Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

More Intel speculative execution vulnerabilities

mdsattacks.com

Post reply on HN
Print view View original

141–150 of 262 posts

Re: More Intel speculative execution vulnerabilities

#141

Post by SketchySeaBeast »

whatshisface wrote: post #133
jjoonathan wrote: post #121

Earlier quoted context omitted.

If the vulnerability pipeline is a few years deep and AMD wasn't considered a worthwhile target a few years ago, we might not want to interpret a lack of AMD vulnerabilities as evidence that they are immune.

AMD was always a worthy target because they sold a lot of cost-effective mid and low range CPUs to Dell and friends. They have been absent from the peak performance market for a while but that's a small fraction of computers. After all, AMD didn't go out of business, and they had to be selling a lot of CPUs.

But isn't that not where the worry is? Isn't it cloud computing and server spaces where the real damage can be done here?

Re: More Intel speculative execution vulnerabilities

#142

Post by jefftk »

Khoth wrote: post #138
jefftk wrote: post #92

Earlier quoted context omitted.

If you discover a flaw in a product, bet against the stock, and publish the flaw, that's not insider trading. Here's an example of Gotham City Research trying this approach and failing: https://www.thedrum.com/news/2017/09/21/criteo-counters-frau... (Not a lawyer)

Also not a lawyer, but check what country you're in before you try this. In countries like the UK, many more things are insider trading than in the US.

Sorry, yes, only trying to talk about the US here

Re: More Intel speculative execution vulnerabilities

#143

Post by vadansky »

jefftk wrote: post #92
segfaultbuserr wrote: post #84

Earlier quoted context omitted.

> a good capitalist would try to sell the discovery to the highest bidder. Not all security researchers are doing it for the money, 0day markets always exist. Malicious people who wish to use the vulnerability for profit wouldn't disclose the vulnerability to begin with. So it's not a new problem. > this case, it would probably be Intel, to "catch and kill" widespread knowledge of the exploit. Another high bidder wou…

If you discover a flaw in a product, bet against the stock, and publish the flaw, that's not insider trading. Here's an example of Gotham City Research trying this approach and failing: https://www.thedrum.com/news/2017/09/21/criteo-counters-frau... (Not a lawyer)

Sounds like "Markets can stay irrational longer than you can stay solvent" would apply here

Re: More Intel speculative execution vulnerabilities

#144

Post by jefftk »

vadansky wrote: post #143
jefftk wrote: post #92

Earlier quoted context omitted.

If you discover a flaw in a product, bet against the stock, and publish the flaw, that's not insider trading. Here's an example of Gotham City Research trying this approach and failing: https://www.thedrum.com/news/2017/09/21/criteo-counters-frau... (Not a lawyer)

Sounds like "Markets can stay irrational longer than you can stay solvent" would apply here

The problem in the Gotham case I linked was that markets didn't consider the news to be as significant as Gotham expected them to.

The goal with this strategy is to find serious issues that will rightly cause investors to immediately decrease their estimate of the value of the company.

Re: More Intel speculative execution vulnerabilities

#145

Post by brewdad »

AnIdiotOnTheNet wrote: post #140
dijit wrote: post #41

Earlier quoted context omitted.

What are you even talking about? the introduction to this problem came with a proof-of-concept _IN JAVASCRIPT_.[0] Session keys, private keys, passwords and all other kinds of access tokens that your system is using, it's the next worst thing from remote code execution. Your browser runs so much untrusted code that it's really unreasonable, and yes, we should definitely be pushing back hard on this. But it's probably…

> Do not fucking turn off these mitigations on desktop computers, they are too complex and run untrusted code all the time. No, fuck you. It is my computer and I have determined the threat to be extremely unlikely and the consequences of successful exploit minimal in my case, while the performance hit of mitigation is guaranteed. Stop trying to tell other people how to use their computer.

I just read your username. Well played.

Re: More Intel speculative execution vulnerabilities

#146

Post by oefrha »

jefftk wrote: post #92
segfaultbuserr wrote: post #84

Earlier quoted context omitted.

> a good capitalist would try to sell the discovery to the highest bidder. Not all security researchers are doing it for the money, 0day markets always exist. Malicious people who wish to use the vulnerability for profit wouldn't disclose the vulnerability to begin with. So it's not a new problem. > this case, it would probably be Intel, to "catch and kill" widespread knowledge of the exploit. Another high bidder wou…

If you discover a flaw in a product, bet against the stock, and publish the flaw, that's not insider trading. Here's an example of Gotham City Research trying this approach and failing: https://www.thedrum.com/news/2017/09/21/criteo-counters-frau... (Not a lawyer)

Security researchers aren’t hedge funds, most aren’t swimming in cash, and can’t borrow millions on a whim. Also, pouring your life savings into a bet like this is probably dumb.

