4 ms·
The 'bombshell' of meltdown isn't about cache side-channel attacks. Instead, it is about the use of out-of-order execution (meltdown) and speculative execution
by rocqua 9y ago
The 'bombshell' of meltdown isn't about cache side-channel attacks.
Instead, it is about the use of out-of-order execution (meltdown) and speculative execution (spectre) to get side effects.
It doesn't matter much that these side effects happen to be cache state. For meltdown, it matters that page protection is essentially broken.
For spectre it matters that speculation on indirect branches are essentially attacker controlled.
Both attacks, in their practical form, use cache timing as the side-channel to extract information. But the surprise is the control over (as the paper calls them) 'transient executions'.
- ryanlol 9y agoYeah, I know. My point was that it is very well established that CPUs are full of issues similar enough to meltdown and spectre. Therefore it is foolish for anyone to assume that they can safely run untrusted code on a machine with secrets on it.
- jnwatson 9y agoThere’s a $250 billion cloud computing market that makes that assumption.
- computerex 9y agoI think you might be misunderstanding what the phrase "side channel attack" means. It's very difficult to protect against side-channel attacks, because of their very nature. There are a lot of ways someone can try to exploit a system and of course not all of them can be accounted for in advance. But not all side-channel attacks are practical, some are done for academic reasons and can only be done in controlled environments with contrived setup. like check this out: https://www.tau.ac.il/~tromer/acoustic/ https://www.tau.ac.il/~tromer/acoustic/ > Here, we describe a new acoustic cryptanalysis key extraction attack, applicable to GnuPG's current implementation of RSA. The attack can extract full 4096-bit RSA decryption keys from laptop computers (of various models), within an hour, using the sound generated by the computer during the decryption of some chosen ciphertexts. So the seriousness of a side-channel attack is determined as a function of the impact of the exploit as well as how easy it is to carry out the exploit. Meltdown in particular is nasty because it is relatively easy exploit and is undetectable and affects a ridiculously large range of hardware. So it is actually a pretty big deal. Yes there are side-channel attacks against Intel CPU's, but this isn't just any old side-channel attack.
- ryanlol 9y agoI'm not misunderstanding anything. I'm simply of the opinion that secure multiuser systems aren't something we can do right now. Here's just one of the more practical attacks http://palms.ee.princeton.edu/system/files/SP_vfinal.pdf http://palms.ee.princeton.edu/system/files/SP_vfinal.pdf >but this isn't just any old side-channel attack. It isn't, but you were already screwed. Now you're just slightly more screwed.
- jnordwick 9y agoThere is no such thing as practical form of these exploits. We have yet to see a real world demonstration even though everybody keeps saying how theoretically easy it is.
- shakna 9y agohttps://github.com/gkaindl/meltdown-poc https://github.com/gkaindl/meltdown-poc
- jnordwick 9y agoPoc in the url means proof of concept. Not very Real world at all. Not some artificial poc that already knows an address to attack and needs to be helped by continually pulling the data into the L1 cache. If it is so easy to do then why has nobody written anything that can read a password from a browser or sudo?