New: Researchers have devised a new variation of the Spectre attack that bypasses on-chip defenses Intel and AMD have built to mitigate such attacks. I expect I’ll get pushback from people who accuse the researchers of exaggerating the effects of their exploit. Hear me out.
Intel denies that the new technique breaks anti-Spectre defenses. The chipmaker cites developer guidelines for writing code that’s resistant to this class of attack. Specifically, the guidelines call for an approach called constant-time programming.

software.intel.com/security-softw…
It’s true that this new attack can’t steal secrets from apps that use constant-time programming. But it’s also true that the vast majority of apps available today don’t use this approach. It’s also true that constant-time programming comes with a high performance penalty.
The on-chip mitigations that Intel and AMD have built into their CPUs aren’t effective against the new attack. So I think it’s fair to say the companies will have to erect some kind of new barrier to contain the data leakage this technique can exploit.
Besides, the vulnerability being exploited resides in the CPU, so I think it's reasonable to expect to flaw to receive a microcode patch.
To review, Spectre exploits speculative execution, a feature that speeds up operations by predicting instructions in advance. Spectre exploits force CPUs to execute instructions along a wrong path & then extract secrets that would be exposed had the CPU continued down that path.
The new Spectre variant is the first to use an on-chip buffer known as a “micro-ops” cache as a side channel. Spectre mitigations Intel and AMD built into their CPUs aren’t well suited to prevent this.

• • •

Missing some Tweet in this thread? You can try to force a refresh
 

Keep Current with Dan Goodin

Dan Goodin Profile picture

Stay in touch and get notified when new unrolls are available from this author!

Read all threads

This Thread may be Removed Anytime!

PDF

Twitter may remove this content at anytime! Save it as PDF for later use!

Try unrolling a thread yourself!

how to unroll video
  1. Follow @ThreadReaderApp to mention us!

  2. From a Twitter thread mention us with a keyword "unroll"
@threadreaderapp unroll

Practice here first or read more on our help page!

More from @dangoodin001

21 Apr
In epic hack, Signal developer turns the tables on forensics firm Cellebrite arstechnica.com/information-te…
@signalapp developer @moxie found vulnerabilities that allow him to execute malicious code on computers running widely used forensic tools from @cellebrite.

Exploits are as easy as embedding a specially formatted file in an app installed before a device is scanned by Cellebrite.
@signalapp @moxie @Cellebrite @moxie says it's possible to use the exploit to maliciously modify reports generated by the Cellebrite software. Vulnerabilities like this are likely to be of interest to defense attorneys seeking ways to invalidate forensic findings submitted in court cases.
Read 7 tweets
15 Apr
Moscow-based Positive Technologies is an important security firm that's regularly responsible for the patching of high-severity vulnerabilities that threaten the US. Now Patrick has unearthed evidence it's also a major provider of weaponized exploits to the Russian government.
In 2016, Positive showed how to bypass encryption by exploiting weaknesses in SS7. Privately, the US has concluded that Positive didn’t just discover and disclose the SS7 flaws, but also developed exploits for them that were then used by Russian intelligence in cyber campaigns.
As recently as February PT reported a VMware code-execution flaw with a severity rating of 9.8 out of 10.

arstechnica.com/information-te…

Last year, it also disclosed a serious vulnerability in gear from Citrix.

arstechnica.com/information-te…
Read 11 tweets
18 Dec 20
Of the 18,000 customers who downloaded a backdoored Orion update, only a few dozen, or about 0.2%, of them received a follow on attack, according to Microsoft telemetry. This super elite group was 44% tech cos, 18% gov agencies and 18% think tanks/NGOs.

arstechnica.com/information-te… Image
Granted, Microsoft can't see every network that received a second-stage payload, but it can see enough that the number is probably very close.
I asked Microsoft if it was among the 40 companies that received a follow-on attack. The company declined to answer.
Read 6 tweets
5 Mar 20
This vulnerability resides in mask ROM that's used to boot the very 1st piece of firmware used by the Converged Security and Management, which implements the firmware-based Trusted Platform Module, authentication of UEFI BIOS & several other silicon-based security features.

1/x
An attacker exploiting this vulnerability could execute malicious code that reads keystrokes and does plenty of other bad stuff.

Because the code would run on hardware, the attack wouldn't be detected by AV. The code would run with the highest of privileges.

2/x
The bug stems from a failure of a firewall to run early enough in the firmware boot process, creating a window of opportunity to run the malicious code. The bug affects virtually all CPUs and chipsets released in the past 5 years, particularly on business systems.

3/x
Read 6 tweets
22 Jan 20
OK, I can't seem to let this go. It would be really, really hard for anyone to have average egress data of just 430KB per day. Just booting an iPhone would generate more outgoing data than that. Yes, you might boot into airplane mode or in a faraday cage, but then:

1/n
(1) how do you upload any data at all over cellular and (2) how is that "fairly typical of an iPhone"?

I can't help thinking that there's an error in this carefully documented 430KB-per-day baseline. Did the FTI analysts make a mistake, or is there another explanation?

2/n
Based on the amount of data reported to egress Bezos' phone after receiving the WhatsApp message, there's no denying there were spikes as high as 300 fold. That's certainly suspicious. But if analysts erred in calculating the baseline, why should we trust the spike either?

3/n
Read 4 tweets
7 Jan 20
PGP keys, software security, and much more threatened by new SHA1 exploit arstechnica.com/information-te…
Researchers declared SHA1 dead 3 years ago after achieving the world's first known collision attack against it. This new attack, a chosen prefix collision, is even more devastating to the hash function.
A chosen prefix collision is a much more powerful exploit. It's what the Flame espionage malware used in 2012 against MD5 to hijack Microsoft's Windows update system. The researchers behind the new exploit used it to achieve a PGP impersonation attack.
Read 7 tweets

Did Thread Reader help you today?

Support us! We are indie developers!


This site is made by just two indie developers on a laptop doing marketing, support and development! Read more about the story.

Become a Premium Member ($3/month or $30/year) and get exclusive features!

Become Premium

Too expensive? Make a small donation by buying us coffee ($5) or help with server cost ($10)

Donate via Paypal Become our Patreon

Thank you for your support!

Follow Us on Twitter!