3 ms·

And still to this date not single spectre attack shown to work under real world conditions. This had been the most overt blown security topic I've ever seen. A

And still to this date not single spectre attack shown to work under real world conditions. This had been the most overt blown security topic I've ever seen. All the POCs required higher help from the code being attacked: eg, known memory locations, nothing else running on the system. There still has not been a single real world exploit developed for Spectre: eg somebody attack a running server. But yet all this time and effort has gone into a theoretical toy. It is so incredibly difficult to pull this off, that is should be one of the lowest priorities. I guess it gets ink because it pushes the security issues past all the software foul ups and lets people hate on Intel. Developers gotta develop I guess. Edit: down to -3 already for expressing an opinion, and nobody really responded except for a variation of the precautionary principle. I wish more people understood that spectre isn't the bogeyman that we need to give up 5 to 15% of our CPU for (and meltdown was more of a bug and when easily patched is no worse than Spectre). Maybe I should put an encryption key in a sandboxed system and play $1000 if anybody can use Spectre to recover it? Even then it probably would shut everybody up.

mxschumacher 8y ago
> And still to this date not single spectre attack shown to work under real world conditions. I find statements like yours difficult. Can we know that something did not happen just because nobody talked about it? A vulnerability as deep and far reaching as Spectre is extremely interesting to nation-state level hacking groups as a means of warfare, we should not assume that we know about everything these actors are up to.
- gmueckl 8y ago
  But if you treat well funded actors as essentially omnipotent entities, you might just as well lie down and give up. The reality is that although we don't know everything, there cannot be all that much activity, either, or we would see many more installations of well crafted exploits and rootkits than what currently gets reported. And I would expect blackhats to go for some reliable 0 day hack with small code size rather than relying on a complex attack that first needs to read memory locations in a roundabout way to get anywhere.
  - mxschumacher 8y ago
    I'm not saying omnipotent, just much less transparent than the above comment suggests. I'm not sure how many exploits leak out of military cyber offense teams in China, Israel or the US.
icedchai 8y ago
All true. But now we're all paying the price in terms of performance "just in case".
- Ragib_Zaman 8y ago
  I turn Spectre/Meltdown protection off (download InSpectre if you run Windows). My Haswell machine gets a noticeable boost (e.g. about 5% increase in Intel XTU benchmark), but newer architectures are less negatively affected by the patches so you may not find the effort/risk to be worth it.
  - shereadsthenews 8y ago
    I am amused at the threat model that might be concerned, on one hand, with extremely complex and difficult speculation attacks, and on the other hand permits downloading random Windows apps and running them at the highest possible privilege level. Clearly the public is of two minds.
    - MrStonedOne 8y ago
      The owner of the device is not a threat actor, and trying to pass them off as one in your example is silly.
      - icedchai 8y ago
        No, but the organization providing the code could be...
username223 8y ago
I agree -- it's silly to worry about this when there's so much more low-hanging fruit, like the endless JavaScript APIs that can access more and more hardware. For example, did you know that you can turn someone's webcam into their favicon? [1] I'll bet there are some exploits lurking around there. And that's even before we get into WASM/WASI. We're piling up complexity fast enough that I doubt Spectre will ever be worth exploiting at any scale in the real world. Maybe by a state-level actor against an individual, but that's not my threat model[2]. [1] https://twitter.com/davywtf/status/1119783380734836737 https://twitter.com/davywtf/status/1119783380734836737 [2] https://www.usenix.org/system/files/1401_08-12_mickens.pdf https://www.usenix.org/system/files/1401_08-12_mickens.pdf
- fwip 8y ago
  I'm not sure that's any kind of exploit. It pops up "[website] wants to access your camera" just like any other website.
  - username223 8y ago
    I wasn't saying it was an exploit, but just an example of how, as we give JavaScript more access to our hardware and browsers, there will be unanticipated interactions between features. Those surprises have often led to exploits in the past. All JavaScript should be considered untrusted (or malicious) code, and giving it new capabilities seems like an endless source of bugs and security problems. Those will probably be easier to exploit than timing attacks.

mxschumacher 8y ago

> And still to this date not single spectre attack shown to work under real world conditions. I find statements like yours difficult. Can we know that something did not happen just because nobody talked about it? A vulnerability as deep and far reaching as Spectre is extremely interesting to nation-state level hacking groups as a means of warfare, we should not assume that we know about everything these actors are up to.

gmueckl 8y ago
But if you treat well funded actors as essentially omnipotent entities, you might just as well lie down and give up. The reality is that although we don't know everything, there cannot be all that much activity, either, or we would see many more installations of well crafted exploits and rootkits than what currently gets reported. And I would expect blackhats to go for some reliable 0 day hack with small code size rather than relying on a complex attack that first needs to read memory locations in a roundabout way to get anywhere.
- mxschumacher 8y ago
  I'm not saying omnipotent, just much less transparent than the above comment suggests. I'm not sure how many exploits leak out of military cyber offense teams in China, Israel or the US.

icedchai 8y ago

All true. But now we're all paying the price in terms of performance "just in case".

Ragib_Zaman 8y ago
I turn Spectre/Meltdown protection off (download InSpectre if you run Windows). My Haswell machine gets a noticeable boost (e.g. about 5% increase in Intel XTU benchmark), but newer architectures are less negatively affected by the patches so you may not find the effort/risk to be worth it.
- shereadsthenews 8y ago
  I am amused at the threat model that might be concerned, on one hand, with extremely complex and difficult speculation attacks, and on the other hand permits downloading random Windows apps and running them at the highest possible privilege level. Clearly the public is of two minds.
  - MrStonedOne 8y ago
    The owner of the device is not a threat actor, and trying to pass them off as one in your example is silly.
    - icedchai 8y ago
      No, but the organization providing the code could be...

username223 8y ago

I agree -- it's silly to worry about this when there's so much more low-hanging fruit, like the endless JavaScript APIs that can access more and more hardware. For example, did you know that you can turn someone's webcam into their favicon? [1] I'll bet there are some exploits lurking around there. And that's even before we get into WASM/WASI. We're piling up complexity fast enough that I doubt Spectre will ever be worth exploiting at any scale in the real world. Maybe by a state-level actor against an individual, but that's not my threat model[2]. [1] https://twitter.com/davywtf/status/1119783380734836737 https://twitter.com/davywtf/status/1119783380734836737 [2] https://www.usenix.org/system/files/1401_08-12_mickens.pdf https://www.usenix.org/system/files/1401_08-12_mickens.pdf

fwip 8y ago
I'm not sure that's any kind of exploit. It pops up "[website] wants to access your camera" just like any other website.
- username223 8y ago
  I wasn't saying it was an exploit, but just an example of how, as we give JavaScript more access to our hardware and browsers, there will be unanticipated interactions between features. Those surprises have often led to exploits in the past. All JavaScript should be considered untrusted (or malicious) code, and giving it new capabilities seems like an endless source of bugs and security problems. Those will probably be easier to exploit than timing attacks.