#speculativeexecution — Public Fediverse posts
Live and recent posts from across the Fediverse tagged #speculativeexecution, aggregated by home.social.
-
@lobingera
That’s exactly my point. Mastery doesn’t mean perfection. It means pushing an idea so far that it starts creating entirely new categories of problems. #SpeculativeExecution did. #AgileCheese does, too. That’s where the #cheese begins. 🧀 -
@lobingera
That’s exactly my point. Mastery doesn’t mean perfection. It means pushing an idea so far that it starts creating entirely new categories of problems. #SpeculativeExecution did. #AgileCheese does, too. That’s where the #cheese begins. 🧀 -
@lobingera
That’s exactly my point. Mastery doesn’t mean perfection. It means pushing an idea so far that it starts creating entirely new categories of problems. #SpeculativeExecution did. #AgileCheese does, too. That’s where the #cheese begins. 🧀 -
@lobingera
That’s exactly my point. Mastery doesn’t mean perfection. It means pushing an idea so far that it starts creating entirely new categories of problems. #SpeculativeExecution did. #AgileCheese does, too. That’s where the #cheese begins. 🧀 -
@lobingera
That’s exactly my point. Mastery doesn’t mean perfection. It means pushing an idea so far that it starts creating entirely new categories of problems. #SpeculativeExecution did. #AgileCheese does, too. That’s where the #cheese begins. 🧀 -
This Week in Security: DeepSeek’s Oopsie, AI Tarpits, And Apple’s Leaks https://hackaday.com/2025/01/31/this-week-in-security-deepseeks-oopsie-ai-tarpits-and-apples-leaks/ #speculativeexecution #ThisWeekinSecurity #HackadayColumns #SecurityHacks #Deepseek #Tarpits #News
-
This Week in Security: DeepSeek’s Oopsie, AI Tarpits, And Apple’s Leaks https://hackaday.com/2025/01/31/this-week-in-security-deepseeks-oopsie-ai-tarpits-and-apples-leaks/ #speculativeexecution #ThisWeekinSecurity #HackadayColumns #SecurityHacks #Deepseek #Tarpits #News
-
This Week in Security: DeepSeek’s Oopsie, AI Tarpits, And Apple’s Leaks https://hackaday.com/2025/01/31/this-week-in-security-deepseeks-oopsie-ai-tarpits-and-apples-leaks/ #speculativeexecution #ThisWeekinSecurity #HackadayColumns #SecurityHacks #Deepseek #Tarpits #News
-
This Week in Security: DeepSeek’s Oopsie, AI Tarpits, And Apple’s Leaks https://hackaday.com/2025/01/31/this-week-in-security-deepseeks-oopsie-ai-tarpits-and-apples-leaks/ #speculativeexecution #ThisWeekinSecurity #HackadayColumns #SecurityHacks #Deepseek #Tarpits #News
-
This Week in Security: DeepSeek’s Oopsie, AI Tarpits, And Apple’s Leaks - DeepSeek has captured the world’s attention this week, with an unexpected release ... - https://hackaday.com/2025/01/31/this-week-in-security-deepseeks-oopsie-ai-tarpits-and-apples-leaks/ #speculativeexecution #thisweekinsecurity #hackadaycolumns #securityhacks #deepseek #tarpits #news
-
This Week in Security: DeepSeek’s Oopsie, AI Tarpits, And Apple’s Leaks - DeepSeek has captured the world’s attention this week, with an unexpected release ... - https://hackaday.com/2025/01/31/this-week-in-security-deepseeks-oopsie-ai-tarpits-and-apples-leaks/ #speculativeexecution #thisweekinsecurity #hackadaycolumns #securityhacks #deepseek #tarpits #news
-
This Week in Security: DeepSeek’s Oopsie, AI Tarpits, And Apple’s Leaks - DeepSeek has captured the world’s attention this week, with an unexpected release ... - https://hackaday.com/2025/01/31/this-week-in-security-deepseeks-oopsie-ai-tarpits-and-apples-leaks/ #speculativeexecution #thisweekinsecurity #hackadaycolumns #securityhacks #deepseek #tarpits #news
-
This Week in Security: DeepSeek’s Oopsie, AI Tarpits, And Apple’s Leaks - DeepSeek has captured the world’s attention this week, with an unexpected release ... - https://hackaday.com/2025/01/31/this-week-in-security-deepseeks-oopsie-ai-tarpits-and-apples-leaks/ #speculativeexecution #thisweekinsecurity #hackadaycolumns #securityhacks #deepseek #tarpits #news
-
