Memory management bug in Intel CPUs threatens massive performance hits.

[dmills]

The cat and mouse game that is played against ciphers, key exchange and transport layer protocols is currently letting the cat doing some serious catching up...

I thought the underlying math was still safeish for all the work being done on number theoretic sieves and the discrete log problem?

Now attacks on protocols and implementations, that has always been the low hanging fruit when breaking these things, between side channel and just plain broken implementations.... I just LOVE people who write their own crypto.

Regards, Dan.

[GeorgeOfTheJungle]

Is this even an issue for standalone PCs ?

The Spectre attack can be delivered as Javascript which means some site you go to could deliver it and search your memory for something interesting and phone home.  The attack is actually pretty slow though, I guess maybe it's not likely to find anything, but it can randomly poke around.  Fixing Javascript to disallow it should be easy, though.

"Spectre attacks can also be used to violate browser sandboxing, by mounting them via portable JavaScript code." (from the first .pdf)

They say "portable js code" sort of implying it can break any javascript engine sandbox which is hardly believable because no two OS/browser/browser version/cpu/cpu version combos are the same, have the same js engine, nor produce the same code after jitting, etc. The code they show is hand tweaked javascript "Like other optimized JavaScript engines, V8 performs just-in-time compilation to convert JavaScript into ma- chine language. To obtain the x86 disassembly of the JIT output during development, the command-line tool D8 was used. Manual tweaking of the source code lead- ing up to the snippet above was done to get the value of simpleByteArray.length in local memory (instead of cached in a register or requiring multiple instructions to fetch)." hardly "portable" as they say.

"We wrote a JavaScript program that successfully reads data from the address space of the browser process running it." means they could only read the browser's memory space, which is not good but not the same nor as dangerous as "search your memory for something interesting and phone home".

OTOH, I strongly believe, I have no doubt, that ALL the browsers have, on purpose, some sort of very well hidden backdoor to pwn our computers. The keys are either in Apple/Google/Mozilla/Brave/Opera or in the NSA hands. I don't think either that heartbleed was an accident.

[bd139]

The cat and mouse game that is played against ciphers, key exchange and transport layer protocols is currently letting the cat doing some serious catching up...

I thought the underlying math was still safeish for all the work being done on number theoretic sieves and the discrete log problem?

Now attacks on protocols and implementations, that has always been the low hanging fruit when breaking these things, between side channel and just plain broken implementations.... I just LOVE people who write their own crypto.

Regards, Dan.

At the moment, yes we're safeish but as always, the transition time between safeish and unsafe gets exponentially shorter. There's a lot of progress in quantum computing which I'm keeping one eye on. There's also some of which we probably can't see and is likely well funded. They're only factoring relatively small numbers now (tangibly brute forceable on traditional compute with an eye shut) but the gains are exponential. That could make the discrete log problem trivial or at least affordable. On a decade scale, shit might be hitting the proverbial fan.

Implementations are easy pickings, especially as everything is written in bloody C still. Also look at logjam as well where the implementation was good but a bad assumption was made on the mathematical side of things (shipping same primes everywhere).

Is this even an issue for standalone PCs ?

The Spectre attack can be delivered as Javascript which means some site you go to could deliver it and search your memory for something interesting and phone home.  The attack is actually pretty slow though, I guess maybe it's not likely to find anything, but it can randomly poke around.  Fixing Javascript to disallow it should be easy, though.

"Spectre attacks can also be used to violate browser sandboxing, by mounting them via portable JavaScript code." (from the first .pdf)

They say "portable js code" sort of implying it can break any javascript engine sandbox which is hardly believable because no two OS/browser/browser version/cpu/cpu version combos are the same, have the same js engine, nor produce the same code after jitting, etc. The code they show is hand tweaked javascript "Like other optimized JavaScript engines, V8 performs just-in-time compilation to convert JavaScript into ma- chine language. To obtain the x86 disassembly of the JIT output during development, the command-line tool D8 was used. Manual tweaking of the source code lead- ing up to the snippet above was done to get the value of simpleByteArray.length in local memory (instead of cached in a register or requiring multiple instructions to fetch)." hardly "portable" as they say.

"We wrote a JavaScript program that successfully reads data from the address space of the browser process running it." means they could only read the browser's memory space, which is not good but not the same nor as dangerous as "search your memory for something interesting and phone home".

