4 ms·

I've been impressed with how long it took for this information to be "leaked"/"declassified"/released given the sheer number of people who knew. The fact that

I've been impressed with how long it took for this information to be "leaked"/"declassified"/released given the sheer number of people who knew. The fact that hundreds maybe thousands of people knew and worked on this ahead of the press reports/rumors and subsequent information release speaks to how seriously everyone involved took this.

cwzwarich 9y ago
I don't think it was a complete success. An AMD engineer mentioned the nature of the vulnerability on lkml before the end of the embargo, even though AMD was a party to the embargo. Of course, it was probably unwise to discuss the code changes implementing mitigations in public anyways, but I don't have first-hand knowledge of how these things work in the Linux world.
- mjevans 9y ago
  Wasn't that also a reply to some part of this which had already surfaced to the public (but the impact maybe not known to the public).
  - cwzwarich 9y ago
    There was an email thread discussing page table isolation mitigations for some bug, but Tom Lendacky mentioned it was about speculation. This let many others finally connect the dots, despite the earlier discussion taking place in the open for a while. Until the connection with speculation was revealed, it could've just been another KASLR info leak defense.
masterleep 9y ago
We can safely assume that black hats have moles on these lists.
- throwaway2048 9y ago
  yeah the idea you can keep something like this away from malicious parties across dozens of huge companies is a ridiculous farce.
  - inlined 9y ago
    I've worked to mitigate other vulnerabilities within Google. at least with the vulnerability I helped on, I'm surprised at how good the information containment was. Based on my area of work and job title, I was notified of the software that was vulnerable and to contact them with further info if we used it. I wasn't allowed to talk to others without explicit consent, so I talked to my central contact to find the right PoC in my neighbor teams to know who I was allowed to pull into a room for any joint strategies. To everyone else, I simply said "sorry. On call is busy this week. I'm working on mitigating an undisclosed vulnerability." No questions asked. To this day I'm still not 100% sure the vulnerability is public so none of my peers know anything more than the time window in which I was distracted.
- wasx 9y ago
  I don't know why this was downvoted, it's a very reasonable assumption given the scale and spread of people who knew. Sure there's no evidence of any actual attacks exploiting this vulnerability, but that doesn't mean we can discount the chance that it was known to malicious parties before the wider public.
- IncRnd 9y ago
  Upvoted, because you are 100% correct, and I need to counteract the downvotes that you for some reason received. Edit: ... which is why I now received downvotes...
ajross 9y ago
Really it never leaked at all. It wasn't until several weeks after the linux known-now-to-be-meltdown-defense patches entered review that non-involved people started putting the pieces together and realized it was a security fix. Only at that point Google pulled the trigger on the revelation.
Matt3o12_ 9y ago
Well we can’t really know if those have not leaked before. I imagine that this vulnerability was worth a lot of money, even if is was clear that it would be fixed one or two months later. There were too many people involved to think that nobody took the opportunity to sell it to the highest bidder. I personally would have preferred if google kept it in house as long as possible and made sure even at Intel, etc, a very limited amount of people could have seen it. This vulnerability could do a lot of damage if it was given to dangerous people. But you are right it is very impressive that there were almost non public leaks (and the only leak was not more like a slip up which nobody took too serious until the patches were made public). I would not have surprised me if someone posted them and they got picked up. It would have made things a lot worse.

cwzwarich 9y ago

I don't think it was a complete success. An AMD engineer mentioned the nature of the vulnerability on lkml before the end of the embargo, even though AMD was a party to the embargo. Of course, it was probably unwise to discuss the code changes implementing mitigations in public anyways, but I don't have first-hand knowledge of how these things work in the Linux world.

mjevans 9y ago
Wasn't that also a reply to some part of this which had already surfaced to the public (but the impact maybe not known to the public).
- cwzwarich 9y ago
  There was an email thread discussing page table isolation mitigations for some bug, but Tom Lendacky mentioned it was about speculation. This let many others finally connect the dots, despite the earlier discussion taking place in the open for a while. Until the connection with speculation was revealed, it could've just been another KASLR info leak defense.

masterleep 9y ago

We can safely assume that black hats have moles on these lists.

throwaway2048 9y ago
yeah the idea you can keep something like this away from malicious parties across dozens of huge companies is a ridiculous farce.
- inlined 9y ago
  I've worked to mitigate other vulnerabilities within Google. at least with the vulnerability I helped on, I'm surprised at how good the information containment was. Based on my area of work and job title, I was notified of the software that was vulnerable and to contact them with further info if we used it. I wasn't allowed to talk to others without explicit consent, so I talked to my central contact to find the right PoC in my neighbor teams to know who I was allowed to pull into a room for any joint strategies. To everyone else, I simply said "sorry. On call is busy this week. I'm working on mitigating an undisclosed vulnerability." No questions asked. To this day I'm still not 100% sure the vulnerability is public so none of my peers know anything more than the time window in which I was distracted.
wasx 9y ago
I don't know why this was downvoted, it's a very reasonable assumption given the scale and spread of people who knew. Sure there's no evidence of any actual attacks exploiting this vulnerability, but that doesn't mean we can discount the chance that it was known to malicious parties before the wider public.
IncRnd 9y ago
Upvoted, because you are 100% correct, and I need to counteract the downvotes that you for some reason received. Edit: ... which is why I now received downvotes...

ajross 9y ago

Really it never leaked at all. It wasn't until several weeks after the linux known-now-to-be-meltdown-defense patches entered review that non-involved people started putting the pieces together and realized it was a security fix. Only at that point Google pulled the trigger on the revelation.

Matt3o12_ 9y ago

Well we can’t really know if those have not leaked before. I imagine that this vulnerability was worth a lot of money, even if is was clear that it would be fixed one or two months later. There were too many people involved to think that nobody took the opportunity to sell it to the highest bidder. I personally would have preferred if google kept it in house as long as possible and made sure even at Intel, etc, a very limited amount of people could have seen it. This vulnerability could do a lot of damage if it was given to dangerous people. But you are right it is very impressive that there were almost non public leaks (and the only leak was not more like a slip up which nobody took too serious until the patches were made public). I would not have surprised me if someone posted them and they got picked up. It would have made things a lot worse.