AMD's auto-updater fetched code over HTTP — and took 124 days to add an 's'

A researcher decompiling AMD’s AutoUpdate tool — initially just to silence a recurring console popup — found that while the updater fetches its manifest over HTTPS, every executable download URL in that XML file used plain HTTP, and the client ran whatever it downloaded with no signature validation. Any attacker positioned on the network path could swap in a malicious binary for trivial remote code execution. AMD’s bug bounty program (run through Intigriti) closed the report as out of scope because MITM attacks are excluded, only reversing course after the writeup gained traction on Hacker News. AMD’s PSIRT then asked the researcher to pull the post, promised a CVE and credit but no payout, and stretched the embargo to 124 days — well past the 90-day industry norm — with minimal communication along the way.

The fix AMD eventually shipped moves updating from the installer into the application layer with HTTPS throughout, but the researcher found AMD’s claim of signature verification to be false: the new updater only performs a CRC-32 check, which provides no cryptographic protection against tampering. In an absurd footnote, the original vulnerability may not have been exploitable anyway — AMD migrated its package manifest from ati.com to drivers.amd.com, and the old updater couldn’t follow the redirect, crashing before reaching the vulnerable code. That created a Catch-22 where the updater couldn’t update itself to receive the fix; affected users are advised to uninstall and reinstall AMD software manually.

The episode is a case study in how bounty scoping rules can deflect serious reports — a vendor invoking ‘out of scope’ to deny payment while simultaneously using program terms to demand the researcher suppress publication. The researcher notes that reports to Google, ASUS, AMD, TP-Link, and MSI have collectively paid $0.