OTOH, I strongly believe, I have no doubt, that ALL the browsers have, on purpose, some sort of very well hidden backdoor to pwn our computers. The keys are either in Apple/Google/Mozilla/Brave/Opera or in the NSA hands. I don't think either that heartbleed was an accident.

You may be right. You don't have to look far to find state interference in crypto implementations. Browsers are likely easier targets.

https://en.wikipedia.org/wiki/IPsec#Alleged_NSA_interference
https://en.wikipedia.org/wiki/Bullrun_(decryption_program)
http://blog.erratasec.com/2013/09/tor-is-still-dhe-1024-nsa-crackable.html

... etc etc ...

[dr.diesel]

Summary:

[nfmax]

I have now turned Javascript OFF in all browsers, until further notice. youTube no longer works. Bye bye, Dave!

[Rerouter]

Dr.Diesel, to better understand, no matter what, 2 of those vulnerabilities are present and unfixable in all affected Intel products, no matter how its patched? or is there ways to avoid it, e.g. the other poster disabling java script.

[Decoman]

From the linked article below some guy (lol, this was my way of trying to reference a quotation about a quotation ) is referenced as having pointing out the following about Intel's Management Engine:

According to Zammit, the ME:
* has full access to memory (without the parent CPU having any knowledge);
* has full access to the TCP/IP stack;
* can send and receive network packets, even if the OS is protected by a firewall;
* is signed with an RSA 2048 key that cannot be brute-forced; and
* cannot be disabled on newer Intel Core2 CPUs.

https://www.techrepublic.com/article/is-the-intel-management-engine-a-backdoor/

This is the kind of shit that makes me sit here and think I am not really the owner or manager of my own damn computer.

[bd139]

I have now turned Javascript OFF in all browsers, until further notice. youTube no longer works. Bye bye, Dave!

I don't use the browser for youtube! https://rg3.github.io/youtube-dl/

This downloads which are then carted off to my iPhone via VLC and I sit and watch them on the sofa with my headphones on.

I have teenagers and a shitty Internet connection so watching youtube without horrible buffering is off the cards.

This is the kind of shit that makes me sit here and think I am not really the owner or manager of my own damn computer.

You're right. Welcome to serfdom.

Really though, I've got a few Z84C0008 parts, a whole tube of MCM6810P SRAMs, some stripboard and about 50 tubes of TTL ICs here. Build my own shit computer instead!

[dr.diesel]

Dr.Diesel, to better understand, no matter what, 2 of those vulnerabilities are present and unfixable in all affected Intel products, no matter how its patched? or is there ways to avoid it, e.g. the other poster disabling java script.

Patches are out for Meltdown, comes with a varying performance hit, but looks like Spectre will take a hardware fix, though can be made more difficult to exploit via patches.

Disabling java helps prevent a browser/webpage based attack.

This is still developing, and will lead to interesting speculative execution changes for all players, including AMD i'd bet.

[tszaboo]

Are you people crazy? It affects Virtual machines that can read from each other. It only affects you, if you are running more than 1 virtual machines on your PC server, and one would run malicious code, specifically designed to attack the other virtual machine. This is only an issue for cloud providers.
99.9999% of PC users are not affected.

Nope.  The ASLR leak has been demonstrated from Javascript so any code running from a web page you have visited can exploit MMU timing to resolve the address of kernel mode data structures and subsequently it just needs an exploit for buffer overflow etc or rewriting the stack return address and you are pwned. But ignorance is bliss.

https://www.vusec.net/projects/anc/

That sounds pretty bad. Also, excecuting data? So any webpage can overtake my PC. Great.
Let's just hope they fix it, the effect is not mayor with normal workload, and they fix Windows 7 also. I dont feel like downgrading my PC to windows 10.

[bd139]

Annoyingly I haven't seen any patches for anything other than Windows 10 and Windows Server 2016 from MSFT. I'm trying to dig through the shitfest of documentation now...

http://www.catalog.update.microsoft.com/Search.aspx?q=KB4056892 <-- this is win10 + server 2016

[Decoman]

You're right. Welcome to serfdom.

