Intel Cache Poisoning Is Dangerously Easy On Linux

Julie188 writes "A researcher recently released proof-of-concept code for an exploit that allows a hacker to overrun an Intel CPU cache and plant a rootkit. A second, independent researcher has examined the exploit and noted that it is so simple and so stealthy that it is likely out in the wild now, unbeknownst to its victims. The attack works best on a Linux system with an Intel DQ35 motherboard with 2GB of memory. It turns out that Linux allows the root user to access MTR registers incredibly easily. With Windows this exploit can be used, but requires much more work and skill and so while the Linux exploit code is readily available now, no Windows exploit code has, so far, been released or seen. This attack is hardware specific, but unfortunately, it is specific to Intel's popular DQ35 motherboards."

Comments

Linux

[the_one(2)]

They make it sound like a bad thing that it's easier to use your hardware on Linux =)

Re:Linux

[CRCulver]

Exploits that escape virtualization are the next wave of nasty.

No kidding. Remember when they took over the Enterprise?

Re:Linux

[Tuoqui]

Oh dont worry we know your password is hunter2.

Queue Microsoft Trolls in

[Cryolithic]

3 2 1

Re:Queue Microsoft Trolls in

[Anonymous Coward]

Actually hackers have much more experience with Win 32 systems than Linux. So while it is easier to program this exploit with Linux, we're still ok because we have security through obscurity.

Re:Queue Microsoft Trolls in

[grub]

"With Windows this exploit can be used, but requires much more work and skill"

That eliminates the VBS crowd, or about 99.8% of Windows 'programmers'.

Re:Queue Microsoft Trolls in

[mr_mischief]

I think you missed the pun. To "queue" a group means to have them form a line so they can each have their turn at something.

Re:First you need root on the box

[Lord Ender]

It's a whole new class of vulnerabilities. In addition to remote code execution and privilege escalation vulnerabilities, we now have privilege equalization vulnerabilities. Scary stuff.

Finally!

[Cornwallis]

2009 will be the Year of the Windows Desktop!

Re:First you need root on the box

[Lord Ender]

Your post indicates that you are suffering from the wooosh vulnerability.

Re:First you need root on the box

[JCSoRocks]

You're 2/2. Where are my bloody mod points when I need them...

Re:At the risk of causing a war...

[ITJC68]

Better to just use AMD CPU and Nvidia Chipsets? Unless those are also exploited. The truth be told is if a hacker wants in and is smart enough given enough time they will find a way in. Up to this point Linux was not popular enough to truly target. Not so anymore. This is a wake up call. Linux is becoming more popular and there will be people who will write these exploits for it. 2009 is the year of Linux on the server and the desktop.

Re:First you need root on the box

[should_be_linear]

It tried to attack my Ubuntu box. I entered admin password on request, but then it complained about missing c libs and opened Synaptic. Lame!

Yes, but does it...

[dave562]

..run on...

Oh, nevermind.

Re:Tides have changed

[Locke2005]

The only good rapper is a dead rapper.
I prefer to think of Tiger Woods as a great Thai golfer.
If somebody has physical access to a Windows box, then they can reboot it off a Knoppix Live CD, and they have the same exact problem. If somebody has the Admin password, they can do anything they want too. This only really effects cases where hostile users are running in another Virtual Machine on the box. If you need security, don't share your hardware with other people!

Re:First you need root on the box

[tisepti]

The wooosh vulnerability? I cant find info about this one anywhere - how do i secure against it?

Re:First you need root on the box

[blueg3]

If only there was a Wikipedia page that explained what a rootkit is and why malware would use one!