4 ms·
> If this vulnerability poses a risk to your environment, the first line of defense is the firewalls and security tools that most organizations already have in
by pokoleo 9y ago
> If this vulnerability poses a risk to your environment, the first line of defense is the firewalls and security tools that most organizations already have in place.
How would firewalls mitigate these attacks?
- lgessler 9y agoI think they're imagining situations where an attacker could gain user-level access to a machine that normally wouldn't be accessible to them at all, e.g. a web server with a weak SSH login.
- mtkd 9y agoAS/400 attacks are a whole next level of interest after first wave of Spectre on Intel/AMD etc. This is a much bigger can of worms than any vendor is admitting to right now. Those documented Spectre attacks were crafted by a handful of researchers - the world knows about the class of attack now - it'll be months or years before mitigation is fully understood - if mitigation is even possible. You can guarantee there are a lot more people are looking to exploit than fix right now.
- dogma1138 9y agoA walled garden might not be perfect security but it is still some security. If you don’t run unvetted code on your system and it’s not directly accessible over the network you limit your attack surface considerably. Limiting the attack surface is also why browser mitigation against SPECTRE are worthwhile.
- InclinedPlane 9y agoThe only way to exploit these vulnerabilities is to run code on target machines. If that's not possible then the vulnerability is irrelevant. Using firewalls to keep attackers away from your vulnerable machines is a viable strategy in this case.
- paulie_a 9y ago>if it's not possible to run code We are doomed
- ams6110 9y agoConventional thinking is that if a malicious user can run code on your system, you've lost. In that sense, this is just another local exploit, of which there are many.
- InclinedPlane 9y agoThis includes fully sandboxed code, however, which is an important distinction. The fact that a driveby javascript exploit could potentially result in leaking every important secret from your system (logins, encryption keys, what-have-you) is why people are taking this so seriously.
- petecox 9y agoAlgorithmically is it possible to pass only 'safe' interpreted code to the CPU? The majority of Javacript engines (Chakra, V8, Spidemonkey and JavasciptCore) are under a security-auditable FOSS license. Browsers claiming Spectre/Meltdown immunity would be in the next release notes, surely. I'm not discounting that CPUs should operate correctly into the future but the current sandboxes would seem to rely on whims of a CPU's microcode. And the question for browser makers is whether to trust them.
- gruez 9y ago>Algorithmically is it possible to pass only 'safe' interpreted code to the CPU? in other words, the halting problem?
- amock 9y agoIt's not the halting problem because you can have false positives. If the code can't be proven safe it is rejected.
- kazagistar 9y agoIts not about algorithms. The issue is mentioned in the paper: even if the cache-based side channels are stopped (lets say, by manually clearing any cached memory as soon as its accessed, reducing performance to 0.1% of what it is now) there are other potential side channels like through limited CPU resources. A lot of the "fixes" might just be mitigations, that don't solve the problem entirely, but make it take much longer. Maybe you can cover up enough holes, and make the timers available poor enough that it takes a few hours or days to read a single byte. In other words, mitigations to make things less simple.
- cheerioty 9y agoThat's a pretty misleading statement indeed.