Processador Vulnerabilidade MeltDown / Spectre (aka Kaiser bug)

miguelbazil · 31 de Agosto de 2018

@Dark Kaeser esse link do eweek está-me a dar forbidden. Consegues abri-lo?

muddymind · 31 de Agosto de 2018

Eu consigo abrir sem problemas.

Dark Kaeser · 31 de Agosto de 2018

@miguelbazil sim, mesmo aqui no bules com o websense esse link abre.

Dark Kaeser · 13 de Setembro de 2018

Nemesis: Studying microarchitectural timing leaks in rudimentary CPU interrupt logic

We present Nemesis, a previously overlooked side-channel attack vector that abuses the CPU's interrupt mechanism to leak microarchitectural instruction timings from enclaved execution environments such as Intel SGX, Sancus, and TrustLite. At its core, Nemesis abuses the same subtle microarchitectural behavior that enables Meltdown, i.e., exceptions and interrupts are delayed until instruction retirement. We show that by measuring the latency of a carefully timed interrupt, an attacker controlling the system software is able to infer instruction-granular execution state from hardware-enforced enclaves. In contrast to speculative execution vulnerabilities, our novel attack vector is applicable to the whole computing spectrum, from small embedded sensor nodes to high-end commodity x86 hardware. We present practical interrupt timing attacks against the open-source Sancus embedded research processor, and we show that interrupt latency reveals microarchitectural instruction timings from off-the-shelf Intel SGX enclaves.
Clicar para expandir...

https://people.cs.kuleuven.be/~jo.vanbulck/ccs18.pdf

muddymind · 13 de Setembro de 2018

Sempre suspeitei que o @Nemesis11 não era flor de se cheirar

palac3 · 27 de Setembro de 2018

Boas, formatei o PC pois fiz upgrade ao CPU e reparei que a MSI retirou os drivers Intel management engine do site assim como muitos outros fabricantes à excepção da ASRock. Alguém sabe se esses drivers tem algum problema de segurança? É seguro não ter isso instalado no PC?

Nemesis11 · 2 de Novembro de 2018 às 15:30

Mais um para a caixa:

Intel CPUs impacted by new PortSmash side-channel vulnerability
Vulnerability confirmed on Skylake and Kaby Lake CPU series. Researchers suspect AMD processors are also impacted.

Intel processors are impacted by a new vulnerability that can allow attackers to leak encrypted data from the CPU's internal processes.

The new vulnerability, which has received the codename of PortSmash, has been discovered by a team of five academics from the Tampere University of Technology in Finland and Technical University of Havana, Cuba.

Researchers have classified PortSmash as a side-channel attack. In computer security terms, a side-channel attack describes a technique used for leaking encrypted data from a computer's memory or CPU, which works by recording and analyzing discrepancies in operation times, power consumption, electromagnetic leaks, or even sound to gain additional info that may help break encryption algorithms and recovering the CPU's processed data.

Researchers say PortSmash impacts all CPUs that use a Simultaneous Multithreading (SMT) architecture, a technology that allows multiple computing threads to be executed simultaneously on a CPU core.

In lay terms, the attack works by running a malicious process next to legitimate ones using SMT's parallel thread running capabilities. The malicious PortSmash process than leaks small amounts of data from the legitimate process, helping an attacker reconstruct the encrypted data processed inside the legitimate process.

Researchers say they've already confirmed that PortSmash impacts Intel CPUs which support the company's Hyper-Threading (HT) technology, Intel's proprietary implementation of SMT.

"Our attack has nothing to do with the memory subsystem or caching," said Billy Brumley, one of the five researchers, referring to previous side-channel attacks that have impacted SMT architectures and Intel's HT implementation.

"The nature of the leakage is due to execution engine sharing on SMT (e.g. Hyper-Threading) architectures. More specifically, we detect port contention to construct a timing side-channel to exfiltrate information from processes running in parallel on the same physical core," Brumley added.

A research paper detailing the PortSmash vulnerability in more depth for astute technical readers will be published on the Cryptology ePrint Archive portal in the coming days, Brumley told ZDNet earlier today via email when we reached out for more details.

TIME TO END SMT/HT SUPPORT
Last year, another team of researchers found a similar side-channel vulnerability named TLBleed impacting Intel's Hyper-Threading (SMT) technology. Following the discovery of TLBleed, the OpenBSD project decided to disable support for Intel's HT technology in upcoming versions of the OpenBSD operating system, on the grounds of security.

"This is the main reason we released the exploit -- to show how reproducible it is," Brumley told us, "and help to kill off the SMT trend in chips."

"Security and SMT are mutually exclusive concepts," he added. "I hope our work encourages users to disable SMT in the BIOS or choose to spend their money on architectures not featuring SMT."

PortSmash is tracked in the CVE vulnerability tracking system with the CVE-2018-5407 identifier.
Clicar para expandir...

É devido ao SMT.

https://www.zdnet.com/article/intel-cpus-impacted-by-new-portsmash-side-channel-vulnerability/

POC - https://github.com/bbbrumley/portsmash

hug0b0ss · 2 de Novembro de 2018 às 17:13

Estava mesmo agora a ler e ia postar o link também, mesma source.

Aftaminas · 3 de Novembro de 2018 às 00:00

Ativar no Windows Defender/Security o "Core Isolation" e "Memory Integrity" ajuda em alguma coisa contra os bugs que têm aparecido no último ano?

Nemesis11 · 3 de Novembro de 2018 às 02:05

Não vejo bem qual é a relação. A única coisa é que estes bugs podem ajudar a "saltar" essas duas features, que estão relacionadas com isolamento e virtualização.
Para o utilizador comum, o que ajuda é ter o sistema operativo e software actualizado e, se possível, a BIOS/UEFI também, visto que normalmente têm microcode mais actualizado.
Pode-se também desligar SMT na BIOS/UEFI, mas isso deixo à consideração de cada um, porque o impacto a nível de performance depende muito do uso que cada um faz do computador.

hug0b0ss · 3 de Novembro de 2018 às 20:38

Researchers Exploit Another Intel Hyper-Threading Flaw

https://www.tomshardware.com/news/portsmash-intel-hyper-threading-flaw,38014.html

Processador Vulnerabilidade MeltDown / Spectre (aka Kaiser bug)

miguelbazil Moderador Ninja
Staff Member

muddymind 1st Folding then Sex

Dark Kaeser Power Member

Dark Kaeser Power Member

muddymind 1st Folding then Sex

palac3 Power Member

Nemesis11 Power Member

hug0b0ss Power Member

Aftaminas Power Member

Nemesis11 Power Member

hug0b0ss Power Member

Partilhar esta Página

Pesquisas Úteis

Processador Vulnerabilidade MeltDown / Spectre (aka Kaiser bug)

miguelbazil Moderador Ninja Staff Member

muddymind 1st Folding then Sex

Dark Kaeser Power Member

Dark Kaeser Power Member

muddymind 1st Folding then Sex

palac3 Power Member

Nemesis11 Power Member

hug0b0ss Power Member

Aftaminas Power Member

Nemesis11 Power Member

hug0b0ss Power Member

Partilhar esta Página

miguelbazil Moderador Ninja
Staff Member