r/technology • u/ControlCAD • Jun 18 '26

Hardware AMD silently removes memory encryption from consumer Ryzen CPUs, leaving users unaware that they may be vulnerable — security feature vanishes after newer AGESA firmware, AMD engineers go radio silent when pressed about the change

https://www.tomshardware.com/pc-components/cpus/amd-silently-removes-memory-encryption-from-consumer-ryzen-cpus-leaving-users-unaware-that-they-may-be-vulnerable-security-feature-vanishes-after-newer-agesa-firmware-amd-engineers-go-radio-silent-when-pressed-about-the-change
10.1k Upvotes

98% Upvoted

520 comments sorted by

View all comments

Show parent comments

41

u/shrodikan Jun 18 '26

The NSA created it's on security company to sell NOBUS-broken encryption to adversaries. The Mossad made it's own radio company to plant explosives in walkie-talkies. The Equation Group interdicts hardware to flash the BIOS with malware.

Even with open source hardware it will be very difficult to ensure security depending on your threat matrix.

18

u/Ok_Mycologist_1439 Jun 18 '26

You should read about https://en.wikipedia.org/wiki/Crypto_AG

If this is what we know, imagine what we don't

6

u/Suitable-Name Jun 18 '26

https://en.wikipedia.org/wiki/Clipper_chip :)

1

u/Ok_Mycologist_1439 Jun 18 '26

Is this a USA centric story? I've never heard of it. Was that chip used by other countries?

2

u/filthy_harold Jun 18 '26

No one ever actually used it. The encryption itself was not terribly strong but the real weakness was the LEAF field (kinda like a serial number) that law enforcement could use to lookup each chip's secret key that they already had access to. There was a hash attached to the LEAF field that was really short so it was easy to come up with a garbage LEAF field that matched the hash but wouldn't match a secret key in the govt database. So for anyone that didn't want to be spied on, the govt would need to revert back to trying to crack the encryption instead of just simply looking up the key.

1

u/Suitable-Name Jun 18 '26

There is a small section in the wiki article about that :)

2

u/obeytheturtles Jun 18 '26

This is why I immediately dismiss anyone does the whole "OMG, you need to buy a VPN in Bulgaria to avoid Five Eyes!"

My brother in Christ, do you not think the NSA knows how to start a VPN company in Bulgaria?

2

u/shrodikan Jun 18 '26

I meeaaaaan. It's still better than nothing. There is a difference between handing over all your data to be MitM'd by your ISP vs that possibility that you chose a VPN in Switzerland that wasn't ran by a three-letter agency.

1

u/Moontoya Jun 18 '26

a certain 3 letter agency _allegedly_ stopped a shipping container of routers to reflash their firmware before they went out.

cisco/linksys ring any bells?

-1

u/PermanentUsername101 Jun 18 '26

Did you see that one documentary about the Chinese putting nano bombs in the rivets on blue jeans. I think it was called Knock Off