5 ms·

>Would this entire Meltdown/Spectre thing count as the biggest mess-up of computing history? When yesterday the PoC repo was posted here, the spy.mp4 demo video

by bArray 9y ago

>Would this entire Meltdown/Spectre thing count as the biggest mess-up of computing history? When yesterday the PoC repo was posted here, the spy.mp4 demo video gave me some chills. It must be up there amongst the greats, probably with the "halt and catch fire" op code. Normally they just patch this stuff with microcode and never really tell anybody, this time that won't work. I'm not entirely convinced it was a mistake at all (dons tin foil hat), Intel have been making suspicious design decisions to their chips for a well now (think this, Intel Me, hidden instructions, etc). It seems clear to me that this security by obscurity approach is quite frankly crap. >And now I can't update my OS before making an installation USB because Canonical can't just follow Linus' releases. Thanks. Linus' releases need some sort of buffering before they can be considered stable, often distributions will apply their own patches on top. Also consider the scenario where Linus releases a bad kernel and no testing has been performed before rolling out to all Linux users.

throwawayfinal 9y ago
I think it's absolutely unreasonable to imply that this was intentional. Besides the massive amount of complexity these systems have, there are plenty of "legitimate" places to hide backdoors, instead of in a performance architecture decision. Keep in mind that whatever "evil agencies" would have asked for this would most likely find themselves vulnerable, and nobody would sign off on. I do agree, however, the "security by obscurity approach is quite frankly crap". The fact that even large corporations (not the big 5) can't even get away from ME speaks volumes about why this is a bad idea. Facebook isn't the only company with important data.
- mehrdadn 9y ago
  > I think it's absolutely unreasonable to imply that this was intentional. Amen. It blows my mind that some people think clever techniques like speculative or out-of-order execution must've somehow how nefarious intentions behind them. Come on HN...
- galvin 9y ago
  Adding a backdoor seems unreasonable but they may have chosen performance over security. Even if this individual bug wasn't intentional they are responsible for setting their priorities.
  - Filligree 9y ago
    There are CPUs available which choose security over performance. They aren't made by Intel, but you can buy them, and they're even cheaper. Oh, you don't want to do that?
- alphonsegaston 9y ago
  Well, I read somewhere the other day that this form of error/attack was conceived of in the academic literature back in 1992. I won’t believe it’s intentional without evidence in that direction, but this is conceivably the kind of obscure/complex attack you’d expect of a state actor.
  - throwawayfinal 9y ago
    This has been a known issue in xbox 360 hardware since about 2010. It just keeps popping up, someone finally thought to weaponize it.
    - oblio 9y ago
      >It just keeps popping up, someone finally thought to weaponize it. Someone published its weaponization, you mean :)
- Animats 9y ago
  The Intel Management Engine is a backdoor. Speed variations in speculative execution are an inherent property of the technology. Until recently, few people thought this was exploitable, and it took a lot of work to figure out how to exploit this.
  - andrewflnr 9y ago
    You do realize those are ideal properties for a backdoor, don't you? If you were writing the spec for a dream backdoor, you would write that down. The only way you could improve it would be "everyone thinks it's impossible, and they never figure it out."
    - Animats 9y ago
      Yes, though it's moderately hard to exploit against a specific target. It's more useful for bulk attacks - getting everyone who visits a specific web site to run a DDOS attack, or ransomware.
    - jijji 9y ago
      the ideal properties of a backdoor were visualized to me the day i hacked into an author of a largely distributed piece of smtp mail server, only to find sitting in his home directory an unpublished integer overflow exploit written by him years earlier for a version of the software that is currently in wide distribution...
      - dvfjsdhgfv 9y ago
        That's close to perfect, indeed. The drawbacks in this scenario are that (1) not everybody runs an SMTP server, (2) if it's open source (and if it's very popular, then it is), some other smart people will look for the bug and publish it for fame. That's quite different from a backdoor built into a processor (although I really doubt Intel was really involved in any shady practices, it looks like they were not smart enough).
        paulie_a 9y ago
gkya 9y ago
Yeah ME is a scary thing also. WRT Linux, well my Xubuntu 16.04 (Xenial) is on 4.10 and no new kernels are available to ma ATM. So if they're going to patch my OS, that's probably going to be a backport to that version, not the latest release integrated to my OS version. I guess that's what caused this bug too, although I admit I only skimmed the conversation linked.
- jlgaddis 9y ago
  They've put out updates for 4.4 and 4.13 (HWE) for 16.04, if that helps. See https://wiki.ubuntu.com/SecurityTeam/KnowledgeBase/SpectreAndMeltdown https://wiki.ubuntu.com/SecurityTeam/KnowledgeBase/SpectreAn...
  - gkya 9y ago
    I'm guessing that updates for LTS kernel will come later. I don't know if I can update to 4.13.
    - deleted 9y ago
      [deleted]
    - lscotte 9y ago
      LTS for xenial is 4.4, and patches have already been released for it.
- lscotte 9y ago
  Note there won't be fixes for 4.10, as it's reached EOL for Ubuntu, so you'll need to move to the 4.13 patched kernel.
PatchMonkey 9y ago
Those undocumented features & byte code? HAP mode - something the NSA doesnt want you to know exists, but that they had put into intelME from Skylake onward. But yet and still we found out. So yes, this security through obscurity approach is terrible (with a code embargo being the obvious exception). They only update microcode when they have to. When doing otherwise risks... Well, this kind of mess. You dont wanna know how many times I've rebuilt my gentoo system chasing after retpoline kernel & gcc builds that just... Break everything. It should be interesting to see how it all develops

