No, I don't...
But it's not a difficult target if you've got control of the ARM on the AMD CPU.
I'm not trying hard at all. On the contrary- people are trying really hard to defend this as "not a big deal" and I'm saying it IS. And I'm qualified to say so.
You're wrong on a lot of levels.
First, this does absolutely affect the AMD CPUs (as well as the ASMedia chipset controllers)
Second, an exploited administrator account is not a bigger deal than an owned chipset or system management controller.
You are free to run any code you want on your main CPU. The SMU requires signed code for a very good reason- because it can transparently prevent you from actually updating its code, and transparently do... well, whatever the fuck it wants, up to and including preventing you from knowing it is there. There are no bigger problems than flaws at this level.
And if someone has already owned the SMU, they can make you think you installed the BIOS, but replace the little blurb of SMU code in it transparently, allowing you to think you've fixed the problem, without actually having done so!
But no, this isn't a problem.
This is what I wish people would take away from this:(
Instead, they're too busy trying to ravenously defend AMD's misstep.
We have got to get these closed ring -1 black box processors out of our fucking equipment. It's horse shit.
That is the most transparent whataboutism I have ever seen.... I suppose at least you're honest.
Can you help me understand why the blatent defensive shilling for AMD? It's cancerous here.
Right on all accounts. This article dearly needs you modded up.
The only thing I would change is, "they could also plant malware where there was no way of finding it, or removing it."
Hi. Real security researcher here. You have no idea what you're talking about. These days, systems that run "higher" than root on the main CPU are ubiquitous from the embedded to desktop range. Getting root/administrator access is only the first step. This presents a single easy target for above-root access to a machine. This is a big deal. Quit shilling.
It has complete oversight... This power is enumerated by statute. It was given to the president, and they are free to remove it. The fact is, the Congress agrees with its use.
AC is being downmodded because AC is ignorant and has no idea what he is talking about. So, apparently, are the people who moderated you.
Where Congress empowers a President to declare an action prohibited or not (which they do in hundreds of aspects of American life) he has that power. In this case, they did, and he did. All's happy and legal. Nothing weird here. Just ignorant people on Slashdot who bitch and moan and call names, too stupid to learn the system, and therefor too stupid to fix it.
Awfully snarky of you. The law is right there in the order. I'm not even a Trump supporter, but there is nothing even remotely fishy about this order. There are literally a couple dozen of orders under this statute in place.
Also horseshit. Executive orders were created so that there was a formal way to issue direction to the Federal Government. They do not make law, they are not above the law. Of course, should an order be illegal, you're welcome to argue against whatever jackbooted thugs the government sends at your ass until you get your day in court to have the order struck down, so there's certainly an element of de facto law creation, until it's struck down.
This order, like all other orders, cite the laws that empower the President to issue the order. Congress already has the check in place, and Trump's administration is following the rules, minus the small procedural problem of he may have let the state of emergency sunset this January because his administration is fucking inept. But that can be fixed easily enough with another order.
Trump actually first prohibited Americans from dealing in a whole list of financial instruments tied to the Venezuelan government back in August. This particular order has almost identical text, only specifically targeting the cryptocurrency.
The law specifically requires such emergencies to be extended annually, or they sunset.. Interestingly enough, The order was renewed in 2016, and 2017, but not 2018... Technically speaking, this order may not be legal, since as far as I can tell, the state of emergency ended on January 13, 2018. Of course he could fix that with another continuing order...
Also, I don't disagree that we're guilty of half-assing it.
But to quote you, let's be real here.
The day when we could push China around is long gone. In an all-out conventional war, they would win. In a limited engagement, they would win. They pushed us to the 38th parallel in Korea and held their ground with no appreciable anti-aircraft forces, or air superiority. We considered nuking the peninsula just to slow them down.
Don't underestimate the power of an enemy that outnumbers you 4:1. That was Germany's mistake.
Nuke the blockade? Hell no. SRBMs and IRBMs are deployed all the time in contemporary warfare. We also have all kinds of defense against them. That being said, in the fight against dropping ballistics down on ships vs. how many Aegis cruisers we can deploy... the ballistics will always win, because they are cheaper.
Plastics used in food packaging are generally pretty inert, though.
Also, a lot of its non-reactivity has to do with the length of the polymers. Break down plastic, and it's far more reactive, unsurprisingly, as it's generally linked hydrocarbons.
