36 ms·
Whitepaper is behind a wall, so I can't read it, but I assume it is another in the large and growing class of explits that cannot practically be exploited like
by jnordwick 7y ago
Whitepaper is behind a wall, so I can't read it, but I assume it is another in the large and growing class of explits that cannot practically be exploited like Spectre or the load-store buffer that didn't stand a snowballs chance in Hell or creating a workable exploit that didn't' require immense cooperation from the target (literally accessing the same address in a loop and and nothing else).
Still no spectre exploit (or even attempt) found in the wild. There should have been something by now.
If anybody has access to the POC code I would love to see it. Until (and probably after I see how laughable it is), I'll assume this is just a press release by some security company.
- wademealing 7y agoI believe that this (SWAPGS) vector is impractical but previous spectre proof of concepts exists if you look hard enough.
- jnordwick 7y agoI have never seen one that would work in the wild. I don't think it is possible. We've had plenty of time to see something somewhere, but nothing. I gone through the papers, read other code, I've seen nothing that didn't require help from the target. I don't accept the general hand waving "they keep getting better" because they haven't. Most of these the exfiltration rate is so slow that simply xor'ing the secret with a random seed that changes locations or moving the memory around itself would prevent any attack.
- edwintorok 7y agoMeltdown rate was quite a bit higher than the other exploits.
- jnordwick 7y agomeltdown is different and clearly a microcode bug that is easily fixed. i don't include it with the other side-channel "attacks" that seem to come out every other week.
- mschuster91 7y ago> literally accessing the same address in a loop and and nothing else All you need for this is Javascript with Web Workers to run effectively multithreaded.