10 ms·

Would this entire Meltdown/Spectre thing count as the biggest mess-up of computing history? When yesterday the PoC repo was posted here, the spy.mp4 demo video

by gkya 9y ago

Would this entire Meltdown/Spectre thing count as the biggest mess-up of computing history? When yesterday the PoC repo was posted here, the spy.mp4 demo video gave me some chills. And now I can't update my OS before making an installation USB because Canonical can't just follow Linus' releases. Thanks.

aaomidi 9y ago
Link to the demo?
- elihu 9y ago
  from https://github.com/IAIK/meltdown/ https://github.com/IAIK/meltdown/: https://cdn.rawgit.com/IAIK/meltdown/master/videos/spy.mp4 https://cdn.rawgit.com/IAIK/meltdown/master/videos/spy.mp4
  - bringtheaction 9y ago
    YouTube mirror for mobile users anyone?
    - gregsadetsky 9y ago
      https://www.youtube.com/watch?v=RbHbFkh6eeE https://www.youtube.com/watch?v=RbHbFkh6eeE
bArray 9y ago
>Would this entire Meltdown/Spectre thing count as the biggest mess-up of computing history? When yesterday the PoC repo was posted here, the spy.mp4 demo video gave me some chills. It must be up there amongst the greats, probably with the "halt and catch fire" op code. Normally they just patch this stuff with microcode and never really tell anybody, this time that won't work. I'm not entirely convinced it was a mistake at all (dons tin foil hat), Intel have been making suspicious design decisions to their chips for a well now (think this, Intel Me, hidden instructions, etc). It seems clear to me that this security by obscurity approach is quite frankly crap. >And now I can't update my OS before making an installation USB because Canonical can't just follow Linus' releases. Thanks. Linus' releases need some sort of buffering before they can be considered stable, often distributions will apply their own patches on top. Also consider the scenario where Linus releases a bad kernel and no testing has been performed before rolling out to all Linux users.
- throwawayfinal 9y ago
  I think it's absolutely unreasonable to imply that this was intentional. Besides the massive amount of complexity these systems have, there are plenty of "legitimate" places to hide backdoors, instead of in a performance architecture decision. Keep in mind that whatever "evil agencies" would have asked for this would most likely find themselves vulnerable, and nobody would sign off on. I do agree, however, the "security by obscurity approach is quite frankly crap". The fact that even large corporations (not the big 5) can't even get away from ME speaks volumes about why this is a bad idea. Facebook isn't the only company with important data.
  - mehrdadn 9y ago
    > I think it's absolutely unreasonable to imply that this was intentional. Amen. It blows my mind that some people think clever techniques like speculative or out-of-order execution must've somehow how nefarious intentions behind them. Come on HN...
  - galvin 9y ago
    Adding a backdoor seems unreasonable but they may have chosen performance over security. Even if this individual bug wasn't intentional they are responsible for setting their priorities.
    - Filligree 9y ago
      There are CPUs available which choose security over performance. They aren't made by Intel, but you can buy them, and they're even cheaper. Oh, you don't want to do that?
  - alphonsegaston 9y ago
    Well, I read somewhere the other day that this form of error/attack was conceived of in the academic literature back in 1992. I won’t believe it’s intentional without evidence in that direction, but this is conceivably the kind of obscure/complex attack you’d expect of a state actor.
brokenmachine 9y ago
I watched that spy demo. How does it know what memory location contains the password being typed?
- KallDrexx 9y ago
  I'm assuming if you know either common byte patterns or string patterns you might be able to figure out where the password string is being allocated and watch that area of memory for changes.
  - brokenmachine 9y ago
    Not sure if Meltdown is the same, but I read that Spectre can recover memory at about 10kb/sec. So it wouldn't be very efficient to scan the entire memory for a known pattern. I suppose if there was an exploit targeted at a specific program, it would be possible to work out what location the secrets are stored in?
    - monk_e_boy 9y ago
      I leave my machine on for weeks at a time. If something was scanning the memory even if it failed to find the location of my password 99.9% before it is erased eventually it will be lucky and get it.
      - brokenmachine 9y ago
        Good point. I was only thinking about a single run but that makes sense.
    - Zakharov 9y ago
      According to the paper, Meltdown can recover memory at about 500 kb/s
      - hvidgaard 9y ago
        It's still "only" 1.7gb/hour. If programs follow reasonable security practices, it shouldn't be possible to stumble upon secrets in the memory. This underlines the importance of things such as ASLR and not holding your key in memory longer than needed and rotating them as well.
ggm 9y ago
"biggest" by number of affected CPUs? very possibly, yes. the march of time has that effect: there are more cpus potentially and actually affected, worldwide, than at any other time in history. "biggest" by net financial loss to a single entity? I dunno. How much did that failed NSA launch cost the state again?
- Y_Y 9y ago
  > failed NSA launch I didn't hear about that one
  - mbroncano 9y ago
    Maybe this https://www.theverge.com/platform/amp/2018/1/9/16866806/spacex-zuma-mission-failure-northrop-grumman-classified-falcon-9-rocket https://www.theverge.com/platform/amp/2018/1/9/16866806/spac...
