Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

New speculative attacks on Apple CPUs

predictors.fail

Post reply on HN
Print view View original

221–230 of 365 posts

Re: New speculative attacks on Apple CPUs

#221

Post by kd913 »

yoshicoder wrote: post #82

Funny that I am seeing this now, because last Fall I had Daniel Genkin as my Intro to Cyber Security Professor (co-author of this result). Interesting class, but I remember him mentioning that they were working on a speculative attack for Apple CPUs after seeing the results of spectre and meltdown on Intel CPUs. I remember how he seemed almost paranoid about security, and I suppose I see why now (security is almost n…

Am curious if the problem impacts m4 given it came out after this was released and disclosed.

That and it moved to Arm’s 9.2 instructions.

Re: New speculative attacks on Apple CPUs

#222

Post by hashstring »

alphabetting wrote: post #189

Is the statement from Apple just PR or is this not a usable exploit? "Based on our analysis, we do not believe this issue poses an immediate risk to our users." https://www.bleepingcomputer.com/news/security/new-apple-cpu...

They carefully added “immediate”.

Re: New speculative attacks on Apple CPUs

#223

Post by hashstring »

prmoustache wrote: post #150
goldsteinq wrote: post #99

Earlier quoted context omitted.

There’re no other browsers on iPhone. Every iPhone browser is a reskin of Safari. They’re in theory supposed to allow other browsers in the EU, but AFAIK it has not happened yet.

Then don't use an iPhone until it is patched.

What about turn JS off on your favourite iOS browser?

Re: New speculative attacks on Apple CPUs

#224

Post by throwaway894345 »

lxgr wrote: post #125
throwaway894345 wrote: post #112

Earlier quoted context omitted.

I mean, if all major browsers do it roughly once then users will complain to the few broken websites. They won’t even think to blame the browser if every other site works fine and the broken site is broken on all browsers.

Good luck trying to get Google or Microsoft to throw their paying enterprise users under the bus in the interest of slightly safer sandboxing defaults.

I wasn’t suggesting it would happen, only that the “users would stop updating their browsers” scenario seemed unlikely.

Re: New speculative attacks on Apple CPUs

#225

Post by lxgr »

gjsman-1000 wrote: post #7

Bizarre the M1 is immune to both; I'm more secure by not upgrading. (Sure, there's still a few, but they are mostly minor by comparison, or newer chips are also affected.)

That's vulnerable to DMP-based side channel attacks though (like GoFetch [1]), which you can only protect against in software [2] on the M3 and beyond.

[1] https://gofetch.fail/

[2] https://developer.apple.com/documentation/xcode/writing-arm6...

Re: New speculative attacks on Apple CPUs

#227

Post by ameliaquining »

asoneth wrote: post #141
lxgr wrote: post #69

Earlier quoted context omitted.

Forcing every website to adapt to a browser update is completely infeasible. > I can't imagine there are many sites passing significant amounts of data through this This is actually a quite common mechanism for popup-based authentication (which is much more secure than iframe-based one, as users can verify where they're potentially entering their credentials).

Why not a choice? Individuals could choose a "secure" browser or browser mode that provides increased protection from such attacks or a "compatible" one that is less likely to break old websites.

People are downvoting you, but Apple does actually offer this: https://support.apple.com/en-us/105120

I think they've gotten away with it because it's a pretty obscure setting and they say a bunch of things like "most users should not enable this, and if you do enable it you should expect things to break".

Re: New speculative attacks on Apple CPUs

#228

Post by lxgr »

danans wrote: post #218
lxgr wrote: post #213

Earlier quoted context omitted.

The permanent solution to the flaw is either a hardware/OS-side fix (i.e. disabling this particular kind of speculation via a chicken bit, if there is one), or Safari implementing site isolation in the same way Chrome and Firefox are already doing. But as the former might well be impossible (at least without ruining performance or requiring a hardware swap), and the latter might take a while, websites should still ta…

> But as the former might well be impossible (at least without ruining performance or requiring a hardware swap), and the latter might take a while, According to the site they informed Apple in May 2024. Should that not have been enough time?

It took Chrome and Firefox years to achieve complete tab separation, so yes, it does seem too close, unfortunately.

Re: New speculative attacks on Apple CPUs

#229

Post by School-Cotton »

ribcage wrote: post #160
autoexec wrote: post #122

Earlier quoted context omitted.

It's a tragedy that so many websites insist on having the ability to run random downloaded code on our systems to do basic things like displaying simple text and images. Things browsers are capable of with nothing but HTML. Google refuses to even show search results, a bunch of literal hyperlinks, without javascript being enabled.

The real tragedy is that our processors try to win a bit more speed by sacrificing simplicity and therefore increasing the chances of such exploits. The other tragedy is that our operating systems are obsolete and have worthless security. Back in the day when UNIX was relevant, a hundred people could use it at the same on a mainframe with no fear of it breaking, now one person cannot safely use a single computer.

> The real tragedy is that our processors try to win a bit more speed by sacrificing simplicity and therefore increasing the chances of such exploits.

This gets repeated on every thread about speculative execution exploits, but I think people who say this are underestimating how huge the difference would be. I suspect processors without speculative execution would be many times slower, not "a bit".

Re: New speculative attacks on Apple CPUs

#230

Post by hashstring »

tptacek wrote: post #84
gabeio wrote: post #68

Earlier quoted context omitted.

That's still more or less 120 days ago. Well over the 90 day typical window.

I'm not saying it's bad (I'm pretty close to a disclosure absolutist), though I don't really know what the norms are for hardware attacks --- both papers are well past the normal coordinated disclosure window for software.

The vendor requested embargo timelines can get pretty crazy.

Intel requested an embargo for 21 months for SRBDS/Crosstalk.

For Downfall, a more recent one, Intel requested a 12 month embargo to release a microcode update.

Post reply on HN