71–80 of 141 posts
Earlier quoted context omitted.
Sounds like you'd enjoy https://en.m.wikipedia.org/wiki/BLIT_(short_story)
Also Snowcrash https://en.wikipedia.org/wiki/Snow_Crash
Earlier quoted context omitted.
>unlike Rowhammer, RAMBleed does not require persistent bit flips, and is thus effective against ECC memory commonly used by server computers. Seems like mitigations for Rowhammer is not enough for RAMBleed.
ECC isn't effective mitigation against Rowhammer either. https://www.vusec.net/projects/eccploit/ tl;dr ECC logic can't cope with 'single' errors involving > 2 bits.
Whenever you have sharing, you usually have side channels. We're going to see more and more of this until we have much better hardware isolation. This is a kind of obvious variant of Rowhammer, which hasn't generally been fixed AFAIK. Hardware in the late 2010s seems a bit like Windows in the late 1990s - a house of cards waiting to collapse, but the dominant vendors know that very few customers are willing to pay mo…
Earlier quoted context omitted.
Also Snowcrash https://en.wikipedia.org/wiki/Snow_Crash
Another fun one is the Lexicon by Max Barry, except it exploits the auditory language processing. https://www.goodreads.com/book/show/16158596-lexicon
Whenever you have sharing, you usually have side channels. We're going to see more and more of this until we have much better hardware isolation. This is a kind of obvious variant of Rowhammer, which hasn't generally been fixed AFAIK. Hardware in the late 2010s seems a bit like Windows in the late 1990s - a house of cards waiting to collapse, but the dominant vendors know that very few customers are willing to pay mo…
Real-world side channels are going to start getting more attention as the technology and techniques for extracting information from EM radiation from circuits (not radios) leaking state improve.
Whenever you have sharing, you usually have side channels. We're going to see more and more of this until we have much better hardware isolation. This is a kind of obvious variant of Rowhammer, which hasn't generally been fixed AFAIK. Hardware in the late 2010s seems a bit like Windows in the late 1990s - a house of cards waiting to collapse, but the dominant vendors know that very few customers are willing to pay mo…
Real-world side channels are going to start getting more attention as the technology and techniques for extracting information from EM radiation from circuits (not radios) leaking state improve.
Whats known to the public, you mean. I suspect even the nuttier conspiracy theorists don't have a solid grasp of just what capabilities might exist among well funded secret institutions.
Earlier quoted context omitted.
Probably not. However, historically, these sorts of attacks always get better, not worse. And while even that can sometimes be empty rhetoric, I will say in the last 5 years I'm seeing a lot of security attacks that are already well beyond what even my moderately-trained intuition would suggest are possible, so I have to admit I've sort of given up on trying to guess on whether or not an attack can be made practical.…
Yeah, it seems that whenever an exploit "doesn't seem practical for actual use" it is just one more exploit-in-the-chain away from being operationalized. So many systems have unspecified, undocumented and undertested behaviors that have not been exploited only because no one has ever tried.
Why does every new attack have a homepage these days?
I forget if heartbleed was the first one to a have a homepage or the first one to have a catchy name, but it was to help with the public relations angle of convincing CIOs or their equivalents in an organization to take the problem seriously AFAIK. Someone else here can probably answer it better.
Earlier quoted context omitted.
Real-world side channels are going to start getting more attention as the technology and techniques for extracting information from EM radiation from circuits (not radios) leaking state improve.
Is that possible without special hardware to detect EM radiation?
This colossal security update was released as Windows XP Service Pack 2. This is the beauty of software.
Hardware vulnerabilities scare me. There are millions of Intel CPUs and DRAM modules installed in data centers and PCs around the world. When we find vulnerabilities in hardware how are we supposed to fix them?
The past few years have been really scary for me as a software engineer. I keep thinking that the next one will pop the software bubble.