    - ygra 9y ago
      To which no government agency is officially attached and the failed thing is more a rumor. SpaceX said that on Falcon 9 side everything worked like it should and NG says they cannot comment on classified payloads. So there's literally no information.
- semi-extrinsic 9y ago
  It's unclear whether it failed or if Northrop Grumman want us to think it failed; since the second stage actually did one full orbit with nominal performance, they might be trying to slip one past us. We'll know in a few weeks time I suppose, every satellite tracking enthusiast will be looking for it.
drb91 9y ago
I think that title is currently held (deserved or not) by null pointers. Tbh it’s not the most meaningful of statements, but it’s food for thought.
- cratermoon 9y ago
  A null pointer doesn't hold a reference, though.
  - drb91 9y ago
    It does if you have something at 0x0. Or, to put it another way, I have no clue to what you're referring--what do references have to do with "The Billion Dollar Mistake"[0]? [0]: https://en.wikipedia.org/wiki/Tony_Hoare#Apologies_and_retractions https://en.wikipedia.org/wiki/Tony_Hoare#Apologies_and_retra... EDIT: my apologies, that joke was actually pretty good.
    - pubby 9y ago
      What modern systems even map memory to 0x0? Doing so breaks the C standard, among other things.
      - drb91 9y ago
        Again, I am unsure how this relates to "The Billion Dollar Mistake" I linked above and was referring to. I am not sure your point. The reason modern systems don't map memory to 0x0 is because NULL pointers exist. It is a reflection of a leaky abstraction equating pointers to references. That leaky abstraction has (or so the argument goes) caused >$1B in software bugs. The other mindset would be "malloc always has to allocate memory or otherwise indicate failure; you cannot cast from a integer to a pointer; you cannot perform arithmetic on a pointer to get a new one; you must demonstrate there are no hanging references when freeing". This is essentially what rust did for safe code. The reason why I indicate so much skepticism is that rust is the first time I've seen the problem solved well in the same problem space as C. Ada has problems of its own. It's more about how small assumptions can have massive economic (and health, and safety, and ethical) consequences. Certainly comparable to a speculative execution bug leaking memory in an unprotected fashion--in both cases the bugs find their way through human error in evaluating enormously complex systems for incorrect assumptions :)
katastic 9y ago
I think Y2K had more practical impact across the business world. There was genuine fear that it could cause an actual apocalypse with all major computerized systems failing, medical machines killing people, banks being affected and all money and debts disappearing overnight. It wasn't that bad, because people took it seriously. But there were still tons of practical systems affected and billions of corporate dollars associated with fixing it. So when you say "biggest mess up" you gotta define specific qualifiers. Because Meltdown/Specter is going to be solved by simply... buying a new CPU. (And retrofitting the old ones). So it consist of mostly a patch. A BIG important patch, granted. But it's still just a patch. But some ATM's aren't going to start spewing money like they did on Y2K.
- gkya 9y ago
  I didn't know Y2K was that big of a deal! I guess I'll have to read a bit more about it, as it seems to be an interesting topic. Thanks!
- tripzilch 9y ago
  I can't find any reports on ATM's spewing money after Y2K, or was that a figure of speech?
eltoozero 9y ago
Link to spy.mp4? Found it: https://www.youtube.com/watch?v=RbHbFkh6eeE https://www.youtube.com/watch?v=RbHbFkh6eeE
topmonk 9y ago
I would think it would be. The strange thing is the markets didn't react at all. They actually went up on January 4th.
- Santosh83 9y ago
  Because this has largely remained theoretical, unlike Maersk or Equifax.
  - DarronWyke 9y ago
    What are you talking about? We've seen working POCs since last week. This isn't "largely theoretical", this is an actively exploitable hole.
    - eric_b 9y ago
      Meh, it's not really very serious in the average case. It's a lot of sky-is-falling rhetoric from the infosec community. Remember Heartbleed and how it was end-of-times bad? Yeah, turned out to be a non-event. Information disclosure bugs like this are difficult to glean useful information from in widely targeted attacks. (Obviously if you have nation states or serious criminal organizations trying to breach you regularly, this is more serious)
      - DarronWyke 9y ago
        You clearly haven't been paying attention or reading about how this works. Heartbleed was touted as being bad by those that didn't read too far into it. You could scrape memory, sure. But it was always random fragments. This lets you make targeted address attacks. Force a process to use that memory space through a NOOP and now you can start scraping at will. Or you can just do an entire memory dump and pull things out in plaintext (like scraping Firefox passwords, which we've seen done already). The only reason this isn't worse is it requires the ability to execute code on the machine. It has high (near absolute) impact, but low-to-moderate on the ease of execution.
rsync 9y ago
"Would this entire Meltdown/Spectre thing count as the biggest mess-up of computing history?" This title is held by autorun.inf which has caused over 20 years of broken, vulnerable behavior and, AFAIK, is still going strong.

