Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

New speculative attacks on Apple CPUs

predictors.fail

Post reply on HN
Print view View original

91–100 of 365 posts

Re: New speculative attacks on Apple CPUs

#91

Post by dfedbeef »

lxgr wrote: post #69
omcnoe wrote: post #63

Earlier quoted context omitted.

Cross-Origin-Opener-Policy seems like a case of bad defaults where a less secure option has been selected so that we don't break some poorly maintained websites. Better to get the actual users of `window.open` to fix their code than to make every website insecure out of the box. I can't imagine there are many sites passing significant amounts of data through this, the small number of users where IPC poses too high a…

Forcing every website to adapt to a browser update is completely infeasible. > I can't imagine there are many sites passing significant amounts of data through this This is actually a quite common mechanism for popup-based authentication (which is much more secure than iframe-based one, as users can verify where they're potentially entering their credentials).

It's super feasible if you own the API default.

Re: New speculative attacks on Apple CPUs

#92

Post by lxgr »

dfedbeef wrote: post #91
lxgr wrote: post #69

Earlier quoted context omitted.

Forcing every website to adapt to a browser update is completely infeasible. > I can't imagine there are many sites passing significant amounts of data through this This is actually a quite common mechanism for popup-based authentication (which is much more secure than iframe-based one, as users can verify where they're potentially entering their credentials).

It's super feasible if you own the API default.

It's definitely a quick way to get all your users to switch to a different browser or figure out how to disable updates forever.

Re: New speculative attacks on Apple CPUs

#93

Post by School-Cotton »

sodality2 wrote: post #19
gjsman-1000 wrote: post #7

Bizarre the M1 is immune to both; I'm more secure by not upgrading. (Sure, there's still a few, but they are mostly minor by comparison, or newer chips are also affected.)

Newer CPUs use more and more "hacks" - out of order execution, caching, speculative execution, branch prediction, etc - to gain performance improvements. The further back you go, the less vulnerable CPUs generally are to these (but possibly more vulnerable to other kinds of attacks).

But M1 is squarely a modern CPU. It uses all the techniques you mention (as does every high-performance CPU since the Pentium Pro era).

Re: New speculative attacks on Apple CPUs

#94

Post by iforgot22 »

viraptor wrote: post #53
umvi wrote: post #23

Earlier quoted context omitted.

Is it bad that I disable spectre mitigations on all my PCs to get a free double-digit-% performance boost?

In practice probably not, as long as general population keeps it enabled. I mean, looking at effort required, it's not worth spending time exploiting spectre these days, because virtually everyone is protected. If you're not likely to be directly targeted, "herd immunity" will work.

If just visiting a webpage with some JS will let them do ACE on even 0.1% of visitors, hackers are probably still motivated enough to try it. But I vaguely remember these kinds of vulns can be patched in-browser for a perf hit instead of taking the hit system-wide, which sounds like an ok compromise.

Edit: Arbitrary memory access, not ACE

Re: New speculative attacks on Apple CPUs

#95

Post by School-Cotton »

sebzim4500 wrote: post #46
kllrnohj wrote: post #20

Earlier quoted context omitted.

Or it's a hardware issue and they don't have any way to do a microcode fix for this

It's could be unfixable without a significant performance penalty, but at minimum they could make safari do proper process isolation like every other browser does.

I could easily imagine such a refactor of Safari taking more than 90 days even if Apple made it the highest possible priority.

Re: New speculative attacks on Apple CPUs

#96

Post by eptcyka »

lxgr wrote: post #34
omcnoe wrote: post #18

Their SLAP demo provides a great example of how defence-in-depth can make/break the viability of an exploit. That terrifying Safari demo is possible because Safari fails to isolate new windows in individual processes when calling `window.open` in js. All the other side channel magic presented here doesn't matter if the data you want to read is in a seperate process with sufficient separation from the "hostile" proces…

That's not a failure of Safari, it's required by window.open API semantics, in particular by the default Cross-Origin-Opener-Policy of "unsafe-none" [1]. By setting a different policy, sites can protect themselves against this. I guess technically browsers could open new windows in a new browsing context group regardless of this setting and relay the allowed types of messages via IPC (if any), but that would be a maj…

Other browsers do site isolation, why can’t Safari? (:

Re: New speculative attacks on Apple CPUs

#97

Post by iforgot22 »

kllrnohj wrote: post #39
umvi wrote: post #23

Earlier quoted context omitted.

Is it bad that I disable spectre mitigations on all my PCs to get a free double-digit-% performance boost?

What are you doing where you see anything remotely close to double-digit-% gains from disabling spectre mitigations?

Video editing maybe? Which is not going to involve running untrusted code.

Re: New speculative attacks on Apple CPUs

#98

Post by sodality2 »

School-Cotton wrote: post #93
sodality2 wrote: post #19

Earlier quoted context omitted.

Newer CPUs use more and more "hacks" - out of order execution, caching, speculative execution, branch prediction, etc - to gain performance improvements. The further back you go, the less vulnerable CPUs generally are to these (but possibly more vulnerable to other kinds of attacks).

But M1 is squarely a modern CPU. It uses all the techniques you mention (as does every high-performance CPU since the Pentium Pro era).

For sure. But the further you go along, the _more_ of these tricks it uses and relies upon to improve performance. New vulnerabilities that are discovered are likely to take advantage of some feature on the spectrum of these “hacks”, from new to old. Because older “hacks” are well-known and studied, newly discovered vulnerabilities are more likely to target features in the newer end of that spectrum (AKA newer CPUs).

Re: New speculative attacks on Apple CPUs

#99

Post by goldsteinq »

omcnoe wrote: post #30
junek wrote: post #11

OK, fun. What can we do to mitigate this until it gets patched?

Serious answer, don't use Safari. Use a browser that properly separates webpages into isolated processes so that this kind of cross-site read is not possible.

There’re no other browsers on iPhone. Every iPhone browser is a reskin of Safari. They’re in theory supposed to allow other browsers in the EU, but AFAIK it has not happened yet.

Re: New speculative attacks on Apple CPUs

#100

Post by dfedbeef »

dfedbeef wrote: post #91
lxgr wrote: post #69

Earlier quoted context omitted.

Forcing every website to adapt to a browser update is completely infeasible. > I can't imagine there are many sites passing significant amounts of data through this This is actually a quite common mechanism for popup-based authentication (which is much more secure than iframe-based one, as users can verify where they're potentially entering their credentials).

It's super feasible if you own the API default.

You just announce you are making a change and then turn it on later.
Post reply on HN