131–140 of 204 posts
I wonder at what point we will finally give up on trying to make a stable implementation of speculative execution.
My reading implies you need actual code execution already? As you need to be able lay down the actual auth instruction that you want to force? (Eg nothing so horrific as simply running js) Hahah, ok now I have a much better understanding. It requires an existing path to arbitrary code execution, and a buffer overflow or some such in kernel space. So yes this does defeat one part of the M1 defensive system, which is c…
Spreading paranoia is how the security industry has always operated. It is its incentive, after all.
The attack itself however seems like it’s fairly close to requiring true arbitrary code execution (the earlier spec. Execution bugs could be unit from “correct” JS).
Earlier quoted context omitted.
Something definitely went wrong here though that more guidance was not provided to the tech journalists. Most of the mainstream articles make it seem like they a) did not read the paper b) are incapable of understanding the paper c) were not provided any guidance about what any of this actually means in the real world. Which is all scary as the paper is well written and very accessible IMO.
Welcome to tech journalism.
"Apple is DOOMED!"
"Turn off your iPhone, Apple's security BUSTED!"
I wonder at what point we will finally give up on trying to make a stable implementation of speculative execution.
I wonder at what point we will finally give up on all these "mitigations" which are otherwise pure bloat without the presence of an actual attack, and seem like they don't make things all that much harder even when there is one.
Earlier quoted context omitted.
Hi! I think I can clear a few things up here. Our goal is to demonstrate that we can learn the PAC for a kernel pointer from userspace. Just demonstrating that this is even possible is a big step in understanding of how mitigations like pointer authentication can be thought of in the spectre era. We do not aim to be a zero day, but instead aim to be a way of thinking about attacks/ an attack methodology. The timer us…
You didn't clear up anything about publicizing this heavily in mainstream press before it's been reviewed by your peers.
I wonder at what point we will finally give up on trying to make a stable implementation of speculative execution.
Any reason they aren't using formal verification for this kind of thing? It would seem like a very worthy investment.
The author is here and ought to make it all clear but if you google the title of the article you can download the paper already despite everyone being coy about it and the ACM not having published it yet. It's kind of ridiculous it's getting this kind of press before the paper is officially published and available. If the paper was published and security experts were allowed to analyze it before the tech press went n…
right, ok? as Snowden thankfully heroically warned us, the NSA already has root-level access to most devices.
“ Remember the Spectre vulnerability. Now we have more than 7 variants of Spectre. No one guarantees that new, more destructive versions of this vulnerability will not be discovered in the future.”
> If someone can find a way to do this without installing kexts then it becomes way more serious.
right, yeah, you’re onto the right trail now.
My reading implies you need actual code execution already? As you need to be able lay down the actual auth instruction that you want to force? (Eg nothing so horrific as simply running js) Hahah, ok now I have a much better understanding. It requires an existing path to arbitrary code execution, and a buffer overflow or some such in kernel space. So yes this does defeat one part of the M1 defensive system, which is c…
but the way the article portrays it is absurd. Spreading paranoia is how the security industry has always operated. It is its incentive, after all.
* A few years old now I guess
Earlier quoted context omitted.
Something definitely went wrong here though that more guidance was not provided to the tech journalists. Most of the mainstream articles make it seem like they a) did not read the paper b) are incapable of understanding the paper c) were not provided any guidance about what any of this actually means in the real world. Which is all scary as the paper is well written and very accessible IMO.
> It's kind of ridiculous it's getting this kind of press > Something definitely went wrong here though Both of these have the same reason: it's about Apple. I know someone that avoids telling people that they work at Apple, to avoid similar drama.