#hardware-security — Public Fediverse posts

🛡️ Atacul TONTOU: Bypassing-ul protecțiilor Spectre v2 pe procesoarele AMD și Intel!

Cercetătorii de la MIT CSAIL au descoperit un nou atac de tip canal lateral numit TONTOU (Time-Of-Neutralization To Time-Of-Use), capabil să ocolească protecțiile existente împotriva Spectre v2 de pe sistemele Linux și să extragă date confidențiale direkte din memoria kernelului.

✨ Detaliile tehnice ale vulnerabilității TONTOU:

💥 Mecanismul de atac (Interrupt Injection):
• Atacul exploatează o fereastră temporală critică între momentul în care predictorul de ramificație al procesorului este izolat/neutralizat (neutralization) și momentul în care acesta este efectiv folosit (use).
• Un program fără privilegii poate injecta un întrerupere de cronometru (timer interrupt) exact în această fereastră de timp, determinând kernelul să ruleze un handler ce permite „re-infestarea” stării CPU-ului înainte ca acesta să execute codul protejat.

🔓 Surgerea datelor din memoria Kernel-ului:
• Testat pe procesoare AMD Zen 2 cu Linux, atacul a demonstrat posibilitatea de a extrage date arbitrare din kernel (cum ar fi hash-urile de parole din /etc/shadow) cu o rată de transfer de 5,47 octeți/secundă și o acuratețe de peste 91%.
• Vulnerabilitatea afectează și procesoarele Intel, însă exploatarea pe acestea este mai complexă din punct de vedere al cerințelor software.

🛠️ Status și Măsuri de Remediere:
• Producătorii de procesoare (AMD, Intel) și comunitatea Linux au recunoscut problema, fiind dezvoltate și integrate patch-uri la nivelul kernelului pentru a închide fereastra de timp exploatată de întreruperi. Se recomandă aplicarea celor mai recente actualizări de sistem.

Un nou memento despre cât de complexe rămân atuurile hardware de speculație și cât de greu de protejat complet sunt împotriva atacurilor de tip canal lateral! 🚀

#TONTOU #SpectreV2 #Linux #CyberSecurity #AMD #Intel #CPU #HardwareSecurity #DesdeLinux #TechNews #FOSS

Discover how VeriChat AI revolutionizes hardware backdoor detection by analyzing microchip designs and uncovering hidden silicon threats.

#Cybersecurity #HardwareSecurity #AI #VeriChat

https://meterpreter.org/hardware-backdoor-detection-verichat/?utm_source=mastodon&utm_medium=jetpack_social

Remote Attestation

https://www.liamcvw.com/p/remote-attestation

Comments: https://news.ycombinator.com/item?id=48839397

#HackerNews #RemoteAttestation #Cybersecurity #TrustVerification #HardwareSecurity

Hardware Security: Threats, Prevention, and AI-Driven Countermeasures by Khaled Mohamed, 2026

This book provides an effective guide to hardware security, presenting both conventional countermeasures and advanced AI-driven strategies for preventing, detecting, and mitigating security vulnerabilities.

#books
#nonfiction
#cybersecurity
#HardwareSecurity
#Springer

The Silent Breach and the Persistence of Unauthorized Access

938 words, 5 minutes read time.

Once the session token is successfully exfiltrated, the nature of the intrusion shifts from external deception to internal subversion. The attacker does not need to crack passwords or trigger further security alerts, as they are now effectively operating with the digital identity of a trusted employee. Analyzing these incidents, I see that the primary goal is often the establishment of persistence within the target environment, which is achieved through the modification of inbox rules or the creation of clandestine mailbox delegates. By silently forwarding incoming emails to an external address or creating hidden folders for sensitive correspondence, the adversary can monitor ongoing business deals, intercept financial instructions, and identify high-value targets for subsequent business email compromise attacks. This stage of the operation is characterized by extreme patience, as the threat actor avoids loud, disruptive actions in favor of a low-and-slow approach that can remain undetected for months. The tragedy is that the victim often remains entirely unaware of the breach, believing they are still securely authenticated while their environment is being methodically picked apart from the inside.