Well, I have to say it is even worse than that. Given the reach of surveillance and hacking and other terrible things, when nation states targets individuals, the threat is real. I personally don't think I can really travel to USA, nor UK because I have opinions that basically deem these government institutions as being villains. But enough about that. I am confident that I am on some list somewhere, and yet I have done nothing wrong. I never forget that one time some random guy in an irc chat once asked me if I owned a firearm (iirc)and if I was a member of an organization. And the truth was ofc that I had none and weren't in any organization. I like playing Arma 3 (most fun game as multiplayer, but terrible game mechanics, and you can drive ground vehicles and fly helicopters and build bases), and one time, without me even really bringing up any issue at all, this one guy who at one point claimed to be working in the arms industry, suddenly had this urge to start having a personal conversation with me about something vague and talked about causing attention like ripples in the water, and other weird stuff, making me having to now wonder if playing on that one server flagged my other co players in some way. And later when this guy in what I thought was Californian accent (obviously a foreigner) sneaks up on me in this local park and says to me "Don't be scared!" as he passes by on his skateboard, I start to wonder if I ought to get a little paranoid or not.

In the proverbial" perfect world", I am sure I wouldn't be bothered by relying on others for my security, but as it stands today, there is literally nobody to trust the way I see it. Not the local government, certainly not foreign governments, not my browser maker, not even technologists that opine on the matter of the "internet of things", and not all the people that actually work with the design and implementation of anything to do with computers and/or networking and standards. I listened to US congress having a hearing not too long ago about their supposed claims of not being able to read off this one particular mobile phone in a criminal investigation (iirc, after this show and spectacle in that US congress hearing , later it turned out that a company managed to copy the content for the law enforcement), and seeing how a higher Apple representative basically happily bent over and acknowledged the suggestion of discussing the matter further with the committee after the hearing to help out, for me just made any public statements from Apple to the public about how they care about people privacy, now a moot point. Ofc, it should be pointed out that I don't own an Apple product. I don't even own a smart phone, as I have the impression that the new phones aren't very good security wise, and they seem to incorporate various features that acts like streaming user telemetry, which imo would be basically at odds with ones privacy needs.

I am also the kind of guy that repeatedly points out to others that people's notion of 'privacy' tend to be misunderstood. As, it ought to be obvious that the matter at hand would be foremost ones privacy needs, and not as 'a right' as such, which in any case would certainly be limited by the merit of making a definition of privacy, or, just with how the mere expectation of privacy is contested, by simply disallowing expectation of privacy in some arbitrary way.

[bd139]

I can't argue with you. It's the same opinion here.

I work on the grey man principle. Cut your life in two. You have the public life and the private life. The public life is in line with expectations. Your private life is offline, entirely.

You will see me mentioning various things like DaveCAD (pen+paper) and using lots of old rancid analogue equipment. This is done not wholly because I enjoy it, which is fortunate that I do, but because being so close to how things really work that I am scared of it. There needs to be a backup plan away from "network dependency".

[Mr. Scram]

I can't argue with you. It's the same opinion here.

I work on the grey man principle. Cut your life in two. You have the public life and the private life. The public life is in line with expectations. Your private life is offline, entirely.

You will see me mentioning various things like DaveCAD (pen+paper) and using lots of old rancid analogue equipment. This is done not wholly because I enjoy it, which is fortunate that I do, but because being so close to how things really work that I am scared of it. There needs to be a backup plan away from "network dependency".

There is no backup plan. Even if you arrange something, others will forcefully take it from you once it becomes of value.

[Decoman]

I think corporations would be the first to be screwed on a general basis.

So I think it makes sense that if you run an important business and have proprietary data, to be kept secret, having no operational security would be bad if having a more or less open computer network system (or bad practices regarding computer security in general, allowing phishing attacks and the like), or allowed people to just walk around the premises, or even inside your home, and even if you hired people randomly with no background checks at all.

I now am reminded of how thieves will steal the entire safe, if the safe is not nailed down. It has been said though that locks are only there to slow down trespassers, and not to really prevent entry/theft.

[bd139]

Yes that's the biggest concern for me as well.

I am developing an exit strategy at the moment. I don't want to be around the gigantic turd if it goes up in flames.

