14 ms·

People had fanciful minds. They had expected the civilization to end in bio-warfare, or atomic bombs, or a blazing meteorite impact. No such luck. The end of t

by dsign 9y ago

People had fanciful minds. They had expected the civilization to end in bio-warfare, or atomic bombs, or a blazing meteorite impact. No such luck. The end of the civilization came, rather anticlimactically, when the humans discovered that side effects and timing attacks made any form of cyber-security a joke. Their computers screeched to a halt bogged down by nightmarish security patches. By then, it was already too late to go back and live off the land.

beamatronic 9y ago
Or they just went back to using simple CPUs, and were content with solving smaller problems.
- dsign 9y ago
  ... they were all eagerly awaiting to upload their souls to Intel CPUs, but alas ...
- qubex 9y ago
  I know this is in good-natured jest, but wouldn’t the arrival of widespread quantum computing, which need to be absolutely decoupled from their environment so as to prevent decoherence, actually be an enormous step forward in almost all these “side channel” attacks? In the sense that decoupling must by definition limit any exchange of information that might constitute ‘observation’, and as such, the goings-on of a quantum computer become literally unobservable on the pain of nonfunction.
  - tlb 9y ago
    Current quantum computers don't have much in the way of microarchitecture. No caches or branch prediction obviously. But if you were timesharing on a quantum machine (which, given that they need $1M microkelvin coolers seems like it will be common) it's not impossible that information could leak. Given the analog way they work, you could probably set up a computation that would be sufficiently sensitive to initial conditions that the not-entirely-decayed-to-zero previous computation could influence it.
    - qubex 9y ago
      Uhm... no, I think not: to get information out of the quantum computer as output for the ”previous user” it needs to go through an explicit phase of observation, busting all the state (?), and loading up new data for the subsequent user’s computation also constitutes ’observation’ since there’s knowledge of the inner state of the quantum system outside the strict confines of the quantum system. I really don’t think you could at any moment in time get information out of a side-channel, otherwise the thing wouldn’t compute. (Yup, of course they’re extremely simplistic in terms of inner architecture, but that’s quite beside the point, as I think we both agree.)
      - tlb 9y ago
        It's true that the quantum state can only be observed once, but at the end of the observation the resolved state exists classically in the phase of the resonating elements. Also, the input vector continues to be there. Leaking either is a leak.
- TeMPOraL 9y ago
  Nah, that wouldn't work - simple CPUs, by virtue of going slower, being less complicated inside and using more power per cycle, would be easier to snoop at through EM channels.
  - 8bitsrule 9y ago
    And then, they discovered that by putting the 8-bit machines under metal rollers moving 12-foot-wide plastic film at 10 meters per second, their signals could not push through the resulting force field.
kibwen 9y ago
This code is more fun and interesting than scary. The only way this could be used maliciously would be in the one-in-a-million environment where arbitrary code execution is possible but exfiltration is difficult and where the attacker has physical proximity to the machine. The other 999,999 times, if you have ACE then it's much simpler to just exfiltrate via the network or USB or etc.
- sharpercoder 9y ago
  This would aid e.g. the "Stuxnet usecase" once the used computer hardware is known. Precise directional antennas could pick up the signal from a distance.
- jstanley 9y ago
  In theory it would help with exfiltration from air-gapped machines, although like you said, you do still need to get the code on there in the first place, which would imply it's not air-gapped all that well.
- AlexVranas 9y ago
  >where the attacker has physical proximity to the machine. There may also be an option to use a directional antenna to pick it up from a great distance away. Physical infiltration of networks isn't a fictional concept. It does happen all the time.
- Eduard 9y ago
  Scenario: broadcasting out passwords and PINs
  - exikyut 9y ago
    Solution: bluetooth transciever silicon is <5mm square when packaged
QAPereo 9y ago
I wouldn’t sell NBC weapons short... at least not the B and N parts. Nukes are dangerous in the hands of nations, but my god you just wait until every asshole with a laptop and $10,000 worth of equipment can customize their own plague. We’re not quite there yet, but we’re close, and regulating that is going to be utterly impossible. It’s possible to exist in a relative detente between nations, but when the capacity to end human civilization is democratized we are dead. Many forms of incredible tech are really maturing, and frankly our laws are a century or more behind. We’re in real trouble if we have to wait to be burned to believe in the fire this time. Unfortunately it seems that most of the smartest people are desperately trying to strike it rich, and that’s just about all. Even most of the people who want to make a difference only feel they can/should after making “fuck you money.”
TeMPOraL 9y ago
Side channels are always present. I think people not realizing it is a sad example of how our brains compartmentalize things, so that even smart individuals end up abstracting away the physical world. These articles are only friendly reminders: computing runs in physical reality. Whatever you do, whatever information you process, its always broadcasting itself at the speed of light. The only thing you can do is to try and raise the practical costs of a side-channel attack so much, that it becomes much more expensive than the target data is worth to the attacker.

