Didn’t Microsoft just pull this same thing and now there’s all these 0-days getting released publicly as vengeance? I swear, all these companies are sharing the same brain cell…
all these companies are sharing the same brain cell…
they all have upper management that went to the same schools and the same classes, so they’re all indoctrinated the same way.
Exactly. The engineering teams are in the background saying to pay him.
Plus they are following the lead of the leadership of the country, which is cheating everyone that you are able to.
Trump too has a degree in economics and went to a prestigious finance school so that tracks.
‘Donald Trump was the dumbest goddamn student I ever had!’
Trump didn’t pass any of his classes or do any of his own work, though. He didn’t learn anything because he’s fucking stupid.
all these companies are sharing the same brain cell…
This cell is called investors.
Yep, the Nightmare Eclipse* crashout continues to be endlessly entertaining and a train wreck for Microsofts security devs.
*Thanks for yhe name correction.
Nothing quite like creating a specific incentive for researchers to seek “alternative” sources of income as payment for their research efforts.
Microsoft tried this … seems to be working out for them … not.
But they saved themselves a whopping $10,000. It’s not like AMD has that kind of money to throw around.
Well the next time someone finds a bug in their software they will have to find other ways to monetize it.
My favourite part was when they rejected the flaw saying it’s out of scope for their bounty program but still wanted him to keep it secret because of the rules of the bounty program. The same bounty program that didn’t cover it.
but still wanted him to keep it secret because of the rules of the bounty program
The rules that were changed after the rejection
They really do be stepping over dollars to pick up pennies.
Or in this case, to save them.
What a stupid expectation. A company with a market cap of 700 billion can’t just throw 10.000 bucks around. Ya’ll need to think of the sustainability of the company.
AMD told MrBruh that all update communications now use HTTPS and that updates undergo signature verification. The researcher says he verified the HTTPS claim, but found only a CRC32 check on the downloaded executable, which is not considered a cryptographic signature.
This is the most shocking part. You’d think that AMD as a high-tech company has some smart people working for them. These are very basic things that any half decent programmers should get right. If at no part of the process of implementing this anyone brought up that this is not secure, that is extremely worrying and indicative of a very broken development process. It’s not like a proper cryptographic signature costs extra. This is just pure incompetence.
The problem with using CRC32 is it reversible and has high collusion rate. An attacker can easily make a file the generates the same hash. This tool a few minutes of searching online. It appears that people who work at AMD don’t even know how to do proper research. All they have to do is look up how to make a secure updating process.
Well the next time someone finds a bug in their software they will have to find other ways to monetize it.
AMD has always sucked at making software. The reason why NVidia gained the AI market is because NVidia worked to write and support all the CUDA libraries. AMD devs are so bad they even struggle to just replicate the APIs NVidia already designed year earlier (ROCm/HIP projects). Even Intel who arrived much later almost managed to catch up with their own HW/SW stack (I think they gave up afterward).
This is going to work out really well for AMD. Any future vulnerabilities will most certainly be reported to them, responsibly. Right?
Totally. If they happen to be the highest bidder on the dark web that is
Have they not understood what currently is happening with Microsoft?
Again that means they don’t want anyone to report or fix security plot flaws.
Yes, that is correct.
They want to look like they care, not actually care.
I don’t have all the facts but based on the article I don’t see the problem everyone seems upset about.
They received the report, decided it was valid but didn’t match a bounty. Then asked him to follow standard responsible disclosure processes giving him credit in the final release. All very standard.
Should there have been a bounty? AMD has the budget, probably yes. But nothing in the communications seems any different from what I’ve seen and have received similar from companies in the past.
Except when he responsibly disclosed to AMD, they closed the ticket as “out of scope” without any further communication. He then made a blog post about it warning other users about the vulnerability since ostensibly, AMD didn’t want to fix it. Only after that post had gone viral AMD suddenly came back saying that despite the ticket being closed as such, their internal security team was still analysing it and he should’ve somehow known that and that he violated the TOC of the bug bounty program (remember, after saying that the vulnerability was out of scope of the program). Additionally AMD then changes those terms a month after the initial ticket to suddenly say that even if the ticket is refused, you’re still not allowed to talk about it. Then to top it off they take a month longer to fix it then is industry standard, don’t disclose the fix to the researcher as is customary until a few days before release and only because he kept badgering them and as the cherry don’t tell their users that the only way to securely fix this is by uninstalling and reinstalling. Everything about it is scummy behaviour all around.
Fuuuuuck. I guess I’m switching back to Intel. I really don’t want to give money to NVidia, þough.
That’s the dumbest reason why. Intel is a shitty company
AMD seems to be trying hard to catch up in þat area.
