Author: batteryforpc

A French security researcher has accidentally discovered a zero-day vulnerability that impacts the Windows 7 and Windows Server 2008 R2 operating systems while working on an update to a Windows security tool.

The vulnerability resides in two misconfigured registry keys for the RPC Endpoint Mapper and DNSCache services that are part of all Windows installations.

HKLM\SYSTEM\CurrentControlSet\Services\RpcEptMapper

HKLM\SYSTEM\CurrentControlSet\Services\Dnscache

French security researcher Clément Labro, who discovered the zero-day, says that an attacker that has a foothold on vulnerable systems can modify these registry keys to activate a sub-key usually employed by the Windows Performance Monitoring mechanism.

“Performance” subkeys are usually employed to monitor an app’s performance, and, because of their role, they also allow developers to load their own DLL files to track performance using custom tools.

While on recent versions of Windows, these DLLs are usually restricted and loaded with limited privileges, Labro said that on Windows 7 and Windows Server 2008, it was still possible to load custom DLLs that ran with SYSTEM-level privileges.

ISSUE DISCOVERED AND DISCLOSED ACCIDENTALLY

But while most security researchers report severe security issues like these to Microsoft in private, when they find them, in Labro’s case, this was too late.

Labro said he discovered the zero-day after he released an update to PrivescCheck, a tool to check common Windows security misconfigurations that can be abused by malware for privilege escalation.

The update, released last month, added support for a new set of checks for privilege escalation techniques.

Labro said he didn’t know the new checks were highlighting a new and unpatched privilege escalation method until he began investigating a series of alerts appearing on older systems like Windows 7, days after the release.

By that time, it was already too late for the researcher to report the issue to Microsoft in private, and the researcher chose to blog about the new method on his personal site instead.

ZDNet has reached out to Microsoft for comment today, but the OS maker has not provided an official statement before this article’s publication.

Both Windows 7 and Windows Server 2008 R2 have officially reached end of life (EOL) and Microsoft has stopped providing free security updates. Some security updates are available for Windows 7 users through the company’s ESU (Extended Support Updates) paid support program, but a patch for this issue has not been released yet.

It is unclear if Microsoft will patch Labro’s new zero-day; however, ACROS Security has already put together a micro-patch, which the company released earlier today. The micro-patch is installed via the company’s 0patch security software and prevents malicious actors from exploiting the bug through ACROS’ unofficial patch.

Most years we’re all about building the best PC you possibly can from Black Friday deal parts, but 2020 isn’t exactly a normal year. AMD’s brand new CPUs are scarce, and even old graphics cards are hard to find. The latest Nvidia RTX 30-series and RX 6800 from AMD? Forget about it—we can’t find them in stock, let alone on sale.

But there is a way to get one of these new cards, if you don’t mind getting a whole PC right along with it. Buying a prebuilt gaming PC right now is the easiest way to get your hands on an RTX 3080 right now. Conveniently, Dell has chopped about $50 off the high-end configuration of the Alienware Aurora R11 with an RTX 3080, which happens to be our pick for the best gaming PC today.

Over on the Alienware Aurora R11 configuration page, you can choose a base model of the PC and then customize it with the graphics card of your choice, including an RTX 3070 or 3080. When I got to the order screen I put in my zip code in San Francisco, and found that I could get the system delivered as soon as December 3 with express shipping. In other words, the RTX models aren’t back-ordered, at least right now; stock might not hold out for the entirety of Black Friday.

The default high-end RTX 3080 Aurora R11 model is a pricey $2,391.19, but Dell lets you do plenty of customization here. I started with the cheapest config, using an Intel i5-10400F, and upgraded to the RTX 3070 along with a 1000W power supply, 16GB of RAM, and a 512GB M.2 SSD for a total price of $1,754 (with discount code “EXTRA50” applied). That’s $600 cheaper, though still a pricey PC build.

If you just want an RTX 3080 model with no thought tweaking required, here it is. Bonus: it comes with a free copy of Call of Duty: Cold War.

The Aurora R11 comes with a one-year warranty including tech support and on-site service if you need it. In our review of the R11, we wrote that “the higher-than-average price provides you with reliable build quality, exceptional customer service, and solid warranties. The numerous pre-fab options offered by Alienware also help eliminate much of the guesswork associated with customizing your system. Some options provide better value for the parts used, but for hassle-free PC gaming out of the box, it’s tough to beat the ease of use that Alienware provides.”

The ThinkPad X1 Fold is finally here and in the hands of reviewers. Sadly, it is not all rosy for Lenovo’s first foldable. The ThinkPad X1 Fold starts at US$2,499, although that only gets you 256 GB of storage and no accessories. Lenovo charges US$2,749 for the detachable keyboard and pen, and another US$50 if you want a Windows 10 Pro licence. Prices rise to US$3,099 though if you want 1 TB of storage, instead of 256 GB.

For that money, you could pick up practically any high-end laptop or 2-in-1, although they lack the foldable display that the ThinkPad X1 Fold has. However, MKBHD inadvertently summed up the limitations of the new form factor, in our opinion, despite ringing its praises. In short, the foldable screen appears to offer no added functionality than one could already get with a Surface Pro. MKHBD highlights the tablet mode of the ThinkPad X1 Fold, before explaining that the detachable keyboard offers a better typing experience than the onscreen keyboard does. 

PC Watch has demonstrated the drawbacks of Intel’s Lakefield processor, too. The Core m3-8100Y in the Surface Go 2 outperforms the ThinkPad X1 Fold and its Core i5-L16G7 in multiple benchmarks, for example, while also lasting longer in PCMark 10 battery life tests. The Core m3-8100Y should offer about 91% of the Core i5-L16G7 according to our database, but Lenovo may have tuned its performance based on the form factor of the ThinkPad X1 Fold, somewhat.

