3 ms·

There was never a real world exploit that did anything like that. They were all POCs that read data from themselves under ideal conditions.

saagarjha 4y ago
That’s because mitigations were rolled out very quickly.
- icedchai 4y ago
  True, though I find it hard to believe there are still no real world exploits.
  - saagarjha 4y ago
    There might be! But I haven’t heard of anything publicly yet.
    - lazide 4y ago
      There is very little incentive for victims OR assailants to let anyone know if it has.
bravetraveler 4y ago
Say that were true - you knew all of the valued zero-days, attacks, etc - and determined nothing happened yet The plan for the future is... what? Pray that nobody ever makes it practical? I'm not saying anyone should lose sleep, that's silly - but disregarding a vector because there haven't been demonstrations in the wild is also silly. The first, and then likely a collection, will be discovered and traded on black markets. Eventually it'll leak, and then we'll know about it.
- icedchai 4y ago
  I feel that exfiltrating memory at a few hundred bytes/sec makes it extremely impractical. You'll be looking for a needle in a haystack. There are easier, faster attacks available. I won't lose sleep over it.
  - inetknght 4y ago
    > I feel that exfiltrating memory at a few hundred bytes/sec makes it extremely impractical. You'll be looking for a needle in a haystack. Do you seriously trust it to be like looking for a needle in a haystack? That haystack becomes much much smaller if you know where to look. An excellent adversary would know a lot about kernel memory and what data to get. Grab a few bytes for a pointer... grab a few more bytes for another pointer offset from the first... just a few pointers and now you're at the secret storage arena. A few hundred bytes/sec is just a few hundred bytes/sec away from gaining sensitive information.
    - icedchai 4y ago
      If you can directly de-reference kernel memory, sure. If you have that capability, why do you need this exploit? I'm still skeptical.
      - paulmd 4y ago
        Haha, speaking of Linus’s carefree attitude towards leaving dangerous things unattended because they are not imminently threatening”, this is an opportune moment to point out that AMD has a series of unpatched vulnerabilities (Take-A-Way and PREFETCH, both by Moritz Lipp of Spectre/Meltdown fame) that leak kernel page table mappings as well, unless you enable KPTI, which AMD continues to push as off-by-default due to performance impact. So on an AMD system you indeed know exactly where to look to get into kernel memory. The processor will just tell you where to look.
        userbinator 4y ago
        Suppose you know that data of interest is at address X. Now how do you propose actually reading that specific address from e.g. JS running in a browser? IMHO having that much knowledge of the system you're attacking means you're not likely to need the side-channel anyway.
- nwiswell 4y ago
  High-value zero days like what you're describing would not get wasted on stealing bank information from random working schlubs like us. I think it is a reasonable approach to personal information security to focus on ensuring that you are robust to families of exploits which have concrete proof of concept in practice, and not wasting calories worrying about stuff that is (for the time being) mostly theoretical. This advice obviously does not apply if you are protecting valuable corporate IP, or a repository of personal information, or god forbid national security secrets.
  - bravetraveler 4y ago
    Oh, definitely - it wouldn't be used for trivial things like that, at least not for quite a while. [Edit: hopefully having better mitigations in hardware by then] My comment didn't follow the thread particularly well, I wasn't so much worried about the everyday person - just that this could be weaponized [against someone/thing] My worry about this really goes as far as... keep the mitigations enabled. That's it. A lot of people disable them today because they're aren't dangerous today - if nothing else, offering a countering opinion to change that trend.
  - BeefWellington 4y ago
    > High-value zero days like what you're describing would not get wasted on stealing bank information from random working schlubs like us. I used to believe this was true. Then someone who had access to post tweets as very famous public figures used it to steal bitcoin.
- rowanG077 4y ago
  The people wanting to make it practical certainly won't use something as crude and slow as Spectre or Meltdown or this. They just own your entire system.

saagarjha 4y ago

That’s because mitigations were rolled out very quickly.

icedchai 4y ago
True, though I find it hard to believe there are still no real world exploits.
- saagarjha 4y ago
  There might be! But I haven’t heard of anything publicly yet.
  - lazide 4y ago
    There is very little incentive for victims OR assailants to let anyone know if it has.

bravetraveler 4y ago

Say that were true - you knew all of the valued zero-days, attacks, etc - and determined nothing happened yet The plan for the future is... what? Pray that nobody ever makes it practical? I'm not saying anyone should lose sleep, that's silly - but disregarding a vector because there haven't been demonstrations in the wild is also silly. The first, and then likely a collection, will be discovered and traded on black markets. Eventually it'll leak, and then we'll know about it.

icedchai 4y ago
I feel that exfiltrating memory at a few hundred bytes/sec makes it extremely impractical. You'll be looking for a needle in a haystack. There are easier, faster attacks available. I won't lose sleep over it.
- inetknght 4y ago
  > I feel that exfiltrating memory at a few hundred bytes/sec makes it extremely impractical. You'll be looking for a needle in a haystack. Do you seriously trust it to be like looking for a needle in a haystack? That haystack becomes much much smaller if you know where to look. An excellent adversary would know a lot about kernel memory and what data to get. Grab a few bytes for a pointer... grab a few more bytes for another pointer offset from the first... just a few pointers and now you're at the secret storage arena. A few hundred bytes/sec is just a few hundred bytes/sec away from gaining sensitive information.
  - icedchai 4y ago
    If you can directly de-reference kernel memory, sure. If you have that capability, why do you need this exploit? I'm still skeptical.
    - paulmd 4y ago
      Haha, speaking of Linus’s carefree attitude towards leaving dangerous things unattended because they are not imminently threatening”, this is an opportune moment to point out that AMD has a series of unpatched vulnerabilities (Take-A-Way and PREFETCH, both by Moritz Lipp of Spectre/Meltdown fame) that leak kernel page table mappings as well, unless you enable KPTI, which AMD continues to push as off-by-default due to performance impact. So on an AMD system you indeed know exactly where to look to get into kernel memory. The processor will just tell you where to look.
      - userbinator 4y ago
        Suppose you know that data of interest is at address X. Now how do you propose actually reading that specific address from e.g. JS running in a browser? IMHO having that much knowledge of the system you're attacking means you're not likely to need the side-channel anyway.
nwiswell 4y ago
High-value zero days like what you're describing would not get wasted on stealing bank information from random working schlubs like us. I think it is a reasonable approach to personal information security to focus on ensuring that you are robust to families of exploits which have concrete proof of concept in practice, and not wasting calories worrying about stuff that is (for the time being) mostly theoretical. This advice obviously does not apply if you are protecting valuable corporate IP, or a repository of personal information, or god forbid national security secrets.
- bravetraveler 4y ago
  Oh, definitely - it wouldn't be used for trivial things like that, at least not for quite a while. [Edit: hopefully having better mitigations in hardware by then] My comment didn't follow the thread particularly well, I wasn't so much worried about the everyday person - just that this could be weaponized [against someone/thing] My worry about this really goes as far as... keep the mitigations enabled. That's it. A lot of people disable them today because they're aren't dangerous today - if nothing else, offering a countering opinion to change that trend.
- BeefWellington 4y ago
  > High-value zero days like what you're describing would not get wasted on stealing bank information from random working schlubs like us. I used to believe this was true. Then someone who had access to post tweets as very famous public figures used it to steal bitcoin.
rowanG077 4y ago
The people wanting to make it practical certainly won't use something as crude and slow as Spectre or Meltdown or this. They just own your entire system.