Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Downfall Attacks

downfall.page

Post reply on HN
Print view View original

161–170 of 349 posts

Re: Downfall Attacks

#161

Post by margalabargala »

justinator wrote: post #132
BeeOnRope wrote: post #120

What I find odd is that after the initial Spectre attacks, there have been a long string of these attacks discovered by outside researchers and then patched by the chipmakers. In principle it seems like the chipmakers should hold all the cards when it comes to discovery: they are experts in speculative execution, know exactly how their chips work and have massive existing validation suites, simulators and internal ma…

>In principle it seems like the chipmakers should hold all the cards when it comes to discovery: they are experts in speculative execution, know exactly how their chips work and have massive existing validation suites, simulators and internal machine-readable specifications for the low-level operations of these chips. I hope you're not in charge of hiring QA. Bugs are often found by people who AREN'T thinking like th…

> I hope you're not in charge of hiring QA.

This seems unnecessarily harsh. The whole post would be improved by removing that sentence IMO.

Re: Downfall Attacks

#162

Post by snvzz »

ISA complexity breeds microarchitecture bugs.

In the internet era, x86 is an anachronism.

RISC is the way forward.

RISC-V is inevitable.

Re: Downfall Attacks

#163

Post by quickthrower2 »

bhk wrote: post #108
Negitivefrags wrote: post #33

Once again it seems clear that running code from two security domains on the same physical processor cores is just not possible to get right, and we should probably just stop doing it. There are really only two common cases for this anyway. VMs and JavaScript. For VMs we just need to give up on it. Dedicate specific cores to specific VMs or at least customers. For JavaScript it’s a bit harder. Either way, we need to…

Once you "dedicate cores to specific VMs" you will find that chip designers can also screw that up, just like they can screw up protection within a core. So you might as well proclaim that "impossible to get right" preemptively.

They said physical processor. I took this to mean chip. Of course you can't trust chips on the same mother board (there could be a bug where they can read the same memory), so you need a network boundary. So different rack on the server, for each [boundary, however you define that...]

Re: Downfall Attacks

#164

Post by xyst »

v8xi wrote: post #4

From FAQ: [Q] How long have users been exposed to this vulnerability? [A] At least nine years. The affected processors have been around since 2014. Amazing how these vulnerabilities sit around unnoticed for years and then it takes two weeks for someone to code up an exploit.

Likely work based off of previous exploits.

Re: Downfall Attacks

#165

Post by moonchild »

hyperman1 wrote: post #46
Negitivefrags wrote: post #33

Once again it seems clear that running code from two security domains on the same physical processor cores is just not possible to get right, and we should probably just stop doing it. There are really only two common cases for this anyway. VMs and JavaScript. For VMs we just need to give up on it. Dedicate specific cores to specific VMs or at least customers. For JavaScript it’s a bit harder. Either way, we need to…

I've wondered if we can't give a dedicated core to the browser. Of course, then web pages can steal from other web pages. Maybe task switching needs to erect much higher barriers between security contexts, a complete flush or so?

You would need a dedicated core per tab.

Partitioning tabs according to trust would be ~fine, but laborious and error-prone.

Re: Downfall Attacks

#166

Post by snvzz »

xyst wrote: post #160

So it seems like speculative execution cannot be disabled. What’s the mitigation here? Nothing and wait for patch or significant redesign?

>What’s the mitigation here?

Replace the buggy CISC CPU. Ideally with a less complex thus highly likely less buggy RISC one.

Re: Downfall Attacks

#167

Post by adgjlsfhk1 »

BeeOnRope wrote: post #120

What I find odd is that after the initial Spectre attacks, there have been a long string of these attacks discovered by outside researchers and then patched by the chipmakers. In principle it seems like the chipmakers should hold all the cards when it comes to discovery: they are experts in speculative execution, know exactly how their chips work and have massive existing validation suites, simulators and internal ma…

I think you're last statement is half right. They probably don't bother looking for them that hard because if they look for them they might find them and then have to make their CPUs slower before launch.

Re: Downfall Attacks

#168

Post by tracker1 »

bsder wrote: post #138
BeeOnRope wrote: post #120

What I find odd is that after the initial Spectre attacks, there have been a long string of these attacks discovered by outside researchers and then patched by the chipmakers. In principle it seems like the chipmakers should hold all the cards when it comes to discovery: they are experts in speculative execution, know exactly how their chips work and have massive existing validation suites, simulators and internal ma…

The problem is that nobody wants to admit that the old, stodgy mainframe guys were right 30 years ago and that sharing anything always results in an exfiltration surface. Nobody wants to be the first to take proper steps because they have to either: 1) Partition hardware properly so that users are genuinely isolated. This costs silicon area that nobody wants to pay for. 2) Stop all the speculative bullshit. This thro…

I'd add that the status quo has done pretty well, and many of these exploits are fixed. It's also worth noting that a lot of the exploits in question may be known, but the people working on them couldn't theorize a practical exploit. How many web browser sandbox breaches have there been over the years? Far less than the CPU exploits in the past several years. The latter can have a much bigger impact though.

The biggest risk target seems to be shared servers, and you often don't know who you're sharing with, so is it worth trying? It seems to be usually, no... in a specific target, maybe.

Re: Downfall Attacks

#169

Post by [deleted] »

BeeOnRope wrote: post #120

What I find odd is that after the initial Spectre attacks, there have been a long string of these attacks discovered by outside researchers and then patched by the chipmakers. In principle it seems like the chipmakers should hold all the cards when it comes to discovery: they are experts in speculative execution, know exactly how their chips work and have massive existing validation suites, simulators and internal ma…

[deleted]

Re: Downfall Attacks

#170

Post by basedrum »

Can someone explain why the ssh video at 2:25, where the 256bit comparison is pasted in, it doesn't match? The first two colon separated number sets do match, but not the following two?
Post reply on HN