Thanks to incidents like these, I'm very happily employed. One of the perks of working in infosec.
I hereby nominate 2018's song to be Billy Joel's We Didn't Start the Fire.
Reading privileged memory with a side-channel
581–590 of 639 posts
Re: Reading privileged memory with a side-channel
#582Earlier quoted context omitted.
I wonder what fraction of data inside a kernel is really ‘private’. Obviously we want 100% of the data in the kernel not to be writeable, but if only a small amount shouldn’t be accessible at all then maybe the long term solution is to handle that data in a special way. Something that makes using it slower but doesn’t make every other syscall suffer as much as a consequence. Or maybe the solution is to prioritize mov…
Well the good news is that now microkernels can take over. With KPTI (also known as FUCKWIT), a syscall is now as expensive as a context switch to another userland process. Of course, that means now monolithic kernels run just as slow as microkernels.
Hypervisors and containers already blur this line. I think we were heading there anyway.
But a microkernel is going to have multiple processes talking to each other, so there will still be more overhead whenever a message requires coordination between more than two processes.
Re: Reading privileged memory with a side-channel
#583Earlier quoted context omitted.
So all that needs to be done is make 64GB L1 on the die...
Not possible - the physical size of 64GB (even at nm scale) means that the time it takes for a signal to traverse it causes memory to take a long time to access, meaning you need a L0 cache to maintain performance.
We need to go 3d
Re: Reading privileged memory with a side-channel
#584Earlier quoted context omitted.
As I read through the meltdown paper, it looks really difficult to have the security we want and the performance we want at the same time. It's pretty crazy, but here's my limited understanding: There's a huge shared buffer between two threads. 256 * 4K. One thread reads a byte of kernel memory, literally any byte it wants, and it then reads one of those 4K pages from that buffer in order to cache that one memory pag…
Keep a small pool of cache lines exclusive to speculative execution, discard when non taken, rename affected cache lines (like register renaming so no copy) when taken.
Also, separate BTB for each process and privilege level.
Re: Reading privileged memory with a side-channel
#585Earlier quoted context omitted.
I don't understand how this info can be used for getting what was inside the book? If my understanding of your explanation is correct, book name is analogous to memory address. When the victim (legit process) returned the book with name X (called free on the mem block X), the librarian (OS) erased all pages of the book and repurposed it for printing another book before handing it out to the evil dude(snoopy process).
My attempt, assuming that the books only contain one character each: The librarian has a list of books you're not allowed to take out. You request one of those books (book X), but it takes a while for search to run to see whether you're allowed to or not. While you're waiting, you say "actually, I'm not really interested in taking out book X, but if the content of that book is 'a', I'd like to take out book Y. If the…
Great explanation - thank you. One thing I don’t understand is how this can be exploited from javascript. Does it have timing primitives so fine it can tell the difference between a memory lookup served from memory va from cache?
Re: Reading privileged memory with a side-channel
#586Thanks again to the geniuses who arranged things so that almost anyone can write code that I must run just so I can use the internet to find and to read public documents
(unless I undergo the tedious process of becoming a noscript user or something similar).
Re: Reading privileged memory with a side-channel
#587Earlier quoted context omitted.
My attempt, assuming that the books only contain one character each: The librarian has a list of books you're not allowed to take out. You request one of those books (book X), but it takes a while for search to run to see whether you're allowed to or not. While you're waiting, you say "actually, I'm not really interested in taking out book X, but if the content of that book is 'a', I'd like to take out book Y. If the…
Great explanation - thank you. One thing I don’t understand is how this can be exploited from javascript. Does it have timing primitives so fine it can tell the difference between a memory lookup served from memory va from cache?
Yes it does because javascript execution has had to become very fast. Fast means you can run a very tight loop that updates a counter to create a fairly high-resolution clock.
Re: Reading privileged memory with a side-channel
#588Does anyone know what kind of isolation still can work after all the patches? Let's say we want to host users' processes or containers and some of them could be pwned. I see Google claiming that their VMs are isolated between the kernel and each other.
Re: Reading privileged memory with a side-channel
#589Earlier quoted context omitted.
My attempt, assuming that the books only contain one character each: The librarian has a list of books you're not allowed to take out. You request one of those books (book X), but it takes a while for search to run to see whether you're allowed to or not. While you're waiting, you say "actually, I'm not really interested in taking out book X, but if the content of that book is 'a', I'd like to take out book Y. If the…
Great explanation - thank you. One thing I don’t understand is how this can be exploited from javascript. Does it have timing primitives so fine it can tell the difference between a memory lookup served from memory va from cache?
I believe they made their own "good enough" clock out of a loop in a webworker.
Re: Reading privileged memory with a side-channel
#590Earlier quoted context omitted.
The majority of coins on Coinbase are in cold-storage and crypto on Coinbase is insured against this type of breach. I personally wouldn't panic to get my coins out.
There was an announcement not long ago saying they are not insured.
Can you reference that? The CoinBase support page currently says crypto is insured against security breaches on their end.