6 ms·

As a consumer, will I have the ability to avoid using or disable the IBRS patches? To be honest I don't really care about some theoretical attack that almost c

As a consumer, will I have the ability to avoid using or disable the IBRS patches? To be honest I don't really care about some theoretical attack that almost certainly won't be used to target me, and if they do, they can have it. I'd rather have the performance.

br1 9y ago
If everybody else is patched, bad buys don't have much incentive to write attacks. It's herd immunity. You have chosen no to vaccinate.
- rorosaurus 9y ago
  https://en.wikipedia.org/wiki/Herd_immunity#Free_riding https://en.wikipedia.org/wiki/Herd_immunity#Free_riding
- sandworm101 9y ago
  Except that the smallpox virus doesn't have the brains to team up with a thousand other viruses, create an exploit kit, test your immune system, and then deploy only the one specific tool most likely to bring you down. The immunology metaphor breaks down once we realize that electronic pathogens are deployed not by innocent rats but sentient human vectors.
  - InclinedPlane 9y ago
    Smallpox also doesn't know the difference between Joe Blow and Mark Zuckerberg. Humans have the ability to pick the most valuable targets and concentrate resources on exploiting them.
- morcheeba 9y ago
  respectfully, ha ha. Just because an exploit is old doesn't mean it still doesn't get used. Attacks don't follow the close-quarters-infection that physical viruses do, so it's a bad model to use.
  - MertsA 9y ago
    That's not entirely without precedent. Look at macOS, still comparatively little malware compared to Windows even though macOS has had quite a bit more vulnerabilities in the OS itself compared to Windows.
    - bartread 9y ago
      Care to post some figures along with a citation for that assertion, please?
      - MertsA 9y ago
        Sure. https://www.cvedetails.com/product/156/Apple-Mac-Os-X.html?vendor_id=49 https://www.cvedetails.com/product/156/Apple-Mac-Os-X.html?v... https://www.cvedetails.com/product/32238/Microsoft-Windows-10.html?vendor_id=26 https://www.cvedetails.com/product/32238/Microsoft-Windows-1... https://www.cvedetails.com/product/17153/Microsoft-Windows-7.html?vendor_id=26 https://www.cvedetails.com/product/17153/Microsoft-Windows-7... But everyone here is already thinking about the string of recent macOS vulnerabilities. Even just in the past few months Apple has been hit by a bunch of fairly major vulnerabilities while Windows hasn't been in the news for a while. What bugs me though is that a theres a handful of the Apple vulnerabilities that weren't caused by an implementation error, it was from a flawed design. In particular the most notable example of this would be the API used by system preferences that would let any user create arbitrary files with arbitrary permissions owned as root. Obviously the first choice with that is to create a setUID binary but even if the permissions weren't user provided this should be something that should jump out during the design process as a bad idea. https://truesecdev.wordpress.com/2015/04/09/hidden-backdoor-api-to-root-privileges-in-apple-os-x/ https://truesecdev.wordpress.com/2015/04/09/hidden-backdoor-... As for a comparison of just recent newsworthy macOS vulnerabilities compared to Windows I'll just cite Hacker News as far smarter people than I have commented on this subject to death. I just used the following query and only looked at the links on the first page. https://www.google.com/search?q=site%3Anews.ycombinator.com+macOS+vulnerability https://www.google.com/search?q=site%3Anews.ycombinator.com+... https://www.google.com/search?q=site%3Anews.ycombinator.com+Windows+vulnerability https://www.google.com/search?q=site%3Anews.ycombinator.com+... macOS total karma 2345 https://news.ycombinator.com/item?id=15410953 https://news.ycombinator.com/item?id=15410953 https://news.ycombinator.com/item?id=15807913 https://news.ycombinator.com/item?id=15807913 https://news.ycombinator.com/item?id=15828767 https://news.ycombinator.com/item?id=15828767 https://news.ycombinator.com/item?id=15864637 https://news.ycombinator.com/item?id=15864637 https://news.ycombinator.com/item?id=15804726 https://news.ycombinator.com/item?id=15804726 https://news.ycombinator.com/item?id=16043578 https://news.ycombinator.com/item?id=16043578 Windows total karma 304 https://news.ycombinator.com/item?id=815265 https://news.ycombinator.com/item?id=815265 https://news.ycombinator.com/item?id=2758554 https://news.ycombinator.com/item?id=2758554 https://news.ycombinator.com/item?id=10889728 https://news.ycombinator.com/item?id=10889728 https://news.ycombinator.com/item?id=13577709 https://news.ycombinator.com/item?id=13577709 The macOS results span the last 3 months, the Windows results span the last 8 years. Mac sales only provide about 8% of Apple's revenue which is overwhelmingly dominated by iPhone sales and app store revenue. macOS has become the red headed step child and it's really starting to show.
