Slashdot Mirror
How a Researcher Hacked His Own Computer and Found One of the Worst CPU Bugs Ever Found (reuters.com)
Reuters tells the story of how Daniel Gruss, a 31-year-old information security researcher and post-doctoral fellow at Austria's Graz Technical University, hacked his own computer and exposed a flaw in most of the Intel chips made in the past two decades. Prior to his discovery, Gruss and his colleagues Moritz Lipp and Michael Schwarz had thought such an attack on the processor's "kernel" memory, which is meant to be inaccessible to users, was only theoretically possible. From the report: "When I saw my private website addresses from Firefox being dumped by the tool I wrote, I was really shocked," Gruss told Reuters in an email interview, describing how he had unlocked personal data that should be secured. Gruss, Lipp and Schwarz, working from their homes on a weekend in early December, messaged each other furiously to verify the result. "We sat for hours in disbelief until we eliminated any possibility that this result was wrong," said Gruss, whose mind kept racing even after powering down his computer, so he barely caught a wink of sleep.
Gruss and his colleagues had just confirmed the existence of what he regards as "one of the worst CPU bugs ever found." The flaw, now named Meltdown, was revealed on Wednesday and affects most processors manufactured by Intel since 1995. Separately, a second defect called Spectre has been found that also exposes core memory in most computers and mobile devices running on chips made by Intel, Advanced Micro Devices (AMD) and ARM Holdings, a unit of Japan's Softbank.
Gruss and his colleagues had just confirmed the existence of what he regards as "one of the worst CPU bugs ever found." The flaw, now named Meltdown, was revealed on Wednesday and affects most processors manufactured by Intel since 1995. Separately, a second defect called Spectre has been found that also exposes core memory in most computers and mobile devices running on chips made by Intel, Advanced Micro Devices (AMD) and ARM Holdings, a unit of Japan's Softbank.
OK, the bug is big. Impact is going to be big. But who's gonna be punished by the market? Who can I short? Will users of Cloud services demand their processes to be hosted on exclusive servers not shared with others? Would it raise cloud costs? Would they punish Intel?
sed -e 's/Chuck Norris/Rajnikant/g' joke > fact
...if you intend on spying on everyone in the world.
Does EVERYTHING have to be in a bold font?
Please fix!
Every is seeing too much of bold fonts? Did someone forget a closing bold tag in some style sheet?
sed -e 's/Chuck Norris/Rajnikant/g' joke > fact
Is that yet another flaw or a duplicate name for one of the other two bugs we were already talking about in previous threads?
In other news, is the Motorola 68K series immune to these two/three problems? (Amiga, Atari ST, classic Macs)
#DeleteFacebook
For every punishing move in the market, there's a reward for new, better, faster, or in this case, more secure.
Who will get to market first with a fix? This will be fun to watch.
"Every time I see an adult on a bicycle, I no longer despair for the future of the human race." - H. G. Wells
If you're not running malicious programs on your computer, you're not vulnerable to these attacks. It's much tougher to sneak malicious functionality into open source software. If the source code is available, it's far more likely someone would notice the malicious behavior than if the software is closed source. It seems like the processor and other hardware hasn't been explored as an attack surface to nearly the same extent as software. I expect there will be more bugs like these, and it's a matter of time before they're found and exploited. The damage from these vulnerabilities can be mitigated by blocking untrusted code (like a lot of JavaScript that could exploit Spectre-like vulnerabilities) and using open source. I'm far more willing to trust that the open source software running on my Linux system isn't working against me than I am with closed source software.
Google and Amazon both say its negligible.
http://www.businessinsider.com...
"The defense of freedom requires the advance of freedom" - George W Bush
The article teases you with "how he did it" and answers with "he did it." You want to know how Meltdown or Specter work? Read the papers: https://meltdownattack.com/
The whole thing is overblown. US CERT gave it a CVSS of 1.5 ... which means on a scale from 1 to 10 in severity, it didn't even break a 2.
https://www.kb.cert.org/vuls/i...
