Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Reading privileged memory with a side-channel

googleprojectzero.blogspot.com

Post reply on HN
Print view View original

141–150 of 639 posts

Re: Reading privileged memory with a side-channel

#141

Post by jwilk »

flukus wrote: post #114
kodablah wrote: post #94

Earlier quoted context omitted.

From spectre.pdf: > In addition to violating process isolation boundaries using native code, Spectre attacks can also be used to violate browser sandboxing, by mounting them via portable JavaScript code. We wrote a JavaScript program that successfully reads data from the address space of the browser process running it. (granted I think site isolation, if enabled, mitigates crossing domain boundaries) It goes on to sh…

And we can't even read TFA with javascript disabled, you have to be less secure just to read the google security blog. Edit - mixing it up with this other article ( https://security.googleblog.com/2018/01/todays-cpu-vulnerabi... )

I can read the article without JS just fine.

Re: Reading privileged memory with a side-channel

#142

Post by candl »

School-Cotton wrote: post #118
TheAlchemist wrote: post #68

I believe most crypto exchanges are running in the cloud. What could possibly go wrong ?

I just sold all my altcoins for BTC on Binance as soon as I saw this and transferred them to gdax. Hopefully I can sell them for USD on gdax and transfer to a real bank before they get hacked.

Why would you do that? If you are concerned for the security of your coins, you should have moved them to a wallet you own that is not hosted on an exchange. The bank you transfer your dollars to is just as likely to get hit by the exact same vurnerability. In addition you have to pay a fee to move your coins, then to wire the dollars to your bank account. Moving from crypto to fiat is also liable to taxation. If the sole goal is to secure your coins then I don't think that the whole process is worth the hassle. Moving them to a private wallet would suffice.

Re: Reading privileged memory with a side-channel

#143

Post by taurath »

static_noise wrote: post #29
forgot-my-pw wrote: post #15

Earlier quoted context omitted.

"We reported this issue to Intel, AMD and ARM on 2017-06-01" What!

How much in advance do the intel managers have to register a stock sell?

The CEO dropped his stock holdings down to the minimum allowed by their board bylaws in December.

https://www.fool.com/investing/2017/12/19/intels-ceo-just-so...

Re: Reading privileged memory with a side-channel

#144

Post by untog »

static_noise wrote: post #45
swampthinker wrote: post #24

"Testing also showed that an attack running on one virtual machine was able to access the physical memory of the host machine, and through that, gain read-access to the memory of a different virtual machine on the same host." Holy shit.

This basically kills cloud computing for anything sensitive using shared hardware. In the short term this will actually be good for cloud providers because the demand for dedicated instances will shoot up as there is no short-term alternative.

The short term answer is to patch the servers and swallow the 30% performance cut. Still likely cheaper than dedicated servers.

Re: Reading privileged memory with a side-channel

#146

Post by blattimwind »

dboreham wrote: post #117
mark-r wrote: post #65

Earlier quoted context omitted.

Speculative execution isn't supposed to leak information; if the speculative instructions aren't supposed to execute, all traces of them should be rolled back. I'd be curious to see what the details of this bug really are. I'm not sure how much will be disclosed in the interests of keeping exploits from popping up.

"all traces" includes timing differences in execution of non-privileged code, which it turns out are not rolled back.

Or side-effects by loading data into the cache hierarchy.

Re: Reading privileged memory with a side-channel

#147

Post by jsmthrowaway »

cesarb wrote: post #91
forgot-my-pw wrote: post #15

Earlier quoted context omitted.

"We reported this issue to Intel, AMD and ARM on 2017-06-01" What!

You know it's a bad one when Project Zero allows more than its usual 90-day deadline...

Then front-runs the negotiated timeline anyway, catching projects like Xen off guard (it seems like)[0]. Will be interested to read the postmortem of the entire process from start to finish, and Xen is promising one from their perspective. I'd be especially interested to understand whether public intel was concrete enough to rush this out the door, because it didn't seem like it was, but I probably missed something.

[0]: https://xenbits.xen.org/xsa/advisory-254.html

Re: Reading privileged memory with a side-channel

#148

Post by 013a »

tonmoy wrote: post #99

I'm not that savvy with security so I need a little help understanding this. According to the google security blog: > Google Chrome > Some user or customer action needed. More information here ( https://support.google.com/faqs/answer/7622138#chrome ). And the "here" link says: >Google Chrome Browser >Current stable versions of Chrome include an optional feature called Site Isolation which can be enabled to provide mi…

It probably means if you want mitigations right now, you can flip that flag. Otherwise wait for Chrome to auto-update with new versions that have mitigations enabled by default.

Re: Reading privileged memory with a side-channel

#149

Post by thesandlord »

oh-kumudo wrote: post #78
swampthinker wrote: post #24

"Testing also showed that an attack running on one virtual machine was able to access the physical memory of the host machine, and through that, gain read-access to the memory of a different virtual machine on the same host." Holy shit.

> The infrastructure that runs Compute Engine and isolates customer workloads from each other is protected against known attacks. This also means that customer VMs are protected against known, infrastructure-based attacks from other malicious VMs. Doesn't Google say that they are protected...?

This means that Customer A's VM cannot attack Customer B's VM.

However, if the OS inside the VM is unpatched, then code inside the VM can attack other code inside the VM. If for example you install some malware on your VM, it could use this attack.

(I am not a security expert, this is just my understanding and not a official Google statement)

Re: Reading privileged memory with a side-channel

#150

Post by School-Cotton »

candl wrote: post #142
School-Cotton wrote: post #118

Earlier quoted context omitted.

I just sold all my altcoins for BTC on Binance as soon as I saw this and transferred them to gdax. Hopefully I can sell them for USD on gdax and transfer to a real bank before they get hacked.

Why would you do that? If you are concerned for the security of your coins, you should have moved them to a wallet you own that is not hosted on an exchange. The bank you transfer your dollars to is just as likely to get hit by the exact same vurnerability. In addition you have to pay a fee to move your coins, then to wire the dollars to your bank account. Moving from crypto to fiat is also liable to taxation. If the…

Most banks don't use cloud providers AFAIK.

Also, real money transactions are much more likely than blockchain transactions to be reversible if fraudulent.

Post reply on HN