Reading privileged memory with a side-channel • Hacker News Board

Re: Reading privileged memory with a side-channel

#201

Post by simion314 » Thu, Jan 04, 2018, 12:12 AM UTC

jhallenworld wrote: post #187

jotux wrote: post #115

Papers describing each attack: https://meltdownattack.com/meltdown.pdf https://spectreattack.com/spectre.pdf From the spectre paper: >As a proof-of-concept, JavaScript code was written that, when run in the Google Chrome browser, allows JavaScript to read private memory from the process in which it runs (cf. Listing 2). Scary stuff.

"Meltdown" is an Intel bug. "Spectre" is very bad news and affects all modern CPUs. Mitigation is to insert mfence instructions throughout jit generated sandboxed code making it very slow, ugh. Otherwise assume that the entire process with jit generated code is open to reading by that code. Any system which keeps data from multiple customers (or whatever) in the same process is going to be highly vulnerable.

From the article it seems that is not 100% sure AMD and ARM are not affected by metldown, only that they could not trigger the issue, but authors mention this

"However, for both ARM and AMD, the toy example as described in Section 3 works reliably, indicating that out-of-order execution generally occurs and instructions past illegal memory accesses are also performed."

Re: Reading privileged memory with a side-channel

#202

Post by userbinator » Thu, Jan 04, 2018, 12:12 AM UTC

debt wrote: post #31

Speculative execution seems like something that would be very intuitively insecure even to a layperson(relative to the field of course). I'm wondering, was this vulnerability theorized first and later found out to be an actual vulnerability? Or was this something that nobody had any clue about? I'm only saying this, because from a security perspective, I imagine somewhere at some point very early on someone had to ha…

I think the chip designers never thought of security much:

https://news.ycombinator.com/item?id=16062223

It's a similar situation to other timing attacks, which have been around practically as long as caches.

Re: Reading privileged memory with a side-channel

#203

Post by makomk » Thu, Jan 04, 2018, 12:13 AM UTC

The ARM whitepaper is also worth a read in terms of how it affects them and mitigations on that platform: https://developer.arm.com/support/security-update

Re: Reading privileged memory with a side-channel

#204

Post by rurban » Thu, Jan 04, 2018, 12:15 AM UTC

oh-kumudo wrote: post #159

thesandlord wrote: post #149

Earlier quoted context omitted.

This means that Customer A's VM cannot attack Customer B's VM. However, if the OS inside the VM is unpatched, then code inside the VM can attack other code inside the VM. If for example you install some malware on your VM, it could use this attack. (I am not a security expert, this is just my understanding and not a official Google statement)

Right. But it means that once the VM is fixed, assuming the customer does this, they are guarded from such attack right?

Not against Spectre, which can extract any memory via javascript or user applications. Eg your secret keys or passwords

Re: Reading privileged memory with a side-channel

#205

Post by [deleted] » Thu, Jan 04, 2018, 12:15 AM UTC

buryat wrote: post #36

mrmondo wrote: post #13

"AMD chips are affected by some but not all of the vulnerabilities. AMD said that there is a "near zero risk to AMD processors at this time." British chipmaker ARM told news site Axios prior to this report that some of its processors, including its Cortex-A chips, are affected." - http://www.zdnet.com/article/security-flaws-affect-every-int... * Edit: From https://meltdownattack.com/ Which systems are affected by Mel…

That article links a commit [1] that contradicts this statement > AMD processors are not subject to the types of attacks that the kernel page table isolation feature protects against. The AMD microarchitecture does not allow memory references, including speculative references, that access higher privileged data when running in a lesser privileged mode when that access would result in a page fault. And Axios [2] that…

[deleted]

Re: Reading privileged memory with a side-channel

#206

Post by debt » Thu, Jan 04, 2018, 12:16 AM UTC

im3w1l wrote: post #153

debt wrote: post #31

Speculative execution seems like something that would be very intuitively insecure even to a layperson(relative to the field of course). I'm wondering, was this vulnerability theorized first and later found out to be an actual vulnerability? Or was this something that nobody had any clue about? I'm only saying this, because from a security perspective, I imagine somewhere at some point very early on someone had to ha…

https://news.ycombinator.com/item?id=14988652

Incredible that in this day and age that chip designers do not prioritize performance over security.

Re: Reading privileged memory with a side-channel

#207

Post by Certhas » Thu, Jan 04, 2018, 12:17 AM UTC

jhallenworld wrote: post #187

jotux wrote: post #115

Papers describing each attack: https://meltdownattack.com/meltdown.pdf https://spectreattack.com/spectre.pdf From the spectre paper: >As a proof-of-concept, JavaScript code was written that, when run in the Google Chrome browser, allows JavaScript to read private memory from the process in which it runs (cf. Listing 2). Scary stuff.

"Meltdown" is an Intel bug. "Spectre" is very bad news and affects all modern CPUs. Mitigation is to insert mfence instructions throughout jit generated sandboxed code making it very slow, ugh. Otherwise assume that the entire process with jit generated code is open to reading by that code. Any system which keeps data from multiple customers (or whatever) in the same process is going to be highly vulnerable.

After skimming the articles it sounds like a lot hinges on just how hard Spectre is to pull off in practice/in the wild. Anyone have any insights on that?

Re: Reading privileged memory with a side-channel

#208

Post by lern_too_spel » Thu, Jan 04, 2018, 12:18 AM UTC

ece wrote: post #197

olliej wrote: post #169

Earlier quoted context omitted.

the google site has the actual white papers detailing the attacks.

The register has the tweet with actual code for spectre, and more details from the manufacturers and potential fixes. Seriosuly? They're both worth a read.

I think the point is that your quoted section of the reg article is not correct according to the new information from Google.

Re: Reading privileged memory with a side-channel

#209

Post by ErikAugust » Thu, Jan 04, 2018, 12:18 AM UTC

jotux wrote: post #115

Papers describing each attack: https://meltdownattack.com/meltdown.pdf https://spectreattack.com/spectre.pdf From the spectre paper: >As a proof-of-concept, JavaScript code was written that, when run in the Google Chrome browser, allows JavaScript to read private memory from the process in which it runs (cf. Listing 2). Scary stuff.

I've thrown the C code in the Spectre paper up if anyone wants to feel the magic: https://gist.github.com/ErikAugust/724d4a969fb2c6ae1bbd7b2a9...

Re: Reading privileged memory with a side-channel

#210

Post by tarruda » Thu, Jan 04, 2018, 12:18 AM UTC

OldSchoolJohnny wrote: post #190

tarruda wrote: post #164

It seems that Richard Stallman is not so paranoid after all: > I am careful in how I use the Internet. > I generally do not connect to web sites from my own machine, aside from a few sites I have some special relationship with. I usually fetch web pages from other sites by sending mail to a program (see https://git.savannah.gnu.org/git/womb/hacks.git ) that fetches them, much like wget, and then mails them back to me…

RMS remains a rambling nutjob and none of this is really applicable to the issue at hand.

The spectre attack is exploitable via javascript and there's no software patch that can fix it. IoW, it is not possible to safely run untrusted code in the same computer that has sentitive information.