4 ms·

When I read about these kind of things I am reminded of this James Mickens quote "Unfortunately, large swaths of the security community are fixated on avant ga

When I read about these kind of things I am reminded of this James Mickens quote "Unfortunately, large swaths of the security community are fixated on avant garde horrors such as the fact that, during solar eclipses, pacemakers can be remotely controlled with a garage door opener and a Pringles can. It’s definitely unfor- tunate that Pringles cans are the gateway to an obscure set of Sith-like powers that can be used against the 0.002% of the population that has both a pacemaker and bitter enemies in the electronics hobbyist community. However, if someone is motivated enough to kill you by focusing electromagnetic energy through a Pringles can, you probably did something to deserve that. I am not saying that I want you dead, but I am saying that you may have to die so that researchers who study per-photon HMACs for pacemaker transmitters can instead work on making it easier for people to generate good passwords." I feel like the same thing applies when we are talking about these kind of attacks. I mean right now the latest version of express currently has a dependency on a library that has a known RCE. I mean listen 99% of us work in a company where if someone wanted to steal our information they'd pay the janitor $500 to grab it on his way out. Is this really a huge priority?

coldpie 3y ago
Yes, I have the same feeling about the SPECTRE mitigations, for example. No one is going to be attacking my home Linux box with SPECTRE (has anyone ever been attacked with SPECTRE?), but by default they remove like 10+% CPU performance, just in case. I disabled the mitigations.
- SV_BubbleTime 3y ago
  I think the threat there isn’t someone else attacking their VM to get to your machine - but that there was at least some proof of concept over JavaScript remotely. But otherwise I agree.
  - monocasa 3y ago
    There's also netspectre which remotely attacks a kernel with malformed network packets. https://arxiv.org/abs/1807.10535 https://arxiv.org/abs/1807.10535
  - coldpie 3y ago
    > but that there was at least some proof of concept over JavaScript remotely Yeah, but that's exactly the rube goldberg kinda thing the quote in the OP is parodying. The threat is IF I come across a hostile page, AND I'm running a specific web browser with the right JS properties, AND I am also running the right security-critical software, AND the attacker can correctly guess the memory layout, AND the JS runs for long enough to pull enough bytes to actually be meaningful, AND the attacker can connect the meaningful secret with whatever purpose it's intended for, AND the attacker can pull my legit data out with all the false positives they're getting from running an un-targeted website, THEN they can maybe like log into my old AOL account or something. It just isn't going to happen. There are usecases where SPECTRE is a meaningful attack (shared hosting being the obvious one), but a normal end-user machine? Nah. Certainly not likely enough to nuke 10% CPU perf on every machine by default.
    - paulmd 3y ago
      > AND the attacker can correctly guess the memory layout AMD has several unpatched vulnerabilities that leak the memory layout/page table mappings, effectively nullifying KASLR as well. they can be mitigated by KPTI, but AMD ships that in a disabled state by default because of the performance implications (with ryzen's reliance on giant caches, flushing caches every time they make a syscall would be even more disastrous for them than for Intel, so they cheat and ship insecure-by-default). The rest of that sentence is just an overwrought description of running a javascript segment in a web browser, there's nothing load-bearing there to prevent an attack.
- supriyo-biswas 3y ago
  For multi tenant environments like a provider running VMs, preventing speculative execution attacks is a priority; otherwise someone can literally see what another tenant is doing (and there are attack demos demonstrating it). Furthermore, the entire concept of paging and virtual memory is built around the concept of not letting one process see what the other one is doing; the described attacks in the prime+probe/flush+reload attacks are quite practical and could let some JS on a website steal passwords (though the information leak rate is a little lower than what you generally get by outright stealing credential files using malware, though that tends to show up on EDRs, whereas speculative execution attacks just show up as memory access patterns with fewer cache hits than what’s expected.) If we’re to say that you don’t need isolation, we could just drop paging and every process just have a view of every other process.
  - dataflow 3y ago
    > the entire concept of paging and virtual memory is built around the concept of not letting one process see what the other one is doing... If we’re to say that you don’t need isolation, we could just drop paging and every process just have a view of every other process. This seems to be moving goalposts. It's like saying curtains were built around the idea of not letting one person see inside a house, so the moment IR sensors (or Wi-Fi or radar or whatever) start being able to see in the house, everyone might as well just remove their curtains.
