You must log in or register to comment.
I mean, I’m not much of a tinfoil hat, but this article feels extremely conveniently timed for Intel, who is currently going through a massive ordeal with their chips. Especially considering that the vulnerability is so extremely difficult to exploit that there’s borderline no story here for 99% of people but the headline will still drive clicks and drama.
Intel has literally done this, and stuff like it before.
They back “independent” researchers who twist themselves in knots to make AMD look bad.
Look up the multiple counts of bullshit from a “research group” called Principled Technologies.
Sidenote: the guy who ran it was Ryan Shrout, who used to work for PC Perspective, and would usually give favourable reviews to Intel. After leaving Principled Technologies, he became head of technical marketing at… drumroll… Intel!
Principled Technologies isn’t the only scam “independent researcher” Intel has set up or paid handsomely either.
Difficult to exploit, already in the process of being patched. Truly, the most breaking of news.
How does the patch actually get delivered? Via windows update or using something else?
Most likely. Windows update (or the Linux equivalent on your platform) will download updated microcode to load at boot time to basically be a software patch for hardware issues. At least, that’s how it was explained when the original speculative execution flaw was discovered and Intel was releasing foxes and shit for it.
and Intel was releasing foxes and shit
I realise this is an autocorrect error, but it’s still funny 🦊
who is naming this shit
Requires kernel-level access. Also AMD is “releasing mitigations,” so is it “unfixable?”
If you have kernel access you can already do almost everything so a vulnerability on top of that isn’t that bad since no one should have kernel access to your computer
You mean like Crowdstrike?
MostAll antivirus software runs at kernel level
Requires kernel-level access
What does that mean to the rest of us?
It means it’s what we in the trade call “a nothingburger”. On Windows you need to explicitly install a malicious driver (which in turn requires to you to disable signature verification), on Linux you’d have to load a malicious kernel module (which requires pasting commands as root, and it would probably be proprietary since it has malware to hide and as every nvidia user knows, proprietary kernel modules break with kernel updates)
On Windows you need to explicitly install a malicious driver (which in turn requires to you to disable signature verification)
Not to be contrarian, but hackers have signed malicious code with compromised Microsoft driver certificates, so it’s not out of the question that it could be snuck in without having to turn off signing.