This Week in Security: DeepSeek’s Oopsie, AI Tarpits, And Apple’s Leaks - DeepSeek has captured the world’s attention this week, with an unexpected release ... - https://hackaday.com/2025/01/31/this-week-in-security-deepseeks-oopsie-ai-tarpits-and-apples-leaks/ #speculativeexecution #thisweekinsecurity #hackadaycolumns #securityhacks #deepseek #tarpits #news
-
Apple chips can be hacked to leak secrets from Gmail, iCloud, and more - Apple-designed chips powering Macs, iPhones, and iPads contain two newly d... - https://arstechnica.com/security/2025/01/newly-discovered-flaws-in-apple-chips-leak-secrets-in-safari-and-chrome/ #speculativeexecution #a-serieschips #m-serieschips #sidechannels #security #biz #apple
-
Apple chips can be hacked to leak secrets from Gmail, iCloud, and more - Apple-designed chips powering Macs, iPhones, and iPads contain two newly d... - https://arstechnica.com/security/2025/01/newly-discovered-flaws-in-apple-chips-leak-secrets-in-safari-and-chrome/ #speculativeexecution #a-serieschips #m-serieschips #sidechannels #security #biz #apple
-
Apple chips can be hacked to leak secrets from Gmail, iCloud, and more - Apple-designed chips powering Macs, iPhones, and iPads contain two newly d... - https://arstechnica.com/security/2025/01/newly-discovered-flaws-in-apple-chips-leak-secrets-in-safari-and-chrome/ #speculativeexecution #a-serieschips #m-serieschips #sidechannels #security #biz #apple
-
Apple chips can be hacked to leak secrets from Gmail, iCloud, and more - Apple-designed chips powering Macs, iPhones, and iPads contain two newly d... - https://arstechnica.com/security/2025/01/newly-discovered-flaws-in-apple-chips-leak-secrets-in-safari-and-chrome/ #speculativeexecution #a-serieschips #m-serieschips #sidechannels #security #biz #apple
-
Apple chips can be hacked to leak secrets from Gmail, iCloud, and more - Apple-designed chips powering Macs, iPhones, and iPads contain two newly d... - https://arstechnica.com/security/2025/01/newly-discovered-flaws-in-apple-chips-leak-secrets-in-safari-and-chrome/ #speculativeexecution #a-serieschips #m-serieschips #sidechannels #security #biz #apple
-
#Intel, #AMD #CPU on #Linux impacted by newly disclosed #Spectre bypass
The #vulnerabilities impact Intel's 12th, 13th, and 14th chip generations for consumers and the 5th and 6th generation of #Xeon processors for servers, along with AMD's older Zen 1, Zen 1+, and Zen 2 processors. The attacks undermine the Indirect Branch Predictor Barrier (#IBPB) on #x86 processors, a core defense mechanism against #speculativeexecution attacks.
https://www.bleepingcomputer.com/news/security/intel-amd-cpus-on-linux-impacted-by-newly-disclosed-spectre-bypass/ -
#Intel, #AMD #CPU on #Linux impacted by newly disclosed #Spectre bypass
The #vulnerabilities impact Intel's 12th, 13th, and 14th chip generations for consumers and the 5th and 6th generation of #Xeon processors for servers, along with AMD's older Zen 1, Zen 1+, and Zen 2 processors. The attacks undermine the Indirect Branch Predictor Barrier (#IBPB) on #x86 processors, a core defense mechanism against #speculativeexecution attacks.
https://www.bleepingcomputer.com/news/security/intel-amd-cpus-on-linux-impacted-by-newly-disclosed-spectre-bypass/ -
#Intel, #AMD #CPU on #Linux impacted by newly disclosed #Spectre bypass
The #vulnerabilities impact Intel's 12th, 13th, and 14th chip generations for consumers and the 5th and 6th generation of #Xeon processors for servers, along with AMD's older Zen 1, Zen 1+, and Zen 2 processors. The attacks undermine the Indirect Branch Predictor Barrier (#IBPB) on #x86 processors, a core defense mechanism against #speculativeexecution attacks.
https://www.bleepingcomputer.com/news/security/intel-amd-cpus-on-linux-impacted-by-newly-disclosed-spectre-bypass/ -
#Intel, #AMD #CPU on #Linux impacted by newly disclosed #Spectre bypass
The #vulnerabilities impact Intel's 12th, 13th, and 14th chip generations for consumers and the 5th and 6th generation of #Xeon processors for servers, along with AMD's older Zen 1, Zen 1+, and Zen 2 processors. The attacks undermine the Indirect Branch Predictor Barrier (#IBPB) on #x86 processors, a core defense mechanism against #speculativeexecution attacks.