by dsign 9y ago

beamatronic 9y ago

Or they just went back to using simple CPUs, and were content with solving smaller problems.

dsign 9y ago
... they were all eagerly awaiting to upload their souls to Intel CPUs, but alas ...
qubex 9y ago
I know this is in good-natured jest, but wouldn’t the arrival of widespread quantum computing, which need to be absolutely decoupled from their environment so as to prevent decoherence, actually be an enormous step forward in almost all these “side channel” attacks? In the sense that decoupling must by definition limit any exchange of information that might constitute ‘observation’, and as such, the goings-on of a quantum computer become literally unobservable on the pain of nonfunction.
- tlb 9y ago
  Current quantum computers don't have much in the way of microarchitecture. No caches or branch prediction obviously. But if you were timesharing on a quantum machine (which, given that they need $1M microkelvin coolers seems like it will be common) it's not impossible that information could leak. Given the analog way they work, you could probably set up a computation that would be sufficiently sensitive to initial conditions that the not-entirely-decayed-to-zero previous computation could influence it.
  - qubex 9y ago
    Uhm... no, I think not: to get information out of the quantum computer as output for the ”previous user” it needs to go through an explicit phase of observation, busting all the state (?), and loading up new data for the subsequent user’s computation also constitutes ’observation’ since there’s knowledge of the inner state of the quantum system outside the strict confines of the quantum system. I really don’t think you could at any moment in time get information out of a side-channel, otherwise the thing wouldn’t compute. (Yup, of course they’re extremely simplistic in terms of inner architecture, but that’s quite beside the point, as I think we both agree.)
    - tlb 9y ago
      It's true that the quantum state can only be observed once, but at the end of the observation the resolved state exists classically in the phase of the resonating elements. Also, the input vector continues to be there. Leaking either is a leak.
TeMPOraL 9y ago
Nah, that wouldn't work - simple CPUs, by virtue of going slower, being less complicated inside and using more power per cycle, would be easier to snoop at through EM channels.
- 8bitsrule 9y ago
  And then, they discovered that by putting the 8-bit machines under metal rollers moving 12-foot-wide plastic film at 10 meters per second, their signals could not push through the resulting force field.

kibwen 9y ago

This code is more fun and interesting than scary. The only way this could be used maliciously would be in the one-in-a-million environment where arbitrary code execution is possible but exfiltration is difficult and where the attacker has physical proximity to the machine. The other 999,999 times, if you have ACE then it's much simpler to just exfiltrate via the network or USB or etc.

sharpercoder 9y ago
This would aid e.g. the "Stuxnet usecase" once the used computer hardware is known. Precise directional antennas could pick up the signal from a distance.
jstanley 9y ago
In theory it would help with exfiltration from air-gapped machines, although like you said, you do still need to get the code on there in the first place, which would imply it's not air-gapped all that well.
AlexVranas 9y ago
>where the attacker has physical proximity to the machine. There may also be an option to use a directional antenna to pick it up from a great distance away. Physical infiltration of networks isn't a fictional concept. It does happen all the time.
Eduard 9y ago
Scenario: broadcasting out passwords and PINs
- exikyut 9y ago
  Solution: bluetooth transciever silicon is <5mm square when packaged

QAPereo 9y ago

I wouldn’t sell NBC weapons short... at least not the B and N parts. Nukes are dangerous in the hands of nations, but my god you just wait until every asshole with a laptop and $10,000 worth of equipment can customize their own plague. We’re not quite there yet, but we’re close, and regulating that is going to be utterly impossible. It’s possible to exist in a relative detente between nations, but when the capacity to end human civilization is democratized we are dead. Many forms of incredible tech are really maturing, and frankly our laws are a century or more behind. We’re in real trouble if we have to wait to be burned to believe in the fire this time. Unfortunately it seems that most of the smartest people are desperately trying to strike it rich, and that’s just about all. Even most of the people who want to make a difference only feel they can/should after making “fuck you money.”

TeMPOraL 9y ago

Side channels are always present. I think people not realizing it is a sad example of how our brains compartmentalize things, so that even smart individuals end up abstracting away the physical world. These articles are only friendly reminders: computing runs in physical reality. Whatever you do, whatever information you process, its always broadcasting itself at the speed of light. The only thing you can do is to try and raise the practical costs of a side-channel attack so much, that it becomes much more expensive than the target data is worth to the attacker.