100 REM PISS OFF CODE FASCISTS 200 GOTO 100
There is no possible way that Intel and other CPU manufacturers were not aware of this problem for many, many years.
I'm safe. My computer doesn't use "core memory".
I guess technically the CVSS scale runs from 0 to 10, but still this one wallows in the bottom half of the Low classification.
https://nvd.nist.gov/vuln-metr...
100 REM PISS OFF CODE FASCISTS 200 GOTO 100
Good thing they clarified who ARM are by referencing a group I have vaguely heard of once or twice.
https://cyber.wtf/2017/07/28/negative-result-reading-kernel-memory-from-user-mode/
Intel PR monkeys are trying to take AMD down with them, let's make this clear:
For the 3 bugs, the biggest one only affect Intel CPUs, for bug 2 and 3:
AMD bug only affects THE SAME PROCESS, unlike Intel, which allows exploits to cross processes:
https://googleprojectzero.blog...
As shown, AMD was only vulnerable to "the ability to read data inside mis-speculated execution within the same process, without crossing any privilege boundaries."
Does this brings up a another issue ? As fixes roll out what about Intel ME ? That is suppose to be on a somewhat modern 32 bit Intel processor. So I would think that ME will have these same issues.
How would that get patched ? Can ME even access kernel memory on the main chip like meltdown can on VM ?
Hope this does not keep you awake at night :)
Hacking is against the law. Teenagers who share nudes of themselves can be tried for pedophilia, too.
You literally just posted an article that said Google's team discovered this a year ago. So which is it?
FTA: The key players were independent researcher Paul Kocher and the team at a company called Cyberus Technology, said Gruss, while Jann Horn at Google Project Zero (GOOGL.O) came to similar conclusions independently.
Which begs the question - how long has the NSA known about this too?
Who will get to market first with a fix?
Intel CPUs are the only ones with an actual flaw requiring KPTI to mitigate, so it's a one person race.
I don't think you understand: Meltdown can only be fixed by replacing your Intel processor. There are mitigation steps in software, but it is not possible to fix.
Who will get to market with a fixed CPU, is what I should have said to be unambiguous.
Whoever that company is may reap huge rewards, even if it's Intel.
"Every time I see an adult on a bicycle, I no longer despair for the future of the human race." - H. G. Wells
AMD already has a "fixed" CPU. Only Intel is affected by Meltdown.
For an article with a title containing "How a researcher hacked his own computer and found 'worst' chip flaw", there is very little detail about "How the Researcher Hacked His Own Computer" - other than the words "Daniel Gruss didn’t sleep much the night he hacked his own computer".
It means the cheap Indian/Chinese workers don't have the cultural bias towards creativity that 'western' workers do; and are less likely to find and report unexpected behavior because they don't want to make their superiors look bad.
I worked for a month for an India based software co, and the bosses *deleted unfixed bugs from the database* in order to appear better. I got away from that company ASAP.
It means the cheap Indian/Chinese workers don't have the cultural bias towards creativity that 'western' workers do; and are less likely to find and report unexpected behavior because they don't want to make their superiors look bad.
I worked for a month for an India based software co, and the bosses *deleted unfixed bugs from the database* in order to appear better. I got away from that company ASAP.
The other possibility is that they are equally creative, but don't have the confidence to raise the flag, since they don't have the protection of being a white American citizen? Or that "this may be the work of the CIA", so lets pretend we don't know about this?
Jumpstart the tartan drive.
I think they better do a routine check of the offices to make sure employees haven't hung themselves
by their neckties.
How much you want to bet that this was one of their dirty tricks...
excitingthingstodo.blogspot.com
"Meltdown" is the issue requiring CPU fixes. That's 100% Intel fuckwittery.
Fucking God Dammit shitel shill, the article is using Shitels PR statement as reference, and you keep posting the same FUCKING incorrect information. So fuck off, I will say it again just stop fucking shilling , here is exactly what AMD said https://www.amd.com/en/corpora... , and what Linus Tovalds said about the god dam PR statement you linked to http://www.businessinsider.com...
