Security researchers have found a vulnerability in AMD processors that has persisted for decades, according to reporting by Wired. This is a fascinating security flaw because it was found in the firmware of the actual chips and potentially allows malware to deeply infect a computer’s memory.

The flaw was discovered by researchers from the security firm IOActive, who are calling the AMD-based vulnerability a “Sinkclose" flaw. This potentially allows hackers to run their own code in the most privileged mode of an AMD processor, System Management Mode. This is typically a protected portion of the firmware. The researchers have also noted that the flaw dates back to at least 2006 and that it impacts nearly every AMD chip.

That’s the bad news. Now onto some better news. Despite being potentially catastrophic, this issue is unlikely to impact regular people. That’s because in order to make full use of the flaw, hackers would already need deep access to an AMD-based PC or server. That’s a lot of work for a random home PC, phew, but could spell trouble for corporations or other large entities.

This is particularly worrisome for governments and the like. In theory, malicious code could burrow itself so deep within the firmware that it would be almost impossible to find. As a matter of fact, the researchers say that the code would likely survive a complete reinstallation of the operating system. The best option for infected computers would be a one-way ticket to the trash heap.

“Imagine nation-state hackers or whoever wants to persist on your system. Even if you wipe your drive clean, it's still going to be there,” says Krzysztof Okupski from IOActive. “It's going to be nearly undetectable and nearly unpatchable.”

Once successfully implemented, hackers would have full access to both surveil activity and tamper with the infected machine. AMD has acknowledged the issue and says that it has “released mitigation options” for data center products and Ryzen PC products “with mitigations for AMD embedded products coming soon.” The company has also published a full list of impacted chips.

AMD has also emphasized just how difficult it would be to take advantage of this exploit. It compares using the Sinkclose flaw to accessing a bank’s safe-deposit boxes after already bypassing alarms, guards, vault doors and other security measures. IOActive, however, says that kernel exploits — the equivalent of plans to get to those metaphorical safe-deposit boxes — exist readily in the wild. “People have kernel exploits right now for all these systems,” the organization told Wired. “They exist and they're available for attackers.”

IOActive has agreed to not publish any proof-of-concept code as AMD gets to work on patches. The researchers have warned that speed is of the essence, saying “if the foundation is broken, then the security for the whole system is broken.”

The Washington DC Superior Court has filed a lawsuit against ticket-seller StubHub that accuses the company of hiding all kinds of fees from consumers until the very last moment. The suit calls out the “deceptive practice of charging hidden junk fees” and refers to it as a “classic bait-and-switch scheme.”

Anyone who has purchased a ticket via StubHub, or many of its rivals, are probably intimately familiar with the sticker shock that arrives at check out. The added fees can boost the total cost of a ticket by up to 40 percent, the lawsuit alleges. Attorney General Brian L. Schwalb says this is due to “a series of deceptive, manipulative, and unfair practices.”

These practices include the aforementioned bait-and-switch. The company allegedly advertises “deceptively low” ticket prices, adding extra charges after the consumer has clicked on multiple pages. Throughout this whole process, StubHub displays a countdown timer, urging users to act swiftly and, thereby, accept those added fees without really thinking about it. Schwalb calls this a “dark pattern” that creates a “false sense of urgency.” This is otherwise known as drip pricing.

The fees themselves are also said to be attributed to vague and cryptic policies, like “fulfillment and service.” These policies lack adequate explanation and the associated fees vary wildly, according to the suit. The lawsuit points out that StubHub doesn’t disclose how these fees are calculated or what they’re even for.

The complaint goes on to allege that StubHub has sold 4.9 million tickets and accrued over $118 million in hidden fees just in Washington DC by relying on the above methods. This lawsuit doesn’t crunch the numbers for other cities, like New York City, Los Angeles and Chicago, though I have a hunch that those residents also attend ticketed events in large numbers.

“We are disappointed that the DC Attorney General is targeting StubHub when our user experience is consistent with the law, our competitors’ practices, and the broader e-commerce sector,” John Lawrence, StubHub’s deputy general counsel, wrote in a statement to The Verge.

To the point of being “consistent with the law,” Schwalb claims that StubHub has violated the District of Columbia’s Consumer Protection Procedures Act (CPPA). The aforementioned drip pricing strategy isn’t allowed, as the law requires merchants to provide factual information regarding consumer goods sold in the city. The AG has asked the court to financially penalize StubHub and for an injunction to stop the allegedly deceptive practices.

“Hidden fees in the ticketing industry have truly gotten out of control. The price that is advertised is the price that we should pay—full stop,” wrote National Consumers League CEO Sally Greenberg in a press release that accompanied the lawsuit.

This is just the latest attempt to dissuade ticket sellers from using junk fees to line their coffers. The federal government, under President Biden, has been trying to tamp down these practices since 2022, when Ticketmaster caused a straight-up fiasco by promising more Taylor Swift tickets than were actually available and adding plenty of junk fees. In 2023, the FTC proposed a rule to ban junk fees. There will be a decision issued on this by the end of the year.

The House also passed a bill back in May to force ticket sellers to display the actual prices at the start of the purchasing process and not at the very end. Finally, the DOJ took legal action against Ticketmaster’s parent company Live Nation earlier this year, accusing it of monopolistic practices that result in high ticket prices.