5 ms·

How was this bug independently discovered by three research teams (Graz University of Technology, Google's Project Zero, Cyberus Technology)? Was it known befor

How was this bug independently discovered by three research teams (Graz University of Technology, Google's Project Zero, Cyberus Technology)? Was it known beforehand that such an attack or a similar one could be possible in theory such that all teams came up the same idea?

exhilaration 9y ago
The article suggests that all the research teams were inspired by one source: The team quickly got in touch with Intel and learned that other researchers - inspired in part by Fogh’s blog - had made similar discoveries.
- tischler 9y ago
  This is the blog article: https://cyber.wtf/2017/07/28/negative-result-reading-kernel-memory-from-user-mode/ https://cyber.wtf/2017/07/28/negative-result-reading-kernel-...
  - oh-kumudo 9y ago
    But this blog is written in 07/28 last year, Google reports this bug back in 06/01, right?
    - DannyBee 9y ago
      Yes. The timeline mentioned is the timeline for others, not Google.
Relys 9y ago
Backstory: https://twitter.com/tehjh/status/948737135007424512 https://twitter.com/tehjh/status/948737135007424512 Original paper (which I actually read when it first came out earlier this year): http://www.cs.binghamton.edu/~dima/micro16.pdf http://www.cs.binghamton.edu/~dima/micro16.pdf First PoC for leaking ASLR based on timing side-channel attack: https://github.com/felixwilhelm/mario_baslr https://github.com/felixwilhelm/mario_baslr
fjarlq 9y ago
CPU side-channel attacks have been an active area of research for years. Here's an incomplete list of papers. "by 2016 it got crazy so this is nowhere near complete" https://twitter.com/csirac2/status/948575368956411904 https://twitter.com/csirac2/status/948575368956411904 csirac2's list on reddit: https://www.reddit.com/r/securityengineering/comments/7o2uzy/a_collection_of_links_to_pdfs_of_papers_on/ https://www.reddit.com/r/securityengineering/comments/7o2uzy...
taneq 9y ago
As others have said, the groundwork was already in place and it was an active topic of research. On top of that, responsible disclosure practices mean that other teams don't know when the first team makes their breakthrough, since nothing is published at that stage, so they have the opportunity to independently make the discovery.

exhilaration 9y ago

The article suggests that all the research teams were inspired by one source: The team quickly got in touch with Intel and learned that other researchers - inspired in part by Fogh’s blog - had made similar discoveries.

tischler 9y ago
This is the blog article: https://cyber.wtf/2017/07/28/negative-result-reading-kernel-memory-from-user-mode/ https://cyber.wtf/2017/07/28/negative-result-reading-kernel-...
- oh-kumudo 9y ago
  But this blog is written in 07/28 last year, Google reports this bug back in 06/01, right?
  - DannyBee 9y ago
    Yes. The timeline mentioned is the timeline for others, not Google.

Relys 9y ago

Backstory: https://twitter.com/tehjh/status/948737135007424512 https://twitter.com/tehjh/status/948737135007424512 Original paper (which I actually read when it first came out earlier this year): http://www.cs.binghamton.edu/~dima/micro16.pdf http://www.cs.binghamton.edu/~dima/micro16.pdf First PoC for leaking ASLR based on timing side-channel attack: https://github.com/felixwilhelm/mario_baslr https://github.com/felixwilhelm/mario_baslr

fjarlq 9y ago

CPU side-channel attacks have been an active area of research for years. Here's an incomplete list of papers. "by 2016 it got crazy so this is nowhere near complete" https://twitter.com/csirac2/status/948575368956411904 https://twitter.com/csirac2/status/948575368956411904 csirac2's list on reddit: https://www.reddit.com/r/securityengineering/comments/7o2uzy/a_collection_of_links_to_pdfs_of_papers_on/ https://www.reddit.com/r/securityengineering/comments/7o2uzy...

taneq 9y ago

As others have said, the groundwork was already in place and it was an active topic of research. On top of that, responsible disclosure practices mean that other teams don't know when the first team makes their breakthrough, since nothing is published at that stage, so they have the opportunity to independently make the discovery.