Virtually every bit of computer security has been uncovered as broken

Author Topic: Virtually every bit of computer security has been uncovered as broken  (Read 7584 times)

on the bright side my computer performed fine with my i5 4690k at 3.5ghz and i overclocked it to 4.5ghz about 6-8 months ago so

This is gonna put a nail in the coffin for my current 5-year-old PC build, forget.



Remember all those talks people like Applebaum gave about how the gov has tech companies bent over leaving back doors for them?  Or how this is all being talked about after those NSA/CIA exploits were leaked by some dude walking out the front door?  Hmmmm

Remember all those talks people like Applebaum gave about how the gov has tech companies bent over leaving back doors for them?  Or how this is all being talked about after those NSA/CIA exploits were leaked by some dude walking out the front door?  Hmmmm
I highly doubt this is a case of government conspiracy. Most likely CPU engineers focused on making computers faster and not on security.

BTW: This was reported to Intel, AMD, and ARM on June 1st (by Google!) It’s been 7 months since. They’ve had a stuff-ton of time to develop a new patch, or a BETTER patch, and, as well, the case of the Intel CEO selling all of his stock WAS absolutely insider trading..
Smfh
« Last Edit: January 04, 2018, 04:13:53 PM by Metario »

>AMD becomes the new CPU giant and has a monopoly over all

loving kill me

Most of this is hardware level flaws in the way branch-prediction and caching works

side channels and these kinds of exploits have been a known attack vector for a while, until this proof of concept, no one did it tho

can't wait to have to REDESIGN every cpu since pentium. this is what happens when you take speed > security

BTW: This was reported to Intel, AMD, and ARM on June 1st (by Google!) It’s been 7 months since. They’ve had a stuff-ton of time to develop a new patch, or a BETTER patch, and, as well, the case of the Intel CEO selling all of his stock WAS absolutely insider trading..
Smfh
only one of the exploits is patchable IIRC

the rest rely on the chip in the CPU that predicts where jumps in the code, you can't update that

only one of the exploits is patchable IIRC

the rest rely on the chip in the CPU that predicts where jumps in the code, you can't update that
It's not that simple... I actually just talked to a PHd (read: my Intro to Computer Systems professor) about it who has extensive experience in cpu architecture and he specifically said that they're quote "not sure" if it can be fixed (in reference to the Spectre exploit which affects all CPUs)

The Meltdown one can definitely be fixed.

Remember all those talks people like Applebaum gave about how the gov has tech companies bent over leaving back doors for them?  Or how this is all being talked about after those NSA/CIA exploits were leaked by some dude walking out the front door?  Hmmmm
there’s no need for the govt to have tech companies leave them backdoors, devs do this to themselves. we’re in an age where technology is such a huge part of our lives that we want speed and functionality, but we’re willing to sacrifice security because security takes time, security takes manpower, and security takes money. push out the product, and wait til a vulnerability is discovered and made publically available, then patch it

It's not that simple... I actually just talked to a PHd (read: my Intro to Computer Systems professor) about it who has extensive experience in cpu architecture and he specifically said that they're quote "not sure" if it can be fixed (in reference to the Spectre exploit which affects all CPUs)

The Meltdown one can definitely be fixed.
he is probably thinking you could have a microcode level patch, but it's anybodies guess tbh, I don't know intel hardware enough

I believe this article is refering to Meltdown, which exclusively impacts Intel processors.

Spectre, on the other hand, has a much more far reaching impact, and one that will be harder to fix, too. Here's info on Spectre. Definitely give it a read, as it almost undoubtably affects you. Here's a quote from the paper.

Quote
We have empirically verified the vulnerability
of several Intel processors to Spectre attacks, including
Ivy Bridge, Haswell and Skylake based processors.
We have also verified the attack’s applicability
to AMD Ryzen CPUs. Finally, we have also successfully
mounted Spectre attacks on several Samsung and
Qualcomm processors (which use an ARM architecture)
found in popular mobile phones.

So basically, everyone is vulnerable. Furthermore, in the paper, they demonstrate how the attack can be launched through JavaScript. In other words, an attack launched through your browser can read private processor memory. This is really bad. On the brightside, this will probably lead to an influx of investment and research into processor security, which is good.

I wouldn't bother freaking out too much. As of yet, we do not know of any attacks in the wild that use Spectre or Meltdown. After all, this exploit was independently discovered in a research labs, so malevolent actors likely haven't had enough time to adopt these attack methods yet. That's not to say they aren't scrambling to put something together, though. People are slow to update their hardware and OS, so it's likely these are vulnerabilities that will remain effective for years to come. Just don't be those shmucks; make sure to update your computers regularly, especially in coming weeks.
« Last Edit: January 04, 2018, 06:42:29 PM by Platypi »