- bee_rider 3y ago
  Yeah I think these sort of attacks only matter to people who run random code sent by untrusted parties on their machines. But I mean that includes Amazon and everybody that browses the web with JavaScript enabled, so I guess it is a pretty big population that might be interested?
  - coldpie 3y ago
    If your threat model now requires a browser in the chain, then we can fix it in the browser, no? https://blog.mozilla.org/security/2018/01/03/mitigations-landing-new-class-timing-attack/ https://blog.mozilla.org/security/2018/01/03/mitigations-lan... https://security.googleblog.com/2018/07/mitigating-spectre-with-site-isolation.html https://security.googleblog.com/2018/07/mitigating-spectre-w... Still safe at full CPU perf.
    - bee_rider 3y ago
      I don’t think I’ve described a threat model, just given and example of a single vector that is pretty widespread. I just assume processes on my system can get root if they really want.
  - G3rn0ti 3y ago
    Yes, but Spectre was easily fixed by limiting the accuracy of the Browsers’ window.Performance interface AFIR. Meltdown on the other hand required a Kernel patch and a general performance penalty. I also have all meltdown mitigations turned off in the Kernel on my Laptop.
- SomeoneFromCA 3y ago
  Well it is in a way like "herd immunity" - if everyone around has mitigations on, no one would bother to use it as an attack vector. If everyone would for some reason start disabling mitigations, then the bug will stasrt getting exploited.
SV_BubbleTime 3y ago
I’ve always thought it a little odd the janitor threat model is called Evil Maid. Perhaps because maid is a household thing and using encryption and authn/z schemes to stop it is less likely in an informal home environment?
- moyix 3y ago
  IIRC the name refers more to cleaning staff at a hotel, who would have access to your laptop while you’re out of the room.
- quacksilver 3y ago
  I was under the impression that it usually referred to the 'maid' in a hotel room cleaning service, when rooms were cleaned more regularly before COVID. If you were away on business somewhere sketchy, the cleaning service could physically access your room and your documents / laptop in an at rest state, potentially without you knowing. This could be particularly a concern years ago if the country that you were in was hostile and the cleaning crews in major hotels had embedded state security (the other side of the iron curtain than you were from or something)
  - SV_BubbleTime 3y ago
    Hmm, well, I suppose I see my home cleaning lady more than I travel! Fair enough.
- GuB-42 3y ago
  Maybe that's my interpretation but when I think "maid", I thing of someone who can access my bedroom, a private space. When I think "janitor" I think more of public spaces where I would be less inclined to leave my stuff unattended and where it would be easier for the evildoer to get caught. In other words, a maid would be a more trusted and therefore more powerful attacker than a janitor.
chunk_waffle 3y ago
> Is this really a huge priority? It is for people who rent out slices of a computer to a bunch of different people and promise that the script kiddie that lives on the same machine as you can't steal your members-only cat photos (e.g. cloud providers.)
- supriyo-biswas 3y ago
  Also anyone who runs JavaScript, since they work across processes.
- gustavus 3y ago
  Like yes hypothetically they could do that. But being an info sec person what I can tell you is much more likely is that 2 years ago a developer was having a bug that he fixed by downgrading the library that interacted with the database. It turned out there was a vulnerability in that version of the library allowing SQL injection, but now that is a core piece of business functionality and no cycles can be spared till "next sprint" which will never come because the company is still a scrappy startup that moves fast and break things. (Despite now having 100 developers and millions in revenue) then someone finds out and can exfiltrate your entire DB in about 20 minutes with automated tools. Or what is more realistic is that they send an email to Sarah the the CEOs PA that says she needs to grant access to "John Smith" and she puts in her username and credentials in the corresponding link. Then those credentials are used to access GitHub (of course the secretary has GitHub access because one time the CEO wanted to look at something and couldn't so now he demands his secretary has full GitHub access) and then they find the root db username and password because after it was accidentally committed the intern decided just to delete it and put in a new commit because he didn't want to get in trouble. That attack took 10 minutes and an email. My point being is if you are running something that is so secure it needs to be protected from this kind of hypothetical attack, while in that case you're probably already paying for a dedicated instance in the first place.
bane 3y ago
https://xkcd.com/538/ https://xkcd.com/538/
- withinboredom 3y ago
