5 ms·
Serious question: as an average person, are those hardware security issues (rowhammer, spectre, meltdown) an actual risk? My understanding with spectre and mel
by VHRanger 3y ago
Serious question: as an average person, are those hardware security issues (rowhammer, spectre, meltdown) an actual risk?
My understanding with spectre and meltdown was that it was an issue for escaping VMs and similar attacks - something AWS engineers should care about, but not me
- transpute 3y agoFirst paragraph: This poses a significant risk as DRAM devices in the wild cannot easily be fixed, and previous work showed that Rowhammer attacks are practical, for example, in the browser, on smartphones, across VMs, and even over the network.
- ngneer 3y agoThat is just one view, namely the authors' view. You may wish to consider recent perfect 10 vulnerabilities for comparison, as these are far more likely to cause problems.
- hathawsh 3y agoFrom a security perspective, a web browser is a kind of VM hypervisor, where each web site may have its own VMs. So yes, everyone can be affected.
- gary_0 3y agoThe solution is to disable JavaScript and not run any untrusted apps. And then move to a shack in the woods and live off the land, because you just cut yourself off from modern society.
- transpute 3y agoSome browsers (including Brave on iOS) can disable Javascript by default, to be enabled only on trusted sites where 3rd-party ads are blocked.
- rtehfm 3y agoSounds like a recipe to become to the next Ted Kaczynski.
- bitwize 3y agoTed Kaczynski's views are pretty popular on Hackernews.
- rustcleaner 3y agoToo bad we won't see Uncle Ted give a TED Talk. :^(
- bee_rider 3y agoJust install Firefox, then noscript, and skip the bit about the shack.
- bee_rider 3y agoNoscript is annoying for like a week until you get the sites that you use frequently and basically trust whitelisted. Sure, it isn’t perfectly safe. If HN or my employer goes evil, they can rowhammer me I guess. I’d expect it to cause a big todo, though, so I’m not that worried about it. I don’t really understand why people seem to think disabling JS is a big hassle. Is this motivated reasoning by web devs or something? It is not a big problem, and the sort of “ambient shittiness” of the internet greatly improved by doing it. Most sites work fine, they’ll default to some (better) less dynamic state, maybe some ads won’t load. For those sites that don’t work, you can make an exception or leave. Personally I’m now mostly visiting sites by people who don’t enjoy over complicating things, and who think about fallbacks. It is great!
- spxneo 3y agoThe year is 2024. Solar panels you installed from Alibaba begins to search for cell towers. Your local instance of LLM voice bot you built to keep you company is using a malicious npm package that suddenly communicates with the solar panels and starts sending packets to a Chinese server.
- malfist 3y agoYour solar panels are talking to China, your lightswitch is part of a massive botnet promoting bitcoin on X, your car is selling your data to your insurance company to have an excuse to raise your rates, your browser is protecting your privacy by routing all your sensitive information through their servers for them to inspect. Your phone is selling your location for antiabortion fanatics to harass you, or help your stalker find you. Your ISP is selling your browsing history to anyone with a dollar. That databroker that everyone was selling too just went to bankrupt and the banks are selling your data to anyone with a penny. We desperately need wholesale privacy regulation.
- spxneo 3y agoWe have a "democracy", Yet no privacy. It's almost like the people who run the country, do not believe in democracy.
- tycho-newman 3y agoThe fact that JavaScript is essential to modern society makes me want to cry.
- berkes 3y agoI'm still not sure what's worse. The fact that I must run JavaScript written by just about anyone, in order to live in a modern society, or the fact that I keep having to write code in JavaScript in order to run a (completely non-JS related) business.
- spxneo 3y agoback in my day we had a thing called Java Applets. You had to download Java to get snowflakes on your geocities son!
- rgbrenner 3y agoYou run untrusted code everyday inside a VM: your browser.
