Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Reading privileged memory with a side-channel

googleprojectzero.blogspot.com

Post reply on HN
Print view View original

401–410 of 639 posts

Re: Reading privileged memory with a side-channel

#401

Post by InclinedPlane »

rconti wrote: post #133

What are the odds that the NSA already knew about this? Roughly 100%?

This is a toughie. These bugs are basically very difficult to mitigate completely without fixes at the hardware level. One might imagine the NSA being coy and patching their own OS's et al to the degree they can while working to exploit the bug in the wild. However, the reality is that this bug is almost worse for the NSA than for most other folks, because they have the most to lose if their security is breached. And they have a lot of machines out there. The idea of a bug of this severity that leaves no traces is probably leaving a lot of people at the NSA in cold sweats right now. Meaning that if they did discover it before other researchers it's questionable whether they would have tried to exploit it vs. driving towards the most rapid possible mitigation and fix.

Re: Reading privileged memory with a side-channel

#402

Post by tanilama »

snowwrestler wrote: post #390
ebikelaw wrote: post #228

Earlier quoted context omitted.

I can't imagine better marketing for cloud services than making it as clear as you can that the world is a very dangerous place for computers and if you don't have a crack team of hundreds of battle-hardened security engineers then you have no business hooking your computers up to the internet.

The irony here is that a good ol' dedicated hardware web server is far less susceptible to Meltdown or Spectre than Google Cloud, because only your code is running on the CPUs. I predict tonight's disclosures will lead to an uptick in interest in running websites on dedicated hardware, like we did back at the turn of the century.

> Spectre

Spectre doesn't really care if it is cloud or bare metal. They are equally vulnerable unless disconnected from internet.

Re: Reading privileged memory with a side-channel

#403

Post by diyseguy »

porjo wrote: post #395
diyseguy wrote: post #355

Earlier quoted context omitted.

I thought it was supposed to be exploitable by javascript? If you can get to the machine and run c code, well, that doesn't seem like an exploit?

From the Spectre whitepaper: > In addition to violating process isolation boundaries using native code, Spectre attacks can also be used to violate browser sandboxing, by mounting them via portable JavaScript code. We wrote a JavaScript program that successfully reads data from the address space of the browser process running it. The whitepaper doesn't contain example JS code however

This whitepaper describes the Javascript exploit in Section IV. I'm struggling to understand it though: http://www.cs.vu.nl/~herbertb/download/papers/anc_ndss17.pdf

Re: Reading privileged memory with a side-channel

#405

Post by olliej »

binarycrusader wrote: post #387
pizlonator wrote: post #376

Earlier quoted context omitted.

It affects CPUs that do speculative execution. Pretty sure some powers do.

I wonder to what degree some systems are affected. I believe Solaris already uses separate address spaces on SPARC for user and kernel. I haven’t looked over the SPARC architecture manual to see if they allow speculative execution beyond privilege boundaries.

That only prevent reading over higher privilege (the meltdown vulnerability) it doesn't protect the arbitrary user land reads from spectre.

Re: Reading privileged memory with a side-channel

#406

Post by olliej »

Certhas wrote: post #207
jhallenworld wrote: post #187

Earlier quoted context omitted.

"Meltdown" is an Intel bug. "Spectre" is very bad news and affects all modern CPUs. Mitigation is to insert mfence instructions throughout jit generated sandboxed code making it very slow, ugh. Otherwise assume that the entire process with jit generated code is open to reading by that code. Any system which keeps data from multiple customers (or whatever) in the same process is going to be highly vulnerable.

After skimming the articles it sounds like a lot hinges on just how hard Spectre is to pull off in practice/in the wild. Anyone have any insights on that?

it isn't. There have been a few PoC referenced on twitter, and the spectre paper itself reference a PoC in browser hosted javascript (e.g. random ad can scan memory)

it's obviously not a free + zero time activity, but I'm going to assume someone making an ad to scan memory isn't super concerned about end user cpu usage or battery life..

Re: Reading privileged memory with a side-channel

#407

Post by [deleted] »

f2f wrote: post #360
cfeeley wrote: post #279

One of the meltdown paper writers evidently has a sense of humor since "hunter2" [0] is one of the passwords they use in their demonstration [1] [0] http://bash.org/?244321 [1] https://meltdownattack.com/meltdown.pdf (page 13, figure 6)

hunter2 is the industry's accepted PoC password.

[deleted]

Re: Reading privileged memory with a side-channel

#408

Post by Godel_unicode »

jacksmith21006 wrote: post #122
enneff wrote: post #77

Earlier quoted context omitted.

I don't know how you would evaluate such a thing as "best security team," but Project Zero certainly attracts a high calibre of security expert. If you're into breaking things, why wouldn't you want to break things with other bright people and the support of a massive corporation?

How about based on how many of the serious issues are found by Google. It has been one after another.

They're definitely world class, but they're also loud about it. Consider that other teams perhaps have a different model. For instance, Microsoft's internal team surely finds lots of clever bugs that never get talked about in Microsoft products.

Re: Reading privileged memory with a side-channel

#409

Post by Godel_unicode »

tanilama wrote: post #402
snowwrestler wrote: post #390

Earlier quoted context omitted.

The irony here is that a good ol' dedicated hardware web server is far less susceptible to Meltdown or Spectre than Google Cloud, because only your code is running on the CPUs. I predict tonight's disclosures will lead to an uptick in interest in running websites on dedicated hardware, like we did back at the turn of the century.

> Spectre Spectre doesn't really care if it is cloud or bare metal. They are equally vulnerable unless disconnected from internet.

Pretty hard to have a neighbor vm execute Spectre on your same physical server if you have dedicated hardware.

Add in that Spectre specifically is a js bug so in order to be vulnerable your server would need to execute untrusted JavaScript and I think we can assume the threat surface of this specific bug is smaller outside the cloud...

Re: Reading privileged memory with a side-channel

#410

Post by perennate »

I can't understand this paragraph from [1]:

> Cloud providers which use Intel CPUs and Xen PV as virtualization without having patches applied. Furthermore, cloud providers without real hardware virtualization, relying on containers that share one kernel, such as Docker, LXC, or OpenVZ are affected.

I take it to imply that hypervisors that use hardware virtualization are not affected. However, the PoC that reads host memory from a KVM guest seems to contradict this.

Is it because on Xen HVM, KVM, and similar hypervisors, only kernel pages are mapped in the address space of the VM thread (so a malicious VM cannot read memory of other VMs), but on these other hypervisors, pages from other containers are mapped? Yet the Xen security advisory [2] says:

> Xen guests may be able to infer the contents of arbitrary host memory, including memory assigned to other guests.

Relatedly, what sensitive information other than passwords could appear in the kernel memory? I'd expect that at the very least buffers containing sensitive data pertaining to other VMs may be leaked.

[1] https://meltdownattack.com/ [2] https://xenbits.xen.org/xsa/advisory-254.html

Post reply on HN