3 ms·

I have a question: the attacks were apparently found by the authors of these papers and project zero very close to each other. Why is it that a bug that has exi

I have a question: the attacks were apparently found by the authors of these papers and project zero very close to each other. Why is it that a bug that has existed so long was suddenly found by both groups so close to each other? Are there other papers or ideas that this is based on, or was there some other reason they both tried to look for these kinds of bugs?

aviv 9y ago
Putting my tinfoil hat for a minute, I suspect that it was well known and in use by various 3-letter agencies for years, and somehow they got wind of a foreign nation either exploiting this as well or about to expose it publicly. Their only move was to let a respectable entity like Google "discover" it.
als0 9y ago
It could be the case that one group found out about the other's work and decided to pursue a similar research direction with the hope of being first to publish.
keldaris 9y ago
Side channel timing attacks have been an active research topic for many years. I'm not a member of that community and I'm sure there are many people on HN who are far better placed to explain the context than I am, but from what I've seen the momentum around practical side channel exploits has been building up for over a year now, there's been a number of public talks on the subject at conferences and consequently several research groups were motivated to pursue similar lines of research at roughly the same time. It's also a fairly tight knit community and I'm sure they exchange information informally as well. I know you asked for specific citations, but I'd rather let someone who actually works in this area respond. I've read a few of the earlier articles on these subjects, but I'm not qualified to detail the full context surrounding the earlier research.
tptacek 9y ago
This happens all the time. In this particular case, speculative execution timing attacks were "in the air" for the last year. A little while ago the C.W. was that Anders Fogh had kicked this off with his blog post from last summer, but Fogh actually posted a chronology taking this work all the way back to December '16: https://cyber.wtf/2018/01/05/behind-the-scene-of-a-bug-collision/ https://cyber.wtf/2018/01/05/behind-the-scene-of-a-bug-colli... Once there's blood in the water, people race to find exploitable flaws (that's the goal of the game), and so it's not surprising that you'd get multiple teams disclosing, especially with something this egregious. Also: there's a Nyquist Frequency thing happening here: remember that we're dealing with months-long embargoes. So there's a lot of time for people to have found these bugs "separately", and all we're really seeing is a colliding disclosure. But having said all that: straight-up collisions happen a lot. We all have favorite stories. My favorite is when Vitaly McLain (then at Matasano, now one of my partners at Latacora) found an nginx bug that was identical to Heartbleed, 2 years before Heartbleed was disclosed. A fantastic bug. We were on a client engagement, so we had to coordinate with the client before reporting it upstream, and in the one hour it took to do that, someone else reported the same bug.

aviv 9y ago

Putting my tinfoil hat for a minute, I suspect that it was well known and in use by various 3-letter agencies for years, and somehow they got wind of a foreign nation either exploiting this as well or about to expose it publicly. Their only move was to let a respectable entity like Google "discover" it.

als0 9y ago

It could be the case that one group found out about the other's work and decided to pursue a similar research direction with the hope of being first to publish.

keldaris 9y ago

Side channel timing attacks have been an active research topic for many years. I'm not a member of that community and I'm sure there are many people on HN who are far better placed to explain the context than I am, but from what I've seen the momentum around practical side channel exploits has been building up for over a year now, there's been a number of public talks on the subject at conferences and consequently several research groups were motivated to pursue similar lines of research at roughly the same time. It's also a fairly tight knit community and I'm sure they exchange information informally as well. I know you asked for specific citations, but I'd rather let someone who actually works in this area respond. I've read a few of the earlier articles on these subjects, but I'm not qualified to detail the full context surrounding the earlier research.

tptacek 9y ago

This happens all the time. In this particular case, speculative execution timing attacks were "in the air" for the last year. A little while ago the C.W. was that Anders Fogh had kicked this off with his blog post from last summer, but Fogh actually posted a chronology taking this work all the way back to December '16: https://cyber.wtf/2018/01/05/behind-the-scene-of-a-bug-collision/ https://cyber.wtf/2018/01/05/behind-the-scene-of-a-bug-colli... Once there's blood in the water, people race to find exploitable flaws (that's the goal of the game), and so it's not surprising that you'd get multiple teams disclosing, especially with something this egregious. Also: there's a Nyquist Frequency thing happening here: remember that we're dealing with months-long embargoes. So there's a lot of time for people to have found these bugs "separately", and all we're really seeing is a colliding disclosure. But having said all that: straight-up collisions happen a lot. We all have favorite stories. My favorite is when Vitaly McLain (then at Matasano, now one of my partners at Latacora) found an nginx bug that was identical to Heartbleed, 2 years before Heartbleed was disclosed. A fantastic bug. We were on a client engagement, so we had to coordinate with the client before reporting it upstream, and in the one hour it took to do that, someone else reported the same bug.