7 ms·

CPUs have been vulnerable to this attack since 1995. How did it collectively take us 22 years to figure this out? I know it's a highly esoteric complex attack,

by js2 9y ago

CPUs have been vulnerable to this attack since 1995. How did it collectively take us 22 years to figure this out? I know it's a highly esoteric complex attack, but there's no shortage of clever hackers in the world.

tzahola 9y ago
- we didn't have browsers compiling JavaScript into machine code - we didn't have hyperconverged cloud infrastructures running arbitrary entities' code next to each other
- ashleyn 9y ago
  Sounds like it's time for me to give up on the so-called "modern web" and install noscript.
  - yorwba 9y ago
    You can have both "modern web" and block most JavaScript. You just need to keep adding scripts to the whitelist until sites you trust work again. It's a bit arduous at first, but possible to get used to once everything you visit daily has been added.
    - meepmorp 9y ago
      Unless, of course, the site you trust is hosted in a shared hosting VM which is also vulnerable to spectre or meltdown. In which case, you can’t trust the scripts.
      - XR0CSWV3h3kZWg 9y ago
        spectre can read, not write.
        dtparr 9y ago
        If it can read the right data (private keys, etc.), then it can write whatever it wants.
        anfilt 9y ago
        What if I read the sites TLS/SSL keys? I could MITM the connection and inject JS to do more malcious thing. Or even easier get the ssh key for the VM. Then do what ever I want.
        meepmorp 9y ago
        If I can read arbitrary data, what’s stopping me from reading the credentials I need to write data?
- jzl 9y ago
  Great answer. The web issue is easier to mitigate if not fix completely since there is already a massive infrastructure for widespread, rapid browser updates, and crippling Javascript to eliminate attack vectors such as high-resolution timers is completely acceptable. The cloud/vm infrastructure is a massive problem though. It is 100% required that VMs be fully isolated. The entire infrastructure breaks down if they aren't.
jcranmer 9y ago
It's sort of been well-known that speculative execution opens up the possibility of side-channel attacks for quite some time. Hell, it's long-known that SMT (e.g., HyperThreading) can leak keys in a not-really-fixable way. What's new and surprising is the power of these side-channel attacks--you can use these, reliably, to exfiltrate arbitrary memory, including across privilege modes in some cases (apparently, some ARM cores are affected by the latter vulnerability, in addition to Intel).
Danihan 9y ago
>there's no shortage of clever hackers in the world. Are you sure?
pixl97 9y ago
Honestly we knew about this in the 70s. Mainframe/time share systems had lots of protections against attacks like this. The problem is mainstream computing when cheap/single user and attempted to build a multi user/untrusted code execution environment on top of it. Now it's come back to bite us in the ass.

by js2 9y ago

tzahola 9y ago

- we didn't have browsers compiling JavaScript into machine code - we didn't have hyperconverged cloud infrastructures running arbitrary entities' code next to each other

ashleyn 9y ago
Sounds like it's time for me to give up on the so-called "modern web" and install noscript.
- yorwba 9y ago
  You can have both "modern web" and block most JavaScript. You just need to keep adding scripts to the whitelist until sites you trust work again. It's a bit arduous at first, but possible to get used to once everything you visit daily has been added.
  - meepmorp 9y ago
    Unless, of course, the site you trust is hosted in a shared hosting VM which is also vulnerable to spectre or meltdown. In which case, you can’t trust the scripts.
    - XR0CSWV3h3kZWg 9y ago
      spectre can read, not write.
      - dtparr 9y ago
        If it can read the right data (private keys, etc.), then it can write whatever it wants.
      - anfilt 9y ago
        What if I read the sites TLS/SSL keys? I could MITM the connection and inject JS to do more malcious thing. Or even easier get the ssh key for the VM. Then do what ever I want.
      - meepmorp 9y ago
        If I can read arbitrary data, what’s stopping me from reading the credentials I need to write data?
jzl 9y ago
Great answer. The web issue is easier to mitigate if not fix completely since there is already a massive infrastructure for widespread, rapid browser updates, and crippling Javascript to eliminate attack vectors such as high-resolution timers is completely acceptable. The cloud/vm infrastructure is a massive problem though. It is 100% required that VMs be fully isolated. The entire infrastructure breaks down if they aren't.

jcranmer 9y ago

It's sort of been well-known that speculative execution opens up the possibility of side-channel attacks for quite some time. Hell, it's long-known that SMT (e.g., HyperThreading) can leak keys in a not-really-fixable way. What's new and surprising is the power of these side-channel attacks--you can use these, reliably, to exfiltrate arbitrary memory, including across privilege modes in some cases (apparently, some ARM cores are affected by the latter vulnerability, in addition to Intel).

Danihan 9y ago

>there's no shortage of clever hackers in the world. Are you sure?

pixl97 9y ago

Honestly we knew about this in the 70s. Mainframe/time share systems had lots of protections against attacks like this. The problem is mainstream computing when cheap/single user and attempted to build a multi user/untrusted code execution environment on top of it. Now it's come back to bite us in the ass.