  My son was asking me how I hacked into things back in the day. I told him 95% of it is literally just talking to people and asking for the thing you want. You don't even have to lie because most people never even thought to ask "why." Well, the older generation didn't. I've noticed most younger people will ask "why", even when it is obvious.
coldpie 3y ago
Thank you so much for that quote. I found the original article[1] from 2014 and it is perhaps the best computer security article I have ever read. [1] https://www.usenix.org/system/files/1401_08-12_mickens.pdf https://www.usenix.org/system/files/1401_08-12_mickens.pdf
- makeworld 3y ago
  Fantastic.
- autoexec 3y ago
  I half expected the article to be a single page telling the reader in a large font to never open PDF files linked to by random users on internet forums. It isn't that, but I wouldn't have been mad if it had been.
- pests 3y ago
  On one hand, I agree. On the other, we do have examples of nation states killing journalists and other people with the use of security bugs in applications. No one really knows when they're being targeted by nation state or when they fall into that category.... but when they do, they won't just being doing things to your email. see: https://www.theguardian.com/world/2021/jul/18/nso-spyware-used-to-target-family-of-jamal-khashoggi-leaked-data-shows-saudis-pegasus https://www.theguardian.com/world/2021/jul/18/nso-spyware-us...
LeifCarrotson 3y ago
It's a matter of scale. If you or I individually have a moderately clever and determined local enemy, with access to an average garage toolbox and some commodity PC accessories, who is not afraid of legal consequences for stealing your information...it would take a lot less than $500 to get your information. The difference, and the reason this exploit is a big deal, is that a huge swath of our economy and society is in The Cloud. There are extremely, extremely clever enemies who (like our local hypothetical) are unafraid of legal consequences, because they're protected by online anonymity and possibly thousands of miles of open ocean and countries without extradition treaties. But they're not determined in the slightest! If it takes 60 seconds or costs $0.06 to break your unique configuration it's not worth it to them. It doesn't concern me that my coworker has a coffee cup in their desk drawer that contains sticky notes for some of their most important passwords. By the time there's a human being inside our building digging through desk drawers, we've pissed someone off far too much for that to be the weak link. I am concerned that said coworker does not use the same password on their pizza delivery app as they do on our work accounts, because it's only a matter of time before the former suffers a leak of ten million plaintext password-email combos, and tries pointing automated ransomware at all of the associated domains.
Traubenfuchs 3y ago
> However, if someone is motivated enough to kill you by focusing electromagnetic energy through a Pringles can, you probably did something to deserve that. Someone who isn't me picked up archery with the express purpose of shooting either their completely innocent and reigthous ex partner and/or their ex partners new partner during their wedding, so I would not say effort made to kill someone equates to them deserving it.
deleted 3y ago
[deleted]
api 3y ago
As with many other areas of development, sexy stuff often edges out practical stuff for attention. A lot of this comes from the natural tendency of engineers to be interested in sexy stuff, and a lot of it comes from career advancement and the desire to pad your resume out with impressive looking projects to show how smart you are.
kragen 3y ago
this is what people thought about buffer-overflow attacks back in the 80s and, unaccountably, 90s: theoretical but not practical if you haven't been following computer security, exploiting buffer overflows has been routine and widespread for decades, and on one notable occasion in the 80s morris's worm used one to take down most of the internet at once by accident
adrian_b 3y ago
RowHammer/RowPress are scarier than most other attacks, because they expose the fact that the memory chips do not behave as advertised, i.e. they do not keep the promise to return on reading the bits that have been written into them, even if their datasheet specifications are not violated. Unlike any other attacks, the memory access patterns used by RowHammer/RowPress may happen when some program is run, without any intention, accidentally, and such an event would cause memory corruption. Even if such access patterns are very unlikely, it would be an unreasonable burden for programmers to analyze all the programs, to be able to guarantee that such memory access patterns can never happen, especially taking into account that the actual access pattern can vary non-deterministically, due to out-of-order execution and interaction between concurrent threads. The only acceptable solution is for the memory producers to improve their products so that their datasheets will correspond to their real behavior.
RicoElectrico 3y ago
Somebody here on HN pointed out there's a security researcher constantly pumping out side-channel attacks that are hard to pull off but sound sensational - and making PR around it that makes the rounds on the internet including HN.

