Slashdot Mirror
Researchers Disclose New 'Inverse Spectre Attack' (digitaljournal.com)
A new Intel security flaw has been discovered that potentially allows passwords to be stolen. An anonymous reader quotes Digital Journal:
As EE News reports, researchers said the new flaw enables an "inverse spectre attack". According to Giorgi Maisuradze and Professor Dr. Christian Rossow a ret2spec (return-to-speculation) vulnerability with the chips allows for would-be attackers to read data without authorization. According to Professor Rossow: "The security gap is caused by CPUs predicting a so-called return address for runtime optimization."
The implications of this are: "If an attacker can manipulate this prediction, he gains control over speculatively executed program code. It can read out data via side channels that should actually be protected from access." This means, in essence, that malicious web pages could interpret the memory of the web browser in order to access and copy critical data. Such data would include stored passwords.
"At least all Intel processors of the past ten years are affected by the vulnerabilities," reports EE News, adding "Similar attack mechanisms could probably also be derived for ARM and AMD processors...."
"Manufacturers were notified of the weaknesses in May 2018 and were granted 90 days to remedy them before the results were published. That deadline has now expired."
The implications of this are: "If an attacker can manipulate this prediction, he gains control over speculatively executed program code. It can read out data via side channels that should actually be protected from access." This means, in essence, that malicious web pages could interpret the memory of the web browser in order to access and copy critical data. Such data would include stored passwords.
"At least all Intel processors of the past ten years are affected by the vulnerabilities," reports EE News, adding "Similar attack mechanisms could probably also be derived for ARM and AMD processors...."
"Manufacturers were notified of the weaknesses in May 2018 and were granted 90 days to remedy them before the results were published. That deadline has now expired."
I will worry about it. I promise.
Any clout the brand had has been destroyed in the past year. What shoddy system design.
You may have some anger management issues. Should get that looked into.
How much is intel paying for the AMD FUD this time?
I can barely afford an old Core2Duo for 50 bucks (case and all). And I have actually for real been a target of my own country. How the hell am I supposed to mitigate all this? I run a well-"secured" Linux with at least daily updates of everything, but what's the point? Sure, a few of those bugs can be worked-around in software. But what does it matter? It takes a single proper one, and I'm done.
I can only console myself with the fact, that if nothing happened until now, then nothing may happen. But I just can't live with that constant insecurity.
I'm at a point where I'm willing to drop all hardware more complex than a pair of pliers. I don't think I can stand such a life though. Not with the illness that made me this poor. Computers are the only thing I'm good at that I have left. I need them, if I ever want to get out of this.
IMNSHO, the whole realm of Spectre/Meltdown vulnerabilities - while an interesting lab experiment - are complete horseshit. Consider:
1) In order for ANY of these vulnerabilities to be useful, you MUST be running malware on your system. If so, you are already hosed.
2) Given the enormous realms of malware extant than can much more quickly and easily grab your data (Hello, Equifax!), any true hacker would laugh at trying to use these vulnerabilities, because...
3) The idea that malware can tickle the cache millions of times to grab data (presuming it has not already been flushed), interpret said data and then prey that it is something useful, like passwords, when cache is normally filled with instructions more than data...Yes. Complete, organic, 100% Dolphin-free horseshit.
Any of you who are now delaying purchases, etc. while you twist your hanky are doing the rest of us a favor by forcing prices down, so - Keep It Up!!
Yeah, the cloud is fucked and web sites that don't work without Javascript need to stop embedding third party scripts, at the very least until CPUs stop leaking predicted execution results.
Escher was the first MC and Giger invented the HR department.
Well all of this goes back to what I have said to everyone I know, "Do nothing important in a WEB Browser". Which I get "It is safe and easy I do it all the time.
At least paying for a stamp to mail in a bill payment buys you protection that is lacking in WEB based tools. If your mail is tampered with, it is a crime. Granted the Gov my take a peek, but better than someone trying to drain your accounts.
