Hertzbleed Attack
hertzbleed.com
Hertzbleed Attack
1–10 of 406 posts
Re: Hertzbleed Attack
#2Brilliant approach, really. Never occurred to me to try something like this!
Are you affected? Very likely. What can you do about it? Nerf your CPU performance by disabling "turbo boost" or equivalent. Should you do it? Probably not unless you're particularly vulnerable (journalist, human rights activist, etc.)
One thing I found interesting that may get changed later, so I'm documenting it here, is in their FAQ they say:
> Why did Intel ask for a long embargo, considering they are not deploying patches? > > Ask Intel.
So Intel did ask for a long embargo, then apparently did nothing about it. My guess is they investigated "can we actually mitigate this thing with a microcode update?" and arrived at the conclusion after actually trying - or possibly after external influences were exerted (you be the judge) - that no, there's not much you can really do about this one.
Later in the document another FAQ says:
> [...] Both Cloudflare and Microsoft deployed the mitigation suggested by De Feo et al. (who, while our paper was under the long Intel embargo, independently re-discovered how to exploit anomalous 0s in SIKE for power side channels). [...]
Which is again telling us that there indeed WAS a long embargo placed on this research by Intel.
Only mentioning this here just in case the PR spin doctors threaten the researchers into removing mention of Intel on this one. Which honestly I hope doesn't happen because my interpretation is that Intel asked for that long embargo so they could investigate really fixing the problem (state agencies have more methods at their disposal and wouldn't need much time to exert influence over Intel if they decided to). Which speaks well of them IMO. But then again, not everybody's going to come to that same conclusion which is why I'm slightly concerned those facts may get memory-holed.
Re: Hertzbleed Attack
#3Brilliant approach, really. Never occurred to me to try something like this! Are you affected? Very likely. What can you do about it? Nerf your CPU performance by disabling "turbo boost" or equivalent. Should you do it? Probably not unless you're particularly vulnerable (journalist, human rights activist, etc.) One thing I found interesting that may get changed later, so I'm documenting it here, is in their FAQ they…
> What can you do about it? Nerf your CPU performance by disabling "turbo boost" or equivalent. Should you do it? Probably not unless you're particularly vulnerable (journalist, human rights activist, etc.)
The most likely to be targeted (and probably easiest to target) systems are probably cloud hosts. This might be an argument for disabling frequency scaling and fixing clock speed on cloud VM hosts or bare metal servers.
Less of a performance hit there too since those tend to run at a sustained max anyway, and turbo boost can be problematic in those environments due to heat. It can reduce overall throughput in a sustained load scenario.
Re: Hertzbleed Attack
#4My first highly amateur idea was to modify the frequency scaling algorithm with some randomness. How stupid is my idea?
Re: Hertzbleed Attack
#5Does this mean that an evil process may gain information about a foreign process by measuring its own execution speed variations?
Re: Hertzbleed Attack
#6I'm mind-blown at this vuln being exploitable remotely. How is that possible?
Re: Hertzbleed Attack
#7My first highly amateur idea was to modify the frequency scaling algorithm with some randomness. How stupid is my idea?
I guess it depends on how much randomness you need to effectively mask the signal.
Re: Hertzbleed Attack
#8At first I thought it had something to do with the company Hertz...
Re: Hertzbleed Attack
#9My first highly amateur idea was to modify the frequency scaling algorithm with some randomness. How stupid is my idea?
Any noise strong enough to have a good chance of hiding the signal would completely defeat the benefit of having dynamic frequency scaling in the first place, I think.
Re: Hertzbleed Attack
#10I'm not too much of a cryptography expert. How do I know if I'm using a
> constant-time cryptographic library
?
Edit: thanks everyone, I just wasn't familiar with the terminology.