Slashdot Mirror
Intel CPUs Vulnerable To New 'BranchScope' Attack (securityweek.com)
wiredmikey writes: Researchers have discovered a new side-channel attack method dubbed "BranchScope" that can be launched against devices with Intel processors. The attack has been identified and demonstrated by a team of researchers, and similar to Meltdown and Spectre, can be exploited by an attacker to obtain potentially sensitive information they normally would not be able to access directly. The attacker needs to have access to the targeted system and they must be able to execute arbitrary code.
Researchers believe the requirements for such an attack are realistic, making it a serious threat to modern computers, "on par with other side-channel attacks." The BranchScope attack has been demonstrated on devices with three types of Intel i5 and i7 CPUs based on Skylake, Haswell and Sandy Bridge microarchitectures. Further reading: As predicted, more branch prediction processor attacks are discovered (ArsTechnica).
Researchers believe the requirements for such an attack are realistic, making it a serious threat to modern computers, "on par with other side-channel attacks." The BranchScope attack has been demonstrated on devices with three types of Intel i5 and i7 CPUs based on Skylake, Haswell and Sandy Bridge microarchitectures. Further reading: As predicted, more branch prediction processor attacks are discovered (ArsTechnica).
Every vulnerability needs a HYPED UP MARKETING NAME in the TECHSOCIAL INDUSTRY!!
EVERYTHING ABOUT TECH IS SOCIAL!!!!
Nerds who built all our technology, die in a fire. We the Social don't need nerds anymore.
can be exploited by an attacker to obtain potentially sensitive information
In other words, there is a one in a billion chance that an attacker would obtain something of importance.
The attacker needs to have access to the targeted system and they must be able to execute arbitrary code
In other words, a completely worthless exploit.
I'll pencil this one in as "yet another Intel patch I won't be applying in 2018"
Future looks bright with new in order part such as the 32MHz quark intel processor...
I guess ARM servers are the future.
When the poo hit the AMD fan a few weeks ago it was front page news everywhere, but now that it has been slung back at Intel, it's good to see Ars is not making this article front and center, but rather downplaying it a bit. I actually had to search the front page to find it.
VMs are safe they said
You can't break out of your sandbox they said
"The attacker needs to have access to the targeted system and they must be able to execute arbitrary code."
Non-news. Move along.
Correction #1: "...pile of leaks that should worry people."
#2: "I have a thing for asterisks."
Friggen Mondays. (I was off yesterday, so it's a mental monday.)
Table-ized A.I.
not again
Although I expect Intel to correct that.
I'm getting tired of patching the servers already...
Another day, another Intel CPU vulnerability revealed. I'm beginning to wonder if we wouldn't all be better off using Motorola chips.
___
"Second place is first loser," whined the second loser, the third loser, the fourth loser... etc., mistakenly thinking they were being clever.
Brach Prediction is the new Buffer Overflow.
There is no justice ... ... death is the only answer
Another consultant who stuck it out.
"We are the Priests, of the Temples of Syrinx..."
AMD needs to have ryzen pro with ipmi (like Intel xeon-e3) and ThreadRipper boards (Xeon W).
Cue up another " hotfix " that will be deployed half a dozen times before it's ready to screw things up again. :|
My condolences in advance if you're running Windows 10 and the unstoppable update machine
SERENITY NOW!
#DeleteFacebook
Good news everybody! This can be mitigated with microcode fix if you can afford to give up another 15% performance on top of the 20% loss the previous bugs caused. Thanks, intel.
It would be nice if they had worked with vendors to disclose this before publishing it. ... or did I miss that?
... everything "social" is a bad word. --.--
If necessary, made bad, by association.
You misspelled "backdoor"
We had established that in the very first article on /. like that. It should still be there in the comments.
It was somehow forgotten by most commentors when the second article appeared.
And it was clear that the mantra was to be repeated until readers had forgotten again what was originally already established.
Typic PR 101: Repeat, repeat, repeat.
A vserver with the resources to host a blog and unlimited bandwidth (meaning limited cost, not that they won't limit at some point) can be had for $2.
Meanwhile on Amazon you never know when you suddenly might get a bill for one. million. dollars. because both resources and price scale with the demand.
If not, then there should be.
Havr the OS providee its own microcode. Or have none at all, running on the *actual* bare metal.
can the code running on that emulated cpu achieve any of these out-of-order execution exploits against the host cpu running the emulator software?
It depends on the depth of the pipeline of the CPU.
If it long enough, the physical CPU might speculatively execute past the point where Qemu simulated the check in the emulated CPU, up to the point where Qemu simulate the payload that the attacker are wanting the emulated CPU to execute.
The thing is, for performance reason, if everybody switches to emulated CPUs (Java's / .NET's dreams), that's exactly the direction we will be heading onto :
- CPU getting longer pipeline (yet again, just like old P4) to try to squeeze more performance
- emulator getting more efficient at simulating the CPU.
Worse part ?
On intel architecture, that's already the case sometimes : Google's project zero managed to exactly pull this situation off, by running eBPF bytecodes (bytecode used by the programmable packet filtering virtual machine) on a few select Intel hardware.
(On AMD, the same only work when JITing is activated, otherwise the speculative execution doesn't reach far enough).
"Sufficiently advanced satire is indistinguishable from reality." - [Tips: 1DrYakQDKCQ6y52z6QbnkxHXAocMZJE61o ]
Let's be more clear, these hardware faults won't just go away in current and past models and the fixes are not fixes. Intel should just give everyone a bios feature to turn off this hardware feature if your concerned about security and can deal with its reduction in speed.
It's not so much this specific vulnerability that bothers me, but rather that there seem to be so many kinds of side-channel attacks that they're unlikely to find or fix them all.
I disagree the cloud is inherently less secure than the traditional approach. If one gives their "local" equipment and setups decent tender-loving-care, yes it's more secure than the cloud, but the average user won't bother, including many businesses.
The "problem" with the cloud is similar to nuclear power generation. Technically its record is safer than the alternatives. However, its failures make big news, which skews perceptions and fears. (Gas and coal kill through cancer and other ailments, and over time the total deaths far exceeds deaths related to nuclear power plant accidents.)
Therefore, the cloud has a PR problem, not so much a technical problem when it comes to security. It's not perfect by any stretch, but will probably be statistically better than the alternatives. But being statistically better may not be enough.
Table-ized A.I.
Intel shills (and assorted useful idiots) and their myths:
1. "This isn't a real problem, it needs physical/root access so you'd be fucked anyhow"
False: For any cloud systems, it potentially allows $randomclouduser access to any other cloud user on the same physical hardware. AWS, Azure etc.
2. "OK, so only cloud services are affected, no-one else"
False: For non-cloud systems, any system that allows untrusted code to run - including any system that runs untrusted Javascript (99% of systems running a browser) - is vulnerable.
AMD processors? May have similar problems. Currently unknown for this particular issue.. Intel? Definitely vulnerable.
No one agreed with you the first 100 times you've said this. Give it a rest.
If i have access and can run arbitrary code then I can do whatever on that computer.......... so this isn't really a vulnerability..