Discover and read the best of Twitter Threads about #Foreshadow
Most recents (3)
I want to start a new thread story. Not sure how long it will be and I may use different prompts: #vss365 #vssmagic #vssnature etc etc ... I love reading about legends and folk lore, and in my fantasy writing I often create my own myths. So this will be just a fun exercise...
Speculative Side-Channel Attacks is misleading terminology and usually used incorrectly. We should all avoid using it and @intel, you should avoid using it too. Not only because it is misleading, but because it hinders successful communication on mitigations.
Let me elaborate:
Let me elaborate:
A side-channel attack uses measurements of side effects to gather enough *meta data* (power consumption, runtime, cache state, etc) to *infer* secret information.
#meltdown #spectre #zombieload and related attacks and variants do not leak meta data. They leak the actual data.
#meltdown #spectre #zombieload and related attacks and variants do not leak meta data. They leak the actual data.
There is no need to infer secret information from meta data, there is no meta data involved. Hence, they are *no side-channel attacks*.
"But they use flush+reload". Sure, but that doesn't make the attack a side-channel attack. Let's assume the following:
"But they use flush+reload". Sure, but that doesn't make the attack a side-channel attack. Let's assume the following:
Secure co-tenancy in VM hosting is a myth. Arbitrary host RAM leak via speculative side channel: xenbits.xen.org/xsa/advisory-2… intel.com/content/www/us… CVE-2018-3615 CVE-2018-3620
RedHat has a good write-up on this L1TF vulnerability: access.redhat.com/security/vulne…
Apparently aka “Foreshadow”, because branded vuln: foreshadowattack.eu
Apparently aka “Foreshadow”, because branded vuln: foreshadowattack.eu
Additional #foreshadow / #L1TF links:
Wired: wired.com/story/foreshad…
Intel: newsroom.intel.com/editorials/pro…
MS Azure: docs.microsoft.com/en-us/azure/vi…
Google Cloud: cloud.google.com/blog/products/…
VMWare: blogs.vmware.com/security/2018/…
Microsoft: blogs.technet.microsoft.com/srd/2018/08/14…
Wired: wired.com/story/foreshad…
Intel: newsroom.intel.com/editorials/pro…
MS Azure: docs.microsoft.com/en-us/azure/vi…
Google Cloud: cloud.google.com/blog/products/…
VMWare: blogs.vmware.com/security/2018/…
Microsoft: blogs.technet.microsoft.com/srd/2018/08/14…