The way things are going lynx is looking pretty good :)
The return instruction is just an indirect branch that jumps to the link register that also manipulates the stack pointer, so it seems pretty unsurprising it has the same speculative behavior.
How is this the reverse of spectre? It's the exact same, just a different instruction.
Is this how Guccifer got into Hillary's email server?
This is what happens when a CPU company has had a monopoly for decades. How to fix this? BUY AMD! Is your only option. Feel safe. BE SAFE!
Maybe it's too late. There was a chance back with the DOS, but not now. Computers are great but people are shit
I know you were making a joke, but California Franchise Tax Board ;)
Maybe its just me, but you can only cry wolf so often and if nothing happens it just stops being important.
I thought the same thing, more or less, based on my understanding of basically how the low-level attack works. As it turns out, I was wrong. They have figured out how to use a "no big deal" issue to build an important and powerful attack around it. I got lost in the details and "couldn't see the forest for the trees", so to speak.
Others have pointed out "maleware running" could be JavaScript. Not even that is necessary, though - even sending specially crafted TCP packets to the target can do the trick! Google Netspectre for details.
It's NOT just "hope something useful is in the cache" as I'd thought. The attacker can read chosen memory addresses, insome cases before ASR is applied.
This is a much bigger issue than I thought, and bigger than you thought, because of what people have been able to build on top of the essential vulnerability.
Sorry to disappoint you all, but this is not new, this is already discovered:
https://arxiv.org/pdf/1807.07940.pdf
Just set the "Execute Payload with NT AUTHORITY\SYSTEM" flag in the IP header ...
Why keep anything security-related in a browser? Passwords go into a local, separate (not on the web) password manager, and are copied via the clipboard when needed (automatically clearing the clipboard in 10 sec or so). You can probably guess what I use from that description.
the only safe computers will be the ones completely disconnected from the internet, kept locked in a secure room where only authorized personnel are allowed to enter, i think its time for a completely new architecture built with security in mind from the ground up and the same goes for the software, no back doors, no remote code allowed to execute unless it is sandboxed and unable to touch the system
Politics is Treachery, Religion is Brainwashing
The only recourse is to disable speculative execution and hyper-threading. The flaw isn't a bug. The flaw is a fundamental philosophy in the paradigm of how to execute data. Or else it wouldn't effect AMD and ARM based CPUs.
This will never get patched. More flavors of it will just get discovered. The REAL FIX will be in entirely new CPU architecture with security setting the fundamental state of computer science in how data gets processed. That, and along with new OS kernels to match will take at least 5 more years.
Back to a notebook next to the computer with everything written out. Type in everyday as needed due to that CPU.
Domestic spying is now "Benign Information Gathering"
Manufacturers were notified of the weaknesses in May 2018 and were granted 90 days to remedy them before the results were published.
90 days may be the standard for Responsible Disclosure, but that's only reasonable for issuing a software patch. Intel doesn't issue new silicon to everyone affected within 90 days, it can take over a year before the next chips are available, and those might've had their design locked down well beyond that.
Corruption is convincing someone that the selfless ideal is the same as their selfish ideal.
Well, when google is your technical authority, it's understandable that you'd be dead wrong...."even sending specially crafted TCP packets to the target can do the trick! Google Netspectre for details."
/. has descended to fucking Alex Jones level of paranoia - facts be damned!!) FFS!!
IF you actually READ TFA, you'll see that it REQUIRES a "gadget" (read: malware code) running on your fucking machine!! (I swear, the tech level on
After hearing about meltdown and spectre I spent time reading the details about Intel's microarchitectural security issues. They are so bad I find it difficult to believe nobody at Intel noticed the security implications of the performance hacks. AMD did a much better job at least with regards to meltdown (It's not vulnerable).
The term "gadget", in this context, means vulnerable code, preferably OS code, an especially kernel code. That's pre-existing code, part of the OS, that's vulnerable.
