Slashdot Mirror
Oracle Bakes Security Into New Chips (theregister.co.uk)
An anonymous reader writes: Oracle's Larry Ellison gave a presentation yesterday at OpenWorld in which he detailed how the M7 chip's new Silicon Secured Memory system works. "On the M7, pointers and their memory blocks are stamped with a 4-bit 'color,' and accesses are verified to make sure the color in the highest bits of the pointer matches the color of the memory allocation. This works with virtual memory allocated from the heap rather from the stack, it appears. Solaris tries to avoid giving adjacent blocks the same color." El Reg notes that a 4-bit security stamp doesn't really offer that many distinct options. "Four bits of color means there are 24, or 16, possible colors a memory block can have. A hijacked pointer has a one-in-16 chance of having a matching color when it accesses any block of memory, allowing it to circumvent the SSM defense mechanism. ... It is even possible [a hacker] can alter the color bits in a pointer to match the color of a block she wishes to access, and thus avoid any crashes and detection. In short, SSM is a mitigation rather than bulletproof protection." Still, Ellison claims this would have shut down vulnerabilities like Heartbleed and Venom.
Colors? I bet he counts binary as "one potato, two potato, four potato".
It is even possible [a hacker] can alter the color bits in a pointer to match the color of a block she wishes to access, and thus avoid any crashes and detection.
Go ahead, mod me down as a troll.
Took me a moment to realize that there are 10 kinds of people in this world: those who know how to type powers of two, and those who don't.
When a workaround for this security measure is discovered, I will have slower hardware that's ineffective at security.
2^4 is 16, what does "Four bits of color means there are 24, or 16," mean?
But... but.... colors are going to change the world! You'll see! *runs off laughing*
It's possible they meant the term in my subject https://en.wikipedia.org/wiki/...
(OR something that operates a LOT like it here...)
APK
P.S.=> I didn't "RTFA" but for those of you that did? Feel FREE to correct me IF it doesn't apply here (otherwise enjoy something possibly NEW to you all then, or not)... apk
Even if Oracle is an evil organization run by salescritters, I fail to see how this computing metaphor is inappropriate. Good metaphor is encouraged because it takes advantage of existing language and simplifies the tech narrative by overloading the language features, provided it should not mislead the audience. We don't raise a colored flag when we think about the 4-color theorem, graph coloring problems, red-black trees, or quantum color dynamics, etc. ;)
I doubt it; but there is a slight possibility that this is actually a delightfully nerdy reference to Paranoia's color-based 'classification' system that some techie deep within the bowels of Oracle managed to sneak past the armies of lawyers, salesmen, and licensing enforcement thugs.
I tried using OpenSolaris and OpenIndiana at home, but it seemed it was not the intended use. Can anyone explain what do people and business do with Solaris?
Linux is for people who don't mind RTFM.
... is that it's essentially an Oracle only platform (not sure what Fujitsu does w/ it in Japan). So if you want to be locked into Oracle and pay the same sort of cash that you would for an Itanic building, this is the way to go.
Otherwise, who else is there who's building boxes based on these that could run something that's not from Oracle, and therefore, doesn't involve paying them huge ransoms? As it is, Linux has almost completely left that platform, and I'm not sure of what support the BSDs have left - aside from OpenBSD. Speaking of which, this CPU, given all its security features, could be a good match for OpenBSD, which could explore interesting ways of using the features in it that are actually useful.
$100,000 per clock cycle per year because its Oracle.
what Burroughs was doing 45 years ago.
"I don't know, therefore Aliens" Wafflebox1
probably meant 4! not 2^4 .
or 4 x 6.
Who is buying new SPARC machines in 2015?
Fujitsu customers in Japan?
Still tons of legacy applications out there. The good thing is that with zones and LDOMs, you can consolidate a ton of SPARC boxes onto one, and almost always, the applications won't really care, assuming the box has enough I/O, disk, and RAM to support it. This way, you can have that one SPARC box, and slowly move everything to x86 when possible.
Plus, for security, SPARC/Solaris still means business. Solaris 11 doesn't even have root by default; it is a role. It also is good to be on a different architecture than everyone else for the same reason why potatoes should be other than the Lumper come a rot epidemic.
A mainframe legacy. Storage protect keys was what IBM called it. Assigned to programs and program storage by the supervisor. Any memory access by the program required the keys to match. A mismatch caused a exception interrupt to the supervisor.
Xeons are getting all the new features that used to be mainframe only yesterday but the security isn't quite there yet. Turns out with some clever hacking you're able to exploit caching behavior on Xeon cpus and steal information from other VMs running on the same socket.
