9 ms·
‘It Can’t Be True’ – Inside the Semiconductor Industry’s Meltdown
- jedmeyers 9y ago"Last week, his worst fears were proved right when Intel, one of the world’s largest chipmakers, said all modern processors can be attacked by techniques dubbed Meltdown and Spectre". Seems like a sneaky reporting by Bloomberg - has Intel actually said that "all modern processors can be attacked by ... Meltdown"?
- makomk 9y agoThey're basically just regurgitating the sneakiness of Intel's official press release, which just said that all modern processors were affected and it wasn't an Intel-specific problem without clarifying in any way that the most serious problem was Intel-specific.
- dvfjsdhgfv 9y agoThey're just reporting what Intel said, whereas later in the article they clarify the consequences for AMD and ARM in more detail.
- slededit 9y agoNot really a semiconductor issue. I doubt the guys working on analogue ICs are working overtime on this.
- adrianmonk 9y agoIt's Bloomberg. They view things in terms of economic sectors. To them, integrated circuit design and manufacturing is all part of one sector.
- howToLearnSpark 9y agoBloomberg is a technology company
- godelmachine 9y agoWell said. I think that applies to any journalist by extension. Little do they know about the difference between analog and digital.
- thriftwy 9y agoIs it just me who now thinks there should be some gigantic holes in processor security, which were just never stumbled upon before, but now will? Similarly how there was a long and happy life of flash plugin before it was recognized as a massive vulnerability surface?
- kabes 9y agoWell, the article ends with that same thought coming from one of the researchers.
- leoc 9y agoI'm finding it hard to escape the suspicion that Spectre and (to a lesser extent) Meltdown is another failure of expertise on the same rough scale as the run-up to the financial crisis, the decades of bad or poorly-justified dietary advice, and the statistical problems in experimental psychology. On the face of it, it seems obvious that speculation + cache + protected mode was a combination likely ripe for exploitation, but the response seems to have been "nah, it'll be fine, probably"? And even if it for some reason wasn't obvious, it's now clear that it actually was the case. So the academic and industrial and bad-boy "security community" collectively more or less let the CPU manufacturers take a flyer on this for, what, a decade?
- carlmr 9y agoI think this is a pervasive problem in big corporations and government. There are probably a few people that are concerned with security and others that are concerned with performance. They don't talk enough.
- graycat 9y agoSpeculative execution, out of order execution, branch prediction have been in processor designs at least back to the 1980s.
- leoc 9y agoSure. I had Meltdown specifically on the brain when I wrote that, sorry. It hardly needs saying that the preconditions for Spectre-like attacks being around for several decades doesn't make the situation any less embarrassing. (That said, I don't know whether things like eg. increasing pipeline depths only made actual attacks feasible relatively recently.)
- CaliforniaKarl 9y agoI didn't see any mention of weather Linus et al were on the inside of this. The impression I get from the article is that they weren't. But that must be wrong, right?
- nsnick 9y agoHe does live less than 20 miles from Intel. They could have just driven to his house to let him know.
- prewett 9y agoI can imagine Linus Torvalds happily working one bright California afternoon and gets a knock at the door. Two men say they are from Intel and need to discuss a serious bug with him. Wondering what could be so bad that Intel pays him a personal visit, he invites them into the sitting room, gets them some tea/coffee. Then they describe the problem. What I want to know is what happens next? Is Linus (or "Mr. Torvolds" to me) silently shocked? Does he go on a LKML-style rant? Immediately whip out his laptop and code up an exploit just to see if it's actually true? All of them? (Mostly I just want to hear him rant, I love his well-informed, opinionated take-downs of lousy ideas. Although it's probably a toxic environment to work it.)
- abricot 9y agoThe narrative sounds a bit like the story of Chernobyl. Except with less (for now) human suffering.
- golergka 9y ago> Spectre fools the processor into running speculative operations -- ones it wouldn’t normally perform -- and then uses information about how long the hardware takes to retrieve the data to infer the details of that information. After reading several in-depth analysis of this vulnerability and then trying to explain my non-tech friends what this is all is about (disclaimer: I'm just a developer and don't work with assembly, processors or security), I have to admit that it's a pretty awesome executive summary of the issue for a non-technical reader.
- ptaipale 9y agoIt's slightly wrong, proposal for improvement: Spectre fools the processor into running speculative operations -- ones that it usually executes "just in case" and then throws the result away if it is not needed -- and then uses information about how long the hardware takes to retrieve the data to infer the details of that information.
- 3chelon 9y agoHaving read the tech reports myself, the interviewee on the Bloomberg report seemed to be most sensible talking head I've yet seen in the media. While most of the press are shouting that we're all pwned and it's Intel's fault or Apple's fault, or whoever, I'm of the opinion that this is one seriously difficult bug to exploit. The speculative branch predication vulnerability seems to basically depend on finding a specific instruction sequence in the target code and then going to some extraordinary lengths to exploit it via a highly convoluted side-channel. My first thought when I started to appreciate the technical details were that this was a Bletchley Park level of exploit, or "nation state" as the man in the interview said. And whilst it's completely possible that the exploit could be packaged up for script kiddies, it seems to me unlikely that someone with the necessary skills would do that, because the return would be too low. But states spying on each other: that seems a much more likely scenario for this.
