Slashdot Mirror
Researchers Discover SplitSpectre, a New Spectre-like CPU Attack (zdnet.com)
An anonymous reader writes from a report via ZDNet: Three academics from Northeastern University and three researchers from IBM Research have discovered a new variation of the Spectre CPU vulnerability that can be exploited via browser-based code. The vulnerability, which researchers codenamed SplitSpectre, is a variation of the original Spectre v1 vulnerability discovered last year and which became public in January 2018. The difference in SplitSpectre is not in what parts of a CPU's microarchitecture the flaw targets, but how the attack is carried out. Researchers say a SplitSpectre attack is both faster and easier to execute, improving an attacker's ability to recover code from targeted CPUs. The research team says they were successfully able to carry out a SplitSpectre attack against Intel Haswell and Skylake CPUs, and AMD Ryzen processors, via SpiderMonkey 52.7.4, Firefox's JavaScript engine. The good news is that existing Spectre mitigations would thwart the SplitSpectre attacks.
I presume that since mitigation measures for Spectre also work against Split Spectre, that CPUs (like mine) which aren't vulnerable to Spectre are also not vulnerable to Split Spectre?
I realize that it's a bit of speculation but it seems like a reasonable conclusion.
I know it might surprise some people but not all recent processors are vulnerable. For example, according to intel, in their i7 lineup only their 45nm and 32nm process chips are vulnerable.
Oh you, managed languages are safe.
Okay so they aren't, but sandboxes are safe.
Okay alright there are bugs, but virtual machines are safe.
So about thos' virtual machines...
Yeah fuck you, throw another layer on, what does it matter.
time to dig out my old kim-1 and forth env.
Sorry, but security researchers have recently discovered that due fundamental architectural issues, a hypothetical malicious program could trivially access *all* of the data on any 6502-based system.