Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Intel Responds to Security Research Findings

newsroom.intel.com

Post reply on HN
Print view View original

231–240 of 245 posts

Re: Intel Responds to Security Research Findings

#231

Post by gshulegaard »

strmpnk wrote: post #224
strmpnk wrote: post #222

Earlier quoted context omitted.

The patch that was under question was related to a workaround for Meltdown, which makes AMD's note regarding the lack of necessity in agreement with the paper. The Spectre paper seems to be a bit less specific on how platforms might differ under explotation but very clearly states that it was verified to be possible. Workarounds for that problem will likely be much more application specific from what I can tell, but…

Update: AMD has an official statement with a clear outline of the discussed vulnerabilities: https://www.amd.com/en/corporate/speculative-execution

Also wanted to point out that AMD's official statement was much better IMO.

Re: Intel Responds to Security Research Findings

#232

Post by nurettin »

This probably means software is using CPUs in a way that they weren't meant to. To me, it is funny to watch how virtualization and JIT compilers changed the game for CPU vendors who were used to making CPUs mainly for compiling and running software on a single host instance. Since we have direct virtualization support now, I suspect we are going to get a JIT support in CPUs soon (if we didn't already).

Re: Intel Responds to Security Research Findings

#233

Post by frik »

frou_dh wrote: post #152
frik wrote: post #117

Earlier quoted context omitted.

Intel should now recall the affected CPUs and ship new fixed CPUs without Intel "ME" for Management Engine, another well known open flaw. In the end, hardware and software devs in the 1970s were right. Operating systems like MULTICS and computers like PDP-11 got it right. MULTICS supported 16 rings and has many advanced features that almost everyone forgot and never implemented in newer OS - shame on all of us! Intel…

> Intel should now recall the affected CPUs and ship new fixed CPUs You think they have the tooling to manufacture drop-in replacements for up to decade old CPUs, even if they wanted to?

Wtf? Have I said that? No.

Re: Intel Responds to Security Research Findings

#234

Post by martin1975 »

Strudelnoggin wrote: post #206
martin1975 wrote: post #138

Earlier quoted context omitted.

Bet you a dollar some lawyer had to vet that three times over before they published it.

That same lawyer no doubt had to tell them that the following statement wouldn't fly without the addition of the word "believes": "Intel believes its products are the most secure in the world [ . . . ]"

Nicely done. Words like 'is' incur liability because it can be interpreted as making factual statements that you could be held accountable for. Hurry, get your law degree so you can skin Intel alive ;)

Re: Intel Responds to Security Research Findings

#235

Post by simooooo »

Nition wrote: post #111
bjornedstrom wrote: post #73

This is probably one of the poorest and most defensive PR pieces I've read from a company in a long time, and it does not really make me sympathetic to them at all. > Intel and other technology companies have been made aware of new security research describing software analysis methods that, when used for malicious purposes, have the potential to improperly gather sensitive data from computing devices that are operat…

Yeah, I had to read the “bug” or “flaw” part twice to be sure they're not saying it isn't a bug or flaw, they're only saying it isn't unique to Intel. And then as you say, they immediately mention AMD to imply that everyone has the issue, but they also avoid actually saying that. Your excellent analysis of what they're really saying reminds me of user thaumaturgy's analysis of Adancing Our Amazing Bet[1]. [1] https:/…

They said it wasn't the paragraph before

Re: Intel Responds to Security Research Findings

#236

Post by GenericsMotors »

> Intel believes its products are the most secure in the world and that, with the support of its partners, the current solutions to this issue provide the best possible security for its customers.

* sad trombone *

They're obviously not the most secure, as the Project Zero research shows. The whole press release has to be one of the most dismissive and snobbish PR pieces I've seen from a large corp.

Re: Intel Responds to Security Research Findings

#237

Post by ksec »

Nition wrote: post #111
bjornedstrom wrote: post #73

This is probably one of the poorest and most defensive PR pieces I've read from a company in a long time, and it does not really make me sympathetic to them at all. > Intel and other technology companies have been made aware of new security research describing software analysis methods that, when used for malicious purposes, have the potential to improperly gather sensitive data from computing devices that are operat…

Yeah, I had to read the “bug” or “flaw” part twice to be sure they're not saying it isn't a bug or flaw, they're only saying it isn't unique to Intel. And then as you say, they immediately mention AMD to imply that everyone has the issue, but they also avoid actually saying that. Your excellent analysis of what they're really saying reminds me of user thaumaturgy's analysis of Adancing Our Amazing Bet[1]. [1] https:/…

They could have just said other Industry vendors, but they HAD to name names.

To add insult to this already cheap shot, it was flat out lies and AMD isn't vulnerable to all three variants.

This is just pathetic.

Re: Intel Responds to Security Research Findings

#239

Post by thehardsphere »

betterunix2 wrote: post #109
thehardsphere wrote: post #92

Earlier quoted context omitted.

We know that "AMD processors are not subject to the types of attacks that the kernel page table isolation feature protects against." E.g. that AMD does not need the patch that Intel does. That is not the same as saying AMD is not affected at all. We do not know what the actual bug that prompted this activity is. Nobody has revealed that information. It is possible that the bug affects AMD also but does not require th…

The followup sentence: "The AMD microarchitecture does not allow memory references, including speculative references, that access higher privileged data when running in a lesser privileged mode when that access would result in a page fault." That is a pretty specific reference to the root of the problem, and a pretty clear indication that AMD's design decisions protect against whatever the attack is. Sure, we may fin…

And, 17 hours later, we now know that there were three distinct vulnerabilities, of which one applies to AMD.

https://googleprojectzero.blogspot.com/2018/01/reading-privi...

Re: Intel Responds to Security Research Findings

#240

Post by betterunix2 »

thehardsphere wrote: post #239
betterunix2 wrote: post #109

Earlier quoted context omitted.

The followup sentence: "The AMD microarchitecture does not allow memory references, including speculative references, that access higher privileged data when running in a lesser privileged mode when that access would result in a page fault." That is a pretty specific reference to the root of the problem, and a pretty clear indication that AMD's design decisions protect against whatever the attack is. Sure, we may fin…

And, 17 hours later, we now know that there were three distinct vulnerabilities, of which one applies to AMD. https://googleprojectzero.blogspot.com/2018/01/reading-privi...

Only under specific software configurations that are not enabled by default, or confined to a userspace single process (which is bad for web browsers running Javascript but not nearly as bad as the Intel-specific attacks). So while AMD is somewhat vulnerable, the most severe and easiest to exploit vulnerabilities are pretty specific to Intel. In a pedantic sense you were right, AMD chips are affected, but it is literally not on the same level as for Intel chips.
Post reply on HN