by gkya 9y ago

aaomidi 9y ago

Link to the demo?

elihu 9y ago
from https://github.com/IAIK/meltdown/ https://github.com/IAIK/meltdown/: https://cdn.rawgit.com/IAIK/meltdown/master/videos/spy.mp4 https://cdn.rawgit.com/IAIK/meltdown/master/videos/spy.mp4
- bringtheaction 9y ago
  YouTube mirror for mobile users anyone?
  - gregsadetsky 9y ago
    https://www.youtube.com/watch?v=RbHbFkh6eeE https://www.youtube.com/watch?v=RbHbFkh6eeE

bArray 9y ago

>Would this entire Meltdown/Spectre thing count as the biggest mess-up of computing history? When yesterday the PoC repo was posted here, the spy.mp4 demo video gave me some chills. It must be up there amongst the greats, probably with the "halt and catch fire" op code. Normally they just patch this stuff with microcode and never really tell anybody, this time that won't work. I'm not entirely convinced it was a mistake at all (dons tin foil hat), Intel have been making suspicious design decisions to their chips for a well now (think this, Intel Me, hidden instructions, etc). It seems clear to me that this security by obscurity approach is quite frankly crap. >And now I can't update my OS before making an installation USB because Canonical can't just follow Linus' releases. Thanks. Linus' releases need some sort of buffering before they can be considered stable, often distributions will apply their own patches on top. Also consider the scenario where Linus releases a bad kernel and no testing has been performed before rolling out to all Linux users.

