7 ms·
Exploiting modern microarchitectures: Meltdown, Spectre, and other attacks [pdf]
- edward 9y agoThis was the last talk at FOSDEM, there were over 1,400 people in the audience. https://fosdem.org/2018/schedule/event/closing_keynote/ https://fosdem.org/2018/schedule/event/closing_keynote/ Video should be available soon.
- michaelanckaert 9y agoAnd a great talk it was! Jon managed to make Spectre, Meltdown and a signifi part of modern processor design understanda in just 45 minutes.
- flexd 9y agoI'm looking forward to the video! Wish I could have been there but I had accidentally^W unfortunately booked my return flight just after the talk ended.
- deepnotderp 9y agoAlso check out their EE380 talk.
- bringtheaction 9y agoLink?
- deepnotderp 9y agohttps://youtu.be/zuBw1HFJMsM https://youtu.be/zuBw1HFJMsM
- iou 9y agoVideo - https://m.youtube.com/watch?v=zuBw1HFJMsM https://m.youtube.com/watch?v=zuBw1HFJMsM
- ufo 9y agoThis video isn't from FOSDEM but it appears to be the same talk / slides.
- jonmasters 9y agoIt's an earlier version from a Stanford session I did last week. But note that the Stanford one was a different audience, and a bit more flexible in time, so it went 2.5 hours and had fewer diagrams. The FOSDEM version was updated to fit for time based upon what I learned giving the earlier talk.
- jonmasters 9y agoThe FOSDEM video is here: https://video.fosdem.org/2018/Janson/closing_fosdem.webm https://video.fosdem.org/2018/Janson/closing_fosdem.webm or https://video.fosdem.org/2018/Janson/closing_fosdem.mp4 https://video.fosdem.org/2018/Janson/closing_fosdem.mp4
- ufo 9y agoThanks! The actual links are https://video.fosdem.org/2018/Janson/closing_keynote.webm https://video.fosdem.org/2018/Janson/closing_keynote.webm and https://video.fosdem.org/2018/Janson/closing_keynote.mp4 https://video.fosdem.org/2018/Janson/closing_keynote.mp4, by the way :)
- deleted 9y ago[deleted]
- burfog 9y agoThis is a 90-page book in the form of slides. It supposedly takes you from not understanding virtual memory up to understanding the details of modern side-channel attacks like Meltdown and Spectre. Either you know it mostly and this is boring, or you don't know it and you're in for a super-steep learning curve.
- adwhit 9y ago> Either you know it mostly and this is boring, or you don't know it and you're in for a super-steep learning curve Or you sort-of-know-but-have-half-forgotten most of it and this is a nice refresher with a few interesting new bits thrown in?
- makapuf 9y agoThat plus a belgian beer, what else ? The guy presenting it live was very enthusiastic and you just can enjoy the whole thing. Seriously it's a thing to live.
- mmrezaie 9y agoI understand this is not related, but how did the counters hide after couples seconds in the pdf? Can I do this using Latex? But what a great presentation of hardware architecture!
- wahern 9y agoWhich page?
- mmrezaie 9y agoOh, Sorry I just realized this is the new version of Okular that does it (adding the number of the slide on top corner and auto hiding it). I thought it is the PDF file feature. Unfortunately, I cannot remove my post! Just switched to KDE and I was not used to seeing the slide counter.
- Grazester 9y agoDeleted. Wrong thread
- burfog 9y agoI have a question about the retpoline code. Does anybody know why they used "lfence;jmp" or "pause;jmp" instead of "ud2" alone? The ud2 instruction has previously been recommended to stop speculative execution. Other good choices would be int3 (0xCC) and int1 (0xF1). Here is somebody quoting from Intel's manual: https://software.intel.com/en-us/forums/software-tuning-performance-optimization-platform-monitoring/topic/721809 https://software.intel.com/en-us/forums/software-tuning-perf... To me, it looks like you could save several bytes.
- rjzzleep 9y agoWhat am I missing here, isn't int3 used for debugging purposes?
- burfog 9y agoOne use of int3 is debugging. That is the originally intended use. You can use it for other things. It gets used for multi-threaded self-modifying code. Simply modifying the code can cause a crash due to an intermediate state. There are caches and there is an instruction prefetcher. To deal with this, first write out an int3 on the first byte of the instruction you wish to replace. The CPU is careful not to screw up in this case because int3 has to work for debugging. Next, update the rest of the instruction as desired, and then write the first byte over the int3. If the int3 happens to get hit by the other thread, just have the debug exception do nothing. The carefulness around int3 will stop speculation. That is what is needed for a retpoline. People have also used int3 for things related to copy protection. You could be silly and write an OS that used int3 to do system calls.
- mangix 9y agoMIPS is not vulnerable to either Meltdoown or Spectre.
- binarycrusader 9y agoSPARC isn't vulnerable to Meltdown either (based on public statements by Oracle and my own understanding of its address space separation).
- trynumber9 9y agoAnd how did they achieve that? MIPS says their only high performance CPUs are vulnerable to Spectre. https://www.mips.com/blog/mips-response-on-speculative-execution-and-side-channel-vulnerabilities/ https://www.mips.com/blog/mips-response-on-speculative-execu...
- DSMan195276 9y agoIt's the same way with ARM. A fair amount of CPUs simply don't do out-of-order or speculative execution to the point where they could be vulnerable. And of course, if they can't do that then there's no way they could be vulnerable to Spectre or Meltdown.
- jonmasters 9y agoThanks for the comments all. Here's the video of my FOSDEM 2018 keynote that matches these slides, which is now available: https://video.fosdem.org/2018/Janson/closing_fosdem.webm https://video.fosdem.org/2018/Janson/closing_fosdem.webm or https://video.fosdem.org/2018/Janson/closing_fosdem.mp4 https://video.fosdem.org/2018/Janson/closing_fosdem.mp4
- tomca32 9y agoThis seems to only be a video of the closing of FOSDEM. Some stats, thanking volunteers and reminders for people to clean after themselves. Am I missing something?
- mhei 9y agoCorrect links are http://ftp.belnet.be/mirror/FOSDEM/2018/Janson/closing_keynote.mp4 http://ftp.belnet.be/mirror/FOSDEM/2018/Janson/closing_keyno... and http://ftp.belnet.be/mirror/FOSDEM/2018/Janson/closing_keynote.webm http://ftp.belnet.be/mirror/FOSDEM/2018/Janson/closing_keyno...