It’s not only TPM. Older chips are missing some actual security features. AMD not patching their old CPUs of their firmware bug will also become a big problem in the long run.
I doubt it, because those bugs require to already have extensive access to the victim PC. Basically, they just expand the trouble on an already compromised system. It’s bad for sure, but at that point you’re already knee deep in shit and this just adds a few buckets on top.
The AMD bug requires the same access that any of serious previous exploits have given. You don’t need physical access. Any exploit that gives root means the payload can be the AMD firmware exploit which will make it permanently undetectable by anti virus and wiping the os won’t remove it.
For example the ssh exploit from years ago allowed root without even an account on the machine. Those affected detected they had been owned, wiped their machines and restored from backup. If something like that happens again, (https://thehackernews.com/2024/07/new-openssh-vulnerability-could-lead-to.html?m=1) you won’t be able to know you are owned.
This AMD firmware exploit is different. Yes if an exploit gets your computer you have lost. But it happens to thousands every day. A virus scan will detect it and an OS wipe will clean it.
This AMD exploit means the exploit lives inside the CPU firmware. It can’t ever be detected or removed by normal means because the CPU itself is compromised. (Unless you have the hardware to pull physical signals off your dram chips.)
In the past even normal OS patches would clear out any virus’s lingering in the PC population. Now you could be compromised and never know or be able to do anything about it.
A virus scan will detect it and an OS wipe will clean it.
This only works before the malware has been executed and only if the malware scanner knows it. Often Antivirus can block access to the malware, so it can’t be executed.
If it has been executed, the PC needs to be shut down and all writable mediums connected wiped (including boot sectors and EFI), maybe even the BIOS reset, if it can be updated, to be 100% clean. If you can’t do this, you have to toss the PC in the trash.
If the PC is not shut down, the malware could still survive in RAM and re-install its files or download something else, eg. a remote shell or rootkit.
These processor security flaws just extend this to the CPU firmware, meaning you need to reset this too, after malware has been executed on the PC. If you just downloaded it and the antivirus blocked and deleted it, you’re still safe.
If it got executed and you or a technician can’t remove it from the CPU, you have to toss the PC in the trash, just like you already had to if you can’t reset a malware that flashed itself into an updatable BIOS, for example.
Offline virus scanners are standard. That’s always how you detect if you have been infected. Bios viruses are detected and removed by standard anti-virus software.
BIOS and UEFI bootkits require special vendor tools and vendor signed firmware binaries to overwrite the SPI memory. Standard anti-virus software can not remove them, once they have been installed.
But why? People who take the effort have their reasons, find other ways.
Btw, Rufus patches the iso, works anyway.
It’s not only TPM. Older chips are missing some actual security features. AMD not patching their old CPUs of their firmware bug will also become a big problem in the long run.
Not for Microsoft.
“Sorry, you’re running an unsupported, deliberately hacked version of our OS. We can’t help you.”
I doubt it, because those bugs require to already have extensive access to the victim PC. Basically, they just expand the trouble on an already compromised system. It’s bad for sure, but at that point you’re already knee deep in shit and this just adds a few buckets on top.
The AMD bug requires the same access that any of serious previous exploits have given. You don’t need physical access. Any exploit that gives root means the payload can be the AMD firmware exploit which will make it permanently undetectable by anti virus and wiping the os won’t remove it.
For example the ssh exploit from years ago allowed root without even an account on the machine. Those affected detected they had been owned, wiped their machines and restored from backup. If something like that happens again, (https://thehackernews.com/2024/07/new-openssh-vulnerability-could-lead-to.html?m=1) you won’t be able to know you are owned.
Same in green. If the attacker has physical access or root, you have lost already.
This AMD firmware exploit is different. Yes if an exploit gets your computer you have lost. But it happens to thousands every day. A virus scan will detect it and an OS wipe will clean it.
This AMD exploit means the exploit lives inside the CPU firmware. It can’t ever be detected or removed by normal means because the CPU itself is compromised. (Unless you have the hardware to pull physical signals off your dram chips.)
In the past even normal OS patches would clear out any virus’s lingering in the PC population. Now you could be compromised and never know or be able to do anything about it.
This only works before the malware has been executed and only if the malware scanner knows it. Often Antivirus can block access to the malware, so it can’t be executed.
If it has been executed, the PC needs to be shut down and all writable mediums connected wiped (including boot sectors and EFI), maybe even the BIOS reset, if it can be updated, to be 100% clean. If you can’t do this, you have to toss the PC in the trash.
If the PC is not shut down, the malware could still survive in RAM and re-install its files or download something else, eg. a remote shell or rootkit.
These processor security flaws just extend this to the CPU firmware, meaning you need to reset this too, after malware has been executed on the PC. If you just downloaded it and the antivirus blocked and deleted it, you’re still safe.
If it got executed and you or a technician can’t remove it from the CPU, you have to toss the PC in the trash, just like you already had to if you can’t reset a malware that flashed itself into an updatable BIOS, for example.
Offline virus scanners are standard. That’s always how you detect if you have been infected. Bios viruses are detected and removed by standard anti-virus software.
BIOS and UEFI bootkits require special vendor tools and vendor signed firmware binaries to overwrite the SPI memory. Standard anti-virus software can not remove them, once they have been installed.
They aren’t. The article is disingenuous.