Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Reading privileged memory with a side-channel

googleprojectzero.blogspot.com

Post reply on HN
Print view View original

371–380 of 639 posts

Re: Reading privileged memory with a side-channel

#371

Post by binarycrusader »

jhallenworld wrote: post #187
jotux wrote: post #115

Papers describing each attack: https://meltdownattack.com/meltdown.pdf https://spectreattack.com/spectre.pdf From the spectre paper: >As a proof-of-concept, JavaScript code was written that, when run in the Google Chrome browser, allows JavaScript to read private memory from the process in which it runs (cf. Listing 2). Scary stuff.

"Meltdown" is an Intel bug. "Spectre" is very bad news and affects all modern CPUs. Mitigation is to insert mfence instructions throughout jit generated sandboxed code making it very slow, ugh. Otherwise assume that the entire process with jit generated code is open to reading by that code. Any system which keeps data from multiple customers (or whatever) in the same process is going to be highly vulnerable.

"Spectre" is very bad news and affects all modern CPUs

It's not yet clear whether it affects all modern CPUs, notably I have yet to see any mention of modern POWER/MIPS/SPARC-based designs. If someone has pointers, those particular cases would probably be quite interesting.

Re: Reading privileged memory with a side-channel

#372

Post by CogitoCogito »

Pyxl101 wrote: post #329
deckard1 wrote: post #276

Earlier quoted context omitted.

We'll have to dig a time machine out and go back to 1998 then. I'm being a facetious ass. But you know I'm not wrong, either.

I browse with NoScript and quite a lot of the web works just fine, in fact. I can selectively enable JavaScript for sites that need it, and that I trust.

Why was this downvoted? This is clearly true. I am in fact doing it right now. I am sitting in an airport and clicked around 20 different comment sections and articles from HN so that I could read them later. None of them gave any issues. The only js that I decided to allow was from HN so that I could expand/hide comments.

Does this mean that all websites work? Of course not. But this allows the user to choose which sites to allow to run js. I'm not going to pretend that this is an easy task for non-technical users, but we should be promoting these kinds of habits, not scoffing at them. We should educate as many users as possible that they can still (for now) control much of the web-based code executing on their machines.

Re: Reading privileged memory with a side-channel

#373

Post by rasz »

bloorp wrote: post #217
mtanski wrote: post #185

Earlier quoted context omitted.

Speculative execution as a concept should not be flawed. My take is that the results of illegal speculation should never be leaked in a visable way.

As I read through the meltdown paper, it looks really difficult to have the security we want and the performance we want at the same time. It's pretty crazy, but here's my limited understanding: There's a huge shared buffer between two threads. 256 * 4K. One thread reads a byte of kernel memory, literally any byte it wants, and it then reads one of those 4K pages from that buffer in order to cache that one memory pag…

Keep a small pool of cache lines exclusive to speculative execution, discard when non taken, rename affected cache lines (like register renaming so no copy) when taken.

Re: Reading privileged memory with a side-channel

#374

Post by jopsen »

ebikelaw wrote: post #228
wslh wrote: post #64

Has Google the best security team in the world? It seems like Google security is in a complete different league. I cannot imagine how this impacts companies handling fiat money or cryptocurrencies in the cloud like Coinbase in AWS.

I can't imagine better marketing for cloud services than making it as clear as you can that the world is a very dangerous place for computers and if you don't have a crack team of hundreds of battle-hardened security engineers then you have no business hooking your computers up to the internet.

Hmm, or maybe it's a reason to go with bare-metal providers :)

Re: Reading privileged memory with a side-channel

#376

Post by pizlonator »

binarycrusader wrote: post #371
jhallenworld wrote: post #187

Earlier quoted context omitted.

"Meltdown" is an Intel bug. "Spectre" is very bad news and affects all modern CPUs. Mitigation is to insert mfence instructions throughout jit generated sandboxed code making it very slow, ugh. Otherwise assume that the entire process with jit generated code is open to reading by that code. Any system which keeps data from multiple customers (or whatever) in the same process is going to be highly vulnerable.

"Spectre" is very bad news and affects all modern CPUs It's not yet clear whether it affects all modern CPUs, notably I have yet to see any mention of modern POWER/MIPS/SPARC-based designs. If someone has pointers, those particular cases would probably be quite interesting.

It affects CPUs that do speculative execution. Pretty sure some powers do.

Re: Reading privileged memory with a side-channel

#377

Post by aidenn0 »

olliej wrote: post #332
aidenn0 wrote: post #289

Earlier quoted context omitted.

That can't be right because they already round performance.now() so the Spectre attack didn't use it (it instead used a webworker with a tight-loop incrementing a counter)

the tight loop iteration used a shared array buffer to provide a high resolution timer, specifically to deal with the obvious fix of truncating precision of performance.now(). The reason for /further/ truncating performance.now() is that the relative cost in this attack means that you don't need as much precision as was needed for the original (page table? I think) attack. A SAB timer just needs to increment a counte…

Thanks, I missed how important SAB was to their webworker timer.

Re: Reading privileged memory with a side-channel

#378

Post by sqldba »

ErikAugust wrote: post #209
jotux wrote: post #115

Papers describing each attack: https://meltdownattack.com/meltdown.pdf https://spectreattack.com/spectre.pdf From the spectre paper: >As a proof-of-concept, JavaScript code was written that, when run in the Google Chrome browser, allows JavaScript to read private memory from the process in which it runs (cf. Listing 2). Scary stuff.

I've thrown the C code in the Spectre paper up if anyone wants to feel the magic: https://gist.github.com/ErikAugust/724d4a969fb2c6ae1bbd7b2a9...

Works on MacOS 10.13.2.

Looking back, the Mac patches were to address KPTI (Meltdown) which is separate to Spectre.

Re: Reading privileged memory with a side-channel

#379

Post by djsumdog »

djur wrote: post #196
Krenair wrote: post #166

Earlier quoted context omitted.

https://www.linkedin.com/feed/update/urn:li:activity:6354450... says: > Want to know what's really going on with the Intel security flaw everyone is talking about? Checkout https://meltdownattack.com to get all the details. This is my boyfriend's and his research team's latest work. An huge security breach which affects nearly all your computers! Stealing all your secrets never was that easy!

I thought the presence of a branch in the logo was clever.

I just noticed that. That is pretty clever.

Re: Reading privileged memory with a side-channel

#380

Post by RandomBK »

lettergram wrote: post #192
digikata wrote: post #42

Earlier quoted context omitted.

So there's a bit of an unknown if AMD's most recent generation of processor has the Spectre vulnerability?

We know that the scariest attack "meltdown", cannot be reproduced on AMD or ARM chips at all[1]. The second attack "Spectre" is also greatly mitigated due the neural network predicting pathways for the application. Thus it's unlikely/less-likely that you'll be able to access other locations in memory[2]. However, it's definitely possible. [1] https://meltdownattack.com/meltdown.pdf [2] https://spectreattack.com/spect…

Has anyone tried the Spectre PoC in the paper on ThreadRipper? I can confirm it works on my i7-7700K.
Post reply on HN