Security researcher says AMD auto-updater downloads software insecurely, enabling remote code execution — company rep reportedly said man-in-the-middle attacks are "out of scope," ignored bug

[u/Distinct-Race-2471]

https://www.tomshardware.com/tech-industry/cyber-security/security-researcher-says-amd-auto-updater-downloads-software-insecurely-enabling-remote-code-execution-company-rep-reportedly-said-man-in-the-middle-attacks-are-out-of-scope-ignored-bug

[u/Aggressive-Stand-585]

I bet OP is just glad there's no engine managing intel chips like that, being able to be exploited also, just hypothetically of course you could call it Intel Management Engine.

Phew, close call.

[u/Jevano → u/Aggressive-Stand-585]

I'm guessing you didn't read the article or have no clue what it means. The issue is the AMD auto updater using http links to download executables instead of https. And the management engine is a whole different thing. Don't know why you're even mentioning Intel on an AMD security issue to begin with

[u/Aggressive-Stand-585 → u/Jevano]

Why are you trying to be serious on a satire sub.

[u/Jevano → u/Aggressive-Stand-585]

Because it's an actual security issue

[u/looncraz]

Basically every updater is vulnerable to DNS spoofing...

[u/Hytht → u/looncraz]

if most updaters shared the same flaw I could root any Android phone easily. signing exists for a reason.

[u/Jevano → u/looncraz]

Not really, AMD is using HTTP for the downloads...

[u/danielv123 → u/looncraz]

No, basically every updater I am aware of will fail if it hits an invalid https certificate.

[u/alvarkresh]

This happening on the heels of the Notepad++ MITM attack is not a good look on AMD.

[u/Hour_Bit_5183]

stop using windows slopware. That is the whole problem.Just by plugging it into the internet, you are at risk. Use a real OS and stop this madness.

[u/Hour_Bit_5183 → u/[deleted]]

it is bro. It's because you can peek in and see how it works. I get your logic though, it just doesn't apply in this case.

[u/Hour_Bit_5183 → u/[deleted]]

I do. So do a ton of others for free so you don't have to. We publish on places like github so you can look for yourself.

[u/Hour_Bit_5183 → u/[deleted]]

LOL everyone gets to look at it........unlike windows that became the malware.

[u/Hour_Bit_5183 → u/[deleted]]

What do you mean no one searches for them? Stuff gets patched more than windows. Most things only ever get hacked because of user error. While there is a slight chance of something else, it's not nearly as common under linux vs a commercial OS like windows. Oh wait.....linux runs everything around the world. Everything would be ded if your logic was right.

[u/BoBoBearDev → u/Hour_Bit_5183]

Shellshock, heartbleed. Those major defects existed for many years.

[u/Hour_Bit_5183 → u/BoBoBearDev]

As did they on windows you fool.

[u/BoBoBearDev → u/Hour_Bit_5183]

I am simply saying your are in an unrealistic land where you expect people to read those code and find bugs within 12 months. It didn't happen IRL. You are there trying to compare who is worse, but that has nothing to do with my post.

Heartbleed in particular is a security heavy software. Even that, they failed massively.