I'm sure the plastic runoff will be much less after the civilization-ending disaster of two nuclear armed powers slugging it out in an all-out attempt to stop the other side from being able to fire anymore guns.
The Soviet Union was unwilling to end civilization over Cuba, but I'm pretty sure the Chinese would be willing to exchange some wicked fire over a blockade of their actual coast. Parent is fucking retarded.
I'm trying to imagine a naval blockade line around china that puts it out of the range of ballistic missiles.
I'm also trying to imagine how a nuclear armed country with the potential to grossly overpower us (no matter what the power disparity is, the potential is there) responds to an internationally accepted act of war (blockade)
I think you've been drinking too much of Jingo's kool-aid.
He's generally a pretty bright guy, but I almost pissed myself at the claim of a requirement of criminal negligence from an administrator.
I've made a living finding privilege escalations in *his* goddamn operating system.
I've never before been able to say, with this root escalation, I can now render this machine forever owned. Now I can.
I just really hope it drives home the silliness of allowing any kind of code to run on the goddamn chipsets, and special security domains running at ring -1.
Here's the part you're missing. This is a real-life blue pill. And a perfect, and do-able version.
There is no successful blue pill- because a perfect hypervisor would be an epic amount of work, and things like trusted booting would make it infeasible to trap the machine early enough.
This is your blue pill. They don't need to write a hypervisor- they can run code that runs *above* root, and at the chipset.
What's uglier, is this blue pill is so deep, that it can effectively prevent itself from ever being removed.
I have several published linux kernel and android CVEs, and have been head hunted by major security firms as a senior analyst. I'm not making shit up. This may not be a big deal to you, but it is a big deal regardless.
... That's not an argument. Reading your posts in the pasts, I had really thought you were more intelligent than that. Are you somehow emotionally invested in AMD not looking bad?
Slashdot Mirror
No, I don't...
But it's not a difficult target if you've got control of the ARM on the AMD CPU.
I'm not trying hard at all. On the contrary- people are trying really hard to defend this as "not a big deal" and I'm saying it IS. And I'm qualified to say so.
You're wrong on a lot of levels.
First, this does absolutely affect the AMD CPUs (as well as the ASMedia chipset controllers)
Second, an exploited administrator account is not a bigger deal than an owned chipset or system management controller.
You are free to run any code you want on your main CPU. The SMU requires signed code for a very good reason- because it can transparently prevent you from actually updating its code, and transparently do... well, whatever the fuck it wants, up to and including preventing you from knowing it is there. There are no bigger problems than flaws at this level.
And if someone has already owned the SMU, they can make you think you installed the BIOS, but replace the little blurb of SMU code in it transparently, allowing you to think you've fixed the problem, without actually having done so!
But no, this isn't a problem.
This is what I wish people would take away from this :(
Instead, they're too busy trying to ravenously defend AMD's misstep.
We have got to get these closed ring -1 black box processors out of our fucking equipment. It's horse shit.
That is the most transparent whataboutism I have ever seen.... I suppose at least you're honest.
Can you help me understand why the blatent defensive shilling for AMD? It's cancerous here.
Right on all accounts. This article dearly needs you modded up.
The only thing I would change is, "they could also plant malware where there was no way of finding it, or removing it."
I doubt real security researchers
Hi. Real security researcher here. You have no idea what you're talking about. These days, systems that run "higher" than root on the main CPU are ubiquitous from the embedded to desktop range. Getting root/administrator access is only the first step. This presents a single easy target for above-root access to a machine. This is a big deal. Quit shilling.
That's partially true. The flaws affect both the ASMedia chips, and the embedded ARM system management processor in the CPU. Parent was not wrong.
It has complete oversight... This power is enumerated by statute. It was given to the president, and they are free to remove it. The fact is, the Congress agrees with its use.
Then, the whole system is deeply and truly fucked.
You're not wrong. A lot of people saw and understood this at the beginning.
They are probably the ones that made the most money.
You're completely correct. Parent is grossly misinformed.
AC is being downmodded because AC is ignorant and has no idea what he is talking about. So, apparently, are the people who moderated you.
Where Congress empowers a President to declare an action prohibited or not (which they do in hundreds of aspects of American life) he has that power. In this case, they did, and he did. All's happy and legal. Nothing weird here. Just ignorant people on Slashdot who bitch and moan and call names, too stupid to learn the system, and therefor too stupid to fix it.
