91–100 of 639 posts
Earlier quoted context omitted.
You can find the details below. They've tried AMD CPUs also. https://googleprojectzero.blogspot.com/2018/01/reading-privi...
"We reported this issue to Intel, AMD and ARM on 2017-06-01" What!
https://spectreattack.com/ Information site with some more information, and links to papers on the two vulnerabilities, called "Meltdown" and "Spectre" (with logos, of course). ( https://meltdownattack.com/ goes to the same site)
I feel like the Meltdown logo was done by a real designer, and Spectre was designed by a bored developer.
https://newsroom.intel.com/news/intel-responds-to-security-r...
Earlier quoted context omitted.
Main/Big impacts are on the cloud computer. For home computer, standard office use, there is no impact at this point, right?
Until someone figures out how to exploit it using JavaScript. The speed this moves it could be any minute now.
> In addition to violating process isolation boundaries using native code, Spectre attacks can also be used to violate browser sandboxing, by mounting them via portable JavaScript code. We wrote a JavaScript program that successfully reads data from the address space of the browser process running it.
(granted I think site isolation, if enabled, mitigates crossing domain boundaries)
It goes on to show a sample JS impl that JITs into the expected insns using V8.
Earlier quoted context omitted.
Main/Big impacts are on the cloud computer. For home computer, standard office use, there is no impact at this point, right?
Chrome is listed as impacted. People use chrome password managers.
"In addition to violating process isolation boundaries using native code, Spectre attacks can also be used to violate browser sandboxing, by mounting them via portable JavaScript code. We wrote a JavaScript program that successfully reads data from the address space of the browser process running it." - from the spectre paper
"Testing also showed that an attack running on one virtual machine was able to access the physical memory of the host machine, and through that, gain read-access to the memory of a different virtual machine on the same host." Holy shit.
Main/Big impacts are on the cloud computer. For home computer, standard office use, there is no impact at this point, right?
> Google Chrome
> Some user or customer action needed. More information here (https://support.google.com/faqs/answer/7622138#chrome).
And the "here" link says:
>Google Chrome Browser
>Current stable versions of Chrome include an optional feature called Site Isolation which can be enabled to provide mitigation by isolating websites into separate address spaces. Learn more about Site Isolation and how to take action to enable it.
>Chrome 64, due to be released on January 23, will contain mitigations to protect against exploitation.
>Additional mitigations are planned for future versions of Chrome. Learn more about Chrome's response.
>Desktop (all platforms), Chrome 63:
> Full Site Isolation can be turned on by enabling a flag found at chrome://flags/#enable-site-per-process. > Enterprise policies are available to turn on Site Isolation for all sites, or just those in a specified list. Learn more about Site Isolation by policy.
Does that mean if I don't enable this feature using chrome://flags and tell my grandma to do this complicated procedure I (or she) will be susceptible to getting our passwords stolen?
Earlier quoted context omitted.
See the Twitter thread here: https://twitter.com/nicoleperlroth/status/948678006859591682 (Edit: there are 9 posts total, go to her user page to see them all) Seems there are two issues. One, called Meltdown, only effects Intel and is REALLY bad, but the kernel page table changes everyone is making fixes it. The other, dubbed Spectre, is apparently common to the way all processors handle speculative execution and is…
That's not even close to a thread... You can see all the tweets here (courtesy of @svenluijten): https://twitter.com/i/moments/948681915485351938 .
> The business/economic implications are not clear, since eventually the only way to eradicate the threat posed by Spectre is to swap out hardware.
Is this fully accurate, there's no software mitigation available now?
From [0], the above may be true:
> There is also work to harden software against future exploitation of Spectre, respectively to patch software after exploitation through Spectre .
There is 'work'? No current patch? So Spectre is unpatched?
This point doesn't seem to be being highlighted but appears particularly important.