- cortesoft 3y agoRowhammer has a javascript implementation that can run in the browser: https://github.com/IAIK/rowhammerjs https://github.com/IAIK/rowhammerjs
- ncann 3y agoThe practical answer is that, if 99.9% of people out there has system that mitigates these issues, no one will bother using these exploits in the wild and you can turn off these mitigations to get the perf benefit and be reasonably sure that you won't get exploited. Unless you're targeted of course.
- magnoliakobus 3y agoIf 99.9% of people can be exposed to the same malicious code and not even be aware that it was running in the background, it's all the more reason for a malicious actor to expose the largest amount of people to it with relatively minimal risk.
- berkes 3y agoBut "we", being the average tech expert, also has no way to know when that 1% will hit. It takes only one creative genious to turn the next security issue into a thing that does affect us all. Some worm that eats all linuxes, a virus that spreads through all bsds or something that installs crypto miners on every second android or so. We cannot know. And so we cannot defend ourselves against that. And so it's useless to worry about it. But it will happen. Our systems are way too monoculture, both soft- and hardware, to be protected against a digital potato famine.
- Tuna-Fish 3y agoBefore browsers got patched, meltdown could be used to steal browser encryption keys using js. This absolutely would have affected normal people.
- bee_rider 3y agoEveryone should install some kind of script whitelisting ad-on and only run JavaScript programs from websites that they really trust. I like noscript. I’m not sure what the Chrome pick is. Other than that… we don’t often run random programs from the internet, right? They’ve only scratched the surface for these sorts of bugs. Modern hardware is too complex to actually believe they’ll ever get them all.
- sundvor 3y agoDefinitely not a security expert here, but this is one of the reasons why I at least run ublock origin on just about everything - and recommend everyone do the same. The ad delivery networks is just such a huge vulnerability surface. Noscript would be much better of course, I guess I'm just too lazy to go that extra step.
- bee_rider 3y agoI’m not an expert either, but the I think the experts are not really very useful in this context. At least, I typically see things about the trade off between usability and security and the need to enable certain use-cases. I think most security experts work in industry where their job is to figure out what can be done to patch things up within the constraint that their job doesn’t exist unless the company can do the stuff it needs to do to stay in business. I don't really care about any of that, I just want to be able to read text from the internet without my system getting messed up. It is a much easier use-case, because static content is usually pretty safe (although I do think there have been vulnerabilities in font and image rendering libraries). We don’t need an expert to intelligently analyze things and balance against the interests of competing parties because there’s no need to push in the “open things up” direction for the most part.
- Dalewyn 3y agoIf you really are an average person, then no: Like most other supposed threats, you lose more to the fixes/mitigations than to the threat itself. They just make for great headlines and sensationalism, which is why you as an average person would hear about them at all. Note that the average person wouldn't know WTF "DRAM" means, let alone "Rowhammer" or "Zen" or other esoteric industry terms.
- ngneer 3y agoNo. As a sober hardware security researcher, most exploited vulnerabilities that would affect an average person are far more mundane and mostly software driven.
- ls612 3y agoNo. I've run the Rowhammer test in memtest86 on my PC after building it (as part of the whole memtest package to verify my XMP was stable) and got zero errors on 64GB of DDR5 memory over all the passes. If Memtest couldn't do it when trying its hardest to brute force it nobody doing drive-by javascript has any chance to exploit it.
- userbinator 3y agoCould you tell us what DIMMs you're using? I thought Rowhammer-free RAM was a thing of the past, but if some manufacturer has fixed theirs to be immune, they deserve the extra sales and publicity.
- ls612 3y agoCorsair Vengeance 2x32GB 5200Mhz. My understanding is that DDR5 in general is mostly immune to known rowhammer attacks because the on-chip ECC is good enough to fix any issues. This attack seems to work only with AMD Zen processors and not with Intel 12th-14th gen so I suspect DDR5 on intel is still good.
- AtNightWeCode 3y agoSome of these exploits can be used in a browser. They leave no trace. So it is hard to tell how much these exploits have been used in the past and how likely a wider attack will happen in the future. Some of these exploits have been used in targeted attacks towards end users so the risk is not 0.