Awfully snarky of you. The law is right there in the order. I'm not even a Trump supporter, but there is nothing even remotely fishy about this order. There are literally a couple dozen of orders under this statute in place.
I shouldn't have to do this, but I will anyway.
https://www.treasury.gov/resou... Enjoy.
Also horseshit. Executive orders were created so that there was a formal way to issue direction to the Federal Government. They do not make law, they are not above the law. Of course, should an order be illegal, you're welcome to argue against whatever jackbooted thugs the government sends at your ass until you get your day in court to have the order struck down, so there's certainly an element of de facto law creation, until it's struck down.
This order, like all other orders, cite the laws that empower the President to issue the order. Congress already has the check in place, and Trump's administration is following the rules, minus the small procedural problem of he may have let the state of emergency sunset this January because his administration is fucking inept. But that can be fixed easily enough with another order.
Trump actually first prohibited Americans from dealing in a whole list of financial instruments tied to the Venezuelan government back in August. This particular order has almost identical text, only specifically targeting the cryptocurrency.
The law specifically requires such emergencies to be extended annually, or they sunset.. Interestingly enough, The order was renewed in 2016, and 2017, but not 2018... Technically speaking, this order may not be legal, since as far as I can tell, the state of emergency ended on January 13, 2018. Of course he could fix that with another continuing order...
Also, I don't disagree that we're guilty of half-assing it.
But to quote you, let's be real here.
The day when we could push China around is long gone. In an all-out conventional war, they would win. In a limited engagement, they would win. They pushed us to the 38th parallel in Korea and held their ground with no appreciable anti-aircraft forces, or air superiority. We considered nuking the peninsula just to slow them down.
Don't underestimate the power of an enemy that outnumbers you 4:1. That was Germany's mistake.
Nuke the blockade? Hell no. SRBMs and IRBMs are deployed all the time in contemporary warfare. We also have all kinds of defense against them. That being said, in the fight against dropping ballistics down on ships vs. how many Aegis cruisers we can deploy... the ballistics will always win, because they are cheaper.
They most certainly aren't inert.
Plastics used in food packaging are generally pretty inert, though.
Also, a lot of its non-reactivity has to do with the length of the polymers. Break down plastic, and it's far more reactive, unsurprisingly, as it's generally linked hydrocarbons.
.1mm is visible to the naked eye?
You have better eyes than me, dude.
I'm sure the plastic runoff will be much less after the civilization-ending disaster of two nuclear armed powers slugging it out in an all-out attempt to stop the other side from being able to fire anymore guns.
The Soviet Union was unwilling to end civilization over Cuba, but I'm pretty sure the Chinese would be willing to exchange some wicked fire over a blockade of their actual coast. Parent is fucking retarded.
I'm trying to imagine a naval blockade line around china that puts it out of the range of ballistic missiles.
I'm also trying to imagine how a nuclear armed country with the potential to grossly overpower us (no matter what the power disparity is, the potential is there) responds to an internationally accepted act of war (blockade)
I think you've been drinking too much of Jingo's kool-aid.
Having just recently gotten my feet wet with Oracle SQL Server for a new billing platform (that was promptly gotten rid of)
Spot fucking on.
He's generally a pretty bright guy, but I almost pissed myself at the claim of a requirement of criminal negligence from an administrator.
I've made a living finding privilege escalations in *his* goddamn operating system.
I've never before been able to say, with this root escalation, I can now render this machine forever owned. Now I can.
I just really hope it drives home the silliness of allowing any kind of code to run on the goddamn chipsets, and special security domains running at ring -1.
Here's the part you're missing. This is a real-life blue pill. And a perfect, and do-able version.
There is no successful blue pill- because a perfect hypervisor would be an epic amount of work, and things like trusted booting would make it infeasible to trap the machine early enough.
This is your blue pill. They don't need to write a hypervisor- they can run code that runs *above* root, and at the chipset.
What's uglier, is this blue pill is so deep, that it can effectively prevent itself from ever being removed.
I have several published linux kernel and android CVEs, and have been head hunted by major security firms as a senior analyst. I'm not making shit up. This may not be a big deal to you, but it is a big deal regardless.
... That's not an argument. Reading your posts in the pasts, I had really thought you were more intelligent than that. Are you somehow emotionally invested in AMD not looking bad?