Challenging the Failure of Traditional Defensive Postures

When considering why these attacks continue to succeed with such alarming frequency, it becomes evident that the industry’s reliance on legacy defensive postures is a failing strategy. Many organizations still treat email security as a static barrier, implementing blacklists and rudimentary heuristic scans that are easily circumvented by adversaries who control their own infrastructure and rotating IP addresses. Furthermore, the human-centric nature of these scams renders technical controls inherently insufficient unless they are paired with a cultural shift toward skeptical verification. It is not enough to deploy an automated solution if the culture within a firm encourages speed over accuracy and ignores the red flags of irregular communication patterns. Consequently, the defense against these campaigns must evolve into a proactive, threat-hunting discipline that monitors for anomalous login locations, unexpected session durations, and unauthorized changes to account configurations. Without this layer of vigilant oversight, the technical barriers essentially act as a screen door, providing the illusion of protection while failing to stop the actual threat.

Implementing Rigorous Verification Protocols in a High-Stakes Environment

The path forward requires a departure from the convenience-first mindset that dominates modern digital work environments. Organizations must adopt hardware-backed authentication methods, such as FIDO2-compliant security keys, which are resistant to the proxy-based interception tactics that currently plague mobile-based push notifications and SMS codes. Additionally, the adoption of strict device posture checks ensures that an attacker cannot simply use a stolen session token from an unauthorized machine or an unrecognized geographic region. Beyond the hardware, there must be a fundamental hardening of organizational processes, such as implementing mandatory out-of-band verification for any request involving financial transfers or the sharing of sensitive credentials. It is a harsh reality that trust is the primary vulnerability in any system, and the most secure posture is one that treats every incoming request as potentially malicious until proven otherwise through independent channels. While this might introduce friction into the workflow, that friction is the necessary price of security in an age where the cost of a single successful breach is often the survival of the entity itself.

Call to Action

The time for passive observation has passed, as the threats currently infiltrating our inboxes are not waiting for an invitation to compromise your organization. You must decide whether to continue relying on outdated defensive protocols that offer only the illusion of safety or to begin the hard work of hardening your infrastructure against the reality of modern adversarial tactics. I urge you to conduct an immediate audit of your current authentication stack and evaluate the necessity of migrating to hardware-backed security keys, as this is the single most effective step you can take to neutralize the threat of proxy-based session hijacking. Furthermore, initiate a comprehensive review of your internal communication policies to ensure that your team is empowered to question anomalies rather than blindly following the path of least resistance. Security is not a product you purchase, but a discipline you practice, and the responsibility to bridge the gap between your existing defenses and the current threat reality rests entirely with you. Do not wait for a compromised session to force your hand, because by the time the impact of a breach is visible, the damage is already absolute.

D. Bryan King

Sources

• CISA: Business Email Compromise (BEC) Resources
• FBI: Business Email Compromise Information
• FIDO Alliance: Defining Phishing-Resistant Authentication
• Microsoft: Analyzing Adversary-in-the-Middle (AiTM) Techniques
• NIST: Digital Identity Guidelines
• CrowdStrike: Phishing and Social Engineering Analysis
• Palo Alto Networks: Business Email Compromise Explained
• SANS Institute: Protecting Against Advanced Email Threats
• Cybereason: BEC Threat Landscape Report
• Check Point: The Evolution of Phishing
• Proofpoint: Understanding BEC Attacks
• Dark Reading: The Mechanics of Session Hijacking
• ZDNet: The New Era of Targeted Phishing
• Wired: Why Modern Phishing is Succeeding
• Trend Micro: BEC Comprehensive Guide
• Recorded Future: BEC Trend Analysis
• Infosecurity Magazine: FIDO2 and Phishing Resistance
• Varonis: Modern Phishing Techniques Deep Dive
• CSO Online: The Mechanics of BEC
• Fortinet: Cybersecurity Glossary on BEC
• SANS: Analyzing MFA Bypass Tactics
• BleepingComputer: Evolution of Phishing Kits
• Secureworks: BEC Defensive Strategies
• CISA: Mitigating Phishing Campaigns
• Mandiant: Evolving Tactics in BEC
• NIST: Phishing Training Resources
• TechTarget: BEC Definition and Prevention
• Elastic: Detecting Phishing Infrastructure
• Rapid7: The Threat of Session Token Theft
• Cloudflare: Understanding FIDO2 Protocol