- collyw 9y agoI am not an expert in these matters in any way, but most vulnerabilities appear fairly difficult to exploit to me (as an application developer). Isn't it usually the case that someone scripts (difficult parts of) the process and then it is a lot easier to exploit?
- 3chelon 9y agoYes, but my point is I think the exploit would be extremely difficult, and any agent capable of doing it would not be too interested in making it available to anyone else. Perhaps I'm naive, but it feels like the kind of thing government agencies would keep in their own armouries.
- katastic 9y agoExcept many hackers run on reputation, and the hacker that releases an amazing new exploit to the masses of script kiddies, is praised for it. "Difficult" is just another word for "look how much greater I am than the competition when I pwn it."
- 9y ago
- gumby 9y agoHeadline hyperbole. Applications of high end CPU suffer. That AVR-equipped light bulb doesn’t, nor do voltage regulators or DRAMs (though they could suffer if fewer devices are built...which won’t happen)
- katastic 9y agoThat's actually an interesting accidental point. How many embedded CPU's with speculation might be affected? You may say "none" but there are Cortex CPUs embedded into FPGAs (either directly or form of IP cores). What if enterprise routers have them? What if TVs have them? I know many Cortex's aren't affected. The point is, anything that needs a "fast enough" CPU to benefit from OoO scheduling is possibly at risk, right? So while most embedded devices use cheaper, less complex CPUs, there are plenty that don't--as more powerful CPUs (which offer speculation) are becoming cheaper and cheaper. A Raspberry Pi 3 has a Cortex-A53 (because they're cheap). They're luckily not affected, but those CPUs and faster are cheap enough to throw onto a $35 retail price computer. What's running in your $800 internet-connected 4K TV? Per the Pi 3 explaination page: >Examples of out-of-order processors include the Intel Pentium 2 (and most subsequent Intel and AMD x86 processors with the exception of some Atom and Quark devices), and many recent ARM cores, including Cortex-A9, -A15, -A17, and -A57. https://www.raspberrypi.org/blog/why-raspberry-pi-isnt-vulnerable-to-spectre-or-meltdown/ https://www.raspberrypi.org/blog/why-raspberry-pi-isnt-vulne... The A9, 15, 17, and A57 are all affected and used across TONS of devices in the world. They're very popular not just in chip form (as the primary CPU), but also in IP cores (inside an FPGA), as well as "secondary CPU" systems attached to FPGAs or other CPU's. And that's just one brand of one type of CPU. Who knows what else is out there. PowerPCs are in everything. Even your dust-covered Gamecube has out-of-order speculation! Here's a link mentioning that PowerPC CPUs are affected: http://tenfourfox.blogspot.com/2018/01/is-powerpc-susceptible-to-spectre-yep.html http://tenfourfox.blogspot.com/2018/01/is-powerpc-susceptibl... So there goes all your PowerMacs. (And likely the Gamecube and Wii too!)
- klibertp 9y agoThis comment was dead. I have no idea why would it be; if there's something factually incorrect in it it would be better to write what exactly in a comment...
- dandare 9y agoIs this Brian White for real? Host: Who could exploit this vulnerability...? White: Those that have significant resources, for instance, Google... (mentions nation-states much later) Nice FUD there. White: what is important here, there are no known attacks ongoing right now... Nice argument from ignorance there. White: there is a lot of things we don't know but it reinforces two things to me, one is that increasingly the software we are operating is quite secure, coz now we are looking at kernel level problems... Nice false cause fallacy.
- wickawic 9y agoYou should argue the points, not label the fallacies. Would you rather White say “well there’s probably attacks, but no one knows!”? This is just as incorrect as his statement, the problem being that /no one knows./ The FUD is real though.
- zero_intp 9y agoI disagree with you. Labeling fallacies is shorthand for calling them out. When reading PR or news, I prefer to read a quick breakdown of the syllogisms BEFORE I go into technical details.
- ant6n 9y ago> I prefer to read a quick breakdown of the syllogisms Do you have a link for a good one?
- rando444 9y agoArguing logical fallacies is a waste of time and effort. They are things that never should have been said in the first place because they're only made to deflect, detract, or support a nonsensical argument. If you get caught up in trying to defend against these things you've already fallen into their trap.
- pessimizer 9y agoPeople frequently use logical fallacies in good faith, usually because they're falling for one of the many permutations of the law of averages, using associative logic/magical thinking, or just have some axiomatic beliefs that they believe are somehow sinful/wrong to scrutinize due to their religion/loyalty.
- o_nate 9y agoThis article made it easier for me to understand how various independent researchers could have arrived at the same discovery around the same time. It seems like Fogh was informally pushing the idea in private discussions, and then after Horn found the first PoC and notified Intel, other researchers got suspicious by the patches being submitted and put 2 and 2 together.
- ataturk 9y agoHow long have the intelligence agencies known about and been exploiting these defects?
- shock 9y ago> Last week, his worst fears were proved right when Intel, one of the world’s largest chipmakers, said all modern processors can be attacked by techniques dubbed Meltdown and Spectre, exposing crucial data, such as passwords and encryption keys. Intel was extremely lucky that Spectre was discovered at the same time as Meltdown, otherwise Intel would've been standing alone facing the industry.