15 ms·
GoFetch: New side-channel attack using data memory-dependent prefetchers
- woadwarrior01 3y agoReminded me of the Augury attack[1] from 2022, which also exploits the DMP prefetcher on Apple Silicon CPUs. [1]: https://www.prefetchers.info https://www.prefetchers.info
- loeg 3y agoYes, they specifically mention that in the article and FAQ.
- Findecanor 3y agoBTW. Three of the authors of GoFetch where also behind Augury.
- martinky24 3y agoWhy does every attack needs its own branding, marketing page, etc...? Genuine question.
- xena 3y agoSo people talk about it
- sapiogram 3y agoWell, names are useful for the same reason people's names are useful. The rest just kinda happens naturally, I think.
- yborg 3y agoYes, it saves time vs. starting a discussion on "that crypto cache sidechannel attack that one team in China found".
- martinky24 3y agoName makes enough sense. "Branding, marketing page, etc..." was my question. "Happens naturally" isn't really an answer.
- ziddoap 3y agoIs your position that any write-up about an attack must be plain text only, and must not use its own URL? I truly cannot understand why this is brought up so often. You aren't paying for it, it doesn't hurt you in any way, it detracts nothing from the findings (in fact, it makes the findings easier to discuss), etc. There is no downside I can think of. Can you share what the downsides of a picture of a puppy and a $5 domain are? Sorry, "branding" and "marketing page"? Or at least, maybe you can share what you think would be a more preferable way?
- fruktmix 3y agoIt's science these days. They need funding, one way is to get people to recognize the importance of their work
- modeless 3y agoScience isn't just about discovering information. Dissemination is critical. Communicating ideas is just as important as discovering them and promotion is part of effective communication. It's natural and healthy for researchers to promote their ideas.
- deleted 3y ago[deleted]
- FiloSottile 3y agoNames are critical to enable discussion. The "marketing" page is where documentation is. Summaries that don't require reading a whole academic papers are a good thing, and they are the place where all the different links are collected. Same reason software has READMEs. Logos... are cute and take 10-60 minutes? If you spend months on some research might as well take the satisfaction of giving it a cute logo, why not.
- m0rshu 3y ago[dead]
- deleted 3y ago[deleted]
- saagarjha 3y agoWhy does the comments of every such attack need a question about why it has its own branding, marketing page, etc…? Genuine question. (Seriously, this comes up every time, just do a search for it if you actually want to figure out why.)
- 0xedd 3y agoBecause it makes it feel like you need some marketing department if you want to publish your work. Rather than give _only_ the work merit, we give too much merit to its colorful presentation. That shouldn't be the case.
- howinteresting 3y agoGood communication has always been a part of making sure your work is influential.
- 12_throw_away 3y agoDunno, but I'm glad they do it. In other fields of research, researchers often purposely hold off on naming something, so that the community kind of has no choice but to name it after the authors themselves. Eg in my field, they would have called Spectre "the Horn-Genkin-Hamburg vulnerability" or something. Which one of these is hard-to-remember jargon, and which one is catchy and evocative?
- jerf 3y agoAs long as we're getting efficiency cores and such, maybe we need some "crypto cores" added to modern architectures, that make promises specifically related to constant time algorithms like this and promise not to prefetch, branch predict, etc. Sort of like the Itanium, but confined to a "crypto processor". Given how many features these things wouldn't have, they wouldn't be much silicon for the cores themselves, in principle. This is the sort of thing that would metaphorically drive me to drink if I were implementing crypto code. It's an uphill battle at the best of times, but even if I finally get it all right, there's dozens of processor features both current and future ready to blow my code up at any time.
- deleted 3y ago[deleted]
- deleted 3y ago[deleted]
- bee_rider 3y agoOne option would be for people to stop downloading viruses and then running them.
- SpaghettiCthulu 3y agoExcept when these vulnerabilities are exploitable from JavaScript in your web browser.
- FiloSottile 3y agoSpeaking as a cryptography implementer, yes, these drive us up the wall. However, crypto coprocessors would be a tremendously disruptive solution: we'd need to build mountains of scaffolding to allow switching to and off these cores, and to share memory with them, etc. Even more critically, you can't just move the RSA multiplication to those cores and call it a day. The key is probably parsed from somewhere, right? Does the parser need to run on a crypto core? What if it comes over the network? And if you even manage to protect all the keys, what if a CPU side channel leaks the message you encrypted? Are you ok with it just because it's not a key? The only reason we don't see these attacks against non-crypto code is that finding targets is very application specific, while in crypto libraries everyone can agree leaking a key is bad. No, processor designers "just" need to stop violating assumptions, or at least talk to us before doing it.
