<story><title>Our Interesting Call with CTS-Labs</title><url>https://www.anandtech.com/show/12536/our-interesting-call-with-cts-labs</url></story><parent_chain><item><author>tptacek</author><text>This is crazymaking. I posted the Trail of Bits technical summary earlier today:&lt;p&gt;&lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;news.ycombinator.com&amp;#x2F;item?id=16595184&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;news.ycombinator.com&amp;#x2F;item?id=16595184&lt;/a&gt;&lt;p&gt;Trail of Bits --- which has a reputation in the field approaching &amp;quot;unimpeachable&amp;quot; --- confirmed a series of serious vulnerabilities. Whether there are real findings involved in this report isn&amp;#x27;t in question, and hasn&amp;#x27;t been since the day of the announcement, when Dan Guido from Trail of Bits confirmed that they&amp;#x27;d reviewed and confirmed the finding.&lt;p&gt;It&amp;#x27;s ironic, or maybe it isn&amp;#x27;t, that after CTS-Labs published their findings in a manner basically optimized for innuendo than Anandtech has run a story that is basically composed of innuendo. Given how charged people&amp;#x27;s feelings about AMD seem to be, this is probably manna from heaven for them, and since CTS-Labs isn&amp;#x27;t publishing the full technical details, it&amp;#x27;ll be raining bread for them for many days to come.&lt;p&gt;I wouldn&amp;#x27;t care, except that after the original monster thread about the CTS-Lab announcement, it&amp;#x27;s become apparent that HN commenters have a very poor understanding of how vulnerability research actually works, and Anandtech is perpetuating some of those myths, like the idea that researchers invariably (or even routinely) arrange for CVE allocation when publishing new flaws.</text></item></parent_chain><comment><author>simias</author><text>You&amp;#x27;re building a strawman (as you were in that announcement thread as well). The fact that they didn&amp;#x27;t allocate a CVE or agree on an embargo is really the least of the issues. It&amp;#x27;s clear that you personally don&amp;#x27;t want to do that as a security researcher. That&amp;#x27;s fine, I tend to agree with you.&lt;p&gt;But that&amp;#x27;s really not the issue. The real problem is that their reveal was clearly meant to mislead. It&amp;#x27;s was a direct attack on AMD and probably more specifically AMD&amp;#x27;s stock. Technical details were hidden in the middle of a mediocre whitepaper, all the descriptions of the flaws appear much more critical than they really are. Meanwhile they took the time to make a fancy website and even a video so it&amp;#x27;s clearly not because of a lack of time or resources. I don&amp;#x27;t have any particular problem with them &amp;quot;0-day&amp;quot; the announcement but I do have many problems with this pretty obvious manipulation attempt.&lt;p&gt;Do you genuinely think that CTS-lab acted in good faith here and that the way they handled the disclosure was appropriate? Would you advise other security researchers to do the same thing, to make sure to reveal the vulnerabilities in a way that will cause as much damage as possible, even if it means resorting to good old FUD?</text></comment>
<story><title>Our Interesting Call with CTS-Labs</title><url>https://www.anandtech.com/show/12536/our-interesting-call-with-cts-labs</url></story><parent_chain><item><author>tptacek</author><text>This is crazymaking. I posted the Trail of Bits technical summary earlier today:&lt;p&gt;&lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;news.ycombinator.com&amp;#x2F;item?id=16595184&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;news.ycombinator.com&amp;#x2F;item?id=16595184&lt;/a&gt;&lt;p&gt;Trail of Bits --- which has a reputation in the field approaching &amp;quot;unimpeachable&amp;quot; --- confirmed a series of serious vulnerabilities. Whether there are real findings involved in this report isn&amp;#x27;t in question, and hasn&amp;#x27;t been since the day of the announcement, when Dan Guido from Trail of Bits confirmed that they&amp;#x27;d reviewed and confirmed the finding.&lt;p&gt;It&amp;#x27;s ironic, or maybe it isn&amp;#x27;t, that after CTS-Labs published their findings in a manner basically optimized for innuendo than Anandtech has run a story that is basically composed of innuendo. Given how charged people&amp;#x27;s feelings about AMD seem to be, this is probably manna from heaven for them, and since CTS-Labs isn&amp;#x27;t publishing the full technical details, it&amp;#x27;ll be raining bread for them for many days to come.&lt;p&gt;I wouldn&amp;#x27;t care, except that after the original monster thread about the CTS-Lab announcement, it&amp;#x27;s become apparent that HN commenters have a very poor understanding of how vulnerability research actually works, and Anandtech is perpetuating some of those myths, like the idea that researchers invariably (or even routinely) arrange for CVE allocation when publishing new flaws.</text></item></parent_chain><comment><author>asimov42</author><text>According to Trail of Bits :&lt;p&gt;&amp;quot;There is no immediate risk of exploitation of these vulnerabilities for most users. Even if the full details were published today, attackers would need to invest significant development efforts to build attack tools that utilize these vulnerabilities. This level of effort is beyond the reach of most attackers (see &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;www.usenix.org&amp;#x2F;system&amp;#x2F;files&amp;#x2F;1401_08-12_mickens.pdf&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;www.usenix.org&amp;#x2F;system&amp;#x2F;files&amp;#x2F;1401_08-12_mickens.pdf&lt;/a&gt;, Figure 1)&lt;p&gt;These types of vulnerabilities should not surprise any security researchers; similar flaws have been found in other embedded systems that have attempted to implement security features. They are the result of simple programming flaws, unclear security boundaries, and insufficient security testing.&amp;quot;
 - &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;blog.trailofbits.com&amp;#x2F;2018&amp;#x2F;03&amp;#x2F;15&amp;#x2F;amd-flaws-technical-summary&amp;#x2F;&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;blog.trailofbits.com&amp;#x2F;2018&amp;#x2F;03&amp;#x2F;15&amp;#x2F;amd-flaws-technical-...&lt;/a&gt;</text></comment>