throwawayfinal 9y ago
I think it's absolutely unreasonable to imply that this was intentional. Besides the massive amount of complexity these systems have, there are plenty of "legitimate" places to hide backdoors, instead of in a performance architecture decision. Keep in mind that whatever "evil agencies" would have asked for this would most likely find themselves vulnerable, and nobody would sign off on. I do agree, however, the "security by obscurity approach is quite frankly crap". The fact that even large corporations (not the big 5) can't even get away from ME speaks volumes about why this is a bad idea. Facebook isn't the only company with important data.
- mehrdadn 9y ago
  > I think it's absolutely unreasonable to imply that this was intentional. Amen. It blows my mind that some people think clever techniques like speculative or out-of-order execution must've somehow how nefarious intentions behind them. Come on HN...
- galvin 9y ago
  Adding a backdoor seems unreasonable but they may have chosen performance over security. Even if this individual bug wasn't intentional they are responsible for setting their priorities.
  - Filligree 9y ago
    There are CPUs available which choose security over performance. They aren't made by Intel, but you can buy them, and they're even cheaper. Oh, you don't want to do that?
- alphonsegaston 9y ago
  Well, I read somewhere the other day that this form of error/attack was conceived of in the academic literature back in 1992. I won’t believe it’s intentional without evidence in that direction, but this is conceivably the kind of obscure/complex attack you’d expect of a state actor.

brokenmachine 9y ago

I watched that spy demo. How does it know what memory location contains the password being typed?

KallDrexx 9y ago
I'm assuming if you know either common byte patterns or string patterns you might be able to figure out where the password string is being allocated and watch that area of memory for changes.
- brokenmachine 9y ago
  Not sure if Meltdown is the same, but I read that Spectre can recover memory at about 10kb/sec. So it wouldn't be very efficient to scan the entire memory for a known pattern. I suppose if there was an exploit targeted at a specific program, it would be possible to work out what location the secrets are stored in?
  - monk_e_boy 9y ago
    I leave my machine on for weeks at a time. If something was scanning the memory even if it failed to find the location of my password 99.9% before it is erased eventually it will be lucky and get it.
    - brokenmachine 9y ago
      Good point. I was only thinking about a single run but that makes sense.
  - Zakharov 9y ago
    According to the paper, Meltdown can recover memory at about 500 kb/s
    - hvidgaard 9y ago
      It's still "only" 1.7gb/hour. If programs follow reasonable security practices, it shouldn't be possible to stumble upon secrets in the memory. This underlines the importance of things such as ASLR and not holding your key in memory longer than needed and rotating them as well.

ggm 9y ago

"biggest" by number of affected CPUs? very possibly, yes. the march of time has that effect: there are more cpus potentially and actually affected, worldwide, than at any other time in history. "biggest" by net financial loss to a single entity? I dunno. How much did that failed NSA launch cost the state again?

Y_Y 9y ago
> failed NSA launch I didn't hear about that one
- mbroncano 9y ago
  Maybe this https://www.theverge.com/platform/amp/2018/1/9/16866806/spacex-zuma-mission-failure-northrop-grumman-classified-falcon-9-rocket https://www.theverge.com/platform/amp/2018/1/9/16866806/spac...
  - ygra 9y ago
    To which no government agency is officially attached and the failed thing is more a rumor. SpaceX said that on Falcon 9 side everything worked like it should and NG says they cannot comment on classified payloads. So there's literally no information.
semi-extrinsic 9y ago
It's unclear whether it failed or if Northrop Grumman want us to think it failed; since the second stage actually did one full orbit with nominal performance, they might be trying to slip one past us. We'll know in a few weeks time I suppose, every satellite tracking enthusiast will be looking for it.

drb91 9y ago

I think that title is currently held (deserved or not) by null pointers. Tbh it’s not the most meaningful of statements, but it’s food for thought.