iooi 9y ago
1. It won't take long for this attack to stop being "theoretical" (assuming it still is). 2. No one has to target you specifically, it's a matter of time until someone uses this attack vector on something everyone has -- a web browser. 3. Once you're owned, you're going to be sharing resources with a couple of bots, so don't be so sure you'll get to keep the performance.
- joosters 9y ago
  Web browsers are potentially easier to protect, as I understand it. You prevent javascript from getting access to high accuracy timers and rate-limit their access to syscalls. If a script is repeatedly calling methods that trigger a syscall thousands of times a second, just slow it down a little and the attack becomes impossible.
  - deleted 9y ago
    [deleted]
  - mort96 9y ago
    Disabling high precision timers isn't a long term solution. There's probably only a matter of time until someone finds a new way to make a high enough precision timer, and even if that wasn't the case, features like SharedArrayBuffer are just too useful to completely disable forever - and there's no easy way to make it impossible to create a high precision timer with a SharedArrayBuffer (just have a web worker which just increments a number in a shared buffer in a loop). Would throttling syscalls really prevent using these syscalls? Surely it would just make the exploits lower to perform? Is there something I've not understood, or is the idea just to throttle syscalls enough to make it infeasably slow? If it's the latter, remember that users might potentially be on a website for half an hour at a time (if they're reading a long article or watching a video), so an attacker (whose code is running on the site, potentially through a compromised ad/tracking platform, or just XSS) would have a lot of time to extract whatever memory they want.
    - wtallis 9y ago
      > and even if that wasn't the case, features like SharedArrayBuffer are just too useful to completely disable forever That's only if you continue to participate in the shared delusion that the WWW can or should be a high-performance applications platform. Those of us who usually browse with JavaScript turned off can get along fine without SharedArrayBuffer or WebGL or WebSockets.
deleted 9y ago
[deleted]
Brybry 9y ago
Spectre (and maybe Meltdown, I'm not sure?) can be done in a browser with javascript. Imagine if a random bad advertisement or injected script on a popular website could silently steal all of your stored session information for other sites.
- wvenable 9y ago
  It requires a lot of CPU so there isn't anything silent about it. If some bad advertisement absolutely kills the tab you're looking at, I hope you'd notice. If you're using a multi-process browser (like Chrome) the impact is pretty minimal. That's not to say it's not bad -- the exploit works remarkably well -- but it's not fast or easy.
  - acqq 9y ago
    Imagine: You open the browser, leave it open on some page and then leave your computer for a few hours or overnight. You can’t notice what a rogue ad did while you were away. Your passwords are maybe gone.
  - LaGrange 9y ago
    Besides the "hiding" strategy (bots hide themselves under the windows clock. It's a wonderful world out there), I'm afraid it's unlikely you'll notice. Reliability of modern consumer software ain't all that great.
frandroid 9y ago
You'll get targeted through a web ad which will then install a BTC miner on your machine, so your performance will be shot anyway.
cesarb 9y ago
Yes, from what I've read on the LKML, the IBRS has to be enabled and disabled by the kernel at the appropriate moments, and there will be a kernel command line flag to disable it (or leave it enabled all the time).
- jlgaddis 9y ago
  > ... there will be a kernel command line flag to disable it ... FYI: pti=off

br1 9y ago

If everybody else is patched, bad buys don't have much incentive to write attacks. It's herd immunity. You have chosen no to vaccinate.

