Get all your news in one place.
100's of premium titles.
One app.
Start reading
Tom’s Hardware
Tom’s Hardware
Technology
Bruno Ferreira

Security researcher says AMD auto-updater downloads software insecurely, enabling remote code execution — company rep reportedly said man-in-the-middle attacks are "out of scope," ignored bug

Cybersecurity - digital lock.

The year is 2026. The future of humanity is under discussion thanks to the rise of artificial intelligence, as robots become eerily humanoid. And somehow, AMD's Windows driver auto-updater still downloads software insecurely (Web Archive link), as discovered by an individual identified only as Paul, an aspiring kiwi security researcher, who published his findings on a blog post that has since then been taken down "temporarily [...] due to a request." For now, it's unclear if the bug has been verified directly by AMD, but the author does note that the takedown is temporary, and it has generated intense interest online.

According to Paul, when the auto-updater finds an eligible update, it proceeds to download it via an insecure connection. This opens up the possibility that an attacker in the same network or further down the line could simply pretend to be AMD's website, or modify the download in flight, adding spyware or ransomware — with administrator permissions, too.

Sign up to read this article
Read news from 100's of titles, curated specifically for you.
Already a member? Sign in here
Related Stories
Top stories on inkl right now
One subscription that gives you access to news from hundreds of sites
Already a member? Sign in here
Our Picks
Fourteen days free
Download the app
One app. One membership.
100+ trusted global sources.