Reading privileged memory with a side-channel • Hacker News Board

Re: Reading privileged memory with a side-channel

#421

Post by jeremyjh » Thu, Jan 04, 2018, 6:03 AM UTC

jerrycruncher wrote: post #391

chrisseaton wrote: post #303

Earlier quoted context omitted.

I think you’re misunderstanding. The person you’re replying to wasn’t saying you couldn’t disable JavaScript. They are saying the websites they and many in the industry develop won’t work like that and haven’t since the turn of the century. That’s what they were claiming to be not wrong about, and they aren’t. Turning on NoScript shows the problem but doesn’t solve it.

"Turn of the century"? JS was used for little more than swapping images on mouseover and changing/"animating" title bar text back then. The "you will see absolutely nothing or a ream of {{blah}} text" without js enabled really only became prevalent in the last 5-or-so years. Even in the halcyon days of jQuery usage you could get around quite comfortably without js, as js was still being used to augment webpages rathe…

It wasn't common practice, but fully Javascript rendered applications were a thing as early as 2001. That was when my company developed the first one that I know of. It was a godawful ugly pig but it worked.

Most sites did nothing like that, but they did use Javascript and would break in various ways without it. At that time, there were a lot of people admonishing web developers to test their applications with Javascript disabled. Sort of like now.

ETA: I had to look it up - XHR was first available in IE 5 as an ActiveX control. The internet at large couldn't really expect it to be available but I believe that is where we first used it.

Initial release: March 18, 1999; 18 years ago

Re: Reading privileged memory with a side-channel

#422

Post by snowwrestler » Thu, Jan 04, 2018, 6:07 AM UTC

tanilama wrote: post #402

snowwrestler wrote: post #390

Earlier quoted context omitted.

The irony here is that a good ol' dedicated hardware web server is far less susceptible to Meltdown or Spectre than Google Cloud, because only your code is running on the CPUs. I predict tonight's disclosures will lead to an uptick in interest in running websites on dedicated hardware, like we did back at the turn of the century.

> Spectre Spectre doesn't really care if it is cloud or bare metal. They are equally vulnerable unless disconnected from internet.

To get you with Spectre, the attacker must be able to run code on your CPU.

This affects browsers with Javascript enabled because your Javascript engine runs foreign code on the CPU. The bad guy puts nasty code in a page, you visit the page, the code executes on your machine--boom.

And it affects public cloud web servers because multiple cloud servers (virtual machines) run on one CPU. So some attacker might be able to jump out of their VM and read your VM's memory.

BUT, on a dedicated hardware web server, there shouldn't be any foreign code running--no foreign VMs, and no browser.

Re: Reading privileged memory with a side-channel

#423

Post by djsumdog » Thu, Jan 04, 2018, 6:09 AM UTC

debt wrote: post #31

Speculative execution seems like something that would be very intuitively insecure even to a layperson(relative to the field of course). I'm wondering, was this vulnerability theorized first and later found out to be an actual vulnerability? Or was this something that nobody had any clue about? I'm only saying this, because from a security perspective, I imagine somewhere at some point very early on someone had to ha…

According to this comment, it has been theorized for quite some time:

https://news.ycombinator.com/item?id=16066165

With this particular computer scientist, who talked about this problem before, referenced in Google's paper:

http://www.cs.binghamton.edu/~dima/

Re: Reading privileged memory with a side-channel

#424

Post by djsumdog » Thu, Jan 04, 2018, 6:13 AM UTC

thaumaturgy wrote: post #130

swampthinker wrote: post #24

"Testing also showed that an attack running on one virtual machine was able to access the physical memory of the host machine, and through that, gain read-access to the memory of a different virtual machine on the same host." Holy shit.

We should quote OpenBSD's Theo de Raadt here, all the way back from 2007: "x86 virtualization is about basically placing another nearly full kernel, full of new bugs, on top of a nasty x86 architecture which barely has correct page protection. Then running your operating system on the other side of this brand new pile of shit." https://marc.info/?l=openbsd-misc&m=119318909016582&w=2

Hmm. Is OpenBSD patched for Meltdown? I don't see anything on their main site.

Re: Reading privileged memory with a side-channel

#425

Post by djsumdog » Thu, Jan 04, 2018, 6:15 AM UTC

untog wrote: post #144

static_noise wrote: post #45

Earlier quoted context omitted.

This basically kills cloud computing for anything sensitive using shared hardware. In the short term this will actually be good for cloud providers because the demand for dedicated instances will shoot up as there is no short-term alternative.