https://www.bleepingcomputer.com/news/security/intel-amd-cpus-on-linux-impacted-by-newly-disclosed-spectre-bypass/ -
#Intel, #AMD #CPU on #Linux impacted by newly disclosed #Spectre bypass
The #vulnerabilities impact Intel's 12th, 13th, and 14th chip generations for consumers and the 5th and 6th generation of #Xeon processors for servers, along with AMD's older Zen 1, Zen 1+, and Zen 2 processors. The attacks undermine the Indirect Branch Predictor Barrier (#IBPB) on #x86 processors, a core defense mechanism against #speculativeexecution attacks.
https://www.bleepingcomputer.com/news/security/intel-amd-cpus-on-linux-impacted-by-newly-disclosed-spectre-bypass/ -
New ARM ‘TIKTAG’ Attack Impacts Google Chrome, Linux Systems https://gbhackers.com/new-arm-tiktag-attack/ #SpeculativeExecution #CVE/vulnerability #CyberSecurityNews #cybersecurity #CyberAttack #TIKTAG #Linux #MTE
-
New ARM ‘TIKTAG’ Attack Impacts Google Chrome, Linux Systems https://gbhackers.com/new-arm-tiktag-attack/ #SpeculativeExecution #CVE/vulnerability #CyberSecurityNews #cybersecurity #CyberAttack #TIKTAG #Linux #MTE
-
New ARM ‘TIKTAG’ Attack Impacts Google Chrome, Linux Systems https://gbhackers.com/new-arm-tiktag-attack/ #SpeculativeExecution #CVE/vulnerability #CyberSecurityNews #cybersecurity #CyberAttack #TIKTAG #Linux #MTE
-
New ARM ‘TIKTAG’ Attack Impacts Google Chrome, Linux Systems https://gbhackers.com/new-arm-tiktag-attack/ #SpeculativeExecution #CVE/vulnerability #CyberSecurityNews #cybersecurity #CyberAttack #TIKTAG #Linux #MTE
-
Speculative execution and other microarchitectural attacks never went away, and the research just keeps getting smarter.
Pathfinder introduces new tools and two new types of speculative execution, affecting Intel and AMD CPUs.
-
Speculative execution and other microarchitectural attacks never went away, and the research just keeps getting smarter.
Pathfinder introduces new tools and two new types of speculative execution, affecting Intel and AMD CPUs.
-
Speculative execution and other microarchitectural attacks never went away, and the research just keeps getting smarter.
Pathfinder introduces new tools and two new types of speculative execution, affecting Intel and AMD CPUs.
-
Speculative execution and other microarchitectural attacks never went away, and the research just keeps getting smarter.
Pathfinder introduces new tools and two new types of speculative execution, affecting Intel and AMD CPUs.
-
Speculative execution and other microarchitectural attacks never went away, and the research just keeps getting smarter.
Pathfinder introduces new tools and two new types of speculative execution, affecting Intel and AMD CPUs.
-
New #SpectreV2 attack impacts #Linux systems on #Intel #CPU
Researchers have demonstrated the "first native #Spectre v2 #exploit" for a new #speculativeexecution side-channel flaw that impacts Linux systems running on many modern Intel processors.
Current mitigations are designed around isolating exploitable gadgets to remove the attack surface. Researchers, through custom 'InSpectre Gadget' analysis tool, demonstrated that exploitable gadgets in the Linux kernel remain.
https://www.bleepingcomputer.com/news/security/new-spectre-v2-attack-impacts-linux-systems-on-intel-cpus/ -
New #SpectreV2 attack impacts #Linux systems on #Intel #CPU
Researchers have demonstrated the "first native #Spectre v2 #exploit" for a new #speculativeexecution side-channel flaw that impacts Linux systems running on many modern Intel processors.
Current mitigations are designed around isolating exploitable gadgets to remove the attack surface. Researchers, through custom 'InSpectre Gadget' analysis tool, demonstrated that exploitable gadgets in the Linux kernel remain.
https://www.bleepingcomputer.com/news/security/new-spectre-v2-attack-impacts-linux-systems-on-intel-cpus/ -
New #SpectreV2 attack impacts #Linux systems on #Intel #CPU
Researchers have demonstrated the "first native #Spectre v2 #exploit" for a new #speculativeexecution side-channel flaw that impacts Linux systems running on many modern Intel processors.
Current mitigations are designed around isolating exploitable gadgets to remove the attack surface. Researchers, through custom 'InSpectre Gadget' analysis tool, demonstrated that exploitable gadgets in the Linux kernel remain.
https://www.bleepingcomputer.com/news/security/new-spectre-v2-attack-impacts-linux-systems-on-intel-cpus/ -
New #SpectreV2 attack impacts #Linux systems on #Intel #CPU
Researchers have demonstrated the "first native #Spectre v2 #exploit" for a new #speculativeexecution side-channel flaw that impacts Linux systems running on many modern Intel processors.
