Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

More Intel speculative execution vulnerabilities

mdsattacks.com

Post reply on HN
Print view View original

81–90 of 262 posts

Re: More Intel speculative execution vulnerabilities

#81

Post by GrayShade »

paulddraper wrote: post #32
systemdtrigger wrote: post #20

One question- do these vulnerabilities , including spectre and meltdown only help in stealing information or can they also hijack your computer to do arbitrary things?

To exploit these vulnerabilities, you already need (unprivileged, sandboxed) RCE. These vulnerabilities "only" steal information; however that information could of course be leveraged into privilege escalation or anything else.

> To exploit these vulnerabilities, you already need (unprivileged, sandboxed) RCE.

Such as running JavaScript code served by an ad network.

Re: More Intel speculative execution vulnerabilities

#82

Post by javajosh »

segfaultbuserr wrote: post #71
xucheng wrote: post #52

> We are particularly worried about Intel's mitigation plan being PoC-oriented with a complete lack of security engineering and underlying root cause analysis, with minor variations in PoCs leading to new embargoes, and these "new" vulnerabilities remaining unfixed for lengthy periods. Unfortunately, until there is sufficient public / industry pressure, there seems to be little incentive for Intel to change course, l…

Perhaps researchers can use the tested-and-proven "Full Disclosure" tactic to exert public pressure on Intel. It doesn't need to disclose everything, just two or three additional unpatched PoCs with full source code would be enough. However, unlike buffer overflow exploits, most researches on CPUs are conducted within academic institutions, doing this certainly breaches the code of conduct. Also, CPUs are the most cr…

The cynic in me thinks a good capitalist would try to sell the discovery to the highest bidder. In this case, it would probably be Intel, to "catch and kill" widespread knowledge of the exploit. Another high bidder would be an investor in position to exploit a short-term massive short on Intel stock. I imagine the payoff would be in the millions of dollars in both cases, and I doubt either scenario is even illegal.

Re: More Intel speculative execution vulnerabilities

#83

Post by pfdietz »

emerongi wrote: post #75
fyfy18 wrote: post #61

Earlier quoted context omitted.

What about companies like IBM? The company was originally foundered in 1911, but you could say their heyday wasn't until half a century later (or even more), after the original founder had left.

Not saying this happened at IBM, but sometimes correct people can be promoted into correct positions, in which case the company keeps going just fine. However, at some point any company is probably bound to promote wrong people, who will end up promoting/hiring the wrong people under them, eventually completely changing the course of the business. It seems like the death of a company is inevitable.

It also happens that the circumstances that allowed a company to dominate come to an end. It would require heroic measures to move to a new form of dominance. Why should lightning strike again in the same place?

Re: More Intel speculative execution vulnerabilities

#84

Post by segfaultbuserr »

javajosh wrote: post #82
segfaultbuserr wrote: post #71

Earlier quoted context omitted.

Perhaps researchers can use the tested-and-proven "Full Disclosure" tactic to exert public pressure on Intel. It doesn't need to disclose everything, just two or three additional unpatched PoCs with full source code would be enough. However, unlike buffer overflow exploits, most researches on CPUs are conducted within academic institutions, doing this certainly breaches the code of conduct. Also, CPUs are the most cr…

The cynic in me thinks a good capitalist would try to sell the discovery to the highest bidder. In this case, it would probably be Intel, to "catch and kill" widespread knowledge of the exploit. Another high bidder would be an investor in position to exploit a short-term massive short on Intel stock. I imagine the payoff would be in the millions of dollars in both cases, and I doubt either scenario is even illegal.

> a good capitalist would try to sell the discovery to the highest bidder.

Not all security researchers are doing it for the money, 0day markets always exist. Malicious people who wish to use the vulnerability for profit wouldn't disclose the vulnerability to begin with. So it's not a new problem.

> this case, it would probably be Intel, to "catch and kill" widespread knowledge of the exploit. Another high bidder would be an investor in position to exploit a short-term massive short

But your comment is insightful - Intel's case is unprecedented. Due to the huge impact of the vulnerabilities, the threat is not coming from the blackhat sellers or black market buyers, but Intel. Intel itself can simply pay researchers with an NDA to keep their mouths shut, while still doing nothing. The impact of the vulnerabilities is also high enough to move the stock market, allowing insider trading.

Re: More Intel speculative execution vulnerabilities

#85

Post by [deleted] »

Grangar wrote: post #73
scandinavian wrote: post #28

Earlier quoted context omitted.

There have been more Chrome/Firefox 0-days than speculative execution vulnerabilities exploitable in Javascript (0). Sure, there is a chance that the Chrome/Firefox teams missed something, but there have been sighted no exploits since the release (of spectrev1) and the browser fixes. It's not a crazy threat model to have on a personal PC, the risk is so very minimal. If your threat model is that strict you shouldn't…

Browser 0-days still often run on user priviledges. The moment you get code-execution on a vulnerable Intel CPU that turns into hardware level access. And like the other commenter said, there are also JS implementations.

