualify as grand larceny.
That's what I came here to ask. It seems like market manipulation - similar to the penny stock pump and dump schemes.
So is it? It's hard to believe that the folks at CTS et al aren't aware of SEC rules, esp brazenly including a comment in the disclosure. It's kind of like those YouTube disclaimers "I don't own this content - any Copyrighted material is owned by other entities" -- yeah that makes it all better.
And as somebody else above noted - the security holes aren't really all that concerning requiring too many pre-reqs to the point that "you've been pwned" already.
This is kind of interesting story within a story. Nothing to see here - except fake news and propaganda carried by news orgs that aren't capable to providing analysis, and wrapped in a possible fraud made possible by the Blogger fake news pipeline.
hmm... you might want to ask Martha Stewart about that definition. She received a tip that the CEO of the company had sold all his shares - and she acted accordingly. But I don't believe she was an officer of the company.
Pump and Dump schemes are illegal too. https://en.wikipedia.org/wiki/...
Actually this CTS instance might be considered "Short and Distort"
1. What is Intel's stake in putting AMD out of business.
2. How much is Intel paying for this hit piece?
IIRC someone did something similar for some Cisco routers. It was a targeted attack, not a global attack, but it wasn't narrowly targeted.
So the scenario isn't unreasonable. A state actor would be the most likely perpetrator, and the attacks would be mildly targeted (systems shipped from location X to foreign location Y between dates D1 and D2). Saying this can't be done is denying that things that have been detected once can happen again.
I think we've pushed this "anyone can grow up to be president" thing too far.
Martha Stewart was convicted of lying to an officer. She tried to cover up what she did. Also, she was on the board of directors of the Stock Exchange, which probably gave her a fiduciary duty (tangentially). But even that wouldn't have stuck if she'd just come clean.
Hi! I make Firefox Plug-ins. Check 'em out @ https://addons.mozilla.org/en-US/firefox/addon/youtube-mp3-podcaster/
Not denying it, but this is a (pretty much extreme) edge case. The only place where it would cause widespread issues is, per your example, at router manufacturers. Those are the only items where few instances can affect many. I don't see people doing this on every chip going into workstations or servers. It just isn't practical.
-- I ignore anonymous replies to my comments and postings.
Manipulating markets with lies. Actually I thought that *was* grounds for prison.
They are not lying. They are stating facts and opinions, and mixing them to confuse naive investors. They preface many sentences with "We believe" and "We may". This "obituary" was almost certainly reviewed by lawyers, to ensure that it got as close to "the line" as possible, without crossing it.
You can fool some of the people some of the time, and for securities manipulation, that is enough.
The last time this shit was posted, we established that the prerequisites for those "vulnerabilities" were ridiculous, requiring *at least* admin access
All of which has nothing to do with TFA or TFS which is all about how perception can affect stock market changes. Take a breath, read the summary, participate in intellectual conversations and wipe the froth from your mouth.
I don't think regulators will let people hide behind 'opinions' anymore. Especially when they say it is such an extremely dire vulnerability, when in fact it is not so dire. Moderate at best. It seems pretty evident when (their lawyers obviously did tell them to include that) they have financial interest in AMD and are partnering with a financial brokerage. If they bought stocks hoping them to rise they wouldn't make such extreme (likely bullshit) proclamations and then give AMD only a day to look at them. They wouldn't do something that would make them lose money. So the only way they could make money doing something like this is to short the stock. So this is plainly manipulation and should be investigated by the regulators. Even more so if some comments are to be believed that the security researchers website is quite new.
-- I ignore anonymous replies to my comments and postings.
Stewart wasn't held liable for most of the things in the SEC complaint because she was neither an officer of the company nor did she get the information from one. She basically went to prison for lying about the whole thing (obstruction of justice, etc.)
Pump and dump is covered under rule 10b-5: Employment of Manipulative and Deceptive Practices. What's illegal is to LIE about a company in order to fraudulently manipulate the stock price. Telling the truth about a company is not only okay, but encouraged. Several offenses related to investing are only offenses if you fail to reveal the truth about the issues. If a company has security risks, or any other risks, certain people are REQUIRED to publish that information. Publishing true statements not only isn't a crime, it's how you avoid being charged with other crimes. Here's the full text if Rule 10b-5, the pump and dump rule.
It shall be unlawful for any person, directly or indirectly, by the use of any means or instrumentality of interstate commerce, or of the mails or of any facility of any national securities exchange,
(a) To employ any device, scheme, or artifice to defraud,
(b) To make any untrue statement of a material fact or to omit to state a material fact necessary in order to make the statements made, in the light of the circumstances under which they were made, not misleading, or
(c) To engage in any act, practice, or course of business which operates or would operate as a fraud or deceit upon any person,
in connection with the purchase or sale of any security."
Another thing that's been done regarding pump and dump is restrictions on who can trade penny stocks and how, since fraudsters often use penny stocks.
AMD could open source the code for review to prove there are no backdoors.
Manipulating markets with lies. Actually I thought that *was* grounds for prison.
They are not lying. They are stating facts and opinions, and mixing them to confuse naive investors. They preface many sentences with "We believe" and "We may". This "obituary" was almost certainly reviewed by lawyers, to ensure that it got as close to "the line" as possible, without crossing it.
You can fool some of the people some of the time, and for securities manipulation, that is enough.
I have a Intel q9650 system. It has no EFI bios, it relies on Linux and Selinux security features. The TPM for my Asus P5Q is a plug in chip.
So, the TPM is replaceable by someone when a technician comes over and pretends he is installing new hardware, as opposed to replacing a Security chip with one allowing dual access.
Yes, anyone who has physical access to the computer can install new bios's, replace TPMs and even replace CPU Microcode fixes.
This problem is no different from my taking my car to a local garage which has a workaround diagnostic and programming machine usually provided to dealers. If I brought my system to Geek Squad, want to bet that they have put in software that indicates who in their organization handled the system last, and what is the bypass (insecure) password.
CTS had a financial interest in dropping the AMD stock prices. And when they hit bottom, to buy them back. AMD is ok, the problem or issue, if any, may rest with the mother board manufacturer.
Leslie Satenstein Montreal Quebec Canada