Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Meltdown Update Kernel doesnt boot

bugs.launchpad.net

Post reply on HN
Print view View original

131–140 of 205 posts

Re: Meltdown Update Kernel doesnt boot

#131

Post by eli_gottlieb »

Animats wrote: post #113
throwawayfinal wrote: post #67

Earlier quoted context omitted.

I think it's absolutely unreasonable to imply that this was intentional. Besides the massive amount of complexity these systems have, there are plenty of "legitimate" places to hide backdoors, instead of in a performance architecture decision. Keep in mind that whatever "evil agencies" would have asked for this would most likely find themselves vulnerable, and nobody would sign off on. I do agree, however, the "secur…

The Intel Management Engine is a backdoor. Speed variations in speculative execution are an inherent property of the technology. Until recently, few people thought this was exploitable, and it took a lot of work to figure out how to exploit this.

If any quantity about what the processor does, outside the intended effect, has a different distribution when X happens versus Y, then the distribution of that quantity is exploitable. Period.

Any nonuniform distribution in any quantity that is not part of the spec is exploitable!

Re: Meltdown Update Kernel doesnt boot

#132

Post by monk_e_boy »

jnordwick wrote: post #124
brokenmachine wrote: post #48

Earlier quoted context omitted.

I watched that spy demo. How does it know what memory location contains the password being typed?

It appears to be known to the exploit. I feel that this is being so overblown and that the exploits we are seeing require more info that something in the wild would have.

Code in the wild would have access to all memory (slowly) so could eventually find the correct location.

Given that whoever writes is would also have access to the other program, they would have a lot more information on where to look in memory.

Re: Meltdown Update Kernel doesnt boot

#133

Post by monk_e_boy »

brokenmachine wrote: post #74
KallDrexx wrote: post #51

Earlier quoted context omitted.

I'm assuming if you know either common byte patterns or string patterns you might be able to figure out where the password string is being allocated and watch that area of memory for changes.

Not sure if Meltdown is the same, but I read that Spectre can recover memory at about 10kb/sec. So it wouldn't be very efficient to scan the entire memory for a known pattern. I suppose if there was an exploit targeted at a specific program, it would be possible to work out what location the secrets are stored in?

I leave my machine on for weeks at a time. If something was scanning the memory even if it failed to find the location of my password 99.9% before it is erased eventually it will be lucky and get it.

Re: Meltdown Update Kernel doesnt boot

#134

Post by drb91 »

andrewflnr wrote: post #118
drb91 wrote: post #99

Earlier quoted context omitted.

It does if you have something at 0x0. Or, to put it another way, I have no clue to what you're referring--what do references have to do with "The Billion Dollar Mistake"[0]? [0]: https://en.wikipedia.org/wiki/Tony_Hoare#Apologies_and_retra... EDIT: my apologies, that joke was actually pretty good.

I think it was supposed to be a pun on "hold". As for the word "reference", your own link uses it.

I use it in a later comment! I was confused about the word in context.

However, I completely missed the pun. Cheers :)

Re: Meltdown Update Kernel doesnt boot

#135

Post by drb91 »

MBCook wrote: post #121
drb91 wrote: post #99

Earlier quoted context omitted.

It does if you have something at 0x0. Or, to put it another way, I have no clue to what you're referring--what do references have to do with "The Billion Dollar Mistake"[0]? [0]: https://en.wikipedia.org/wiki/Tony_Hoare#Apologies_and_retra... EDIT: my apologies, that joke was actually pretty good.

I think it was supposed to be a joke.

Yes, thank you.

Re: Meltdown Update Kernel doesnt boot

#136

Post by Animats »

andrewflnr wrote: post #116
Animats wrote: post #113

Earlier quoted context omitted.

The Intel Management Engine is a backdoor. Speed variations in speculative execution are an inherent property of the technology. Until recently, few people thought this was exploitable, and it took a lot of work to figure out how to exploit this.