[deleted]

Re: More Intel speculative execution vulnerabilities

#86

Post by S_A_P »

segfaultbuserr wrote: post #71
xucheng wrote: post #52

> We are particularly worried about Intel's mitigation plan being PoC-oriented with a complete lack of security engineering and underlying root cause analysis, with minor variations in PoCs leading to new embargoes, and these "new" vulnerabilities remaining unfixed for lengthy periods. Unfortunately, until there is sufficient public / industry pressure, there seems to be little incentive for Intel to change course, l…

Perhaps researchers can use the tested-and-proven "Full Disclosure" tactic to exert public pressure on Intel. It doesn't need to disclose everything, just two or three additional unpatched PoCs with full source code would be enough. However, unlike buffer overflow exploits, most researches on CPUs are conducted within academic institutions, doing this certainly breaches the code of conduct. Also, CPUs are the most cr…

Somewhat tangential point: having a single technological leader is a significant risk. Thankfully AMD is hitting its stride again and seems to be at least somewhat immune or less susceptible to this class of attack. Apples arm processors are approaching x64 performance in some cases.

Imagine if Intel had squashed the competition only to find their architecture is a security risk. As it is now, it really sucks to know that yet another cpu power robbing patch is coming. As a processor monolith they could set back most operations 10 years plugging security flaws. At least I feel like I have a few replacement options. However the skeptic in me feels like it’s only a matter of time that other platforms are researched with equal scrutiny.

Re: More Intel speculative execution vulnerabilities

#87

Post by AJ007 »

Mirioron wrote: post #66
xucheng wrote: post #52

> We are particularly worried about Intel's mitigation plan being PoC-oriented with a complete lack of security engineering and underlying root cause analysis, with minor variations in PoCs leading to new embargoes, and these "new" vulnerabilities remaining unfixed for lengthy periods. Unfortunately, until there is sufficient public / industry pressure, there seems to be little incentive for Intel to change course, l…

I wonder if it might not come to bite them though. Doing it this way means that the media will constantly keep talking about yet another vulnerability in Intel CPUs for years. There's a chance that Intel might and up picking a reputation like Flash did for being insecure.

In this case, the FBI and SEC may need to investigate precisely what is going on. If Intel is doing partial fixes it knows of other things that aren’t being disclosed there could be criminal activity occurring.

Additionally, this had big implications for cloud providers. If additional liabilities of data leaks are foisted on companies, insurance companies and corporate counsel may just say no more using amazon, google cloud, azure, etc.

Re: More Intel speculative execution vulnerabilities

#88

Post by [deleted] »

xucheng wrote: post #52

> We are particularly worried about Intel's mitigation plan being PoC-oriented with a complete lack of security engineering and underlying root cause analysis, with minor variations in PoCs leading to new embargoes, and these "new" vulnerabilities remaining unfixed for lengthy periods. Unfortunately, until there is sufficient public / industry pressure, there seems to be little incentive for Intel to change course, l…

[deleted]

Re: More Intel speculative execution vulnerabilities

#89

Post by pjmlp »

reacweb wrote: post #72
Mirioron wrote: post #66

Earlier quoted context omitted.

I wonder if it might not come to bite them though. Doing it this way means that the media will constantly keep talking about yet another vulnerability in Intel CPUs for years. There's a chance that Intel might and up picking a reputation like Flash did for being insecure.

Or like java applet. Oracle has killed java applet by not handling security issues in a responsible manner.

Sun...

Re: More Intel speculative execution vulnerabilities

#90

Post by Merrill »

fyfy18 wrote: post #61
cookiecaper wrote: post #50

Earlier quoted context omitted.

HP was the Google of its day when H & P were in charge. People either retire or die eventually. What happens to Google when time claims Larry and/or Sergei? Not trying to besmirch or minimize early HP by comparing to Google -- probably better to use Musk/SpaceX or something -- but IMO this is the key takeaway that doesn't seem widely discussed. Innovative companies have innovative leaders with expert-level knowledge…

What about companies like IBM? The company was originally foundered in 1911, but you could say their heyday wasn't until half a century later (or even more), after the original founder had left.

It was the unusual case of a competent son of the founder.

https://en.wikipedia.org/wiki/Thomas_Watson_Jr.

>Although the initiative, and as such much of the credit for the birth of the information revolution, must go to Tom Jr., considerable courage was also displayed by his then aging father who, despite his long commitment to internal funding, backed his son to the hilt; reportedly with the words "It is harder to keep a business great than it is to build it."

Post reply on HN