6 ms·

"potentially compromising security even though a system is operating exactly as it is designed to" Sounds like a bug to me. The PR team must have had fun tryi

"potentially compromising security even though a system is operating exactly as it is designed to" Sounds like a bug to me. The PR team must have had fun trying to find a way to downplay this one...

x14 9y ago
Or NSA had them do this intentionally, and thus, its not a bug :)
- seppin 9y ago
  I promise you NSA's machines run on Intel chips too
  - pritambaral 9y ago
    Yes, but then again, they could also be running with mitigations, like the HAP bit for the ME.
- blattimwind 9y ago
  On an "how impractical is this CPU bug as a backdoor"-scale this one is so far off the charts it already left the building.
  - beamatronic 9y ago
    Does that mean we don't need to rush to patch it?
    - pritambaral 9y ago
      Ignore parent, patch all systems as quickly and orderly as you can.
    - blattimwind 9y ago
      I replied to a comment saying "Or NSA had them do this intentionally"; my comment is not about whether this is a vulnerability, or whether exploitation is viable (it absolutely is), but rather about whether this is a viable backdoor.
  - jandrese 9y ago
    The example I saw didn't seem that impractical. A malicious process allocates a 256 member array. Then it creates a conditional where the speculatively executed part writes a byte at offset array + kernel_memory_value. The speculative branch is executed but then backed out, but the byte in the array was touched so it is in cache now. Then the malicious process reads all of the members of the array and looks for one that returns much faster than expected (is in cache) and they know the value of that byte. Rinse and repeat to read the rest of the kernel memory. It's not going to give you MB/s of throughput, but it's plenty fast to read some key material or process tables or anything like that. It's a very impressive attack. My hat is off to whomever thought it up.
    - samat 9y ago
      This will give you only memory addresses of the data in question, right?
      - jandrese 9y ago
        No it gets you the contents. The crux is: array[value_of_kernel_memory_byte] = 1; So it speculatively indexes into the array by the value stored at that memory address and writes the byte. Then to figure out what the value is you just have to see which element in the array is cached.
        MertsA 9y ago
        To elaborate on this, the write to the array isn't what's being read here. array[value_of_kernel_memory_byte] = 1; This assignment gets rolled back like it's supposed to. It's when reading the array after the rollback that the exploit measures that a read to array[value_of_kernel_memory_byte] is faster than the rest because that index is already in the cache.
    - aseipp 9y ago
      I didn't read it as whether whether the attack is impractical (because it is clearly quite practical) -- the parent was questioning whether it's practical (or not) that such an attack would be "planted" as a backdoor by an agency like the NSA. The attack comes off as quite impractical for something like a plant (sensitive to e.g. compiler output, requires locally executing code to snoop is already a red flag, and the 'bug' enabling this has really been considered a feature of every mainstream CPU for like 15 years, and not considered by many to be any kind of attack vector.) Or maybe the idea is speculative execution itself was a dream of the NSA that was Inception-planted into the brains of CPU designers in the 90s; who knows what the theory-of-the-hour is regarding 3-letter-agencies and their capabilities. Ultimately I think what we're really learning is that guarding against things like microarchitectural attacks on contemporary superscalar, OoO CPUs is going to be an uphill battle that we didn't ever think of due to incidental complexity (among other reasons), and will serve as a new class of attacks. Who knows how long this bug class will exist; we've killed some. What's also likely is that, like most security failures in the industry, this is a result of various things like basic lack of forethought/ill considered design, as opposed to plants (3 letter agencies aren't responsible for the vast majority of security failures you see, it's simple mistakes). But peddling conspiracy theories involving them gets you upvotes, so, you know...
debt 9y ago
Ironically, a chip company, whom deals in ones and zeros all day long, committed a very serious logical fallacy: appealing to the common practice. One way to interpret the statement is that the chip design which they utilized is widely available and understood by everyone in the chip community to be good chip design, thus we aren't at fault, because everyone is doing it. To reiterate those types of arguments are a very serious logical fallacy and unsound argument called appealing to common practice. They should fire their PR team.
- qubex 9y ago
  This is not by or for technologists, it is by PR folks for stock-market analysts. Far from being at risk of being fired their whole PR department is probably swelled by ranks of excruciatingly expensive corporate emergency consultants and experts paid precisely to output this kind of menial drivel.
- CamperBob2 9y ago
  To reiterate those types of arguments are a very serious logical fallacy and unsound argument called appealing to common practice. How were they supposed to avoid an exploit that no one would discover for years? And exactly how is "appeal to common practice" a fallacious or unsound argument? Exactly how much performance -- meaning, how much market share -- is Intel supposed to sacrifice to avoid the possibility of introducing unforeseen bugs?
  - debt 9y ago
    People did discover it early on as it's inherent in the design of the chips, it just seemed unlikely at the time. Now Intel has to deal with a huge potential liability if something bad happens because of it. It was just bad business. Also, appealing to common practice doesn't make logical sense. Here: https://en.wikipedia.org/wiki/Appeal_to_tradition https://en.wikipedia.org/wiki/Appeal_to_tradition
    - CamperBob2 9y ago
      Also, appealing to common practice doesn't make logical sense. It is hazardous to apply logical arguments blindly in illogical contexts, such as competitive markets. Again: mitigating all possible bugs isn't free. Exactly how much effort and expense is worthwhile, and how do you know beforehand?