You do realize those are ideal properties for a backdoor, don't you? If you were writing the spec for a dream backdoor, you would write that down. The only way you could improve it would be "everyone thinks it's impossible, and they never figure it out."

Yes, though it's moderately hard to exploit against a specific target. It's more useful for bulk attacks - getting everyone who visits a specific web site to run a DDOS attack, or ransomware.

Re: Meltdown Update Kernel doesnt boot

#137

Post by paulddraper »

drb91 wrote: post #86
gkya wrote: post #20

Would this entire Meltdown/Spectre thing count as the biggest mess-up of computing history? When yesterday the PoC repo was posted here, the spy.mp4 demo video gave me some chills. And now I can't update my OS before making an installation USB because Canonical can't just follow Linus' releases. Thanks.

I think that title is currently held (deserved or not) by null pointers. Tbh it’s not the most meaningful of statements, but it’s food for thought.

"The Billion Dollar Mistake"

https://www.lucidchart.com/techblog/2015/08/31/the-worst-mis...

Re: Meltdown Update Kernel doesnt boot

#138

Post by brokenmachine »

monk_e_boy wrote: post #133
brokenmachine wrote: post #74

Earlier quoted context omitted.

Not sure if Meltdown is the same, but I read that Spectre can recover memory at about 10kb/sec. So it wouldn't be very efficient to scan the entire memory for a known pattern. I suppose if there was an exploit targeted at a specific program, it would be possible to work out what location the secrets are stored in?

I leave my machine on for weeks at a time. If something was scanning the memory even if it failed to find the location of my password 99.9% before it is erased eventually it will be lucky and get it.

Good point. I was only thinking about a single run but that makes sense.

Re: Meltdown Update Kernel doesnt boot

#139

Post by flukus »

rlanday wrote: post #108
Consultant32452 wrote: post #80

Earlier quoted context omitted.

Boxed Intel processors carry a 3 year warranty. It certainly seems reasonable for everyone who bought a CPU within the last 3 years to expect a warranty replacement with the manufacturer defect fixed. In the EU virtually every product comes with a 2 year warranty. So every CPU sold in the EU in the last two years should be replaced for free by Intel, even through OEMs. I wonder what potential class action lawsuits In…

Any sufficiently complex CPU surely contains some number of defects, perhaps even serious security defects, just as any sufficiently complex piece of software contains bugs and security holes. I wouldn't be surprised if someone tries to sue Intel over this, or even if they win, but this is way outside the scope of what a warranty would traditionally cover, which in the case of a CPU would be hardware failure. If a wa…

> but this is way outside the scope of what a warranty would traditionally cover

The warranty and any other legalese from intel is irrelevant here, this is about consumer protection laws of various countries that supersede an intel warranty. A serious post sale drop in performance would be enough for a refund on any computer purchased in many countries. In Australia if I bought a computer 6 months ago I'd be entitled to take it back to the store for a refund, then it's up to them to argue with dell and dell to argue with intel.

> Note that the cost of overly onerous regulation (e.g. requiring that every computer manufacturer replace these chips even though the problems can largely be worked around in software) is of course passed onto consumers.

Demanding that a product works and in lieu of that offering a replacement or refund is not overly onerous regulation, it's a very basic standard protection.

Re: Meltdown Update Kernel doesnt boot

#140

Post by 1stranger »

dbenhur wrote: post #114
ask098 wrote: post #2

it's the fault of Intel, why don't they recall all the CPU? just like vehicle company

Most vehicle recalls are not of the form: return your vehicle, we give you a new fixed one; but rather: bring your vehicle to one of our dealers and they'll perform some action to repair the defect. The later is pretty analogous to issuing firmware and OS patches to mitigate the flaw.

What if the fix to the car reduced your MPG by 30% to address a safety issue? This seems somewhat analogous to the number being bandied about as the CPU performance decrease. (Depends on workload, etc, etc.) I think most car owners would expect some kind of compensation for a product that no longer has the same efficiency as when they bought it.
Post reply on HN