[BravoV]

CNN -> http://money.cnn.com/2018/01/03/technology/computer-chip-flaw-security/index.html

Reuters -> https://www.reuters.com/article/us-cyber-intel/security-flaws-put-virtually-all-phones-computers-at-risk-idUSKBN1ES1BO

[Decoman]

Its on CNN -> http://money.cnn.com/2018/01/03/technology/computer-chip-flaw-security/index.html

The article states that "Flaws in chips are unusual." I am no expert, but I suspect that this statement is not true as a more objective statement. I've also read that there is a real risk of (any) computer chip being vulnerable to it being doped in a subtle way by an advanced adversary for further manipulating a chip in use, in desired ways.

[Mr. Scram]

I think corporations would be the first to be screwed on a general basis.

So I think it makes sense that if you run an important business and have proprietary data, to be kept secret, having no operational security would be bad if having a more or less open computer network system (or bad practices regarding computer security in general, allowing phishing attacks and the like), or allowed people to just walk around the premises, or even inside your home, and even if you hired people randomly with no background checks at all.

I now am reminded of how thieves will steal the entire safe, if the safe is not nailed down. It has been said though that locks are only there to slow down trespassers, and not to really prevent entry/theft.

We know this to be true when t comes to computers too. Any adversary motivated enough will find a way to gain access. With enough mud thrown, something is bound to stick. You can only make yourself a less interesting target and more painful to hit.

[Decoman]

One thing I've learned about computers, is that it does not matter if the crypto is good, if the implementation is bad. And so, then things get really complicated, and a single wrong character in some piece of code somewhere, can lead to what is called a 'catastrophic failure' with regard to having some expected security.

An important aspect of computer security is probably how allowing physical access to an adversary makes having security more like an impossibility, as the risk of anyone tampering with physical hardware at some location is more like a feature, than a threat model.

[Avacee]

Microsoft have started pushing an Out-Of-Band update (ie they aren't waiting until next Patch Tuesday).
https://support.microsoft.com/en-us/help/4056892/windows-10-update-kb4056892

If you are thinking of applying it be sure to read all the known issues - especially the last one regarding Anti-Virus software.

[Tomorokoshi]

Doctor Who:

The trouble with computers, of course, is that they're very sophisticated idiots. They do exactly what you tell them at amazing speed, even if you order them to kill you. So if you do happen to change your mind, it's very difficult to stop them obeying the original order, but... not impossible.

[SaabFAN]

Doctor Who:

The trouble with computers, of course, is that they're very sophisticated idiots. They do exactly what you tell them at amazing speed, even if you order them to kill you. So if you do happen to change your mind, it's very difficult to stop them obeying the original order, but... not impossible.

No problem with a TARDIS

Wasn't AMD working on something to replace the x86-Architecture for consumer-computers? I remember reading something like that one or two years back. Would be the perfect time to present the new CPU-Architecture now

[Ampera]

Doctor Who:

The trouble with computers, of course, is that they're very sophisticated idiots. They do exactly what you tell them at amazing speed, even if you order them to kill you. So if you do happen to change your mind, it's very difficult to stop them obeying the original order, but... not impossible.

No problem with a TARDIS

Wasn't AMD working on something to replace the x86-Architecture for consumer-computers? I remember reading something like that one or two years back. Would be the perfect time to present the new CPU-Architecture now

There is so much going on right now in the computing world. New architectures are ALWAYS a great idea. Replacing what everybody is using with a better technology is definitely attractive, but the issue is not only what, but how do we get people to drop their over 35 years of software support on a single platform for something else? Who is going to be able to make enough of a statement for everybody to fight against everybody who WILL want to keep the x86 battleship tanking?

At the moment, there is no consumer oriented processing platform with the same power and app support as x86. ARM has a lot of app support, and POWER has very similar, no pun intended, power, but they just don't mix. I recall watching a computer chronicles episode where they were talking about DEC Alpha, MIPS, and PowerPC machines taking the stage, and asking if the market is going to expand towards them. (It was the episode about the original Pentium if you want to see it) About 25 years later, DEC Alpha is completely dead, MIPS is hard to come by, and PowerPC is completely dead with POWER being resigned to servers and supercomputing tasks.

There have been designs that fix so many problems with x86. Heck, just starting over with x86 and re-implementing a lot of stuff would make the platform WAY better, but the reason why everybody uses x86, and the reason why I can still run the first version of PC-DOS on a Threadripper is because of backwards compatibility with application code. As more and more code is written for x86, we sink deeper into why nobody will change.

[JoeN]

You can use NoScript and leave Javascript turned on for certain sites.  I don't think Youtube is going to send you anything malicious.