SecurityWeek reports that AMD processors could be exploited to expose sensitive data using the new Scheduler Queue Usage via Interference Probing, or SQUIP, attack, which was discovered by researchers from the Georgia Institute of Technology, the Graz University of Technology, and the Lamarr Security Research non-profit researcher center.
Such an attack involves the measurement of scheduler contention by attackers sharing the victim's hardware core while having a different simultaneous multithreading thread, the study showed.
"An attacker running on the same host and CPU core as you could spy on which types of instructions you are executing due to the split-scheduler design on AMD CPUs," said researcher Daniel Gruss.
Researchers noted that such an attack may be prevented with a single scheduler design, symmetric schedulers, and isolated hardware threads. Meanwhile, AMD has confirmed that chipsets using the Zen 1, Zen 2, and Zen 3 microarchitectures, including Athlon, EPYC, and Ryzen processors, are affected by the attack.
Gigabyte has released BIOS updates aimed at removing a firmware backdoor discovered by Eclypsium in over 270 of its motherboard models, which could have been exploited to facilitate the deployment of a Windows binary that would then prompt payload retrieval and execution, SecurityWeek reports.
Attacks exploiting a zero-day in the MOVEit Transfer file transfer app to compromise various servers and facilitate data exfiltration efforts have been admitted by the Clop ransomware operation, also known as Lace Tempest, TA505, and FIN11, after the intrusions have been attributed to the group by Microsoft, reports BleepingComputer.
New attacks by Chinese state-backed threat operation Camaro Dragon, which overlaps with Mustang Panda, have involved the novel Go-based TinyNote malware, which creates various persistency tasks to ensure host access despite its lacking sophistication, according to The Hacker News.