"potentially compromising security even though a system is operating exactly as it is designed to" Sounds like a bug to me. The PR team must have had fun trying to find a way to downplay this one...

x14 9y ago

Or NSA had them do this intentionally, and thus, its not a bug :)

seppin 9y ago
I promise you NSA's machines run on Intel chips too
- pritambaral 9y ago
  Yes, but then again, they could also be running with mitigations, like the HAP bit for the ME.
blattimwind 9y ago
On an "how impractical is this CPU bug as a backdoor"-scale this one is so far off the charts it already left the building.
- beamatronic 9y ago
  Does that mean we don't need to rush to patch it?
  - pritambaral 9y ago
    Ignore parent, patch all systems as quickly and orderly as you can.
  - blattimwind 9y ago
    I replied to a comment saying "Or NSA had them do this intentionally"; my comment is not about whether this is a vulnerability, or whether exploitation is viable (it absolutely is), but rather about whether this is a viable backdoor.
- jandrese 9y ago
  The example I saw didn't seem that impractical. A malicious process allocates a 256 member array. Then it creates a conditional where the speculatively executed part writes a byte at offset array + kernel_memory_value. The speculative branch is executed but then backed out, but the byte in the array was touched so it is in cache now. Then the malicious process reads all of the members of the array and looks for one that returns much faster than expected (is in cache) and they know the value of that byte. Rinse and repeat to read the rest of the kernel memory. It's not going to give you MB/s of throughput, but it's plenty fast to read some key material or process tables or anything like that. It's a very impressive attack. My hat is off to whomever thought it up.
  - samat 9y ago
    This will give you only memory addresses of the data in question, right?
    - jandrese 9y ago
      No it gets you the contents. The crux is: array[value_of_kernel_memory_byte] = 1; So it speculatively indexes into the array by the value stored at that memory address and writes the byte. Then to figure out what the value is you just have to see which element in the array is cached.
      - MertsA 9y ago
        To elaborate on this, the write to the array isn't what's being read here. array[value_of_kernel_memory_byte] = 1; This assignment gets rolled back like it's supposed to. It's when reading the array after the rollback that the exploit measures that a read to array[value_of_kernel_memory_byte] is faster than the rest because that index is already in the cache.
  - aseipp 9y ago
    I didn't read it as whether whether the attack is impractical (because it is clearly quite practical) -- the parent was questioning whether it's practical (or not) that such an attack would be "planted" as a backdoor by an agency like the NSA. The attack comes off as quite impractical for something like a plant (sensitive to e.g. compiler output, requires locally executing code to snoop is already a red flag, and the 'bug' enabling this has really been considered a feature of every mainstream CPU for like 15 years, and not considered by many to be any kind of attack vector.) Or maybe the idea is speculative execution itself was a dream of the NSA that was Inception-planted into the brains of CPU designers in the 90s; who knows what the theory-of-the-hour is regarding 3-letter-agencies and their capabilities. Ultimately I think what we're really learning is that guarding against things like microarchitectural attacks on contemporary superscalar, OoO CPUs is going to be an uphill battle that we didn't ever think of due to incidental complexity (among other reasons), and will serve as a new class of attacks. Who knows how long this bug class will exist; we've killed some. What's also likely is that, like most security failures in the industry, this is a result of various things like basic lack of forethought/ill considered design, as opposed to plants (3 letter agencies aren't responsible for the vast majority of security failures you see, it's simple mistakes). But peddling conspiracy theories involving them gets you upvotes, so, you know...

debt 9y ago

Ironically, a chip company, whom deals in ones and zeros all day long, committed a very serious logical fallacy: appealing to the common practice. One way to interpret the statement is that the chip design which they utilized is widely available and understood by everyone in the chip community to be good chip design, thus we aren't at fault, because everyone is doing it. To reiterate those types of arguments are a very serious logical fallacy and unsound argument called appealing to common practice. They should fire their PR team.

qubex 9y ago
This is not by or for technologists, it is by PR folks for stock-market analysts. Far from being at risk of being fired their whole PR department is probably swelled by ranks of excruciatingly expensive corporate emergency consultants and experts paid precisely to output this kind of menial drivel.
CamperBob2 9y ago
To reiterate those types of arguments are a very serious logical fallacy and unsound argument called appealing to common practice. How were they supposed to avoid an exploit that no one would discover for years? And exactly how is "appeal to common practice" a fallacious or unsound argument? Exactly how much performance -- meaning, how much market share -- is Intel supposed to sacrifice to avoid the possibility of introducing unforeseen bugs?
- debt 9y ago
  People did discover it early on as it's inherent in the design of the chips, it just seemed unlikely at the time. Now Intel has to deal with a huge potential liability if something bad happens because of it. It was just bad business. Also, appealing to common practice doesn't make logical sense. Here: https://en.wikipedia.org/wiki/Appeal_to_tradition https://en.wikipedia.org/wiki/Appeal_to_tradition
  - CamperBob2 9y ago
    Also, appealing to common practice doesn't make logical sense. It is hazardous to apply logical arguments blindly in illogical contexts, such as competitive markets. Again: mitigating all possible bugs isn't free. Exactly how much effort and expense is worthwhile, and how do you know beforehand?