Slashdot Mirror
Researchers Disclose New 'Inverse Spectre Attack' (digitaljournal.com)
A new Intel security flaw has been discovered that potentially allows passwords to be stolen. An anonymous reader quotes Digital Journal:
As EE News reports, researchers said the new flaw enables an "inverse spectre attack". According to Giorgi Maisuradze and Professor Dr. Christian Rossow a ret2spec (return-to-speculation) vulnerability with the chips allows for would-be attackers to read data without authorization. According to Professor Rossow: "The security gap is caused by CPUs predicting a so-called return address for runtime optimization."
The implications of this are: "If an attacker can manipulate this prediction, he gains control over speculatively executed program code. It can read out data via side channels that should actually be protected from access." This means, in essence, that malicious web pages could interpret the memory of the web browser in order to access and copy critical data. Such data would include stored passwords.
"At least all Intel processors of the past ten years are affected by the vulnerabilities," reports EE News, adding "Similar attack mechanisms could probably also be derived for ARM and AMD processors...."
"Manufacturers were notified of the weaknesses in May 2018 and were granted 90 days to remedy them before the results were published. That deadline has now expired."
The implications of this are: "If an attacker can manipulate this prediction, he gains control over speculatively executed program code. It can read out data via side channels that should actually be protected from access." This means, in essence, that malicious web pages could interpret the memory of the web browser in order to access and copy critical data. Such data would include stored passwords.
"At least all Intel processors of the past ten years are affected by the vulnerabilities," reports EE News, adding "Similar attack mechanisms could probably also be derived for ARM and AMD processors...."
"Manufacturers were notified of the weaknesses in May 2018 and were granted 90 days to remedy them before the results were published. That deadline has now expired."
I will worry about it. I promise.
Any clout the brand had has been destroyed in the past year. What shoddy system design.
How much is intel paying for the AMD FUD this time?
I can barely afford an old Core2Duo for 50 bucks (case and all). And I have actually for real been a target of my own country. How the hell am I supposed to mitigate all this? I run a well-"secured" Linux with at least daily updates of everything, but what's the point? Sure, a few of those bugs can be worked-around in software. But what does it matter? It takes a single proper one, and I'm done.
I can only console myself with the fact, that if nothing happened until now, then nothing may happen. But I just can't live with that constant insecurity.
I'm at a point where I'm willing to drop all hardware more complex than a pair of pliers. I don't think I can stand such a life though. Not with the illness that made me this poor. Computers are the only thing I'm good at that I have left. I need them, if I ever want to get out of this.
IMNSHO, the whole realm of Spectre/Meltdown vulnerabilities - while an interesting lab experiment - are complete horseshit. Consider:
1) In order for ANY of these vulnerabilities to be useful, you MUST be running malware on your system. If so, you are already hosed.
2) Given the enormous realms of malware extant than can much more quickly and easily grab your data (Hello, Equifax!), any true hacker would laugh at trying to use these vulnerabilities, because...
3) The idea that malware can tickle the cache millions of times to grab data (presuming it has not already been flushed), interpret said data and then prey that it is something useful, like passwords, when cache is normally filled with instructions more than data...Yes. Complete, organic, 100% Dolphin-free horseshit.
Any of you who are now delaying purchases, etc. while you twist your hanky are doing the rest of us a favor by forcing prices down, so - Keep It Up!!
Escher was the first MC and Giger invented the HR department.
Well all of this goes back to what I have said to everyone I know, "Do nothing important in a WEB Browser". Which I get "It is safe and easy I do it all the time.
At least paying for a stamp to mail in a bill payment buys you protection that is lacking in WEB based tools. If your mail is tampered with, it is a crime. Granted the Gov my take a peek, but better than someone trying to drain your accounts.