For Netspectre, an interesting gadget is a network card driver that is vulnerable.
Gadget does NOT mean malware.
Anyone else read that as inverse sphincter attack?
simple, don't trust jewputers
Burma-Shave
Anons need not reply. Questions end with a question mark.
Only we don't know whether AMD or ARM are affected. That's pure *ahem* speculation at this point.
We OTOH, are equally free to speculate why they were included at this point since there apparently is no evidence that they indeed are vulnerable.
The risk is obviously there, but I'm withholding judgment until there are more facts. It's not like there hasn't been attempts before to "fix" everyone else with the same performance degrading patches that are needed for Intel, whether they were vulnerable or not.
I guarantee you that this exact same thing will be in AMD chips, and possibly ARM and other chips with speculative execution.
Men in Black will never allow that.
See subject, there are in-order CPUs and those are not subject to the flaws.
Other old Atoms are immune too (called something silly like Cherry View, older than Bay Trail), but have PowerVR graphics which mean you'd probably be lucky if you get raw 2D graphics working in linux.
Worst though is these systems typically have 1GB RAM, max is 2GB RAM max.
Desktop systems exist but most are old netbooks - netbook with broken screen or keyboard will work.
As a further post says there's rapsberry pi but the 1GB RAM limit is even worse than 2GB!
Some netbooks have both VGA and HDMI, which can't be said of a raspy.
Here a couple of examples of Spectre gadgets. Suppose we have this code making sure the input doesn't try to access beyond the end of an array:
if (x array1_size)
y = array2[array1[x] * 4096];
Or maybe this code you might find in a firewall such as iptables. It checks to make sure the protocol of the packet is either TCP, udp, icmp, or another valid protocol:
if (packet.ethertype = maxtype) {
CurrentProt = EtherTypes[packet.ethertype];
}
Can you spot the problem?
99.99999% of the time, a received packet will have a valid protocol type. The CPU "learns" that the condition is almost always true, so will speculatively set the value of CurrentProt, then undo that if the condition ends up being false. Suppose there are 100 valid protocols the code handles. The attacker sends a frame with the EtherType (protocol) set to 40,101. The CPU speculatively loads whatever data is 40,001 bytes past the EtherTypes variable. The attacker has loaded the contents of whatever memory address they choose.
How frequently do you see a gadget such as bounds checks? Well, almost ALL well-written code will include these patterns, and therefore be vulnerable.
Here's something that will annoy the heck out of a few people here -
ALL code written in Rust which uses an array is guaranteed to have bounds checks, and therefore be vulnerable.
Here's the code for the driver uses with Intel network gigabit network cards. Hardly anyone ever uses that, right? Only people with Intel motherboards or Intel network cards, and other companies network cards that use the Intel chip.
https://github.com/torvalds/li...
I see a couple hundred if statements in there. Maybe 20% of those will serve as a gadget. I bet you can find three or four bounds checks. In my other reply I showed you how to use a bounds check as a Spectre gadget.
Richard Stallman clearly predicted this: https://en.wikipedia.org/wiki/...
I don't deny the attacks are possible, but they really are not very feasible outside of a carefully coordinated attack on a specific target.
It's not like some gaping hole where you could use a drive by site to drop rootkit on millions of passing systems.
And even a targeted attack is unreliable outside of carefully controlled lab environments, especially the network based one.
The current network based variant has an important limitation in regards exfiltration rate. Based on past vulnerabilities and exploits, we can guesstimate that new developments might make it roughly 10X faster. That makes it even more interesting to use against chosen HTTPS sites to retrieve the private key.
The JavaScript based ones aren't currently the easiest way to build a botnet, but deploying such JavaScript on a site frequented by Lockheed Martin employees, or bank employees, could be really interesting.
Bitcoin fanboys: It is an unalterable ledger, safe for ever
Rest of the computer industry: uh, what about bugs ?
Rip this fucking unit out of the CPU and be done with it.