Disclaimer:

The views and opinions expressed in this post are solely those of the author. The information provided is based on personal research, experience, and understanding of the subject matter at the time of writing. Readers should consult relevant experts or authorities for specific guidance related to their unique situations.

Related Posts

Rate this:

Interesting work on AMD SEV-SNP by Benedict Schlüter, Christoph Wech and @Shweta: https://fabricked-attack.github.io/

By reconfiguring data fabric routing from the untrusted, hypervisor-controlled UEFI firmware, they redirect Platform Security Processor (PSP) memory accesses, compromising SEV-SNP initialization, particularly the Reverse Map Table (RMP).

#Fabricked #sevsnp #security #hardwaresecurity #confidentalcomputing

Investigating Split Locks on x86-64

https://chipsandcheese.com/p/investigating-split-locks-on-x86

#HackerNews #SplitLocks #x86_64 #CPUArchitecture #HardwareSecurity #TechInvestigation

Critics call FCC router rule a ‘big swing’ that could create more supply chain uncertainty | CyberScoop
https://cyberscoop.com/fcc-bans-foreign-routers-critics-warn-about-supply-chain/

#Cybersecurity #InfoSec #FCC #SupplyChain #HardwareSecurity #NetSec #TechNews #NationalSecurity #MastodonAdmin

Caetra new release v1.2.0; added new shield that reacts when a webcam turns it on/off.

With this shield we are trying to avoid privacy leaks from you and others, among possible security visual breaches like harvesting information about your surroundings. Do not forget to cover your webcam with a nice cat sticker :3

https://github.com/carvilsi/caetra

#physicalSecurity #physicalAttacks #linuxhardening #hardwareSecurity #bpf #ebpF #bcc

caetra new release v1.1.0; added new shield to react when the CD-DVD-ROM tray opens or closes.

https://github.com/carvilsi/caetra?tab=readme-ov-file#12-cd_dvd_rom

#physicalSecurity #physicalAttacks #linuxhardening #hardwareSecurity #bpf #ebpF #bcc

Was für ein unbeschreibliches Gefühl! 📦📚

Nach über acht Monaten intensiver Arbeit, unzähligen Tassen Schwarztee und Club-Mate-Flaschen war es heute so weit: Der Postbote stand vor der Tür und überreichte mir die allerersten Autorenexemplare meines ersten eigenen englischsprachigen Buches!

„Hacking Hardware: The Practical Guide to Penetration Testing and Prevention” ist nun offiziell bei Rheinwerk Publishing in den USA erschienen. Es physisch in den Händen zu halten, durch die frisch gedruckten Seiten zu blättern und das eigene Cover zu sehen, ist ein absoluter Meilenstein für mich.

#HackingHardware #Pentesting #Cybersecurity #InfoSec #HardwareSecurity #RheinwerkPublishing #AuthorLife

Google OpenTitan open source security chip is now shipping inside Chromebooks

https://fed.brid.gy/r/https://nerds.xyz/2026/03/google-opentitan/

Leanpub book LAUNCH 🚀 Code, Chips and Control: The Security Posture of Digital Isolation by Sal Kimmich

Watch here: https://youtu.be/KCURt43Rqhg

#books #leanpublishing #selfpublishing #booklaunch #cybersecurity #infosec #securityarchitecture #supplychainsecurity #opensource #devsecops #hardwaresecurity #softwaresecurity #zerotrust #leanpubpodcast