The way things are going lynx is looking pretty good :)
Maybe it's too late. There was a chance back with the DOS, but not now. Computers are great but people are shit
I thought the same thing, more or less, based on my understanding of basically how the low-level attack works. As it turns out, I was wrong. They have figured out how to use a "no big deal" issue to build an important and powerful attack around it. I got lost in the details and "couldn't see the forest for the trees", so to speak.
Others have pointed out "maleware running" could be JavaScript. Not even that is necessary, though - even sending specially crafted TCP packets to the target can do the trick! Google Netspectre for details.
It's NOT just "hope something useful is in the cache" as I'd thought. The attacker can read chosen memory addresses, insome cases before ASR is applied.
This is a much bigger issue than I thought, and bigger than you thought, because of what people have been able to build on top of the essential vulnerability.
the only safe computers will be the ones completely disconnected from the internet, kept locked in a secure room where only authorized personnel are allowed to enter, i think its time for a completely new architecture built with security in mind from the ground up and the same goes for the software, no back doors, no remote code allowed to execute unless it is sandboxed and unable to touch the system
Politics is Treachery, Religion is Brainwashing
Back to a notebook next to the computer with everything written out. Type in everyday as needed due to that CPU.
Domestic spying is now "Benign Information Gathering"
Manufacturers were notified of the weaknesses in May 2018 and were granted 90 days to remedy them before the results were published.
90 days may be the standard for Responsible Disclosure, but that's only reasonable for issuing a software patch. Intel doesn't issue new silicon to everyone affected within 90 days, it can take over a year before the next chips are available, and those might've had their design locked down well beyond that.
Corruption is convincing someone that the selfless ideal is the same as their selfish ideal.
The term "gadget", in this context, means vulnerable code, preferably OS code, an especially kernel code. That's pre-existing code, part of the OS, that's vulnerable.
For Netspectre, an interesting gadget is a network card driver that is vulnerable.
Gadget does NOT mean malware.
Burma-Shave
Anons need not reply. Questions end with a question mark.
Here a couple of examples of Spectre gadgets. Suppose we have this code making sure the input doesn't try to access beyond the end of an array:
if (x array1_size)
y = array2[array1[x] * 4096];
Or maybe this code you might find in a firewall such as iptables. It checks to make sure the protocol of the packet is either TCP, udp, icmp, or another valid protocol:
if (packet.ethertype = maxtype) {
CurrentProt = EtherTypes[packet.ethertype];
}
Can you spot the problem?
99.99999% of the time, a received packet will have a valid protocol type. The CPU "learns" that the condition is almost always true, so will speculatively set the value of CurrentProt, then undo that if the condition ends up being false. Suppose there are 100 valid protocols the code handles. The attacker sends a frame with the EtherType (protocol) set to 40,101. The CPU speculatively loads whatever data is 40,001 bytes past the EtherTypes variable. The attacker has loaded the contents of whatever memory address they choose.
How frequently do you see a gadget such as bounds checks? Well, almost ALL well-written code will include these patterns, and therefore be vulnerable.
Here's something that will annoy the heck out of a few people here -
ALL code written in Rust which uses an array is guaranteed to have bounds checks, and therefore be vulnerable.
Here's the code for the driver uses with Intel network gigabit network cards. Hardly anyone ever uses that, right? Only people with Intel motherboards or Intel network cards, and other companies network cards that use the Intel chip.
https://github.com/torvalds/li...
I see a couple hundred if statements in there. Maybe 20% of those will serve as a gadget. I bet you can find three or four bounds checks. In my other reply I showed you how to use a bounds check as a Spectre gadget.
Richard Stallman clearly predicted this: https://en.wikipedia.org/wiki/...
The current network based variant has an important limitation in regards exfiltration rate. Based on past vulnerabilities and exploits, we can guesstimate that new developments might make it roughly 10X faster. That makes it even more interesting to use against chosen HTTPS sites to retrieve the private key.
The JavaScript based ones aren't currently the easiest way to build a botnet, but deploying such JavaScript on a site frequented by Lockheed Martin employees, or bank employees, could be really interesting.