That's not at all true. Spectre can most certainly access memory from other processes, including on AMD.
What they are referring to is Meltdown, which is specifically a privilege escalation exploit that allows a user process to access kernel memory from within it's own virtual memory space. Spectre, on the other hand, tricks another process to leak it's protected memory.
Even then, the Spectre paper specifically mentions how it may be possible to use it to access privileged memory by targeting an interrupt or syscall.
And AMD may very well turn out to be vulnerable to Meltdown too. While the researchers weren't able to get their PoC working on AMD CPUs, they did show that they *do* out of order execute instructions following an illegal memory access and discuss the problem may just be a matter of optimizing the side channel method they used.
Honestly I think AMD is being very dishonest in their announcement, beyond just the Meltdown handwaving. They claim the Spectre bounds check bypass has been fixed with software, but I haven't heard of a good software solution to this, much less have I seen an actual patch. Then they claim the Spectre branch target injection isn't an issue, but my understanding is this is just a matter of figuring out how to better mistrain AMDs branch prediction, as was done with Intel's.
These vulns are much more difficult to develop than your typical software vulns, and the researchers have barely even scratched the surface. There's sure to be much more to come and AMDs claims to be largely immune are horribly irresponsible. Until they disclose their actual reasoning behind their claims, I'm going to assume they're full of shit and just as vulnerable as everyone else.
Nuh unh! AMD is also vulnerable to CPU cracking if you hit it with a hammer! Or a nuke! No one has proven intel is...
There is bad stuff on both sides. Both sides!
If this were true, it would mean people could also arrive to the same thoughts or ideas independently, throwing the entire patent system out the window
Does this mean that users can use Meltdown and Spectre to peek behind the Windows 10 curtain, and see what telemetry it collects?
ALPHA + VMS
OR
MAINFRAME + COBOL
xoxox
Kilroy & The Punch_Card_Vacuum_Tube_Posse
Given that JavaScript runs in the browser process, that's still dangerous. Even with process-per-tab isolation, JavaScript that exploits Spectre could potentially steal:
I think it would be premature at this point to start buying new processors. I believe that there are a number of related vulnerabilities that will emerge over the next year and I wouldn't want to guess which processors are vulnerable (well, anything in-order, with no branch predictor is probably fine).
This has been concerning me for a little while. CPUs have come with a lot of performance improvements over the last 20-30 years that have introduced nondeterminism into execution timings and have regarded side channels as a software problem. It now appears that, as with memory protection, software solutions are largely inadequate and it's going to be a big challenge to retain the CPU performance that we're accustomed to.
AMD people shouldn't be too gleeful. They're happy because their processors don't speculate across protection level crossings. If you don't think about timing attacks, then that's not such a good thing: it means that every system call is a pipeline stall, whereas the Intel chip will keep executing into the system call without a stall. All of the fixes for the next few years are likely to be like that: lose something that gives a performance increase to get back some security.
I am TheRaven on Soylent News
What is this "kernel" memory you speak of?
What were the lessons, IF ANY, that Intel learned from the Pentium 60?
They sent me a replacement for that processor. Fortunately it came in a ZIF socket and was a quick replacement.
Alas, my Pentium 60 and Pentium 133 Mhz machines are now part of the ewaste stream but I still occasionally use an Athlon 500Mhz machine!
This may help to partially mitigate (Google does this with Chrome, too):
about:config
privacy.firstparty.isolate TRUE
Come on, people. This is Intel we are talking about here. This is not a BUG, but rather a FEATURE placed by the NSA, like IME and so many others.
"These processors are buggy as hell, and some of these bugs don't just
cause development/debugging problems, but will *ASSUREDLY* be
exploitable from userland code."
https://marc.info/?l=openbsd-misc&m=118296441702631&w=2
I'm surprised he didn't "discover" these Intel security issues as well:
http://blog.invisiblethings.org/papers/2015/x86_harmful.pdf
AMD is NOT vulnerable to Meltdown. AMD already responded that their permission bits are checked BEFORE issuing instructions so kernel memory isn't readable, even speculatively.