coldpie 3y ago

Yes, I have the same feeling about the SPECTRE mitigations, for example. No one is going to be attacking my home Linux box with SPECTRE (has anyone ever been attacked with SPECTRE?), but by default they remove like 10+% CPU performance, just in case. I disabled the mitigations.

SV_BubbleTime 3y ago
I think the threat there isn’t someone else attacking their VM to get to your machine - but that there was at least some proof of concept over JavaScript remotely. But otherwise I agree.
- monocasa 3y ago
  There's also netspectre which remotely attacks a kernel with malformed network packets. https://arxiv.org/abs/1807.10535 https://arxiv.org/abs/1807.10535
- coldpie 3y ago
  > but that there was at least some proof of concept over JavaScript remotely Yeah, but that's exactly the rube goldberg kinda thing the quote in the OP is parodying. The threat is IF I come across a hostile page, AND I'm running a specific web browser with the right JS properties, AND I am also running the right security-critical software, AND the attacker can correctly guess the memory layout, AND the JS runs for long enough to pull enough bytes to actually be meaningful, AND the attacker can connect the meaningful secret with whatever purpose it's intended for, AND the attacker can pull my legit data out with all the false positives they're getting from running an un-targeted website, THEN they can maybe like log into my old AOL account or something. It just isn't going to happen. There are usecases where SPECTRE is a meaningful attack (shared hosting being the obvious one), but a normal end-user machine? Nah. Certainly not likely enough to nuke 10% CPU perf on every machine by default.
  - paulmd 3y ago
    > AND the attacker can correctly guess the memory layout AMD has several unpatched vulnerabilities that leak the memory layout/page table mappings, effectively nullifying KASLR as well. they can be mitigated by KPTI, but AMD ships that in a disabled state by default because of the performance implications (with ryzen's reliance on giant caches, flushing caches every time they make a syscall would be even more disastrous for them than for Intel, so they cheat and ship insecure-by-default). The rest of that sentence is just an overwrought description of running a javascript segment in a web browser, there's nothing load-bearing there to prevent an attack.
supriyo-biswas 3y ago
For multi tenant environments like a provider running VMs, preventing speculative execution attacks is a priority; otherwise someone can literally see what another tenant is doing (and there are attack demos demonstrating it). Furthermore, the entire concept of paging and virtual memory is built around the concept of not letting one process see what the other one is doing; the described attacks in the prime+probe/flush+reload attacks are quite practical and could let some JS on a website steal passwords (though the information leak rate is a little lower than what you generally get by outright stealing credential files using malware, though that tends to show up on EDRs, whereas speculative execution attacks just show up as memory access patterns with fewer cache hits than what’s expected.) If we’re to say that you don’t need isolation, we could just drop paging and every process just have a view of every other process.
- dataflow 3y ago
  > the entire concept of paging and virtual memory is built around the concept of not letting one process see what the other one is doing... If we’re to say that you don’t need isolation, we could just drop paging and every process just have a view of every other process. This seems to be moving goalposts. It's like saying curtains were built around the idea of not letting one person see inside a house, so the moment IR sensors (or Wi-Fi or radar or whatever) start being able to see in the house, everyone might as well just remove their curtains.
bee_rider 3y ago
Yeah I think these sort of attacks only matter to people who run random code sent by untrusted parties on their machines. But I mean that includes Amazon and everybody that browses the web with JavaScript enabled, so I guess it is a pretty big population that might be interested?
- coldpie 3y ago
  If your threat model now requires a browser in the chain, then we can fix it in the browser, no? https://blog.mozilla.org/security/2018/01/03/mitigations-landing-new-class-timing-attack/ https://blog.mozilla.org/security/2018/01/03/mitigations-lan... https://security.googleblog.com/2018/07/mitigating-spectre-with-site-isolation.html https://security.googleblog.com/2018/07/mitigating-spectre-w... Still safe at full CPU perf.
  - bee_rider 3y ago
    I don’t think I’ve described a threat model, just given and example of a single vector that is pretty widespread. I just assume processes on my system can get root if they really want.
- G3rn0ti 3y ago
  Yes, but Spectre was easily fixed by limiting the accuracy of the Browsers’ window.Performance interface AFIR. Meltdown on the other hand required a Kernel patch and a general performance penalty. I also have all meltdown mitigations turned off in the Kernel on my Laptop.
SomeoneFromCA 3y ago
Well it is in a way like "herd immunity" - if everyone around has mitigations on, no one would bother to use it as an attack vector. If everyone would for some reason start disabling mitigations, then the bug will stasrt getting exploited.