cratermoon 9y ago
A null pointer doesn't hold a reference, though.
- drb91 9y ago
  It does if you have something at 0x0. Or, to put it another way, I have no clue to what you're referring--what do references have to do with "The Billion Dollar Mistake"[0]? [0]: https://en.wikipedia.org/wiki/Tony_Hoare#Apologies_and_retractions https://en.wikipedia.org/wiki/Tony_Hoare#Apologies_and_retra... EDIT: my apologies, that joke was actually pretty good.
  - pubby 9y ago
    What modern systems even map memory to 0x0? Doing so breaks the C standard, among other things.
    - drb91 9y ago
      Again, I am unsure how this relates to "The Billion Dollar Mistake" I linked above and was referring to. I am not sure your point. The reason modern systems don't map memory to 0x0 is because NULL pointers exist. It is a reflection of a leaky abstraction equating pointers to references. That leaky abstraction has (or so the argument goes) caused >$1B in software bugs. The other mindset would be "malloc always has to allocate memory or otherwise indicate failure; you cannot cast from a integer to a pointer; you cannot perform arithmetic on a pointer to get a new one; you must demonstrate there are no hanging references when freeing". This is essentially what rust did for safe code. The reason why I indicate so much skepticism is that rust is the first time I've seen the problem solved well in the same problem space as C. Ada has problems of its own. It's more about how small assumptions can have massive economic (and health, and safety, and ethical) consequences. Certainly comparable to a speculative execution bug leaking memory in an unprotected fashion--in both cases the bugs find their way through human error in evaluating enormously complex systems for incorrect assumptions :)

katastic 9y ago

I think Y2K had more practical impact across the business world. There was genuine fear that it could cause an actual apocalypse with all major computerized systems failing, medical machines killing people, banks being affected and all money and debts disappearing overnight. It wasn't that bad, because people took it seriously. But there were still tons of practical systems affected and billions of corporate dollars associated with fixing it. So when you say "biggest mess up" you gotta define specific qualifiers. Because Meltdown/Specter is going to be solved by simply... buying a new CPU. (And retrofitting the old ones). So it consist of mostly a patch. A BIG important patch, granted. But it's still just a patch. But some ATM's aren't going to start spewing money like they did on Y2K.

gkya 9y ago
I didn't know Y2K was that big of a deal! I guess I'll have to read a bit more about it, as it seems to be an interesting topic. Thanks!
tripzilch 9y ago
I can't find any reports on ATM's spewing money after Y2K, or was that a figure of speech?

eltoozero 9y ago

Link to spy.mp4? Found it: https://www.youtube.com/watch?v=RbHbFkh6eeE https://www.youtube.com/watch?v=RbHbFkh6eeE

topmonk 9y ago

I would think it would be. The strange thing is the markets didn't react at all. They actually went up on January 4th.

Santosh83 9y ago
Because this has largely remained theoretical, unlike Maersk or Equifax.
- DarronWyke 9y ago
  What are you talking about? We've seen working POCs since last week. This isn't "largely theoretical", this is an actively exploitable hole.
  - eric_b 9y ago
    Meh, it's not really very serious in the average case. It's a lot of sky-is-falling rhetoric from the infosec community. Remember Heartbleed and how it was end-of-times bad? Yeah, turned out to be a non-event. Information disclosure bugs like this are difficult to glean useful information from in widely targeted attacks. (Obviously if you have nation states or serious criminal organizations trying to breach you regularly, this is more serious)
    - DarronWyke 9y ago
      You clearly haven't been paying attention or reading about how this works. Heartbleed was touted as being bad by those that didn't read too far into it. You could scrape memory, sure. But it was always random fragments. This lets you make targeted address attacks. Force a process to use that memory space through a NOOP and now you can start scraping at will. Or you can just do an entire memory dump and pull things out in plaintext (like scraping Firefox passwords, which we've seen done already). The only reason this isn't worse is it requires the ability to execute code on the machine. It has high (near absolute) impact, but low-to-moderate on the ease of execution.

rsync 9y ago

"Would this entire Meltdown/Spectre thing count as the biggest mess-up of computing history?" This title is held by autorun.inf which has caused over 20 years of broken, vulnerable behavior and, AFAIK, is still going strong.