Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

New speculative attacks on Apple CPUs

predictors.fail

Post reply on HN
Print view View original

21–30 of 365 posts

Re: New speculative attacks on Apple CPUs

#21

Post by thijsr »

junek wrote: post #11

OK, fun. What can we do to mitigate this until it gets patched?

From the FAQ:

> While FLOP has an actionable mitigation, implementing it requires patches from software vendors and cannot be done by users. Apple has communicated to us that they plan to address these issues in an upcoming security update, hence it is important to enable automatic updates and ensure that your devices are running the latest operating system and applications.

Re: New speculative attacks on Apple CPUs

#23

Post by umvi »

anotherhue wrote: post #3

For any yung'uns seeing this for the first time, the spectre and meltdown attacks (and accompanying papers) are worth reading. https://spectreattack.com/

Is it bad that I disable spectre mitigations on all my PCs to get a free double-digit-% performance boost?

Re: New speculative attacks on Apple CPUs

#24

Post by saurik »

dartos wrote: post #6
remus wrote: post #5

Interesting that the researchers have gone public before a mitigation is in place from Apple. Seems in pretty stark contrast to the industry-wide coordination that went into patching and mitigating spectre.

Does Apple pay bug bounties?

They claim to, but they drag their feet, demand terms most researchers find so unacceptable as to be a bit immoral (the point of "responsible disclosure" isn't, in fact, to hold secrets from the public arbitrarily long), and often end up paying only a fraction of what was expected, if anything.

https://pxlnv.com/linklog/apple-bug-bounty-troubles/

https://www.marketplace.org/shows/marketplace-tech/looking-f...

https://mjtsai.com/blog/2021/07/13/more-trouble-with-the-app...

Re: New speculative attacks on Apple CPUs

#25

Post by tptacek »

Cool detail, in the section where they reverse-engineer the presence of an LVP on the M3:

    Remarkably, while all other load widths activate the LVP
    on any constant value fitting that width, we observe that acti-
    vation on 8-byte wide loads occurs only when the load value
    is zero. We conjecture that this may be a countermeasure for
    memory safety such that the LVP will not learn values of
    pointers. That is, with the M3 being a 64-bit CPU, pointers
    are 8 bytes wide. Furthermore, on 64-bit macOS executables,
    any virtual address below 0x100, 000, 000 is invalid.

Re: New speculative attacks on Apple CPUs

#26

Post by baq »

umvi wrote: post #23
anotherhue wrote: post #3

For any yung'uns seeing this for the first time, the spectre and meltdown attacks (and accompanying papers) are worth reading. https://spectreattack.com/

Is it bad that I disable spectre mitigations on all my PCs to get a free double-digit-% performance boost?

Only if you don't care if baddies see you go fast

Re: New speculative attacks on Apple CPUs

#28

Post by bobnamob »

tptacek wrote: post #4

Aside: I feel like RUB has become kind of a global center for this kind of high-end offensive security work. Was I just not paying enough attention 10 years ago or is this a new-ish thing?

Idk if it's RUB or Yuval, he was credited on spectre and meltdown as well (if I recall correctly), but he was at data61 or Uni adelaide at the time

Re: New speculative attacks on Apple CPUs

#29

Post by tptacek »

gjsman-1000 wrote: post #7

Bizarre the M1 is immune to both; I'm more secure by not upgrading. (Sure, there's still a few, but they are mostly minor by comparison, or newer chips are also affected.)

The M1 doesn't have load address or value predictors. It's less sophisticated, and so has a smaller microarchitectural attack surface.
Post reply on HN