Re: Intel's having a bad year... but it looks like it's going to be worse for AMD

On Sun, 11 Aug 2024 15:36:41 -0600, "rms"
<rsquiresMOO@MOOflashMOO.net> wrote:

Recent revelations about the "Sinkclose" bug

>
  Looks like there's an updated bios for my motherboard already:
https://www.msi.com/Motherboard/MAG-X570-TOMAHAWK-WIFI/support

Which is cool, but the worry is that if you're system is compromised,
the updated BIOS won't do a thing to help you.

(Well, not unless you reflash the BIOS from an uncompromised machine,
anyway, but most people don't even bother updating their BIOS using
software. Yanking chips and plugging it into a new machine is a no-go
for 99.9999999% of users. ;-)

That said, the exploit can't be leveraged unless the end-user runs
some sort of malware that is allowed kernel-level access. But it
really isn't all that hard to get people to download some program,
convince them to ignore the UAC prompts on Windows, and infect
themselves with a trojan.

AMD has also stated they will not provide patches for all their
vulnerable processors because they're beyond their official service
life. I guess they're taking a page out of the Intel playbook on
screwing their customers.

Since most users won't ever update their BIOS, they'll remain
vulnerable until they buy a new computer, potentially leaving a huge
number of zombiefied PCs chugging away. Like I said, it's not clear if
this vulnerability has been exploited yet by malware authors, but it's
only a matter of time.

As one person put it, if you're really concerned with the security of
your PC -if you want to be sure you aren't running compromised code- ,
you're only real option at this point is is to throw out the PC and
buy one that isn't using a vulnerable CPU. Because short of examining
your PCs ROM on a clean machine, you CAN'T know for sure you haven't
been compromised, and once it happens, it's practically impossible to
remove.