- theobservor 3y agoThe end result of these side channel attacks would be to have CPUs that perform no optimizations at all and all opcodes would run in the same number of cycles in all situations. But that will never happen. No one wants a slow CPU. As long as these effects cannot be exploited remotely, it's not a concern. Of course multi-tenant cloud-based virtualization would be a no go.
- bee_rider 3y agoWe need to drop all the untrusted code on some horrible in-order, no speculative execution, no prefetching, 5 stage pipeline from architectures 101 class core.
- graemep 3y agoIt might be preferable. We have ridiculously fast hardware. In many use cases (client machines in particular) we do not usually really need that. I would gladly drop features for security.
- bee_rider 3y agoIt will also be good because users will become more annoyed when people try to sneak full programs into their websites, hopefully resulting in a generally less bloated internet.
- kbolino 3y agoIf you account for all of the CPU "features" that can be exploited, you're looking at probably 80% of what makes it "ridiculously fast". If you also account for all of the ways in which the entire modern hardware ecosystem can be exploited, you're probably looking at gross performance loss of over 90% to remove these "holes". An overclocked 486 PC that can only run a single program at a time and isn't continuously connected to a network might be very secure, but replacing every modern computer with something like it will not be even remotely feasible. In most situations, it would be better to have some risk tolerance, and couple modern hardware with mitigations, disposability, and supply-chain security instead.
- xiconfjs 3y agoFrom the paper: "OpenSSL reported that local side-channel attacks (...) fall outside of their threat model. The Go Crypto team considers this attack to be low severity".
- lxgr 3y agoAt least one Go crypto developer publicly expressed concern about this very issue in 2021: https://github.com/golang/go/issues/49702 https://github.com/golang/go/issues/49702
- yuedongze 3y ago[flagged]
- john_alan 3y agoOn reading it seems a lib like libsodium can simply set the disable bit prior to cryptographic operations that are sensitive on M3 and above. Also looks like they need to predetermine aspects of the key. Very cool but I don’t think it looks particularly practical.
- saagarjha 3y ago> Can the DMP be disabled? > Yes, but only on some processors. We observe that the DIT bit set on m3 CPUs effectively disables the DMP. This is not the case for the m1 and m2. Surely there is a chicken bit somewhere to do this?
- john_alan 3y agoI’ve often wondering how are these bits set? Like can you do it from Swift? Or need assembly?
- saagarjha 3y agoIt's probably in a MSR accessible from the kernel?
- lxgr 3y agoIt seems to be userspace accessible: https://developer.apple.com/documentation/xcode/writing-arm64-code-for-apple-platforms#Enable-DIT-for-constant-time-cryptographic-operations https://developer.apple.com/documentation/xcode/writing-arm6... The kernel would have to be aware of it in order to be able to restore its state across context switches though, unless it's part of a set of registers that is automatically persisted. But given that Apple is publicly documenting this flag, I suppose it is. Here's an interesting conversation by the Go developers from as early as 2021 being suspicious of DIT: https://github.com/golang/go/issues/49702 https://github.com/golang/go/issues/49702
- Shtirlic 3y agoIs it naive to ask whether implementing this mitigation would impact performance and memory interaction speed?
- d-z-m 3y agowhat's the attack vector here? access to an encrypt oracle and co-location on the target machine?
- 0xedd 3y agoWhy does Apple have so many hardware backd... innocent bugs?
- olliej 3y agowhy do we even need caches? why do we need prefetchers? But in answer to your bullshit backdoor conspiracy theory (JFC processors have caches and timing variants because people want fast CPUs, you cannot have constant time and fast, apple is not the only company with prefetchers), here's some apple provided documentation on how disable the hardware backd... enable constant time operations specifically for the purpose of cryptography, almost like it's designed into the hardware. So weird. https://developer.apple.com/documentation/xcode/writing-arm64-code-for-apple-platforms#Enable-DIT-for-constant-time-cryptographic-operations https://developer.apple.com/documentation/xcode/writing-arm6...
- howinteresting 3y agoThe M1 and M2 don't have that bit.
- m0rshu 3y agoSame reason Intel and AMD had Meltdown and Specter.
- olliej 3y agoIf you're writing cryptographic routines you should either use the platform cryptography libraries, or follow the documentation: https://developer.apple.com/documentation/xcode/writing-arm64-code-for-apple-platforms#Enable-DIT-for-constant-time-cryptographic-operations https://developer.apple.com/documentation/xcode/writing-arm6...
- deleted 3y ago[deleted]
- slowmovintarget 3y agoSo malware scanning and virus scanners just became relevant for Macs and IPads. (Compromise must be running on the same hardware.)