Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

MIT researchers uncover ‘unpatchable’ flaw in Apple M1 chips

techcrunch.com

Post reply on HN
Print view View original

61–70 of 204 posts

Re: MIT researchers uncover ‘unpatchable’ flaw in Apple M1 chips

#61

Post by rc_mob »

gruturo wrote: post #53
yosito wrote: post #48

Earlier quoted context omitted.

So not the "last line of defense"?

It is. It's just that compromising the last line of defense, without compromising the ones which come before it, is not the end of the world. It's like if I could wave a magnet over your encrypted backup tapes, ruining your restore capability, but without having any ability to affect your production and DR sites. You'd rather it didn't happen, but you are still up and even have redundancy.

lol. apparently the article title is "technically the truth"

Re: MIT researchers uncover ‘unpatchable’ flaw in Apple M1 chips

#62

Post by nimbius »

rs_rs_rs_rs_rs wrote: post #45
api wrote: post #32

Seems like if this were successful it would weaken the extra security provided by pointer authentication, at worse weakening it to the level of a CPU without pointer authentication like the x86_64 chips they used to use. So not great but not catastrophic. Or am I missing something?

You're right, that's exactly what this is. Just a way to defeat a defense in depth measure. This vulnerability it's useless by itself.

This is a dangerous position to hold. this vulnerability aids in reducing the overall security posture of the OS so its quite valuable. it improves an adversaries opportunities and however limited, still advances the potential for system compromise.

Infosec isnt just home runs, it is iterative, cumulative progress toward a shared goal. things like this are what ultimately led to XBox and Playstation jailbreaks.

Re: MIT researchers uncover ‘unpatchable’ flaw in Apple M1 chips

#63

Post by api »

nimbius wrote: post #62
rs_rs_rs_rs_rs wrote: post #45

Earlier quoted context omitted.

You're right, that's exactly what this is. Just a way to defeat a defense in depth measure. This vulnerability it's useless by itself.

This is a dangerous position to hold. this vulnerability aids in reducing the overall security posture of the OS so its quite valuable. it improves an adversaries opportunities and however limited, still advances the potential for system compromise. Infosec isnt just home runs, it is iterative, cumulative progress toward a shared goal. things like this are what ultimately led to XBox and Playstation jailbreaks.

This is correct, but at the same time it's important to not overhype every single vulnerability as the end of the world. Unfortunately some security people seem incentivized to do that, and it causes a "crying wolf" problem. Serious end of the world announcements should be reserved for serious end of the world vulnerabilities.

This is a vulnerability that reduces the security of the Apple Silicon platform to being closer to on par with the immediate prior platform that Apple is actually still selling.

Re: MIT researchers uncover ‘unpatchable’ flaw in Apple M1 chips

#64

Post by rs_rs_rs_rs_rs »

tester756 wrote: post #56
gruturo wrote: post #53

Earlier quoted context omitted.

It is. It's just that compromising the last line of defense, without compromising the ones which come before it, is not the end of the world. It's like if I could wave a magnet over your encrypted backup tapes, ruining your restore capability, but without having any ability to affect your production and DR sites. You'd rather it didn't happen, but you are still up and even have redundancy.

>is not the end of the world. today, how many years it took the theory to be applied in "real world" with other cpu vulns

I don't think you understand this vulnerability.

This will not become Spectre-like in 10 years from now.

The impact will be the same as it is today.

Re: MIT researchers uncover ‘unpatchable’ flaw in Apple M1 chips

#65

Post by MBCook »

ben7799 wrote: post #34

The author is here and ought to make it all clear but if you google the title of the article you can download the paper already despite everyone being coy about it and the ACM not having published it yet. It's kind of ridiculous it's getting this kind of press before the paper is officially published and available. If the paper was published and security experts were allowed to analyze it before the tech press went n…

Once you can get someone to install your kext aren’t you basically at game over anyway?

Or do they have strong limits as well?

Re: MIT researchers uncover ‘unpatchable’ flaw in Apple M1 chips

#66

Post by danaris »

api wrote: post #63
nimbius wrote: post #62

Earlier quoted context omitted.

This is a dangerous position to hold. this vulnerability aids in reducing the overall security posture of the OS so its quite valuable. it improves an adversaries opportunities and however limited, still advances the potential for system compromise. Infosec isnt just home runs, it is iterative, cumulative progress toward a shared goal. things like this are what ultimately led to XBox and Playstation jailbreaks.

This is correct, but at the same time it's important to not overhype every single vulnerability as the end of the world. Unfortunately some security people seem incentivized to do that, and it causes a "crying wolf" problem. Serious end of the world announcements should be reserved for serious end of the world vulnerabilities. This is a vulnerability that reduces the security of the Apple Silicon platform to being cl…

...in certain, very restricted circumstances.

Re: MIT researchers uncover ‘unpatchable’ flaw in Apple M1 chips

#67

Post by xxpor »

cosmiccatnap wrote: post #10

I wonder at what point we will finally give up on trying to make a stable implementation of speculative execution.

The moment someone wants to take the economic hit of a decade+ of performance progress.

IOW, not gonna happen.

I could see coprocessors becoming more popular though. We already have AES-NI, what if the sensitive keys never ended up in CPU cache because the CPU never had to see them? Specialized HW could not have speculative execution. Granted, that doesn't prevent seeing the plain text of something that's decrypted. It's all about the threat model and what tradeoffs you're willing to make.

And that's why Intel et al haven't completely abandoned speculative execution. For the vast vast vast majority of people, the security issues they're much more likely to deal with are straight up getting scammed. Not 0 days, and especially not insane stuff like this. Unless you can turn it into a zero-click iMessage bug (or similar), meh.

Re: MIT researchers uncover ‘unpatchable’ flaw in Apple M1 chips

#69

Post by azakai »

api wrote: post #32

Seems like if this were successful it would weaken the extra security provided by pointer authentication, at worse weakening it to the level of a CPU without pointer authentication like the x86_64 chips they used to use. So not great but not catastrophic. Or am I missing something?

Correct. And, in general, I don't think this worsens it to the level of a CPU without PAC. It still takes effort to do this, since like SPECTRE, you need the ability to measure time, and you need to spend a significant amount of CPU power to get a useful signal.

Definitely an impressive result, and it certainly reduces the usefulness of PAC, but I'd guess PAC is still going to prevent a significant number of attacks.

Post reply on HN