5 ms·

You know it's a bad one when Project Zero allows more than its usual 90-day deadline...

by cesarb 9y ago

blattimwind 9y ago
"Which systems are affected?" – "All systems." – "Come again?"
- Ajedi32 9y ago
  From the FAQ on spectreattack.com: > Q: Am I affected by the bug? > A: Most certainly, yes. Scary.
- Symmetry 9y ago
  If you're using an in order processor, a Nexus 9 tablet say, then you should be safe.
  - Symmetry 9y ago
    I wasn't thinking straight last night. Basically all in order application processors use speculative execution.
    - blattimwind 9y ago
      Even a low-power core like a Cortex-M7 can do some speculative execution through its branch predictor. Though of course a M7 isn't running VMs, and probably isn't running any kind of attacker-controlled code (scripting included - its there, but rare), so many of the vectors aren't present.
jsmthrowaway 9y ago
Then front-runs the negotiated timeline anyway, catching projects like Xen off guard (it seems like)[0]. Will be interested to read the postmortem of the entire process from start to finish, and Xen is promising one from their perspective. I'd be especially interested to understand whether public intel was concrete enough to rush this out the door, because it didn't seem like it was, but I probably missed something. [0]: https://xenbits.xen.org/xsa/advisory-254.html https://xenbits.xen.org/xsa/advisory-254.html
- londons_explore 9y ago
  I reimplemented variant 3 based solely on clues from twitter posts yesterday. I am by no means a computer security guru - I just did a CPU architecture course at uni and figured I'd cowboy up an implementation. It worked nearly first time, and can read both kernel and userspace pages from userspace by fooling the branch predictor into going down the wrong path, and relying on the permission checks to be slower than the data reads from a virtually addressed cache. It can only access stuff already cached though, so you can't do a full memory dump with it.
- baq 9y ago
  speculation was apparently hitting very close to home allowing attackers with resources (think nation states) to start developing their own tooling. at least this early announcement allows people with sensitive data to quickly move to dedicated instances. edit: well it didn't take a nation state after all: https://twitter.com/brainsmoke/status/948561799875502080 https://twitter.com/brainsmoke/status/948561799875502080 - given that, you can be sure that everybody who counts is frantically launching these on your clouds gathering whatever they can.

You know it's a bad one when Project Zero allows more than its usual 90-day deadline...

by cesarb 9y ago

You know it's a bad one when Project Zero allows more than its usual 90-day deadline...

blattimwind 9y ago

"Which systems are affected?" – "All systems." – "Come again?"

Ajedi32 9y ago
From the FAQ on spectreattack.com: > Q: Am I affected by the bug? > A: Most certainly, yes. Scary.
Symmetry 9y ago
If you're using an in order processor, a Nexus 9 tablet say, then you should be safe.
- Symmetry 9y ago
  I wasn't thinking straight last night. Basically all in order application processors use speculative execution.
  - blattimwind 9y ago
    Even a low-power core like a Cortex-M7 can do some speculative execution through its branch predictor. Though of course a M7 isn't running VMs, and probably isn't running any kind of attacker-controlled code (scripting included - its there, but rare), so many of the vectors aren't present.

jsmthrowaway 9y ago

Then front-runs the negotiated timeline anyway, catching projects like Xen off guard (it seems like)[0]. Will be interested to read the postmortem of the entire process from start to finish, and Xen is promising one from their perspective. I'd be especially interested to understand whether public intel was concrete enough to rush this out the door, because it didn't seem like it was, but I probably missed something. [0]: https://xenbits.xen.org/xsa/advisory-254.html https://xenbits.xen.org/xsa/advisory-254.html

londons_explore 9y ago
I reimplemented variant 3 based solely on clues from twitter posts yesterday. I am by no means a computer security guru - I just did a CPU architecture course at uni and figured I'd cowboy up an implementation. It worked nearly first time, and can read both kernel and userspace pages from userspace by fooling the branch predictor into going down the wrong path, and relying on the permission checks to be slower than the data reads from a virtually addressed cache. It can only access stuff already cached though, so you can't do a full memory dump with it.
baq 9y ago
speculation was apparently hitting very close to home allowing attackers with resources (think nation states) to start developing their own tooling. at least this early announcement allows people with sensitive data to quickly move to dedicated instances. edit: well it didn't take a nation state after all: https://twitter.com/brainsmoke/status/948561799875502080 https://twitter.com/brainsmoke/status/948561799875502080 - given that, you can be sure that everybody who counts is frantically launching these on your clouds gathering whatever they can.