SV_BubbleTime 3y ago

I’ve always thought it a little odd the janitor threat model is called Evil Maid. Perhaps because maid is a household thing and using encryption and authn/z schemes to stop it is less likely in an informal home environment?

moyix 3y ago
IIRC the name refers more to cleaning staff at a hotel, who would have access to your laptop while you’re out of the room.
quacksilver 3y ago
I was under the impression that it usually referred to the 'maid' in a hotel room cleaning service, when rooms were cleaned more regularly before COVID. If you were away on business somewhere sketchy, the cleaning service could physically access your room and your documents / laptop in an at rest state, potentially without you knowing. This could be particularly a concern years ago if the country that you were in was hostile and the cleaning crews in major hotels had embedded state security (the other side of the iron curtain than you were from or something)
- SV_BubbleTime 3y ago
  Hmm, well, I suppose I see my home cleaning lady more than I travel! Fair enough.
GuB-42 3y ago
Maybe that's my interpretation but when I think "maid", I thing of someone who can access my bedroom, a private space. When I think "janitor" I think more of public spaces where I would be less inclined to leave my stuff unattended and where it would be easier for the evildoer to get caught. In other words, a maid would be a more trusted and therefore more powerful attacker than a janitor.

chunk_waffle 3y ago

> Is this really a huge priority? It is for people who rent out slices of a computer to a bunch of different people and promise that the script kiddie that lives on the same machine as you can't steal your members-only cat photos (e.g. cloud providers.)

supriyo-biswas 3y ago
Also anyone who runs JavaScript, since they work across processes.
gustavus 3y ago
Like yes hypothetically they could do that. But being an info sec person what I can tell you is much more likely is that 2 years ago a developer was having a bug that he fixed by downgrading the library that interacted with the database. It turned out there was a vulnerability in that version of the library allowing SQL injection, but now that is a core piece of business functionality and no cycles can be spared till "next sprint" which will never come because the company is still a scrappy startup that moves fast and break things. (Despite now having 100 developers and millions in revenue) then someone finds out and can exfiltrate your entire DB in about 20 minutes with automated tools. Or what is more realistic is that they send an email to Sarah the the CEOs PA that says she needs to grant access to "John Smith" and she puts in her username and credentials in the corresponding link. Then those credentials are used to access GitHub (of course the secretary has GitHub access because one time the CEO wanted to look at something and couldn't so now he demands his secretary has full GitHub access) and then they find the root db username and password because after it was accidentally committed the intern decided just to delete it and put in a new commit because he didn't want to get in trouble. That attack took 10 minutes and an email. My point being is if you are running something that is so secure it needs to be protected from this kind of hypothetical attack, while in that case you're probably already paying for a dedicated instance in the first place.

bane 3y ago

https://xkcd.com/538/ https://xkcd.com/538/

withinboredom 3y ago
My son was asking me how I hacked into things back in the day. I told him 95% of it is literally just talking to people and asking for the thing you want. You don't even have to lie because most people never even thought to ask "why." Well, the older generation didn't. I've noticed most younger people will ask "why", even when it is obvious.

