Slashdot Mirror
Kaspersky To Demo Attack Code For Intel Chips
snydeq writes "Kris Kaspersky will demonstrate how attackers can target flaws in Intel microprocessors to remotely attack a computer using JavaScript or TCP/IP packets, regardless of OS. The demo will be presented at the Hack In The Box Security Conference in Kuala Lumpur in October and will show how processor bugs can be exploited using certain instruction sequences and a knowledge of how Java compilers work, allowing an attacker to take control of the compiler. The demonstrated attack will be made against fully patched computers running a range of OSes, including Windows XP, Vista, Windows Server 2003, Windows Server 2008, Linux, and BSD. An attack against a Mac is also a possibility."
So is it Java or Javascript? Either the summary is wrong or this guy doesn't even know the difference between the two.
will show how processor bugs can be exploited using certain instruction sequences and a knowledge of how Java compilers work
Huh? Javascript != Java!!!!
Monstar L
a knowledge of how Java compilers work
Hrm, seems like he's counting on things happening in a certain sequence. So, perhaps a JVM could do more stuff in an unpredictable order? Perhaps using an SSA representation and context switching threads? Yeah, slightly more expensive, but let Firefox turn it on for me when I'm running untrusted code.
My God, it's Full of Source!
OUTSIDE_IP=$(dig +short my.ip @outsideip.net)
... Windows XP, Vista, Windows Server 2003, Windows Server 2008, Linux, and BSD. An attack against a Mac is also a possibility.
Why don't they just say... "any computer that has an Intel chip?".. shock value I guess.
If this can consistently crash my computer regardless of OS or browser, I'd sure as hell update my BIOS.
This is a big deal.
I have developed a truly marvelous proof of this comment, which this signature is too narrow to contain.
They call it a flaw, while I call it a backdoor.
They're using their grammar skills there.
>I see, so your argument is that if it can't be fixed by the discoverer,
> they should keep it obscure.
Yeah, we could have the oft-heard chicken or egg debate. But we both know where it would end up. One side would say "disclose everything right away" and the other side would say "give the vendors a chance to fix it first". See how much time we just saved?
1 in 4 Maine children in struggle with hunger.
Possibly, but as an AMD user myself I can't help but wonder if what can be done on Intel with this won't also open Pandora's box on AMD using the same or similar methods.
I am Bennett Haselton! I am Bennett Haselton!
As an end-user, to me it doesn't matter. If patches aren't available, I still need to know the details of the vulnerability so I can judge which of my systems need how much of their external access blocked or removed. To me, keeping it secret doesn't remove the vulnerability. I have to assume that, if it exists, the bad guys know about it and will use it. The only question for me is whether or not I know I need to take protective measures. If you say I don't need to, then I say "OK, let's you sign this contract making you liable for every penny of losses resulting from exploitation of that vulnerability.".
And then the irony will be that on Windows, the exploit will crash out, in Linux it will require a more up to date version of WINE to be installed so it can run and then crash like in Windows, and in BSD it simply won't run since BSD is that old "eunuchs" stuff that won't run Windows "cross platform" 'sploits.
In the end, everyone is SAFE from attack by the sheer virtues of their software goodness that is inherent in "modern" OS's.
" What luck for rulers that men do not think" - Adolf Hitler
If the fundamental flaw is BOTH the way intel chips execute code and a primitive in Java, that could be dangerous.
I could get all snarky and tell everyone I buy AMD, but I wouldn't be too confident that a similar exploit couldn't exist there either.
This is all possible if...
You need to reliably produce a series of instructions on a typical jvm. This doesn't present a problem as primitive expressions probably get predictable JIT sequences,
The next question is what kind of exploit? Are you running native x86 code? If so, you are still limited by the OS level protection. If you can then create an exploit that elevates your permissions that doubly bad.
One more snarky comment. I don't like JITs. I like my interpreted code interpreted, and I like my binary code native. I prefer something like a PHP model where you put glue in PHP and hard code in a C extension or a service.
> The government just supplies a cheap alternative that people elect to use.
No my statist friend, we don't 'elect' to use the USPS if we can avoid it. But we don't have a choice in some cases because the US Government grants a monopoly on letter delivery. UPS and Fedex can deliver freight and because nobody thought it possible and thus Congress didn't forbid it in time, overnight letters. Notice how totally the private competitors dominate the postal service in those catagories? How many YEARS it took for the postal service to even attempt an overnight delivery service... that still only promises (as in refund you money for being late) 2-3 day delivery between most endpoints.
Do you really think UPS couldn't eat the postal service's lunch on 1st Class postage if they were allowed to compete? Of course they could, which is why the Postal Workers unions make damned sure Congress never even brings the subject up. They would probably have to adopt the same subsidy tactics as the USPS, i.e. use bulk mailers to subsidize 1st Class postage. But not being a government agency, once they demolished the USPS would restore actual market forces. So you would end up paying a bit more to send a letter AND get a bit more paper spam. But mail would flow quicker and with greater reliability.
Democrat delenda est
It's another case of "security research by press release, you can have the details in X months. in the mean time, I'll pump the PR wires".
Show us the code, or pipe the fuck down you attention whore.