Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Reading privileged memory with a side-channel

googleprojectzero.blogspot.com

Post reply on HN
Print view View original

151–160 of 639 posts

Re: Reading privileged memory with a side-channel

#151

Post by cesarb »

ateesdalejr wrote: post #108

So, basically CPUs will read instructions inside a branch even if the branch is eventually going to evaluate to false. Does the CPU do this to optimize branch instructions? The results of instructions that are executed ahead of time are stored in a cache. How exactly does this exploit read from the cache? I understand it uses timing somehow but I'm not quite sure exactly how that works. (I mostly do software.)

The cache in question is not something which stores the result of these speculatively executed instructions, but the normal L1-L2-L3 caches we are used to. The result of these instructions is discarded, but as a side effect, they may load something from memory into the cache. The exploit detects whether or not a particular memory address was loaded into the cache (reading from something already in the cache is much faster than reading from the main memory).

Re: Reading privileged memory with a side-channel

#152

Post by thesandlord »

static_noise wrote: post #45
swampthinker wrote: post #24

"Testing also showed that an attack running on one virtual machine was able to access the physical memory of the host machine, and through that, gain read-access to the memory of a different virtual machine on the same host." Holy shit.

This basically kills cloud computing for anything sensitive using shared hardware. In the short term this will actually be good for cloud providers because the demand for dedicated instances will shoot up as there is no short-term alternative.

> The infrastructure that runs Compute Engine and isolates customer workloads from each other is protected against known attacks. This also means that customer VMs are protected against known, infrastructure-based attacks from other malicious VMs.

Re: Reading privileged memory with a side-channel

#153

Post by im3w1l »

debt wrote: post #31

Speculative execution seems like something that would be very intuitively insecure even to a layperson(relative to the field of course). I'm wondering, was this vulnerability theorized first and later found out to be an actual vulnerability? Or was this something that nobody had any clue about? I'm only saying this, because from a security perspective, I imagine somewhere at some point very early on someone had to ha…

https://news.ycombinator.com/item?id=14988652

Re: Reading privileged memory with a side-channel

#155

Post by mintplant »

013a wrote: post #148
tonmoy wrote: post #99

I'm not that savvy with security so I need a little help understanding this. According to the google security blog: > Google Chrome > Some user or customer action needed. More information here ( https://support.google.com/faqs/answer/7622138#chrome ). And the "here" link says: >Google Chrome Browser >Current stable versions of Chrome include an optional feature called Site Isolation which can be enabled to provide mi…

It probably means if you want mitigations right now, you can flip that flag. Otherwise wait for Chrome to auto-update with new versions that have mitigations enabled by default.

Would I be correct in assuming a browser-level mitigation isn't necessary if you're running a patched OS?

Re: Reading privileged memory with a side-channel

#158

Post by mwgalloway »

candl wrote: post #142
School-Cotton wrote: post #118

Earlier quoted context omitted.

I just sold all my altcoins for BTC on Binance as soon as I saw this and transferred them to gdax. Hopefully I can sell them for USD on gdax and transfer to a real bank before they get hacked.

Why would you do that? If you are concerned for the security of your coins, you should have moved them to a wallet you own that is not hosted on an exchange. The bank you transfer your dollars to is just as likely to get hit by the exact same vurnerability. In addition you have to pay a fee to move your coins, then to wire the dollars to your bank account. Moving from crypto to fiat is also liable to taxation. If the…

The majority of coins on Coinbase are in cold-storage and crypto on Coinbase is insured against this type of breach. I personally wouldn't panic to get my coins out.

Re: Reading privileged memory with a side-channel

#159

Post by oh-kumudo »

thesandlord wrote: post #149
oh-kumudo wrote: post #78

Earlier quoted context omitted.

> The infrastructure that runs Compute Engine and isolates customer workloads from each other is protected against known attacks. This also means that customer VMs are protected against known, infrastructure-based attacks from other malicious VMs. Doesn't Google say that they are protected...?

This means that Customer A's VM cannot attack Customer B's VM. However, if the OS inside the VM is unpatched, then code inside the VM can attack other code inside the VM. If for example you install some malware on your VM, it could use this attack. (I am not a security expert, this is just my understanding and not a official Google statement)

Right. But it means that once the VM is fixed, assuming the customer does this, they are guarded from such attack right?

Re: Reading privileged memory with a side-channel

#160

Post by woodson »

candl wrote: post #142
School-Cotton wrote: post #118

Earlier quoted context omitted.

I just sold all my altcoins for BTC on Binance as soon as I saw this and transferred them to gdax. Hopefully I can sell them for USD on gdax and transfer to a real bank before they get hacked.

Why would you do that? If you are concerned for the security of your coins, you should have moved them to a wallet you own that is not hosted on an exchange. The bank you transfer your dollars to is just as likely to get hit by the exact same vurnerability. In addition you have to pay a fee to move your coins, then to wire the dollars to your bank account. Moving from crypto to fiat is also liable to taxation. If the…

at least the dollars are insured ;-)
Post reply on HN