by bArray 9y ago

throwawayfinal 9y ago

I think it's absolutely unreasonable to imply that this was intentional. Besides the massive amount of complexity these systems have, there are plenty of "legitimate" places to hide backdoors, instead of in a performance architecture decision. Keep in mind that whatever "evil agencies" would have asked for this would most likely find themselves vulnerable, and nobody would sign off on. I do agree, however, the "security by obscurity approach is quite frankly crap". The fact that even large corporations (not the big 5) can't even get away from ME speaks volumes about why this is a bad idea. Facebook isn't the only company with important data.

mehrdadn 9y ago
> I think it's absolutely unreasonable to imply that this was intentional. Amen. It blows my mind that some people think clever techniques like speculative or out-of-order execution must've somehow how nefarious intentions behind them. Come on HN...
galvin 9y ago
Adding a backdoor seems unreasonable but they may have chosen performance over security. Even if this individual bug wasn't intentional they are responsible for setting their priorities.
- Filligree 9y ago
  There are CPUs available which choose security over performance. They aren't made by Intel, but you can buy them, and they're even cheaper. Oh, you don't want to do that?
alphonsegaston 9y ago
Well, I read somewhere the other day that this form of error/attack was conceived of in the academic literature back in 1992. I won’t believe it’s intentional without evidence in that direction, but this is conceivably the kind of obscure/complex attack you’d expect of a state actor.
- throwawayfinal 9y ago
  This has been a known issue in xbox 360 hardware since about 2010. It just keeps popping up, someone finally thought to weaponize it.
  - oblio 9y ago
    >It just keeps popping up, someone finally thought to weaponize it. Someone published its weaponization, you mean :)
Animats 9y ago
The Intel Management Engine is a backdoor. Speed variations in speculative execution are an inherent property of the technology. Until recently, few people thought this was exploitable, and it took a lot of work to figure out how to exploit this.
- andrewflnr 9y ago
  You do realize those are ideal properties for a backdoor, don't you? If you were writing the spec for a dream backdoor, you would write that down. The only way you could improve it would be "everyone thinks it's impossible, and they never figure it out."
  - Animats 9y ago
    Yes, though it's moderately hard to exploit against a specific target. It's more useful for bulk attacks - getting everyone who visits a specific web site to run a DDOS attack, or ransomware.
  - jijji 9y ago
    the ideal properties of a backdoor were visualized to me the day i hacked into an author of a largely distributed piece of smtp mail server, only to find sitting in his home directory an unpublished integer overflow exploit written by him years earlier for a version of the software that is currently in wide distribution...
    - dvfjsdhgfv 9y ago
      That's close to perfect, indeed. The drawbacks in this scenario are that (1) not everybody runs an SMTP server, (2) if it's open source (and if it's very popular, then it is), some other smart people will look for the bug and publish it for fame. That's quite different from a backdoor built into a processor (although I really doubt Intel was really involved in any shady practices, it looks like they were not smart enough).
      - paulie_a 9y ago

gkya 9y ago

Yeah ME is a scary thing also. WRT Linux, well my Xubuntu 16.04 (Xenial) is on 4.10 and no new kernels are available to ma ATM. So if they're going to patch my OS, that's probably going to be a backport to that version, not the latest release integrated to my OS version. I guess that's what caused this bug too, although I admit I only skimmed the conversation linked.

jlgaddis 9y ago
They've put out updates for 4.4 and 4.13 (HWE) for 16.04, if that helps. See https://wiki.ubuntu.com/SecurityTeam/KnowledgeBase/SpectreAndMeltdown https://wiki.ubuntu.com/SecurityTeam/KnowledgeBase/SpectreAn...
- gkya 9y ago
  I'm guessing that updates for LTS kernel will come later. I don't know if I can update to 4.13.
  - deleted 9y ago
    [deleted]
  - lscotte 9y ago
    LTS for xenial is 4.4, and patches have already been released for it.
lscotte 9y ago
Note there won't be fixes for 4.10, as it's reached EOL for Ubuntu, so you'll need to move to the 4.13 patched kernel.

PatchMonkey 9y ago

Those undocumented features & byte code? HAP mode - something the NSA doesnt want you to know exists, but that they had put into intelME from Skylake onward. But yet and still we found out. So yes, this security through obscurity approach is terrible (with a code embargo being the obvious exception). They only update microcode when they have to. When doing otherwise risks... Well, this kind of mess. You dont wanna know how many times I've rebuilt my gentoo system chasing after retpoline kernel & gcc builds that just... Break everything. It should be interesting to see how it all develops