The short term answer is to patch the servers and swallow the 30% performance cut. Still likely cheaper than dedicated servers.

Which could mean huge sales for Intel, or even AMD, if Amazon, DigitalOcean, Linode and others want to rush to get that lost performance back.

Going to AMD would be incredibly expensive as you'd be replacing nearly everything, but if Intel gets new chips out in a reasonable amount of time, they might actually make a killing on this.

Re: Reading privileged memory with a side-channel

#426

Post by djsumdog » Thu, Jan 04, 2018, 6:17 AM UTC

baq wrote: post #97

srcmap wrote: post #70

Earlier quoted context omitted.

Main/Big impacts are on the cloud computer. For home computer, standard office use, there is no impact at this point, right?

the big if is whether javascript code that can exploit this can be written. (edit: that's a yes, from the pdf itself...) if yes, nobody's safe, as any webpage ( any webpage , even that ad in an iframe) could in theory read your password if it's anywhere in RAM.

Firefox and Chrome have both started posting mitigation strategies. They're mentioned in other comments, some depending on making time functions less accurate since this is a timing attack.

Re: Reading privileged memory with a side-channel

#427

Post by djsumdog » Thu, Jan 04, 2018, 6:18 AM UTC

OldSchoolJohnny wrote: post #190

tarruda wrote: post #164

It seems that Richard Stallman is not so paranoid after all: > I am careful in how I use the Internet. > I generally do not connect to web sites from my own machine, aside from a few sites I have some special relationship with. I usually fetch web pages from other sites by sending mail to a program (see https://git.savannah.gnu.org/git/womb/hacks.git ) that fetches them, much like wget, and then mails them back to me…

RMS remains a rambling nutjob and none of this is really applicable to the issue at hand.

Well he was right about the Intel ME vulnerabilities

Re: Reading privileged memory with a side-channel

#428

Post by [deleted] » Thu, Jan 04, 2018, 6:23 AM UTC

InclinedPlane wrote: post #245

jotux wrote: post #115

Papers describing each attack: https://meltdownattack.com/meltdown.pdf https://spectreattack.com/spectre.pdf From the spectre paper: >As a proof-of-concept, JavaScript code was written that, when run in the Google Chrome browser, allows JavaScript to read private memory from the process in which it runs (cf. Listing 2). Scary stuff.

This is so incredibly bad. Spectre is basically unpatchable . We can do better than we are now with patches but it's all just turd polishing, essentially. A proper fix will require new CPU hardware. And as a kicker? Leaks are basically undetectable.

[deleted]

Re: Reading privileged memory with a side-channel

#429

Post by [deleted] » Thu, Jan 04, 2018, 6:24 AM UTC

asgioiobuio wrote: post #419

gervase wrote: post #134

Earlier quoted context omitted.

Project Zero is very well known for things exactly like this. Partially, it's because they are incredibly talented, but there are also talented people in academia and in other security consultancies. The biggest difference with Project Zero is that their primary [0] goal is altruistic: find vulnerabilities, and let people who can fix them know (vs publishing papers, securing paying clients, auctioning zero-days, etc)…

Oh, come on. Their only goal is to make Google money. The fact that they do useful work is a nice side effect, but if they didn't improve Google's security and give good PR there's not a chance in Hell Google would keep them around.

[deleted]

Re: Reading privileged memory with a side-channel

#430

Post by hyperion2010 » Thu, Jan 04, 2018, 6:25 AM UTC

An analogy that was useful for explaining part of this to my (non-technical) father. Maybe others will find it helpful as well.

Imagine that you want to know whether someone has checked out a particular library book. The library refuses to give you access to their records and does not keep a slip inside the front cover. You can only see the record of which books you have checked out.

What you do is follow the person of interest into the library whenever they return a book. You then ask the librarian for a copy of the books you want to know whether the person has checked out. If the librarian looks down and says "You are in luck, I have a copy right here!" then you know the person had checked out that book. If the librarian has to go look in the stacks and comes back 5 minutes later with the book, you know that the person didn't check out that book (this time).

The way to make the library secure against this kind of attack is to require that all books be reshelved before they can be lent out again, unless the current borrower is requesting an extension.

There are many other ways to use the behavior of the librarian and the time it takes to retrieve a book to figure out which books a person is reading.

edit: A closer variant. Call the library pretending to be the person and ask for a book to be put on hold. Then watch how long it takes them in the library. If they got that book they will be in and out in a minute (and perhaps a bit confused), if they didn't take that book it will take 5 minutes.