Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Downfall Attacks

downfall.page

Post reply on HN
Print view View original

291–300 of 349 posts

Re: Downfall Attacks

#291

Post by kzrdude »

hansendc wrote: post #246
kzrdude wrote: post #148

See this LWN story: https://lwn.net/Articles/940783/ on Linux, any cpus that don't have updated microcode will have AVX completely disabled as a mitigation for this issue. That's rather harsh if you ask me and would be very noticeable. Now I'm interested in finding out if I can get updated microcode..

The AVX disable is only when you use "gather_data_sampling=force". The default is to leave AVX alone and proclaim the system to be vulnerable. From https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/lin... : > Specifying "gather_data_sampling=force" will use the microcode mitigation when > available or disable AVX on affected systems where the microcode hasn't been > updated to include the mitigation. Disclaime…

Great, thanks for the clarification

Re: Downfall Attacks

#292

Post by dijit »

mike_hearn wrote: post #289
BeeOnRope wrote: post #120

What I find odd is that after the initial Spectre attacks, there have been a long string of these attacks discovered by outside researchers and then patched by the chipmakers. In principle it seems like the chipmakers should hold all the cards when it comes to discovery: they are experts in speculative execution, know exactly how their chips work and have massive existing validation suites, simulators and internal ma…

One possibility nobody mentioned yet: the chip vendors don't invest a ton of time looking for them because they don't actually matter that much. Bear in mind, security researchers are incentivized to find things to build their reputation. It's very often the case that they claim something is a world-shaking security vulnerability when in reality it doesn't matter much for real world attackers. Has anyone ever found a…

> Has anyone ever found a speculation attack in the wild? I think the answer might be no.

this is known as the Y2K paradox.

The Y2K bug had the potential to be very dangerous, but due to a wide-reaching campaign and tonnes of investment in prevention, when the millennium came, it did so with very few issues (though there were still some); leading many to speculate that the issues were overblown

Re: Downfall Attacks

#293

Post by mad »

BeeOnRope wrote: post #120

What I find odd is that after the initial Spectre attacks, there have been a long string of these attacks discovered by outside researchers and then patched by the chipmakers. In principle it seems like the chipmakers should hold all the cards when it comes to discovery: they are experts in speculative execution, know exactly how their chips work and have massive existing validation suites, simulators and internal ma…

Company politics? According to this tweet, parts of Intel did know about this attack: https://twitter.com/bsdaemon/status/1688978152201015301

Re: Downfall Attacks

#294

Post by andrewaylett »

r3trohack3r wrote: post #232
throwaway892238 wrote: post #226

Earlier quoted context omitted.

If by "highly standardized" you mean "you don't get a choice in what you can do or how it works", I agree. Native mobile apps thrive despite this magical web browser working everywhere, because the web browser simply doesn't do what native apps do. You may enjoy that, but a million businesses and billions of users out there don't agree, because they use native apps. There were 255 billion native mobile app downloads…

> Native mobile apps thrive despite this magical web browser working everywhere There’s also user behavior. Many users are conditioned to get software through the App Store. I’ve seen this be a driving factor for quite a few web native applications spinning up native dev teams and shipping native clients. Many folks are surprised to see just how far you can push a browser app and how small the gap between web and bro…

You can ship web apps via the Play Store for Android: https://developers.google.com/codelabs/pwa-in-play

But you're not allowed to for iOS: https://developer.apple.com/app-store/review/guidelines/#min...

Re: Downfall Attacks

#295

Post by yaris »

djbusby wrote: post #205
toyg wrote: post #193

Earlier quoted context omitted.

Maybe they're simply victims of Kernighan's Law of Debugging: "Everyone knows that debugging is twice as hard as writing a program in the first place. So if you're as clever as you can be when you write it, how will you ever debug it?" There is no doubt that Intel make chips "as clever as they can". Hence, by definition, they can't fully debug them.

If debugging is what we call it when fixing things, does that mean we're "bugging" when we make it?

Indeed! "Every program can be reduced to a single line of code, which will have a bug". For hardware this also holds, I believe.

Re: Downfall Attacks

#296

Post by kzrdude »

moonchild wrote: post #165
hyperman1 wrote: post #46

Earlier quoted context omitted.

I've wondered if we can't give a dedicated core to the browser. Of course, then web pages can steal from other web pages. Maybe task switching needs to erect much higher barriers between security contexts, a complete flush or so?

You would need a dedicated core per tab . Partitioning tabs according to trust would be ~fine, but laborious and error-prone.

Normally only one tab is in view at a time. Probably a bunch of use cases would hate this, but what if all background tabs just got very sparse time-share of a core and the foreground tab a dedicated core?

Re: Downfall Attacks

#298

Post by pulpfictional »

eternityforest wrote: post #259
throwaway892238 wrote: post #226

Earlier quoted context omitted.

If by "highly standardized" you mean "you don't get a choice in what you can do or how it works", I agree. Native mobile apps thrive despite this magical web browser working everywhere, because the web browser simply doesn't do what native apps do. You may enjoy that, but a million businesses and billions of users out there don't agree, because they use native apps. There were 255 billion native mobile app downloads…

There are probably more website visits than that. People download games and bank apps and things like that, stuff they expect to use frequently, want fast access or offline ability, of they need hardware access. There are still tons of things that don't need an app. Things that are inherently online and not accessed frequently work fine as sites. The web doesn't limit what you can do that much, it limits how you can…

> A lot of the limitations are probably just Mozzilla hating anything that could be used for tracking, and not trusting users to manage permissions.

Don't denigrate Mozilla for protecting users. There are a lot of privacy issues that can't be addressed by permissions models, Android serves as an example of that. Enumeration is not effective.

If Mozilla are standing in the way of invasive webpages, more power to them.

Re: Downfall Attacks

#299

Post by dncornholio »

zerocrates wrote: post #117

Only up to 11th gen... it didn't seem like this could have been disclosed to Intel soon enough for them to have fixed it for 12th gen, so had they just happened to fix it while fixing something else, or what? Decided to look in the paper and "Intel states that newer CPUs such as Alder Lake, Raptor Lake, and Sapphire Rapids are unaffected, although not a security consideration and seems just a side effect of a signifi…

Yes

Re: Downfall Attacks

#300

Post by mnw21cam »

CanaryLayout wrote: post #189
CTDOCodebases wrote: post #173

Earlier quoted context omitted.

And maybe just maybe when the Snowden revelations started to come out some people woke up and realised that the companies who design the processors used in the vast majority of computers are from the US. https://www.theverge.com/2013/12/20/5231006/nsa-paid-10-mill...

Since Applied Cryptograhy and everyday since publication it's been well-known and well-understood that NSA's never-ending efforts to weaken systems to make it easier for them to do their work wrecks havoc and costs billions to everyone else. Luckily their attempt to get everyone to adopt a PRNG that was broken on-purpose was thwarted. But who's to say that any chipmaker gets bribed to backdoor their design to allow t…

It wreaks havoc. I think wrecking havoc is probably the opposite to what you meant.
Post reply on HN