These guys wrote a paper about it.
https://eprint.iacr.org/2015/898.pdf
They were able to steal encryption keys from another VM running on the same host system on real live AWS instances. Lots of other interesting stuff in there regarding host system identification based on information leaked from the host to the VMs.
something bakes something something chips
I skipped breakfast this morning.
systemd is Roko's Basilisk.
Oracle is struggling to adapt to new times using the old model...
Oh, this makes me so happy... I think I may live to see Oracle be finished...
It looks like Oracle are taking that they bought with Sun's ZFS and applying it to memory hardware.
45 years? Longer than that. Storage protection keys were introduced on the IBM 360/67, in August 1965.
This isn't a panacea, but neither is it useless. It's much like current versions of ASLR (Address Space Layout Randomization), which attempt to make it hard for attackers to guess where important bits of data/code are located in memory by randomizing where stuff is put in memory. The amount of randomization that current ASLR implementations provide is somewhat limited, so it only achieves a few bits of randomization, meaning that the attacker may still be able to guess the correct location with some trial and error.
But layering enough of these sorts of obstacles on really does mean that in many cases an exploit chain that would be easy becomes much more difficult, or even impossible, and they don't impact legitimate code. In this case the color bits do consume some of the virtual address space, but we're talking about 64-bit pointers, which have space to spare.
Note to ACs: I usually delete AC replies without reading them. If you want to talk to me, log in.
That's what IBM said about AIX, then they became a "services" company.
Python: 'And then suddenly you have a language which says "we're all stuck with whatever the whiniest coder wants".'
Did you miss the part where they have an algorithm that tries not to assign the same colors to adjacent blocks of memory?
Colors? I bet he counts binary as "one potato, two potato, four potato".
It's very unlikely that the decision to call the categories "colors" originated with the sales/PR people. Designers need names for things, and calling things like this "colors" has a long history. Graph coloring, red-black trees, cache coloring... "color" is a nice notion for labels on chunks of memory or data where the color is an attribute that has no meaning to the underlying structure but is layered on top for bookkeeping purposes. Among other benefits, it makes for nice whiteboard diagrams, because you can actually color the nodes in the diagram.
Note to ACs: I usually delete AC replies without reading them. If you want to talk to me, log in.
Sound a little... (puts on sunglasses)... half-baked.
I have been in hardware design on and off since the days of Intel's 8080.
It always seemed to me that attaching type bits to each memory location could be very useful. This was not possible in the old memory constricted days. However, now memory is very abundant and the additional overhead should be worth the added security. To implement a scheme like this would require a serious rethink of the operation of the memory management system.
Every addressable memory byte would be assigned a type (via extra bits (or perhaps a more clever mechanism by modern memory management systems)). Important memory block types would include:
Executable space. This would indicate memory locations that contains executable code. It is almost always write protected. It can only be written to by a few special privileged instructions. Any attempt to read from (or write to) this memory as a data block, stack block or buffer block generates an exception at the hardware level.
Stack space: Push/pop and call/return type instructions could only happen in memory the is tagged as stack space. Regular data read/write operations are permitted. A stack overflow (push/pop or call/return) into or from memory not tagged as stack space generates an exception at the hardware level. Also, any attempt to execute code from the stack space generates an exception at the hardware level.
Buffer space: A limited, privileged set of instructions would permit moving data between the buffer and data memory or (with privilege) between the buffer and executable space. Obviously, buffer space cannot be used as a stack or executable space. Any attempt to do so generates an exception at the hardware level.
Data space: Normal program data storage. Like buffer space, data space cannot be used as a stack or executable space. Any attempt to do so generates an exception at the hardware level.
Unallocated space: This is memory that has been been issued a type by the memory manager. Any attempt by any process to access this space generates an exception at the hardware level.
This is just an idea that has been rattling around in my head for some time. Thanks for listening.
NSA haxors it in 4ms, code gets into wild, end of story. I think 'the man' would rather have us all running around naked with implanted remote activated cyanide charged RFID chips and Illuminati tattoos, and every woman well beyond the 5 year 50,000 mile warranty.
The term "color" has been used in algorithm descriptions for decades. Spotted the non-programmer!
Wut?
Hey Soulskill, a power of 2 isn't what you get when you stick your foot in the toilet then lick your finger and place it into an open light socket.
I was just impressed with 4bits = 24 what is this quantum?
