news.volyx.in

The RCE that AMD won't fix (mrbruh.com)

373 points by MrBruh · 257 days ago · 173 comments on HN

Article summary

A security researcher discovered a Remote Code Execution (RCE) vulnerability in AMD's AutoUpdate software, which uses HTTP to download executable files, making it vulnerable to Man-in-the-Middle (MITM) attacks. The researcher reported the issue to AMD, but it was deemed out of scope and not considered a vulnerability. The vulnerability can be exploited by an attacker on the same network or with access to the user's ISP. The researcher believes this is a severe issue that should be addressed.

Main themes

  • RCE vulnerability
  • AMD AutoUpdate software
  • Man-in-the-Middle attacks
  • Security vulnerabilities
  • Bug bounty programs

What commenters say

  • The RCE vulnerability in AMD's AutoUpdate software is a serious issue that can be easily exploited by an attacker on the same network or with access to the user's ISP.
  • Automatic updates are not the peak of stupidity, but rather a necessary measure to ensure timely security patches, and disabling them can leave devices vulnerable to known security vulnerabilities.
  • The vulnerability can be exploited without a MITM attack if combined with other attacks, such as DNS cache poisoning, and AMD should still fix it even if it's not within their bug bounty scope.
  • The fact that AMD deemed the issue out of scope and not a vulnerability is concerning, and it raises questions about the effectiveness of their bug bounty program and security policies.
  • Using HTTPS for the initial update check does provide some security benefits, but it is not enough to prevent exploitation of the vulnerability.
  • The vulnerability can be easily exploited in public places, such as airports, where users may be more likely to connect to unsecured networks.
  • Simply making exploits illegal does not prevent them from happening, and companies like AMD should prioritize fixing security vulnerabilities rather than relying on legal measures.
  • The use of HTTP instead of HTTPS for downloading executable files is a significant oversight, and it is surprising that AMD did not prioritize fixing this issue.