5 ms·

I've been using AMD CPUs exclusively on the desktop for the last 3-4 builds I've done and it sure feels nice all of a sudden. I recognize it's luck rather than

I've been using AMD CPUs exclusively on the desktop for the last 3-4 builds I've done and it sure feels nice all of a sudden. I recognize it's luck rather than skill of course, but I'll take what I can get because this one is a doozie! "An attacker therefore requires some kind of foothold in your machine in order to pull this off." Right, but these days browsers are handing over footholds to anyone with a webserver! It used to be that you worried about pop-ups because they were annoying. Now it seems you need to worry about the modern-day equivalent because they could at least theoretically ruin your digital and perhaps real life.

dspillett 8y ago
> these days browsers are handing over footholds to anyone with a webserver It is bad for providers using non-dedicated cloud infrastructure too: some of these flaws allow breaking out of the hypervisor's protections so an attacker can in theory read from other VMs on the same infrastructure not just other processes on your (virtual)server. > I've been using AMD CPUs exclusively on the desktop That doesn't protect you all that much. While this particular flaw seems from current reports to be Intel specific, some of the past ones affected AMD and Arm designs also, and maybe there are some AMD/Arm/other specific attacks waiting to be found too.
- Nursie 8y ago
  It does seem to be a(nother) good argument for a heteogenous CPU marketplace though.
- dvdkhlng 8y ago
  > That doesn't protect you all that much. While this particular flaw seems from current reports to be Intel specific, some of the past ones affected AMD and Arm designs also, and maybe there are some AMD/Arm/other specific attacks waiting to be found too. I think this is called "security through minority" which is a special case of "security through obscurity" :)
  - phkahler 8y ago
    Dont forget about meltdown.
    - dfrage 8y ago
      Only AMD has avoided Meltdown, both ARM in some CPUs, and IBM, both POWER and mainframe, have Meltdown bugs.
  - rbanffy 8y ago
    Decreasing the likelihood of being compromised is still one layer of security. It's only bad if you depend on it.
  - NullPrefix 8y ago
    That was the case with the whole "MacOS doesn't have viruses" thing.
- simion314 8y ago
  >and maybe there are some AMD/Arm/other specific attacks waiting to be found too. And maybe there is no such a flaw hiden in AMD, the certain thing is that if bad people start to use this in JS then all the people that have Intel CPUs like I have will have to do something about it , disable JS and suffer a lot of breakage or install some software patch that will decrease the performance even more on this machines. It will be interesting how this will affect the decision for what hardware to buy for cloud computers, AMD and ARM could gain new customers.
rbanffy 8y ago
> I've been using AMD CPUs exclusively on the desktop for the last 3-4 builds I've done and it sure feels nice all of a sudden Don't underestimate the ability of AMD's engineers to make similar mistakes. The exploit specifics may be different, but it's foolish to think you are safe just for not knowing whether something bad is possible or not. You can bet the people you should be afraid of know more than you.
theandrewbailey 8y ago
> Right, but these days browsers are handing over footholds to anyone with a webserver! Not only is code that isn't run (or written) the fastest code, its also the most secure. And on the web, its the most compatible. Funny, that.
vectorEQ 8y ago
amd is subject to the same issues regarding preempting execution. it's just not so in the spot light because there's no one who did a POC for it yet. Arguably with their new neuralnetwork powered branch predictor it might be more difficult to fool it, the underlying issue of the architecrutal model still exists, which is that you can learn about micro-architectural state via architectural behaviour which should never be possible within such an abstraction. these timers and behaviours also exist on AMD by design, and thus will also have similar holes. as stated by other posters though, these attacks are sso resource intensive in the sense it would be cheaper to buy some browser o-day or some other exploit to get similar results that i don't see anyone wanting to practically use such a channel to get to someone. that's like trying to convince someone their wallet belongs to you, despite the fact you can hypothetically buy a gun and tell them it is with much less effort / time invested (and thus costs)

dspillett 8y ago

> these days browsers are handing over footholds to anyone with a webserver It is bad for providers using non-dedicated cloud infrastructure too: some of these flaws allow breaking out of the hypervisor's protections so an attacker can in theory read from other VMs on the same infrastructure not just other processes on your (virtual)server. > I've been using AMD CPUs exclusively on the desktop That doesn't protect you all that much. While this particular flaw seems from current reports to be Intel specific, some of the past ones affected AMD and Arm designs also, and maybe there are some AMD/Arm/other specific attacks waiting to be found too.

Nursie 8y ago
It does seem to be a(nother) good argument for a heteogenous CPU marketplace though.
dvdkhlng 8y ago
> That doesn't protect you all that much. While this particular flaw seems from current reports to be Intel specific, some of the past ones affected AMD and Arm designs also, and maybe there are some AMD/Arm/other specific attacks waiting to be found too. I think this is called "security through minority" which is a special case of "security through obscurity" :)
- phkahler 8y ago
  Dont forget about meltdown.
  - dfrage 8y ago
    Only AMD has avoided Meltdown, both ARM in some CPUs, and IBM, both POWER and mainframe, have Meltdown bugs.
- rbanffy 8y ago
  Decreasing the likelihood of being compromised is still one layer of security. It's only bad if you depend on it.
- NullPrefix 8y ago
  That was the case with the whole "MacOS doesn't have viruses" thing.
simion314 8y ago
>and maybe there are some AMD/Arm/other specific attacks waiting to be found too. And maybe there is no such a flaw hiden in AMD, the certain thing is that if bad people start to use this in JS then all the people that have Intel CPUs like I have will have to do something about it , disable JS and suffer a lot of breakage or install some software patch that will decrease the performance even more on this machines. It will be interesting how this will affect the decision for what hardware to buy for cloud computers, AMD and ARM could gain new customers.

rbanffy 8y ago

> I've been using AMD CPUs exclusively on the desktop for the last 3-4 builds I've done and it sure feels nice all of a sudden Don't underestimate the ability of AMD's engineers to make similar mistakes. The exploit specifics may be different, but it's foolish to think you are safe just for not knowing whether something bad is possible or not. You can bet the people you should be afraid of know more than you.

theandrewbailey 8y ago

> Right, but these days browsers are handing over footholds to anyone with a webserver! Not only is code that isn't run (or written) the fastest code, its also the most secure. And on the web, its the most compatible. Funny, that.

vectorEQ 8y ago

amd is subject to the same issues regarding preempting execution. it's just not so in the spot light because there's no one who did a POC for it yet. Arguably with their new neuralnetwork powered branch predictor it might be more difficult to fool it, the underlying issue of the architecrutal model still exists, which is that you can learn about micro-architectural state via architectural behaviour which should never be possible within such an abstraction. these timers and behaviours also exist on AMD by design, and thus will also have similar holes. as stated by other posters though, these attacks are sso resource intensive in the sense it would be cheaper to buy some browser o-day or some other exploit to get similar results that i don't see anyone wanting to practically use such a channel to get to someone. that's like trying to convince someone their wallet belongs to you, despite the fact you can hypothetically buy a gun and tell them it is with much less effort / time invested (and thus costs)