Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Reading privileged memory with a side-channel

googleprojectzero.blogspot.com

Post reply on HN
Print view View original

121–130 of 639 posts

Re: Reading privileged memory with a side-channel

#121

Post by static_noise »

cesarb wrote: post #102
static_noise wrote: post #22

So, as I gather, one of the main culprits is that unwinding of speculatively executed commands is done incompletely. That is something that the people doing the unwinding must have noticed and known. Somewhere the decision must have been made to unwind incompletely for some reasons (performance/power/cost/time). As for the difference between AMD and intel. (From other posts here, not this one.) The speculative execut…

You can't unwind completely. Once the cache is full, to load something on the cache, it has to evict something else. You might be able to evict what you just loaded, but you can't undo the earlier eviction.

Only if your speculative reads do cause irreversible side-effects on those caches. You could implement them in a way that doesn't modify the caches... but that would be complicated and probably use more power and have lower performance.

Re: Reading privileged memory with a side-channel

#122

Post by jacksmith21006 »

enneff wrote: post #77
wslh wrote: post #64

Has Google the best security team in the world? It seems like Google security is in a complete different league. I cannot imagine how this impacts companies handling fiat money or cryptocurrencies in the cloud like Coinbase in AWS.

I don't know how you would evaluate such a thing as "best security team," but Project Zero certainly attracts a high calibre of security expert. If you're into breaking things, why wouldn't you want to break things with other bright people and the support of a massive corporation?

How about based on how many of the serious issues are found by Google. It has been one after another.

Re: Reading privileged memory with a side-channel

#123

Post by blattimwind »

cesarb wrote: post #91
forgot-my-pw wrote: post #15

Earlier quoted context omitted.

"We reported this issue to Intel, AMD and ARM on 2017-06-01" What!

You know it's a bad one when Project Zero allows more than its usual 90-day deadline...

"Which systems are affected?" – "All systems." – "Come again?"

Re: Reading privileged memory with a side-channel

#124

Post by stock_toaster »

partiallypro wrote: post #51
richadams wrote: post #41

https://spectreattack.com/ Information site with some more information, and links to papers on the two vulnerabilities, called "Meltdown" and "Spectre" (with logos, of course). ( https://meltdownattack.com/ goes to the same site)

I feel like the Meltdown logo was done by a real designer, and Spectre was designed by a bored developer.

From the site:

> Both the Meltdown and Spectre logo are free to use, rights waived via CC0. Logos are designed by Natascha Eibl.

Re: Reading privileged memory with a side-channel

#125

Post by [deleted] »

tonmoy wrote: post #99

I'm not that savvy with security so I need a little help understanding this. According to the google security blog: > Google Chrome > Some user or customer action needed. More information here ( https://support.google.com/faqs/answer/7622138#chrome ). And the "here" link says: >Google Chrome Browser >Current stable versions of Chrome include an optional feature called Site Isolation which can be enabled to provide mi…

[deleted]

Re: Reading privileged memory with a side-channel

#126

Post by YurtleTheTurtle »

static_noise wrote: post #103
chc wrote: post #79

Earlier quoted context omitted.

You mean without getting whomped for insider trading? I don't think they're allowed to do it in advance at all.

As far as I know they HAVE to register a trade in advance. I.E. three months ahead: "I will sell 600 shares on 15th of December if the share price is above 50". This information is public and other people can use this information before the trade actually happens.

Note that's not a legal requirement. That's just a policy many companies have to lower the risk of insider trading.

Re: Reading privileged memory with a side-channel

#127

Post by kbwt »

The papers take a while to get to the point. I nearly fell asleep re-reading the same statements until they got to the point: speculative execution of buffer overflows.

Could have been said more concisely. Sadly, this seems to be the norm with academic texts.

Re: Reading privileged memory with a side-channel

#129

Post by partiallypro »

steveklabnik wrote: post #92
partiallypro wrote: post #51

Earlier quoted context omitted.

I feel like the Meltdown logo was done by a real designer, and Spectre was designed by a bored developer.

It says at the bottom they were both done by the same person.

That's funny, but also makes me wonder how you get contracted to do logos for things like this. Based strictly on her LinkedIn, she doesn't work for Google. Maybe a friend of someone? Kind of a cool gig though.

Re: Reading privileged memory with a side-channel

#130

Post by thaumaturgy »

swampthinker wrote: post #24

"Testing also showed that an attack running on one virtual machine was able to access the physical memory of the host machine, and through that, gain read-access to the memory of a different virtual machine on the same host." Holy shit.

We should quote OpenBSD's Theo de Raadt here, all the way back from 2007:

"x86 virtualization is about basically placing another nearly full kernel, full of new bugs, on top of a nasty x86 architecture which barely has correct page protection. Then running your operating system on the other side of this brand new pile of shit."

https://marc.info/?l=openbsd-misc&m=119318909016582&w=2

Post reply on HN