Leanpub book LAUNCH 🚀 Code, Chips and Control: The Security Posture of Digital Isolation by Sal Kimmich

Watch here: https://youtu.be/KCURt43Rqhg

#books #leanpublishing #selfpublishing #booklaunch #cybersecurity #infosec #securityarchitecture #supplychainsecurity #opensource #devsecops #hardwaresecurity #softwaresecurity #zerotrust #leanpubpodcast

Understanding that it's probably nowhere close to as good as the #GoogleTensor chip or #SamsungKnox, has anyone done an analysis of the #HardwareSecurity of the @jolla phone line?

#security #MobileSecurity #JollaPhone #SailfishOS

Leanpub book LAUNCH 🚀 Code, Chips and Control: The Security Posture of Digital Isolation by Sal Kimmich

Watch here: https://youtu.be/KCURt43Rqhg

#books #leanpublishing #selfpublishing #booklaunch #cybersecurity #infosec #securityarchitecture #supplychainsecurity #opensource #devsecops #hardwaresecurity #softwaresecurity #zerotrust #leanpubpodcast

NEW! A Leanpub Podcast Interview with Sal Kimmich, Author of Code, Chips and Control: The Security Posture of Digital Isolation

Watch here: https://youtu.be/kfeJVv7boNs

#books #leanpublishing #selfpublishing #cybersecurity #infosec #securityarchitecture #supplychainsecurity #opensource #devsecops #hardwaresecurity #softwaresecurity #zerotrust #leanpubpodcast

Leanpub Book LAUNCH 🚀 Code, Chips and Control: The Security Posture of Digital Isolation by Sal Kimmich

Through the lens of the top 100 hacks since 1985, learn cybersecurity through real-world examples of what went wrong to convince us of “best practices".

Watch on our blog here:

https://leanpub.com/blog/leanpub-book-launch-code-chips-and-control-the-security-posture-of-digital-isolation-by-sal-kimmich

#books #leanpublishing #selfpublishing #booklaunch #cybersecurity #infosec #securityarchitecture #supplychainsecurity #opensource #devsecops #hardwaresecurity #softwaresecurity #zerotrust

Leanpub book LAUNCH 🚀 Code, Chips and Control: The Security Posture of Digital Isolation by Sal Kimmich

Watch here: https://youtu.be/KCURt43Rqhg

#books #leanpublishing #selfpublishing #booklaunch #cybersecurity #infosec #securityarchitecture #supplychainsecurity #opensource #devsecops #hardwaresecurity #softwaresecurity #zerotrust #leanpubpodcast

In this episode of the Leanpub Podcast, Sal Kimmich offers a deep technical look at the evolving security landscape across hardware, software, and open-source ecosystems.

Watch & read on our blog here:

https://leanpub.com/blog/the-leanpub-podcast-feat-sal-kimmich-author-of-code-chips-and-control-the-security-posture-of-digital-isolation

#books #leanpublishing #selfpublishing #cybersecurity #infosec #securityarchitecture #supplychainsecurity #opensource #devsecops #hardwaresecurity #softwaresecurity #zerotrust #leanpubpodcast

NEW! A Leanpub Podcast Interview with Sal Kimmich, Author of Code, Chips and Control: The Security Posture of Digital Isolation

Watch here: https://youtu.be/kfeJVv7boNs

#books #leanpublishing #selfpublishing #cybersecurity #infosec #securityarchitecture #supplychainsecurity #opensource #devsecops #hardwaresecurity #softwaresecurity #zerotrust #leanpubpodcast

Every modern system carries a tiny vault called a TPM—Trusted Platform Module.
It protects encryption keys and validates your system at boot.
TPM is now required for Windows 11, making firmware vigilance more critical than ever.
Even trusted hardware needs updates.
Trust, but patch.
#CyberSecurity #HardwareSecurity #Privacy #B2B