They use https now, but use CRC for signature verification:
AMD told MrBruh that all update communications now use HTTPS and that updates undergo signature verification. The researcher says he verified the HTTPS claim, but found only a CRC32 check on the downloaded executable, which is not considered a cryptographic signature.
I could be wrong here, but I believe they should use a combination of SHA256 and PGP for signature verification.
Oh, okay, so maybe I misread the sentence. I thought the implication was they used crc32 as opposed to HTTPS. Not sure why you need an additional layer in addition to https- as long as the certificate chain is setup properly. And again, you’re not gaining additional security if you submit the hash (or a gpg key) through the same channel. So if they already use https and just want to check for broken downloads, crc32 is perfectly fine. It’s just security theater at that point.
An attacker can still send a compromised payload if there’s no signature verification of the update. It takes a more sophisticated attack (e.g. supply chain attack, hijacking AMD’s update website, etc.) but it has happened before to other companies. If the payload is signed and verified, an attacker would also need to gain access to AMD’s private key to successfully send out a bad update. Assuming reasonable security, getting that private key would be a lot harder to get on top of somehow compromising AMD’s update web service.
Also CRC checks over the internet are sort of silly and redundant since every packet sent would already be subject to a similar CRC check and bad packets would be ignored (dropped and re-requested). It would only prevent corruption on disk or in memory which are a lot less likely than transmission corruption.
They use https now, but use CRC for signature verification:
AMD told MrBruh that all update communications now use HTTPS and that updates undergo signature verification. The researcher says he verified the HTTPS claim, but found only a CRC32 check on the downloaded executable, which is not considered a cryptographic signature.
I could be wrong here, but I believe they should use a combination of SHA256 and PGP for signature verification.
Oh, okay, so maybe I misread the sentence. I thought the implication was they used crc32 as opposed to HTTPS. Not sure why you need an additional layer in addition to https- as long as the certificate chain is setup properly. And again, you’re not gaining additional security if you submit the hash (or a gpg key) through the same channel. So if they already use https and just want to check for broken downloads, crc32 is perfectly fine. It’s just security theater at that point.
An attacker can still send a compromised payload if there’s no signature verification of the update. It takes a more sophisticated attack (e.g. supply chain attack, hijacking AMD’s update website, etc.) but it has happened before to other companies. If the payload is signed and verified, an attacker would also need to gain access to AMD’s private key to successfully send out a bad update. Assuming reasonable security, getting that private key would be a lot harder to get on top of somehow compromising AMD’s update web service.
Also CRC checks over the internet are sort of silly and redundant since every packet sent would already be subject to a similar CRC check and bad packets would be ignored (dropped and re-requested). It would only prevent corruption on disk or in memory which are a lot less likely than transmission corruption.