rorosaurus 9y ago
https://en.wikipedia.org/wiki/Herd_immunity#Free_riding https://en.wikipedia.org/wiki/Herd_immunity#Free_riding
sandworm101 9y ago
Except that the smallpox virus doesn't have the brains to team up with a thousand other viruses, create an exploit kit, test your immune system, and then deploy only the one specific tool most likely to bring you down. The immunology metaphor breaks down once we realize that electronic pathogens are deployed not by innocent rats but sentient human vectors.
- InclinedPlane 9y ago
  Smallpox also doesn't know the difference between Joe Blow and Mark Zuckerberg. Humans have the ability to pick the most valuable targets and concentrate resources on exploiting them.
morcheeba 9y ago
respectfully, ha ha. Just because an exploit is old doesn't mean it still doesn't get used. Attacks don't follow the close-quarters-infection that physical viruses do, so it's a bad model to use.
- MertsA 9y ago
  That's not entirely without precedent. Look at macOS, still comparatively little malware compared to Windows even though macOS has had quite a bit more vulnerabilities in the OS itself compared to Windows.
  - bartread 9y ago
    Care to post some figures along with a citation for that assertion, please?
    - MertsA 9y ago
      Sure. https://www.cvedetails.com/product/156/Apple-Mac-Os-X.html?vendor_id=49 https://www.cvedetails.com/product/156/Apple-Mac-Os-X.html?v... https://www.cvedetails.com/product/32238/Microsoft-Windows-10.html?vendor_id=26 https://www.cvedetails.com/product/32238/Microsoft-Windows-1... https://www.cvedetails.com/product/17153/Microsoft-Windows-7.html?vendor_id=26 https://www.cvedetails.com/product/17153/Microsoft-Windows-7... But everyone here is already thinking about the string of recent macOS vulnerabilities. Even just in the past few months Apple has been hit by a bunch of fairly major vulnerabilities while Windows hasn't been in the news for a while. What bugs me though is that a theres a handful of the Apple vulnerabilities that weren't caused by an implementation error, it was from a flawed design. In particular the most notable example of this would be the API used by system preferences that would let any user create arbitrary files with arbitrary permissions owned as root. Obviously the first choice with that is to create a setUID binary but even if the permissions weren't user provided this should be something that should jump out during the design process as a bad idea. https://truesecdev.wordpress.com/2015/04/09/hidden-backdoor-api-to-root-privileges-in-apple-os-x/ https://truesecdev.wordpress.com/2015/04/09/hidden-backdoor-... As for a comparison of just recent newsworthy macOS vulnerabilities compared to Windows I'll just cite Hacker News as far smarter people than I have commented on this subject to death. I just used the following query and only looked at the links on the first page. https://www.google.com/search?q=site%3Anews.ycombinator.com+macOS+vulnerability https://www.google.com/search?q=site%3Anews.ycombinator.com+... https://www.google.com/search?q=site%3Anews.ycombinator.com+Windows+vulnerability https://www.google.com/search?q=site%3Anews.ycombinator.com+... macOS total karma 2345 https://news.ycombinator.com/item?id=15410953 https://news.ycombinator.com/item?id=15410953 https://news.ycombinator.com/item?id=15807913 https://news.ycombinator.com/item?id=15807913 https://news.ycombinator.com/item?id=15828767 https://news.ycombinator.com/item?id=15828767 https://news.ycombinator.com/item?id=15864637 https://news.ycombinator.com/item?id=15864637 https://news.ycombinator.com/item?id=15804726 https://news.ycombinator.com/item?id=15804726 https://news.ycombinator.com/item?id=16043578 https://news.ycombinator.com/item?id=16043578 Windows total karma 304 https://news.ycombinator.com/item?id=815265 https://news.ycombinator.com/item?id=815265 https://news.ycombinator.com/item?id=2758554 https://news.ycombinator.com/item?id=2758554 https://news.ycombinator.com/item?id=10889728 https://news.ycombinator.com/item?id=10889728 https://news.ycombinator.com/item?id=13577709 https://news.ycombinator.com/item?id=13577709 The macOS results span the last 3 months, the Windows results span the last 8 years. Mac sales only provide about 8% of Apple's revenue which is overwhelmingly dominated by iPhone sales and app store revenue. macOS has become the red headed step child and it's really starting to show.

