> Final update: A couple of days before the embargo ended (and after I wrote the majority of this blog post), AMD told me what their patch for this vulnerability is [...] Although it is true that they now fully use HTTPS, the claim about signature verification is untrue; they only perform a CRC-32 check on the downloaded executable, which is not cryptographically secure.
So solves the MITM, but massive infection is still trivial if someone compromises the webserver.
So solves the MITM, but massive infection is still trivial if someone compromises the webserver.