11 ms·
Intel hit with 32 lawsuits over security flaws
- yorby 9y agoThis comment on Slashdot is interesting: https://yro.slashdot.org/comments.pl?sid=11756132&cid=56135852 https://yro.slashdot.org/comments.pl?sid=11756132&cid=561358...
- speps 9y agoThat's about ME, not the recent Spectre and Meltdown that the article talks about: "Security researchers at the start of January publicized two flaws, dubbed Spectre and Meltdown"
- Cyphase 9y agoME = [Intel] Management Engine https://en.wikipedia.org/wiki/Intel_Management_Engine https://en.wikipedia.org/wiki/Intel_Management_Engine
- oneweekwonder 9y ago> That's about ME, not the recent Spectre and Meltdown I'm a layman, but spectre and meltdown seems like it can be a vehicle to exploit the intel management engine. Once your on ME with a "designed"/obfuscated or hacked path. It is basically over, because ME a unix system; with lan access; can run java-applets while the host machine is powered down. I hope it is only time before intel gives us the keys to our own ME jail. Hopefully ME will feature in some of these lawsuits.
- yaantc 9y ago> I'm a layman, but spectre and meltdown seems like it can be a vehicle to exploit the intel management engine. No, or extremely unlikely at the very least. Spectre and Meltdown allow a low privilege program to read (not write, only read) normally protected system memory accessed by higher privileged software through a shared cache. In the initial attack the privileged and attacking software run on the same CPU, but there are now "Prime" versions where attacker and privileged software can run on separate CPUs as long as they're on the same coherence domain (very simplified: they share some level of cache, at least the last level). The ME on the other hand is a completely separate CPU. Although it can access system memory, likely in a coherent way, as I understand it has its own dedicated internal memories (sometimes called TCM for "tightly coupled memory" or CCM for "closely coupled meory", it's all the same: internal SRAM directly attached to a CPU core and dedicated to it). All the security context would be in these ME TCMs, so physically unaccessible from software running on the main CPU cores. It's a simple and efficient way to enforce security: true physical isolation with no sharing. So Spectre and Meltdonw may enable a low privilege application to spy on communications between privileged software on the main CPUs and the ME, but it shouldn't help attack the ME itself. Unless the Intel ME devs did something horribly wrong, like storing sensitive ME data in the main system memory. Which would be very surprising really: if you put an isolated CPU for a ME, it's really to isolate the security state.
- grkvlt 9y agoSince there are exactly zero [0] implementations of the JVM for Minix, your worries about Java applets running on ME while a machine is powered down can be put to rest. And 'powered down' activities of ME are very limited, and only applicable to certain ACPI states - not a magical way of using the computer when the PSU is switched off. 0. EDIT: Well, maybe not, see http://jainja.thenesis.org/ http://jainja.thenesis.org/ for instance. But still, I don't believe the NSA tailored access teams are building Java applets for their persistent malware...
- tomxor 9y ago> dubbed Spectre and Meltdown, that affected nearly every modern computing device containing chips from Intel, Advanced Micro Devices Inc and ARM Holdings. WTF, spreading FUD on Intels behalf again?
- strictnein 9y agoApple's CPUs were affected. They're ARM based: https://support.apple.com/en-us/HT208394 https://support.apple.com/en-us/HT208394 AMD's press release on their susceptibility to Spectre: https://www.amd.com/en/corporate/speculative-execution https://www.amd.com/en/corporate/speculative-execution
- tomxor 9y agoMy comment is regarding Meltdown which affects Intel CPUs almost exclusively. The wording used takes the same strategy as Intels own PR statement by blurring the line between Meltdown and Spectre in an attempt to play down how Intel specific the Meltdown vulnerability is.
- theresistor 9y agoMeltdown affected Apple's ARM CPUs as well. If you read the linked support doc, you can see that they released Meltdown mitigations for iOS as well.
- tomxor 9y agoYes... like I said almost exclusively affects Intel CPUs. Just because 0.001% of non-Intel CPUs are affected while 100% of intel CPUs are, doesn't make Intel's strategy forgivable. I'm tired of seeing it echoed everywhere.
- 40acres 9y agoTired of seeing what? The truth? The truth is that all these chips are affected.. it's one thing to ask for clarification on the numbers but this is not "fake news".
- kcmastrpc 9y agomeanwhile, equifax stumbles in and yells, "nothing to see here, MOVE ALONG...."
- kjar 9y agoriffing on 'the beatings will continue until morale improves': 'the insanity will continue until awareness improves.'
- arjo129 9y agoThere needs to be a law that protects engineering corporations against security flaws that were previously unknown.