iooi 9y ago

1. It won't take long for this attack to stop being "theoretical" (assuming it still is). 2. No one has to target you specifically, it's a matter of time until someone uses this attack vector on something everyone has -- a web browser. 3. Once you're owned, you're going to be sharing resources with a couple of bots, so don't be so sure you'll get to keep the performance.

joosters 9y ago
Web browsers are potentially easier to protect, as I understand it. You prevent javascript from getting access to high accuracy timers and rate-limit their access to syscalls. If a script is repeatedly calling methods that trigger a syscall thousands of times a second, just slow it down a little and the attack becomes impossible.
- deleted 9y ago
  [deleted]
- mort96 9y ago
  Disabling high precision timers isn't a long term solution. There's probably only a matter of time until someone finds a new way to make a high enough precision timer, and even if that wasn't the case, features like SharedArrayBuffer are just too useful to completely disable forever - and there's no easy way to make it impossible to create a high precision timer with a SharedArrayBuffer (just have a web worker which just increments a number in a shared buffer in a loop). Would throttling syscalls really prevent using these syscalls? Surely it would just make the exploits lower to perform? Is there something I've not understood, or is the idea just to throttle syscalls enough to make it infeasably slow? If it's the latter, remember that users might potentially be on a website for half an hour at a time (if they're reading a long article or watching a video), so an attacker (whose code is running on the site, potentially through a compromised ad/tracking platform, or just XSS) would have a lot of time to extract whatever memory they want.
  - wtallis 9y ago
    > and even if that wasn't the case, features like SharedArrayBuffer are just too useful to completely disable forever That's only if you continue to participate in the shared delusion that the WWW can or should be a high-performance applications platform. Those of us who usually browse with JavaScript turned off can get along fine without SharedArrayBuffer or WebGL or WebSockets.

deleted 9y ago

[deleted]

Brybry 9y ago

Spectre (and maybe Meltdown, I'm not sure?) can be done in a browser with javascript. Imagine if a random bad advertisement or injected script on a popular website could silently steal all of your stored session information for other sites.

wvenable 9y ago
It requires a lot of CPU so there isn't anything silent about it. If some bad advertisement absolutely kills the tab you're looking at, I hope you'd notice. If you're using a multi-process browser (like Chrome) the impact is pretty minimal. That's not to say it's not bad -- the exploit works remarkably well -- but it's not fast or easy.
- acqq 9y ago
  Imagine: You open the browser, leave it open on some page and then leave your computer for a few hours or overnight. You can’t notice what a rogue ad did while you were away. Your passwords are maybe gone.
- LaGrange 9y ago
  Besides the "hiding" strategy (bots hide themselves under the windows clock. It's a wonderful world out there), I'm afraid it's unlikely you'll notice. Reliability of modern consumer software ain't all that great.

frandroid 9y ago

You'll get targeted through a web ad which will then install a BTC miner on your machine, so your performance will be shot anyway.

cesarb 9y ago

Yes, from what I've read on the LKML, the IBRS has to be enabled and disabled by the kernel at the appropriate moments, and there will be a kernel command line flag to disable it (or leave it enabled all the time).

jlgaddis 9y ago
> ... there will be a kernel command line flag to disable it ... FYI: pti=off