Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

iPhone update for Meltdown-Spectre: before/after performance benchmarks

melv1n.com

Post reply on HN
Print view View original

11–20 of 119 posts

Re: iPhone update for Meltdown-Spectre: before/after performance benchmarks

#11

Post by 2bitencryption »

this leads me to a couple questions, hopefully you smart folk can answer:

1. I thought Spectre was "Intel-only", and Meltdown was the general case, which is less severe but effectively nearly everywhere? If so, how is an iPhone susceptible to Spectre?

2. Beyond that, I thought meltdown/spectre was an x86 problem. So why all this trouble on phones, with ARM?

3. I've read the first, simplest variant of meltdown, and it is so beautifully simple. Is this "speculative execution + cache timing" thing an entirely novel exploit, or have we seen incarnations of this before?

Re: iPhone update for Meltdown-Spectre: before/after performance benchmarks

#12

Post by tibu »

tn_ wrote: post #8

This might sound dumb but.. with these Meltdown + Spectre bugs would an attacker be able to penetrate to gain full access only if a user downloads a native app or would it be possible through the browser/js?

As far I remember JS exploit is possible. That's why Mozilla patched Firefox already.

Re: iPhone update for Meltdown-Spectre: before/after performance benchmarks

#13

Post by neilsimp1 »

tn_ wrote: post #8

This might sound dumb but.. with these Meltdown + Spectre bugs would an attacker be able to penetrate to gain full access only if a user downloads a native app or would it be possible through the browser/js?

This post, which I saw on HN yesterday, may answer some of that for you:

https://webkit.org/blog/8048/what-spectre-and-meltdown-mean-...

Short answer: yes.

Re: iPhone update for Meltdown-Spectre: before/after performance benchmarks

#15

Post by [deleted] »

2bitencryption wrote: post #11

this leads me to a couple questions, hopefully you smart folk can answer: 1. I thought Spectre was "Intel-only", and Meltdown was the general case, which is less severe but effectively nearly everywhere? If so, how is an iPhone susceptible to Spectre? 2. Beyond that, I thought meltdown/spectre was an x86 problem. So why all this trouble on phones, with ARM? 3. I've read the first, simplest variant of meltdown, and it…

[deleted]

Re: iPhone update for Meltdown-Spectre: before/after performance benchmarks

#16

Post by intopieces »

StringyBob wrote: post #10

Wow. After ios 10.2.1 halved performance on my iphone 6 due to the battery issues, I next avoided 11.0 as I accepted responsiveness would be slower on the older iphone6 model. Now if we want these security fixes that's another -40%... Yikes! However, it looks like ios 11.2.2 and a new battery is still slightly faster than ios 10.3.3 and an old battery! (geekbench single/multi core score from article of 924/1616 vs my…

I don't understand this logic at all. The fixes are being made for a reason... avoiding the update just means you are getting more performance for a less secure system. Are you betting on a law of averages to break in your favor? Hoping you're not a target of hackers? what am I missing with this strategy?

Re: iPhone update for Meltdown-Spectre: before/after performance benchmarks

#17

Post by bluedino »

>> a significant decrease in performance on the iPhone 6 up to 50%

Something's up. I updated my 6S yesterday and have noticed zero in performance changes or battery loss. Still plenty of bugs though, I was reading an email and the 'flag/file/trash/reply/new' bar totally went away. At least the touchscreen hasn't gone unresponsive, causing me to have to hit sleep/wake to toggle it back on. Maybe they finally fixed that.

Re: iPhone update for Meltdown-Spectre: before/after performance benchmarks

#18

Post by Scaevolus »

2bitencryption wrote: post #11

this leads me to a couple questions, hopefully you smart folk can answer: 1. I thought Spectre was "Intel-only", and Meltdown was the general case, which is less severe but effectively nearly everywhere? If so, how is an iPhone susceptible to Spectre? 2. Beyond that, I thought meltdown/spectre was an x86 problem. So why all this trouble on phones, with ARM? 3. I've read the first, simplest variant of meltdown, and it…

1. is reversed: meltdown is intel-only. Spectre is a more generic speculation attack.

2. Apple's custom ARM chips have extensive speculative execution, and clearly their fixes for it are extremely expensive.

3. It's novel, which is why security researchers are so excited! Branching based side-channel attacks were previously only known to be able to track execution (so branch-based AES encryption was vulnerable to having its keys stolen)-- but reading arbitrary data is much stronger.

Re: iPhone update for Meltdown-Spectre: before/after performance benchmarks

#19

Post by qeternity »

2bitencryption wrote: post #11

this leads me to a couple questions, hopefully you smart folk can answer: 1. I thought Spectre was "Intel-only", and Meltdown was the general case, which is less severe but effectively nearly everywhere? If so, how is an iPhone susceptible to Spectre? 2. Beyond that, I thought meltdown/spectre was an x86 problem. So why all this trouble on phones, with ARM? 3. I've read the first, simplest variant of meltdown, and it…

Re: #2 - it’s a speculative execution issue, not x86 specific.

Re: iPhone update for Meltdown-Spectre: before/after performance benchmarks

#20

Post by [deleted] »

2bitencryption wrote: post #11

this leads me to a couple questions, hopefully you smart folk can answer: 1. I thought Spectre was "Intel-only", and Meltdown was the general case, which is less severe but effectively nearly everywhere? If so, how is an iPhone susceptible to Spectre? 2. Beyond that, I thought meltdown/spectre was an x86 problem. So why all this trouble on phones, with ARM? 3. I've read the first, simplest variant of meltdown, and it…

[deleted]
Post reply on HN