5 ms·

This is an amazing piece of work. They started with a good concept then hit it from all angles. I posted about risk areas such as this on Schneier's blog long a

This is an amazing piece of work. They started with a good concept then hit it from all angles. I posted about risk areas such as this on Schneier's blog long ago. When debating with Joanna of Qubes, one of the reasons she said she chose Xen over the security-focused microkernels I mentioned was she wanted the power management it already had. When people told me how that worked, I told the readers that the implementation was way too complicated to trust in a secure system. Management features should be on a microcontroller sitting outside the CPU running verifiable algorithms. If on CPU, in an truly-isolated partition at the least. Also, use proper isolation on system in general to limit shared resources due to covert & side channels. Typical of separation kernels. So, this attack happens since isolation is broken in numerous ways plus stuff is on-CPU. It was preventable but it would cost extra. The market prefers to make extra money per unit then clean up after a disaster. Everything is running right on schedule. Note that the needs of mobile might justify keeping things in the SoC but the isolation failures weren't necessary. The embedded and mobile segments have had for some time SoC support for coprocessors, accelerators for specific functions, and separation kernels. I thinking they're avoiding those to squeeze out extra profit.

otakucode 9y ago
Yeah, this is just 'wow' level work. And it's going to be a NIGHTMARE to fix. I don't think most people realize how much of a ballet it is that chips on devices like phones are doing on a nanosecond-to-nanosecond basis. The thermal and energy management is utter voodoo. They're allocating work to different parts of the chip calculating the time it will take for the last hotspot to drop close enough to thermal equilibrium to be used again without straight up destroying the circuits, dancing activity all around the chip just to avoid frying it. To them layer on top of that 'well you have to do it in a way that emits not a single bit of useful information in any form, thermal, radio, energy, etc'... someone somewhere who is very smart is having a very, very bad day.
- mjevans 9y ago
  It might be a better approach to have executing code signal if a segment is a security-critical section or not. In that way a performance hit might be taken while doing work in a properly secure way but the rest of the time things could be run in a looser manor. Taking that concept further, it might be worth it to have an 'edgy' state as well, where the results aren't super critical but merely nice to have (EG for software video decoding).
- wmf 9y ago
  This particular attack isn't that bad. It relies on putting the VRM into "illegal" configurations (overclocking/undervolting) thus it can be fixed by preventing such configurations in hardware.

otakucode 9y ago

Yeah, this is just 'wow' level work. And it's going to be a NIGHTMARE to fix. I don't think most people realize how much of a ballet it is that chips on devices like phones are doing on a nanosecond-to-nanosecond basis. The thermal and energy management is utter voodoo. They're allocating work to different parts of the chip calculating the time it will take for the last hotspot to drop close enough to thermal equilibrium to be used again without straight up destroying the circuits, dancing activity all around the chip just to avoid frying it. To them layer on top of that 'well you have to do it in a way that emits not a single bit of useful information in any form, thermal, radio, energy, etc'... someone somewhere who is very smart is having a very, very bad day.

mjevans 9y ago
It might be a better approach to have executing code signal if a segment is a security-critical section or not. In that way a performance hit might be taken while doing work in a properly secure way but the rest of the time things could be run in a looser manor. Taking that concept further, it might be worth it to have an 'edgy' state as well, where the results aren't super critical but merely nice to have (EG for software video decoding).
wmf 9y ago
This particular attack isn't that bad. It relies on putting the VRM into "illegal" configurations (overclocking/undervolting) thus it can be fixed by preventing such configurations in hardware.