coldpie 3y ago

Thank you so much for that quote. I found the original article[1] from 2014 and it is perhaps the best computer security article I have ever read. [1] https://www.usenix.org/system/files/1401_08-12_mickens.pdf https://www.usenix.org/system/files/1401_08-12_mickens.pdf

makeworld 3y ago
Fantastic.
autoexec 3y ago
I half expected the article to be a single page telling the reader in a large font to never open PDF files linked to by random users on internet forums. It isn't that, but I wouldn't have been mad if it had been.
pests 3y ago
On one hand, I agree. On the other, we do have examples of nation states killing journalists and other people with the use of security bugs in applications. No one really knows when they're being targeted by nation state or when they fall into that category.... but when they do, they won't just being doing things to your email. see: https://www.theguardian.com/world/2021/jul/18/nso-spyware-used-to-target-family-of-jamal-khashoggi-leaked-data-shows-saudis-pegasus https://www.theguardian.com/world/2021/jul/18/nso-spyware-us...

LeifCarrotson 3y ago

It's a matter of scale. If you or I individually have a moderately clever and determined local enemy, with access to an average garage toolbox and some commodity PC accessories, who is not afraid of legal consequences for stealing your information...it would take a lot less than $500 to get your information. The difference, and the reason this exploit is a big deal, is that a huge swath of our economy and society is in The Cloud. There are extremely, extremely clever enemies who (like our local hypothetical) are unafraid of legal consequences, because they're protected by online anonymity and possibly thousands of miles of open ocean and countries without extradition treaties. But they're not determined in the slightest! If it takes 60 seconds or costs $0.06 to break your unique configuration it's not worth it to them. It doesn't concern me that my coworker has a coffee cup in their desk drawer that contains sticky notes for some of their most important passwords. By the time there's a human being inside our building digging through desk drawers, we've pissed someone off far too much for that to be the weak link. I am concerned that said coworker does not use the same password on their pizza delivery app as they do on our work accounts, because it's only a matter of time before the former suffers a leak of ten million plaintext password-email combos, and tries pointing automated ransomware at all of the associated domains.

Traubenfuchs 3y ago

> However, if someone is motivated enough to kill you by focusing electromagnetic energy through a Pringles can, you probably did something to deserve that. Someone who isn't me picked up archery with the express purpose of shooting either their completely innocent and reigthous ex partner and/or their ex partners new partner during their wedding, so I would not say effort made to kill someone equates to them deserving it.

deleted 3y ago

[deleted]

api 3y ago

As with many other areas of development, sexy stuff often edges out practical stuff for attention. A lot of this comes from the natural tendency of engineers to be interested in sexy stuff, and a lot of it comes from career advancement and the desire to pad your resume out with impressive looking projects to show how smart you are.

kragen 3y ago

this is what people thought about buffer-overflow attacks back in the 80s and, unaccountably, 90s: theoretical but not practical if you haven't been following computer security, exploiting buffer overflows has been routine and widespread for decades, and on one notable occasion in the 80s morris's worm used one to take down most of the internet at once by accident

adrian_b 3y ago

RowHammer/RowPress are scarier than most other attacks, because they expose the fact that the memory chips do not behave as advertised, i.e. they do not keep the promise to return on reading the bits that have been written into them, even if their datasheet specifications are not violated. Unlike any other attacks, the memory access patterns used by RowHammer/RowPress may happen when some program is run, without any intention, accidentally, and such an event would cause memory corruption. Even if such access patterns are very unlikely, it would be an unreasonable burden for programmers to analyze all the programs, to be able to guarantee that such memory access patterns can never happen, especially taking into account that the actual access pattern can vary non-deterministically, due to out-of-order execution and interaction between concurrent threads. The only acceptable solution is for the memory producers to improve their products so that their datasheets will correspond to their real behavior.

RicoElectrico 3y ago

Somebody here on HN pointed out there's a security researcher constantly pumping out side-channel attacks that are hard to pull off but sound sensational - and making PR around it that makes the rounds on the internet including HN.