Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

MDS: Microarchitectural Data Sampling side-channel vulnerabilities in Intel CPUs

mdsattacks.com

Post reply on HN
Print view View original

11–20 of 118 posts

Re: MDS: Microarchitectural Data Sampling side-channel vulnerabilities in Intel CPUs

#11

Post by compiler-guy »

rightbyte wrote: post #8
StudentStuff wrote: post #3

Hyper-Threading has been a source of security concerns for a decade now, and vulnerabilities in existing HT implementations have been trickling out over the last few years. Unlike Management Engine or TrustZone, at least we can disable Hyper-Threading (for a 30% performance hit).

The security concern is remote code execution via JS, and sharing processor time with other people you don't trust, right? It should be up to the VM-as-a-service and browser vendors to flush the cache properly.

No. The security concern is attackers reading data they shouldn’t. The article explains how.

“Microarchitectural Data Sampling (MDS) is a group of vulnerabilities that allow an attacker to potentially read sensitive data.”

That is way more serious than stealing cycles.

Re: MDS: Microarchitectural Data Sampling side-channel vulnerabilities in Intel CPUs

#13

Post by smnra »

StudentStuff wrote: post #3

Hyper-Threading has been a source of security concerns for a decade now, and vulnerabilities in existing HT implementations have been trickling out over the last few years. Unlike Management Engine or TrustZone, at least we can disable Hyper-Threading (for a 30% performance hit).

30% performance hit? I'm sure that heavily depends on the workload... and I'm also sure you lose performance when HT is on, depending on the workload as well.

Re: MDS: Microarchitectural Data Sampling side-channel vulnerabilities in Intel CPUs

#15

Post by docker_up »

Causality1 wrote: post #4

For me as a home user, taking a performance hit of any kind in response to threats which haven't yet been seen in the wild simply isn't good math.

Didn't they already have a proof of concept Spectre or Meltdown exploit via a web page? Malicious ads seem like the best way to spread ransomware, etc.

Re: MDS: Microarchitectural Data Sampling side-channel vulnerabilities in Intel CPUs

#16

Post by JdeBP »

Commentary by Intel: https://software.intel.com/security-software-guidance/softwa...

Commentary by RedHat: https://www.redhat.com/en/blog/understanding-mds-vulnerabili... (https://news.ycombinator.com/item?id=19912108)

Commentary by Ubuntu: https://blog.ubuntu.com/2019/05/14/ubuntu-updates-to-mitigat...

Re: MDS: Microarchitectural Data Sampling side-channel vulnerabilities in Intel CPUs

#18

Post by beagle3 »

StudentStuff wrote: post #3

Hyper-Threading has been a source of security concerns for a decade now, and vulnerabilities in existing HT implementations have been trickling out over the last few years. Unlike Management Engine or TrustZone, at least we can disable Hyper-Threading (for a 30% performance hit).

Also, HT is not such a great performance win - on a few different 4-core/8-thread machines, I had access to, loading all 8 threads to "100% CPU" (whatever that means) usually only delivers 20-30% faster computation than with HT off (4-core/4-thread) - which is inline with your 30% number.

And that's an improvement - some 15 years ago, with similar computational loads, most of my tests ran 10-20% faster with the HT off (using 2 core / 2 threads) than with HT on (using 2 core / 4 threads) - there just wasn't enough cache to support those many threads.

Re: MDS: Microarchitectural Data Sampling side-channel vulnerabilities in Intel CPUs

#19

Post by Theodores »

It is funny how ChromeOS is the most ridiculously secure of the commonly available operating systems. It is not as if you can do much other than surf the internet with it.

It makes me chuckle to think that my not-so-computer-literate friend whom I gave a Chromebook to is protected from anyone snooping in on Youtube, Hotmail and Youtube running on this toy machine (designed for 9 year olds). There really is nothing to hide there. Meanwhile, people doing important work on proper computers are properly vulnerable to this new Hyperthreading theoretical attack.

I will be interested to find out if there is a drop-off in performance on ChromeOS, e.g. Youtube stuttering whilst the whatsapp web tab updates itself with a new message. If there is nobody complaining then why did we need Hyper-Threading in the first place?

Re: MDS: Microarchitectural Data Sampling side-channel vulnerabilities in Intel CPUs

#20

Post by Causality1 »

jMyles wrote: post #5
Causality1 wrote: post #4

For me as a home user, taking a performance hit of any kind in response to threats which haven't yet been seen in the wild simply isn't good math.

I don't think that anybody can know whether this is true, since exploitation leaves little evidence. Even before this is witnessed in the wild for the first time, you can't really know which secrets of yours have already been exfiltrated.

Everything that can't be fixed with a ten minute phone call to my bank is already public knowledge thanks to Experian, so I really don't have anything left to fear.
Post reply on HN