macOS 11’s hidden security improvements
blog.malwarebytes.com
macOS 11’s hidden security improvements
1–10 of 152 posts
Re: macOS 11’s hidden security improvements
#2But does it scan your pictures???
Re: macOS 11’s hidden security improvements
#3I feel absolutely violated by Apple. Privacy and Security are now words I would not associate with that brand.
Re: macOS 11’s hidden security improvements
#4> NO_SMT disables Simultaneous multithreading (SMT), the CPU feature better known under Intel’s trade name of “Hyper-Threading”. SMT allows a CPU core to execute two or more threads at the same time, for improved performance at the cost of contention for per-core resources, such as caches, TLBs etc.
> Letting multiple threads share invisible resources carries the risk of letting a malicious thread steal secrets from a “sibling” thread running on the same core—a risk that over the years has materialized into multiple attacks, like TLBleed, PortSmash, Fallout, ZombieLoad, RIDL. A straightforward mitigation for this entire family of attacks, past and future, is then to simply disable SMT, which is what NO_SMT does.
BAHAHA cperciva was right! It’s a decade later and people care now! Linus didn’t care at the time!
I’m on mobile otherwise I’d link to relevant refs, but it was an “I told you so” 10 years in the making. Maybe longer? When was cperciva’s cache stealing research?
Re: macOS 11’s hidden security improvements
#5But can it ignore your firewall settings?
Re: macOS 11’s hidden security improvements
#6> NO_SMT disables Simultaneous multithreading (SMT), the CPU feature better known under Intel’s trade name of “Hyper-Threading”. SMT allows a CPU core to execute two or more threads at the same time, for improved performance at the cost of contention for per-core resources, such as caches, TLBs etc. > Letting multiple threads share invisible resources carries the risk of letting a malicious thread steal secrets from…
Discussed here:
https://news.ycombinator.com/item?id=16082909
cperciva's paper from 2005 (linked above):
Re: macOS 11’s hidden security improvements
#7But does it scan your pictures???
It ingests but it doesn’t exhale.
Re: macOS 11’s hidden security improvements
#8I'd be interested to hear from someone with deep security knowledge:
Some people have dismissed OpenBSD's mitigations as overhyped (i.e. - things like W^X are not the main problem, linux has long caught up, etc).
But now we see Apple adding precisely some of these mitigations.
Where does this leave such architectural countermeasures? Are there real gains from investing in such low-level things? Are they irrelevant in an age where many laptops still have ports that give direct DMA access, users are not savvy and sandboxes incomplete?
Re: macOS 11’s hidden security improvements
#9> NO_SMT disables Simultaneous multithreading (SMT), the CPU feature better known under Intel’s trade name of “Hyper-Threading”. SMT allows a CPU core to execute two or more threads at the same time, for improved performance at the cost of contention for per-core resources, such as caches, TLBs etc. > Letting multiple threads share invisible resources carries the risk of letting a malicious thread steal secrets from…
Discussed here: https://news.ycombinator.com/item?id=16082909 cperciva's paper from 2005 (linked above): http://www.daemonology.net/papers/htt.pdf
Hmm. That commenter’s username seems familiar…
Thanks. :)
> The problems introduced by caches have been further exacerbated by the current trend towards increased parallelism. On recent processors implementing simultaneous multithreading [18], such as Intel’s “Hyper- Threading” processors [11], access to the L1 cache is shared between two independent instruction streams
And here we are 16 years later, with NO_SMT. Neat.
Perhaps my emotional outburst wasn’t substantive, but boy was it satisfying. I’ll try to restrain such urges in the future, but somehow I doubt a 16 year “told ya so” will pop up again any time soon. It’s half as old as I am.
I wish I could remember Linus’ remark about cperciva’s attack being merely “theoretical.”
Re: macOS 11’s hidden security improvements
#10Very hidden. The 11.5.2 patch from last week had no release notes (https://eclecticlight.co/2021/08/15/last-week-on-my-mac-trus...), and Apple replied to inquiries with "No further details on the Big Sur 11.5.2 update will be released" (https://twitter.com/ClassicII_MrMac/status/14256327792624312...).