Build a Man a Fire, and He'll Be Warm for a Day. Set a Man on Fire, and He'll Be Warm for the Rest of His Life.
What they are doing is equivalent to what userspace library Electric Fence does (which is to leave every alternate block of virtual memory unmapped so that running off the edge of a block makes a trap). The problem with Electric Fence is that you can benefit only by putting 1 malloc per 8kByte SPARC page, which wastes _huge_ amounts of memory, so electric fence is used only for debugging, and you have to run the program twice to find bugs---once with mallocs at the top of pages, once at the bottom---because overruns may be small. Since their colours apply to 64-byte blocks, I think it's more useful. I wish this feature were available on commodity machines.
NSA haxors it in 4ms, code gets into wild, end of story.
Nope. This kind of exploit mitigation that has no single hack. It's something that every exploit author has to work around, and exactly how to do that will depend on the nature of the exploit. In particular, this promises to be devastating to ROP attacks, seriously reducing the number of gadgets available and how they can be combined. It's doesn't make exploits impossible, but it makes many of them much harder, and some of them impossible.
Note to ACs: I usually delete AC replies without reading them. If you want to talk to me, log in.
I'm going to make a guess it was 24 but the superscriptiness got lost in a cut and paste. The sentence works if you assume that.
You are not alone. This is not normal. None of this is normal.
It's not unprecedented. See for instance the "red black tree".
Is it possible to design a Memory Management Unit that can prevent one process walking all over another processes memory?
which will be the result of the license of this internal processor segmentation of memory.
if this is supposed to be a new economy, how come they still want my old fashioned money?
Their licensing suck, try to build your own cloud with Oracle products in it, you can't it becomes too expensive, and impossible with vmWare 6, but you can buy access to THEIR cloud for much less. Someone should take them to court for it.
Fuck Oracle.
Colors? I bet he counts binary as "one potato, two potato, four potato".
It's very unlikely that the decision to call the categories "colors" originated with the sales/PR people. Designers need names for things, and calling things like this "colors" has a long history. Graph coloring, red-black trees, cache coloring... "color" is a nice notion for labels on chunks of memory or data where the color is an attribute that has no meaning to the underlying structure but is layered on top for bookkeeping purposes. Among other benefits, it makes for nice whiteboard diagrams, because you can actually color the nodes in the diagram.
Colors is also easier to understand for those purchasing the tech who aren't necessarily techies.
Colors? I bet he counts binary as "one potato, two potato, four potato".
It's very unlikely that the decision to call the categories "colors" originated with the sales/PR people. Designers need names for things, and calling things like this "colors" has a long history. Graph coloring, red-black trees, cache coloring... "color" is a nice notion for labels on chunks of memory or data where the color is an attribute that has no meaning to the underlying structure but is layered on top for bookkeeping purposes. Among other benefits, it makes for nice whiteboard diagrams, because you can actually color the nodes in the diagram.
Colors is also easier to understand for those purchasing the tech who aren't necessarily techies.
Not in this case. Pointer labeling and its anti-exploit value is still going to be opaque no matter what you call it, and you could apply any common word as the description and the non-technical would be fine using that as the hook. Oracle could be touting their new "porcupine" security technology, it would work as well from a sales perspective. Probably better.
Note to ACs: I usually delete AC replies without reading them. If you want to talk to me, log in.
I love it when the retards come out on /.
16 shades of grey
I'm going to make a guess it was 2<sup>4</sup> but the superscriptiness got lost in a cut and paste. The sentence works if you assume that.
Looking at the source, you're exactly right.
And Oracle, of all companies, is the one to be providing this "security" solution. Given their track record, I wouldn't trust Oracle to secure an honesty box...
It's NUMA. Go back to your 4th grade class. Recess is over.
Strong ASLR (OpenBSD, GRSecurity patched Linux kernel & ELF loader) are already devastating. Basically ROP attacks on such systems can require hundreds or thousands of attempts. But for servers this usually isn't a big deal because the software restarts itself. And you can usually finish the attack before anyone realizes what's happening.
Solaris probably can't implement strong ASLR (many bits of entropy, non-lazy binding so you can't just read the GOT table, etc) because of backward compatability issues.
See subject: Do you own /.? No. Do I obey you?? No. Are you worth the air you breathe & water + food you eat??? Hell no, lol!
* :)
(Go away now, PUNY troll - "shoo", lmao!)
APK
P.S.=> It must suck to be you - a total WASTE of life that THINKS he can give orders & others will obey them - that's what YOU want? Guess what - how's it FEEL to want something you'll NEVER get???... apk