Re: More Intel speculative execution vulnerabilities

#147

Post by jdmichal »

segfaultbuserr wrote: post #103
jefftk wrote: post #92

Earlier quoted context omitted.

If you discover a flaw in a product, bet against the stock, and publish the flaw, that's not insider trading. Here's an example of Gotham City Research trying this approach and failing: https://www.thedrum.com/news/2017/09/21/criteo-counters-frau... (Not a lawyer)

> If you discover a flaw in a product, bet against the stock, and publish the flaw, that's not insider trading. Thanks for the information, never thought about that. On the other hand, would purchasing information about a flaw and using the information to bet the stock constitutes insider trading?

Insider information is not about the information itself, but rather the source of the information. The exact same piece of information could be insider information or not depending on who you heard it from. Think of it like a watermark or stain on the information. When the information is generated within the "insider" circle, it is permanently stained until that information is made public. Legally, this stain remains no matter how many hops it goes through. However, if the same information is generated by an "outsider" that figured it out, that same information is not stained.

Example: Your neighbor Alice is a hotshot executive at BigCorp. If Alice comes over to your BBQ and starts telling you about how bad their upcoming quarter is going to be, that's probably tainted information. However, if your other neighbor Bob comes to your BBQ, and starts talking about how grumpy Alice has been, and she's always grumpy like this when BigCorp is about to have a bad quarter... That's fair game. Same information, different sources.

That said, in the US I think there must be some indication or reasonable expectation that you knew or were willingly blind to the non-public status of the information.

Re: More Intel speculative execution vulnerabilities

#148

Post by segfaultbuserr »

mandevil wrote: post #131
segfaultbuserr wrote: post #103

Earlier quoted context omitted.

> If you discover a flaw in a product, bet against the stock, and publish the flaw, that's not insider trading. Thanks for the information, never thought about that. On the other hand, would purchasing information about a flaw and using the information to bet the stock constitutes insider trading?

It would be insider trading if the person you purchased from had a duty to the company to keep the secret (they worked for the company and learned of the vulnerability in the normal course of their job, say). If they are an independent researcher and you are an independent researcher, trade away. Then it is just like using satellites to find out that a shopping mall's parking lot is empty on a big shopping day- trade…

So utilizing information discovered or obtained from independent researches from public sources and personal expertise to trade is not inside trading, albeit how your conclusions are asymmetrical, inaccessible to others, or how impactful they are - since it's inherently no difference from any other type of market analysis, and it's literally the job of financial analysts. And it's also the function of the market: take all these trades as inputs, calculate its output - current price.

Makes perfect sense to me now. I now realized I've some serious misunderstanding of insider trading. Thanks for clearing it up for me.

Re: More Intel speculative execution vulnerabilities

#149

Post by koheripbal »

nolok wrote: post #47
foxes wrote: post #4

Another nail in the casket lake. Is the solution just to throw everything out and start again? Do we just abandon speculative execution?

The problem for most of these is not speculative, it's not doing proper acl during speculation. Just because the cpu is speculating doesn't mean it shouldn't check if you are allowed to access this or that, but that's what Intel did, and they only did the security check at the end before giving back the result, except at this point its too late you've already accessed it. Other manufacturers AMD included didn't get a…

I wonder what the performance costs of those ACL checks are.

Re: More Intel speculative execution vulnerabilities

#150

Post by dijit »

scandinavian wrote: post #125
dijit wrote: post #117

Earlier quoted context omitted.

Except that the Spectre paper already takes degraded timers into account and suggests to use a Web Worker thread that increments a value in a loop as a replacement. This is not misinformation, _you_ are spreading "certainty" of safety surrounding a dangerous idea. https://spectreattack.com/spectre.pdf Even if I was wrong, and very wrong, why the hell would you choose to be less safe? this whole thread chain is absolu…

>Except that the Spectre paper already takes degraded timers into account and suggests to use a Web Worker thread that increments a value in a loop as a replacement. Yeah, which was why SharedArrayBuffer was disabled when spectrev1 was released. It is still disabled in Chrome if site-isolation is disabled and it's still disabled in firefox. You should really know all this if you are so very well versed in the subject…

“Threat model is so strict” is weird to say when any ad network can access any and all memory on your desktop potentially.

That’s a very wide attack scope.

Post reply on HN