Here we are - 3600 which was still under manufacture 2-3 years ago are not get patched. Shame on you AMD, if it is true.

  • ducking_donuts@lemm.ee
    link
    fedilink
    English
    arrow-up
    65
    ·
    3 months ago

    The good news is that in order to exploit the new vulnerability, the attacker first has to obtain kernel level access to the system somehow - by exploiting some other vulnerabilities perhaps.

    The bad news is once Sinkclose attack is performed, it can be hard to detect and mitigate: it can even survive an OS reinstall.

    • scoutFDT@lemm.ee
      link
      fedilink
      English
      arrow-up
      56
      arrow-down
      2
      ·
      3 months ago

      So basically what you are saying is we just need one pvp game with kernel level anti cheat to fuck up somewhere… yeah I’m sure that’s not going to happen.

      • Appoxo@lemmy.dbzer0.com
        link
        fedilink
        English
        arrow-up
        12
        ·
        3 months ago

        Probably only on a targeted attack. I don’t see it being a mass target attack like a worm could be.
        And in the realm of businesses, how many programs are running in kernel level besides the antivirus/ED(P)R solution?

        • weker01
          link
          fedilink
          English
          arrow-up
          15
          arrow-down
          3
          ·
          3 months ago

          And with crowd strike we have seen how reliable Antivirus is.

        • conciselyverbose
          link
          fedilink
          English
          arrow-up
          4
          ·
          3 months ago

          I don’t see it being a mass target attack like a worm could be.

          Why not? Malware that survives a full new install is extremely valuable, and there are loads of games adding vulnerabilities with required kernel level rootkits. It’s only a matter of time until one of these vendors is exploited, and why wouldn’t you permanently own the significant chunk of the market with unpatched serious vulnerabilities while you’re at it?

          • Appoxo@lemmy.dbzer0.com
            link
            fedilink
            English
            arrow-up
            1
            ·
            3 months ago

            Again: Mass spread vs target attack.
            Remember WannaCry? Yeah, I don’t see that happen.
            But (industrial) e-spionage on the other hand? Yup. Will happen 100%

            • conciselyverbose
              link
              fedilink
              English
              arrow-up
              1
              ·
              3 months ago

              For what reason?

              Kernel level game anticheats are a great attack vector, and it’s one that inherently identifies and enables distribution to other vulnerable targets. It’s begging to self replicate.

              Industrial espionage does not make sense, because most enterprises have, even if imperfect, restrictions on what can be installed on company computers that contain valuable information. You’re not going to get a game with kernel malware on a managed enterprise computer.

              • Appoxo@lemmy.dbzer0.com
                link
                fedilink
                English
                arrow-up
                2
                ·
                edit-2
                3 months ago

                Are you ignoring what I wrote earlier in the same thread?

                Probably only on a targeted attack. I don’t see it being a mass target attack like a worm could be. And in the realm of businesses, how many programs are running in kernel level besides the antivirus/ED(P)R solution?

                Anyway. Counter question: Why do you think gamers appear as a more valuable target with the anti cheat as a possible attack vector vs a business running literally the same CPU line-up but with fewer kernel level programs?

                My personal opinion: You can’t extract as much money from private folks vs a business through blackmail and other solutions. Not in a wide casted attack.
                Targeted individuals can be assumed to be at a higher risk (e.g. hacking their private devices like the gaming pc and then doing home office work in the same network, or misusing trust in the home network between pc and phone and then installing malware like pegasus).
                But again: Not in a wide casted net. And you are probably better of using the good exploits for higher value targets.

                • conciselyverbose
                  link
                  fedilink
                  English
                  arrow-up
                  2
                  ·
                  3 months ago

                  You’re responding to a post about exploiting kernel level anticheat and saying it would only be a targeted attack, despite that inherently not making sense. When you find a vulnerability in that software, there is absolutely no reason not to spread it en masse. The cost to infect one person is the same as the cost to affect tens of thousands or more. The game is both the vulnerability and the distribution method.

                  Gamers aren’t more valuable. They’re more accessible. Because there isn’t a kernel rootkit “anticheat” developer on the planet who gives two shits about security in any context, and there are a massive number of systems that their insane hacky bullshit touches. Every single one of them has their security automatically compromised. The goal isn’t just information. You’re getting a massive, distributed, residential IP botnet that you can’t lose unless they throw their systems in the trash.

      • raspberriesareyummy@lemmy.world
        link
        fedilink
        English
        arrow-up
        6
        arrow-down
        12
        ·
        3 months ago

        we just need one pvp game with kernel level anti cheat

        Leaving aside that security patches should be done, if you install that kind of game on a system where you have any data worth protecting, you’re a dumb ass mtherfcker. Sorry, but seriously, that’s just how it is.

        • scutiger@lemmy.world
          link
          fedilink
          English
          arrow-up
          7
          ·
          3 months ago

          Ignorance is not stupidity.

          Despite this being reported on tech news, most people won’t even be aware that it’s a thing because most people won’t actually read about it. And the majority of gamers probably don’t even know what a kernel is or why an anti-cheat with elevated privileges would be a bad thing.

          Most people buy their computers with Windows preinstalled and probably couldn’t tell you if the CPU is Intel or AMD.

          • raspberriesareyummy@lemmy.world
            link
            fedilink
            English
            arrow-up
            3
            ·
            3 months ago

            Okay, fair point, let me rephrase: if someone knows what kernel (admin) level execution means, and installs a game that requires this on a computer where they keep important data, they are a dumbass mtherfcker :) Generally speaking though: most people shouldn’t be allowed to use technology - humans are unbelievably stupid for the most part.

            • WhyJiffie
              link
              fedilink
              English
              arrow-up
              1
              ·
              3 months ago

              Kernel level and admin level is not the same thing. For example on windows, you can’t really write your own kernel driver, and on Linux even root can’t do everything if capabilities have been revoked.

              • raspberriesareyummy@lemmy.world
                link
                fedilink
                English
                arrow-up
                1
                ·
                3 months ago

                For the purpose of protecting important data, the distinction really doesn’t matter. And the good old xkcd comic has a point - for many people, all relevant data is in the user’s accessible storage area anyways. Hence me running almost all internet applications and steam in a jail.

    • JASN_DE@lemmy.world
      link
      fedilink
      English
      arrow-up
      11
      arrow-down
      1
      ·
      3 months ago

      The other bad news: there are so many vulnerabilities on all systems which can be used to gain root-level access, it’s just a matter of time. Also, even future vulnerabilities will be an issue, as the underlying Sinkclose attacks will still work.