Profile picture
Jan Schaumann @jschauma
, 3 tweets, 3 min read Read on Twitter
Secure co-tenancy in VM hosting is a myth. Arbitrary host RAM leak via speculative side channel: xenbits.xen.org/xsa/advisory-2… intel.com/content/www/us… CVE-2018-3615 CVE-2018-3620
RedHat has a good write-up on this L1TF vulnerability: access.redhat.com/security/vulne…

Apparently aka “Foreshadow”, because branded vuln: foreshadowattack.eu
Additional #foreshadow / #L1TF links:
Wired: wired.com/story/foreshad…
Intel: newsroom.intel.com/editorials/pro…
MS Azure: docs.microsoft.com/en-us/azure/vi…
Google Cloud: cloud.google.com/blog/products/…
VMWare: blogs.vmware.com/security/2018/…
Microsoft: blogs.technet.microsoft.com/srd/2018/08/14…
Missing some Tweet in this thread?
You can try to force a refresh.

Like this thread? Get email updates or save it to PDF!

Subscribe to Jan Schaumann
Profile picture

Get real-time email alerts when new unrolls are available from this author!

This content may be removed anytime!

Twitter may remove this content at anytime, convert it as a PDF, save and print for later use!

Try unrolling a thread yourself!

how to unroll video

1) Follow Thread Reader App on Twitter so you can easily mention us!

2) Go to a Twitter thread (series of Tweets by the same owner) and mention us with a keyword "unroll" @threadreaderapp unroll

You can practice here first or read more on our help page!

Related hashtags

#foreshadow #L1TF

More from @jschauma see all

Profile picture
I kinda feel like there's an #infosec equivalent to Brooks's Law: hiring more infosec people does not make an organization (or project) more secure. Likewise, mirroring complexity, I think we have accidental as well as essential insecurity.
We often measure #infosec team success or impact via navel gazing: how many vulnerabilities we identified, how many open ports we found, how many AWS tokens we found in git.
The remedies? Build more tools to detect more stuff, deploy more agents, create more dashboards, tickets, metrics. All that requires more people, so our headcount requests go up.
Read 11 tweets
Profile picture
Google to deprecate TLS 1.0 and 1.1 in Chrome, going to users in 01/2020: security.googleblog.com/2018/10/modern…
Mozilla has a similar timeframe for deprecating TLS 1.0 and 1.1: blog.mozilla.org/security/2018/…

So yeah, you can get started on turning those off, too.
Stick a fork in it, it's done: both Apple and Microsoft also announced the deprecation of TLS 1.0 and 1.1 in Webkit and Internet Explorer and Edge: webkit.org/blog/8462/depr… blogs.windows.com/msedgedev/2018…

(Well, except for all the unpatchable IoT devices you need to support... :-/ )
Read 3 tweets
Profile picture
So other than following up on shit that should have been done but wasn't, sifting through miles of forwarded emails (all with full quote below a statement saying "my comments in red” or “+cindy”), and cursing Slack "threads", I spend a good chunk of my day juggling Jira tickets.
So much of our work is ticket driven, yet many of us seem to lack basic best practices and habits that could make our (ok: my) life a lot easier. So let me present a quick primer:

Essential Ticket Skills - just because Jira sucks doesn't mean you have to!
(Note: most of this applies equally to Bugzilla, GNATS, or whatever bugtracking software; I just happen to use Jira at the moment, so that's what my examples are based on.

And don't you fucking start with Trello or sticky notes and "swimlanes". Those can fuck right off here.)
Read 24 tweets

Related threads

Profile picture
💦Deluge💦

On a whim Trump orders withdrawal of US from Syria; Putin & Erdogan are jubilant: Turkey knew b/4 the Pentagon, DOS & Corker.

U.S. Readies Charges Against Chinese Hackers - 10:30 am 12/20

Stone & Bibi indictments imminent

FB allowed 3d party access to our DMsMsgs
💦Deluge2💦

‘This isn’t a victory — it’s a surrender’: CNN Trump’s Syria withdrawal gives RU/ISIS a win-they are thrilled

“Turks were bragging that Turkey knew about Trump's decision on U.S. forces before the Pentagon and State Department did.”
💦Deluge2💦

📌DOJ will announce a national security action involving China, Thursday at 10:30am at the DOJ

📌U.S. Readies Charges Against Chinese Hackers

📌Government-linked hackers allegedly engaged in a multiyear scheme to break into U.S. technology service providers
Read 89 tweets
Profile picture
🛢EndGame🛢

📌Pence in the Barrel, Bibi too, ergo we are very close to Endgame

📌RU, China & SA make oil deals, excluding US.

📌As we approach Endgame, look for Putin, XI, MbS -> make 😱mischief.👇🏼

📌”China has now effectively taken control of the South China Sea.”
🛢EndGame2🛢

📌”WikiLeaks is a non-state hostile intell service often abetted by state actors like Russia...”

📌MbS exchanged messages b/4 & after the brutal murder w/ aide alleged to have overseen Khashoggi killing

📌Pompeo protects MbS, kinda throws our intel under the bus.
🛢EndGame3🛢

Jared Kushner likely caused 'Significant Security Breach' Of U.S. Gov't.

This despite the NSA’s warning the Trump Adm against using their personal emails.

Ex-prosecutor hints Cohen may have secretly recorded Don Jr. and Ivanka: 'Lordy, I hope there are tapes
Read 59 tweets
Profile picture
From what I understand, the latest #OpenBSD vs #Intel thing went a little bit like that:
- OpenBSD: Can we be a part of this rumored Intel bug embargo?
- Intel: No. Go away.
- OpenBSD: dev do their homework, fix FPU bug, publish patch.
- Theo (at @BSDCan): we are worried, we don't have access to info. Please help us.
- Intel: publishes official advisory: intel.com/content/www/us…
Now everybody and their dogs are going crazy over #OpenBSD developpers doing their jobs , correcting stuff and "violating"an embargo... That they were *never* a part of. Because Intel did not want them to receive information!
Read 7 tweets
Profile picture
#Probablemente ([#EO]#probable🍀/[#EN]#Probably🏴󠁧󠁢󠁥󠁮󠁧󠁿)
Read 357 tweets
Profile picture
😁
Deutsche Bank receives subpoena from Mueller on Trump accounts
Read 23 tweets
Profile picture
Thoughts on the latest Intel ME vulnerabilities: based on public information, we have no real idea how serious this is yet. It could be fairly harmless, it could be a giant deal.
There's two classes of vulnerability disclosed. One is in the Intel AMT component, which runs on ME and is restricted to "enterprise" hardware (which includes higher end laptops), the other is arbitrary ME execution and applies to the entire product range.
The AMT vulnerabilities "only" permit code execution in the context of AMT. That means at least all the capabilities of AMT, but potentially more besides.
Read 14 tweets

Trending hashtags

#RICO #SHOUTY #NOT #JohnMcLaughlan #Meltdown #CNN #censored #HR #Illuvatar #Create #PAMFAM #world #ThePatriotTimes #Spectre #Probably #SmartWatch #Goody #RecordStoreDay2019 #theWorld #RexTillersonTopIck #PublicDomain #PBS #Erté #Real #MP

Did Thread Reader help you today?

Support us! We are indie developers!

This site is made by just three indie developers on a laptop doing marketing, support and development! Read more about the story.

Become a Premium Member and get exclusive features!

Premium member ($3.00/month or $30.00/year)

Too expensive? Make a small donation by buying us coffee ($5) or help with server cost ($10)

Donate via Paypal Become our Patreon

Thank you for your support!