Ultimately, the ThinkPad X1 Fold disappoints on price, performance and does not offer more versatility than something like a Surface Pro. Nonetheless, we hold out hope for the likes of Lenovo delivering more useful second and third-generation foldable laptops, as Samsung has with its foldable smartphones.

If you had hopes of getting a shiny new RDNA 2 graphics card from AMD this upcoming Black Friday, you’ll likely be very disappointed. Even though AMD’s launch for third-party custom Radeon RX 6000 graphics cards officially occurred today, every single tech store has sold out its entire stock in both aftermarket and reference flavors. That isn’t surprising, as some retailers didn’t even have stock to begin with. 

Both graphics card manufacturers and some stores have gone to Twitter to share the problems with the RX 6000 series volume. Simply put, just like the Ampere shortages, AMD and its partners are unable to manufacturer enough graphics cards to meet demand.

Most of the recent product launches have been plagued by bots, but that doesn’t seem to be the cause of the shortage this time around. In fact, Microcenter says it had zero cards for the launch today. 

So what should you do as a gamer? Right now is perhaps one of the worst times to build a system, so if you’re a DIYer we would highly recommend you wait until next year to build a new workstation/gaming machine when stock goes back to normal and prices are not over-inflated. 

But, if you’re a gamer and desperate to grab anything to get your game on, check out our Black Friday deal guides here, which can help you get together a gaming machine. If you don’t mind going with entry-level graphics like an RX 5500 XT, those are still a solid option for a “gaming-capable PC.”

It really is a terrible time to build a gaming computer, especially if you were considering purchasing an RX 6800 or RX 6800 XT. If you really need something to game on now, be prepared to make some sacrifices.

The programmability of a processor is a scale is all about flexibility and performance – something highly programmable and customizable is adaptable to all sort of situations, but often isn’t as fast. However, something that has a very specified compute pathway can go very fast, but can’t do much beyond that pathway. On the flexible side, we have FPGAs, that can be configured to do almost anything. On the fixed side, we have ASICs, such as fixed function hardware for AI. Somewhere in the middle is what’s called a ‘Structured ASIC’, which tries to combine as many benefits from the two.

An FPGA, or Field Programmable Gate Array, is a piece of silicon built that can be configured after manufacturing. By implementing a series of programmable logic blocks, memory cells, and layers of connectivity, a programmer with enough knowledge can configure the FPGA to run the equivalent of unique circuit designs for specific functions. For example, any series of AI calculations can be done on a CPU core slowly, and a subset of them can be very fast on a GPU, but if that calculation methodology has to change, the FPGA can be adjusted to be GPU-like of efficiency while being as configurable as the CPU.

An ASIC, by contrast, is a very fixed unit of hardware. By knowing what sort of calculations are expected, an ASIC can implement those calculations very fast and very efficiently, but it can only do that sort of calculation. For example, a graphics card can be thought of as an ASIC, as it does graphics very well, however the special 4K decode engine inside the GPU is better suited to the term of an ASIC, because all it does is decode 4K images/video and it knows how to do it much faster and much more efficiently than a CPU or an FPGA could.

Obviously if there are security concerns, an FPGA has the ability to perhaps be configured to avoid that issue. An ASIC by contrast has no solution. FPGAs can be deployed with updates to be sent later, whereas ASICs cannot be updated. FPGAs are initially very cheap, and ASICs require a lot of up-front non-reusable engineering (NRE) costs, however when built at scale, can offer something cheaper at orders of magnitude lower power and higher performance. These are some of the trade-offs.

A structured ASIC (or for Intel, an eASIC), is something between the two. The underlying design of an eASIC product is similar to an FPGA, but by doing some small upfront NRE/circuit design, an eASIC company changes some of its silicon manufacturing masks for FPGAs for the design in question. This means that the eASIC is no longer as configurable as an FPGA as it now has some rigid pathways in its silicon, but it takes gains some of the performance and power efficiency by having rigid pathways. It also hasn’t required the large amount of design costs that a full ASIC requires, and thus saves a lot of cost, and the product ends up somewhere between an FPGA and an ASIC.

For any company interested in something like a structured ASIC, it means developing a relationship with a vendor offering a portfolio of structured ASIC base designs, and then implementing some level of circuit customization on top at the point of manufacture.

Intel recently purchased a company called eASIC in mid-2018 to do just this, and the first line of products are called the N5X eASICs (Diamond Mesa, for anyone following code names), which add-in hardened embedded CPU cores to allow for control and security. A number of technologies have been pulled in from the Intel Agilex FPGA family to improve the previous eASIC offering, as well as a software platform.

The N5X series base design is built on a 16nm process (TSMC, by virtue of the acquisition), uses up to 80 million eASIC gates (8.8 million FPGA-like look up tables/logic elements), 225 megabits of dual port memory, supports 32G transceiver tiles, and features a quad-core A53 hard processor system. The N5X product line is in the form of N5Xabc, where abc is the number of FPGA-equivalent cells divided by 100,000 – thus the top model is the N5X088, with 8.8 million.

With customers implementing their own DSPs and pipelines into the N5X, Intel is promising faster time-to-market than traditional ASICs, up to 50% lower power than FPGAs with smaller form factor packaging, overall lower unit cost than FPGAs, and enhanced security.

Intel decided to make this announcement at its FPGA Technology Day, which coincided directly with the annual Supercomputing conference. It seemed odd that Intel would cause the two to clash. The N5X family of products however won’t be in production until Q2 2021.