this post was submitted on 09 Aug 2024
186 points (86.6% liked)

Technology

60074 readers
3641 users here now

This is a most excellent place for technology news and articles.


Our Rules


  1. Follow the lemmy.world rules.
  2. Only tech related content.
  3. Be excellent to each another!
  4. Mod approved content bots can post up to 10 articles per day.
  5. Threads asking for personal tech support may be deleted.
  6. Politics threads may be removed.
  7. No memes allowed as posts, OK to post as comments.
  8. Only approved bots from the list below, to ask if your bot can be added please contact us.
  9. Check for duplicates before posting, duplicates may be removed

Approved Bots


founded 2 years ago
MODERATORS
you are viewing a single comment's thread
view the rest of the comments
[–] [email protected] 149 points 4 months ago* (last edited 4 months ago) (3 children)

Requires kernel-level access. Also AMD is "releasing mitigations," so is it "unfixable?"

[–] [email protected] 77 points 4 months ago (1 children)

I think they meant it as "once infected may be impossible to disinfect." But it sure doesn't read that way at first glance.

[–] [email protected] 18 points 4 months ago (1 children)

Did they change it? Because now it says "Allows Deep, Virtually Unfixable Infections" and that seems to say exactly what you are.

[–] [email protected] 4 points 4 months ago

Surely one could use the same exploit to restore the original boot code as the malware used to corrupt it

[–] Bjornir 51 points 4 months ago (2 children)

If you have kernel access you can already do almost everything so a vulnerability on top of that isn't that bad since no one should have kernel access to your computer

[–] [email protected] 11 points 4 months ago (1 children)
[–] [email protected] 7 points 4 months ago (1 children)

~~Most~~ All antivirus software runs at kernel level

[–] Bjornir 2 points 4 months ago

Which is precisely the reason you shouldn't use an AV apart from the one packaged with Windows

[–] [email protected] 8 points 4 months ago (1 children)

"They're going for the kernel!"

"Colonel who?"

[–] [email protected] 2 points 4 months ago

Cancer. Brain. Brain cancer.

[–] [email protected] 8 points 4 months ago (3 children)

Requires kernel-level access

What does that mean to the rest of us?

[–] [email protected] 43 points 4 months ago* (last edited 4 months ago) (5 children)

It means it's what we in the trade call "a nothingburger". On Windows you need to explicitly install a malicious driver (which in turn requires to you to disable signature verification), on Linux you'd have to load a malicious kernel module (which requires pasting commands as root, and it would probably be proprietary since it has malware to hide and as every nvidia user knows, proprietary kernel modules break with kernel updates)

[–] [email protected] 21 points 4 months ago

So install a multiplayer game, it has kernel level anticheat that opens a bunch of security holes, game over.

Kernel level access is absolutely achievable in the real world.

[–] [email protected] 7 points 4 months ago

On Windows you need to explicitly install a malicious driver (which in turn requires to you to disable signature verification)

Not to be contrarian, but hackers have signed malicious code with compromised Microsoft driver certificates, so it's not out of the question that it could be snuck in without having to turn off signing.

[–] [email protected] 3 points 4 months ago* (last edited 4 months ago)

No, it does not mean you would need to do that.

The more likely scenario is an attacker using another vulnerability, either in the OS itself or in a vendor-supplied component like a driver or anti-cheat module, to gain a foothold for this one. Chaining exploits is a very common technique. (What "trade" are you in, exactly?)

Apply the mitigations when they become available for your hardware, folks.

[–] [email protected] 2 points 4 months ago (1 children)

This article should say, with this one easy hack you can control an AMD users PC, all you gotta do is break into their home at 10pm right before they log off from browsing reddit and bam access.

[–] [email protected] 1 points 4 months ago

Sounds like a plan!

[–] [email protected] 17 points 4 months ago

It means that a malicious actor would already need to have hacked your computer quite deeply through some other vulnerability (or social engineering) before they could take advantage of this one. But I don't agree with another commenter here that this is a "nothingburger": this vulnerability enables such a hacker to leave undetectable malware that you just can't remove from the computer even if you replace everything but the motherboard. That's significant, particularly for anyone who might be a target of cyber-espionage.

[–] [email protected] 1 points 4 months ago