111–120 of 639 posts
So is speculative execution just inherently flawed like this, or can we expect chips in 2 years that let operating systems go back to the old TLB behavior?
Earlier quoted context omitted.
Until someone figures out how to exploit it using JavaScript. The speed this moves it could be any minute now.
From spectre.pdf: > In addition to violating process isolation boundaries using native code, Spectre attacks can also be used to violate browser sandboxing, by mounting them via portable JavaScript code. We wrote a JavaScript program that successfully reads data from the address space of the browser process running it. (granted I think site isolation, if enabled, mitigates crossing domain boundaries) It goes on to sh…
Do we know how news of this got out before the disclosure date?
See this blog post, which is some very informed speculation based on public Linux kernel patch activity. http://pythonsweetness.tumblr.com/post/169166980422/the-myst...
Earlier quoted context omitted.
Until someone figures out how to exploit it using JavaScript. The speed this moves it could be any minute now.
From spectre.pdf: > In addition to violating process isolation boundaries using native code, Spectre attacks can also be used to violate browser sandboxing, by mounting them via portable JavaScript code. We wrote a JavaScript program that successfully reads data from the address space of the browser process running it. (granted I think site isolation, if enabled, mitigates crossing domain boundaries) It goes on to sh…
Edit - mixing it up with this other article (https://security.googleblog.com/2018/01/todays-cpu-vulnerabi...)
https://meltdownattack.com/meltdown.pdf
https://spectreattack.com/spectre.pdf
From the spectre paper:
>As a proof-of-concept, JavaScript code was written that, when run in the Google Chrome browser, allows JavaScript to read private memory from the process in which it runs (cf. Listing 2).
Scary stuff.
Earlier quoted context omitted.
That's unclear, to the point of being factually wrong. Variant 2 and Variant 3 POCs only affect Intel, and those are the ones people are most talking about, and at least to me, the most concerning. Treating them as a group, ignores the very real differences in effect. https://googleprojectzero.blogspot.com/2018/01/reading-privi...
https://meltdownattack.com/meltdown.pdf >6.4 Limitations on ARM and AMD We also tried to reproduce the Meltdown bug on several ARM and AMD CPUs. However, we did not manage to successfully leak kernel memory with the attack described in Section 5, neither on ARM nor on AMD. The reasons for this can be manifold. First of all, our implementation might simply be too slow and a more optimized version might succeed. For in…
Speculative execution seems like something that would be very intuitively insecure even to a layperson(relative to the field of course). I'm wondering, was this vulnerability theorized first and later found out to be an actual vulnerability? Or was this something that nobody had any clue about? I'm only saying this, because from a security perspective, I imagine somewhere at some point very early on someone had to ha…
Speculative execution isn't supposed to leak information; if the speculative instructions aren't supposed to execute, all traces of them should be rolled back. I'd be curious to see what the details of this bug really are. I'm not sure how much will be disclosed in the interests of keeping exploits from popping up.
I believe most crypto exchanges are running in the cloud. What could possibly go wrong ?
And I certainly expect to see more things like this (but at least hopefully with lower bandwidth).
Earlier quoted context omitted.
That's not even close to a thread... You can see all the tweets here (courtesy of @svenluijten): https://twitter.com/i/moments/948681915485351938 .
The linked thread suggests that Spectre doesn't have _any_ mitigation. > The business/economic implications are not clear, since eventually the only way to eradicate the threat posed by Spectre is to swap out hardware. Is this fully accurate, there's no software mitigation available now? From [0], the above may be true: > There is also work to harden software against future exploitation of Spectre, respectively to pa…
On the positive side, the flaw is very difficult to exploit in a practical setting.