- JohnJamesRambo 9y agoIs this satire?
- Retric 9y agoThat would simply promote intentional ignorance. Even then Meltdown is part of a known class of attacks namely race conditions, Intel simply messed up.
- AnimalMuppet 9y agoThey messed up in a way that nobody spotted for a decade. That's not "messing up", that's failing to be psychic.
- DannyBee 9y agoWell, actually, the cache sidechannel timing attacks were fairly well known for quite a while. It's just nobody put two and two together. This is actually mostly due to lack of public information in the processor manuals. Otherwise it's quite likely it would have been discovered 5-6 years ago at least.
- tarlinian 9y agoThe fact that modern processors speculatively load memory has been known for a long time (and it's not like the fact that permission checking only occurs during retirement is documented...the reason no one considered it a problem was that it was thought of as an implementation detail and literally something you wouldn't document because in the future you might arbitrarily change it). This isn't exactly novel information...and putting two and two together only seemed obvious after the fact.
- tehlike 9y agoAm i the only one that thinks bugs are called bugs for a reason, and this was most likely not negligence.
- josaka 9y agoSympathetic to the notion given how difficult/useful it is to design a chip. But someone has to bear the cost of this. Chip designers are the party most capable of mitigating the harm. Seems reasonable to ask them to pay. See e.g., https://en.wikipedia.org/wiki/Coase_theorem https://en.wikipedia.org/wiki/Coase_theorem
- mseebach 9y agoThere's no externality to speak off here, so Coase doesn't apply. The costs, even if unexpected, are borne by the people who buy the chips, not random bystanders.
- bonzini 9y agoYes. Bugs are called bugs because you could actually find bugs among triodes and they could cause the computer to malfunction. Then the wording was extended to software bugs.
- mirimir 9y agoYes, the first known documented was a moth. By Grace Hopper. It prevented a relay from closing, I gather. https://thenextweb.com/shareables/2013/09/18/the-very-first-computer-bug/ https://thenextweb.com/shareables/2013/09/18/the-very-first-...
- chx 9y agoThis, even after so many years? Please! http://www.jamesshuggins.com/h/tek1/first_computer_bug.htm http://www.jamesshuggins.com/h/tek1/first_computer_bug.htm Obligatory working scihub link: https://sci-hub.la/10.2307/455415 https://sci-hub.la/10.2307/455415
- snissn 9y agoI'm really relieved the number is a power of 2.
- chx 9y agoThe problem, I feel, is with the Coffee Lake and Kaby Lake R release after learning of Spectre and Meltdown.
- bonzini 9y agoSpectre can be avoided (at small performance cost on new CPUs) with microcode updates and OS fixes. Meltdown can be fixed just at the OS level. At this point, whether you're releasing a chip with or without the vulnerability is not an issue. Fixing them will make you look better in benchmarks if anything, because you don't need anymore the slow PTI mitigation.
- digitalni 9y agoAm I the only one who thinks that now would be a good time to buy intel shares, or even wait a bit more until these suits are won (intel will likely lose), so the stock price will go down even further. There is no way intel will lose its market position, so stock prices are likely to go back up after all this drama settles down...
- gnarbarian 9y ago>There is no way intel will lose its market position Famous last words if I ever heard them. Ryzen and threadripper are a significant threat especially knowing that AMD is not vulnerable to meltdown (only Spectre).
- digitalni 9y agoI'll go with you on this one, but keep in mind that Amd and Arm are also affected. I see no obvious replacement for Intel, or am I missing something?
- jjeaff 9y agoOnly Spectre. AMD and arm are not vulnerable to meltdown.
- SteveNuts 9y agoI was due for an upgrade, this time I got an AMD Ryzen 1800x. First time I've EVER bought an AMD product, and I'm definitely impressed.
- danieldk 9y agoBut the large margins are in Xeons for enterprise and HPC computing. We use high-end Xeon machines for research and would think twice before purchasing AMD. Besides a generally good reputation and good performance, Intel has a great ecosystem with Intel MKL, ICC, etc. Besides that, Spectre also affects AMD and many ARM CPUs.
- seanlinmt 9y agoDoes anyone know how one could take part in these class action suits? And are they limited to US citizens only?
- classics2 9y agoIf the behaviors (bus timing logic and such) that are being used to spill information across process and privilege boundaries actually were fully documented, wouldn’t the liability fall on the people who used these chips to write multi-user environments without knowing or understanding the implications of the technical details?
- sannee 9y agoIt's very well documented that writing outside array boundaries in C can cause undefined behavior (leading to arbitrary code execution no less!), yet Adobe isn't exactly sued for every buffer overflow in Flash.