Current mitigations are designed around isolating exploitable gadgets to remove the attack surface. Researchers, through custom 'InSpectre Gadget' analysis tool, demonstrated that exploitable gadgets in the Linux kernel remain.
https://www.bleepingcomputer.com/news/security/new-spectre-v2-attack-impacts-linux-systems-on-intel-cpus/ -
New #SpectreV2 attack impacts #Linux systems on #Intel #CPU
Researchers have demonstrated the "first native #Spectre v2 #exploit" for a new #speculativeexecution side-channel flaw that impacts Linux systems running on many modern Intel processors.
Current mitigations are designed around isolating exploitable gadgets to remove the attack surface. Researchers, through custom 'InSpectre Gadget' analysis tool, demonstrated that exploitable gadgets in the Linux kernel remain.
https://www.bleepingcomputer.com/news/security/new-spectre-v2-attack-impacts-linux-systems-on-intel-cpus/ -
#iLeakage Attack: Theft of Sensitive Data from #Apple’s #Safari #Browser
What happens in iLeakage attacks is that the #CPU is tricked into #speculativeexecution of code that reads sensitive data from memory. https://www.hackread.com/ileakage-attack-sensitive-data-theft-apple-safari-browser/ #sidechannel attack -
#iLeakage Attack: Theft of Sensitive Data from #Apple’s #Safari #Browser
What happens in iLeakage attacks is that the #CPU is tricked into #speculativeexecution of code that reads sensitive data from memory. https://www.hackread.com/ileakage-attack-sensitive-data-theft-apple-safari-browser/ #sidechannel attack -
#iLeakage Attack: Theft of Sensitive Data from #Apple’s #Safari #Browser
What happens in iLeakage attacks is that the #CPU is tricked into #speculativeexecution of code that reads sensitive data from memory. https://www.hackread.com/ileakage-attack-sensitive-data-theft-apple-safari-browser/ #sidechannel attack -
#iLeakage Attack: Theft of Sensitive Data from #Apple’s #Safari #Browser
What happens in iLeakage attacks is that the #CPU is tricked into #speculativeexecution of code that reads sensitive data from memory. https://www.hackread.com/ileakage-attack-sensitive-data-theft-apple-safari-browser/ #sidechannel attack -
#iLeakage Attack: Theft of Sensitive Data from #Apple’s #Safari #Browser
What happens in iLeakage attacks is that the #CPU is tricked into #speculativeexecution of code that reads sensitive data from memory. https://www.hackread.com/ileakage-attack-sensitive-data-theft-apple-safari-browser/ #sidechannel attack -
"🚨 iLeakage: Safari's Side Channel Vulnerability Exposed! 🍎🔓"
Researchers have unveiled a new attack, dubbed "iLeakage", that exploits a side channel vulnerability in Apple's A- and M-series CPUs. This attack forces Apple’s Safari browser on iOS and macOS devices to reveal passwords, Gmail content, and more. The exploit is practical and doesn't require vast resources but demands in-depth reverse-engineering of Apple hardware. The side channel exploited is speculative execution, a feature in modern CPUs that has been the foundation for numerous attacks recently. The iLeakage attack, when executed, can recover YouTube viewing history, Gmail inbox content, and even passwords autofilled by credential managers. Apple is aware and plans to address this in an upcoming software release. 🚀🔍
Source: Ars Technica
Author: Dan Goodin - Senior Security Editor at Ars Technica. Profile
Tags: #iLeakage #Apple #Safari #SideChannel #Vulnerability #CyberSecurity #iOS #macOS #SpeculativeExecution 🌐🔐🍏
-
"🚨 iLeakage: Safari's Side Channel Vulnerability Exposed! 🍎🔓"
Researchers have unveiled a new attack, dubbed "iLeakage", that exploits a side channel vulnerability in Apple's A- and M-series CPUs. This attack forces Apple’s Safari browser on iOS and macOS devices to reveal passwords, Gmail content, and more. The exploit is practical and doesn't require vast resources but demands in-depth reverse-engineering of Apple hardware. The side channel exploited is speculative execution, a feature in modern CPUs that has been the foundation for numerous attacks recently. The iLeakage attack, when executed, can recover YouTube viewing history, Gmail inbox content, and even passwords autofilled by credential managers. Apple is aware and plans to address this in an upcoming software release. 🚀🔍
Source: Ars Technica
Author: Dan Goodin - Senior Security Editor at Ars Technica. Profile
Tags: #iLeakage #Apple #Safari #SideChannel #Vulnerability #CyberSecurity #iOS #macOS #SpeculativeExecution 🌐🔐🍏
-
"🚨 iLeakage: Safari's Side Channel Vulnerability Exposed! 🍎🔓"
Researchers have unveiled a new attack, dubbed "iLeakage", that exploits a side channel vulnerability in Apple's A- and M-series CPUs. This attack forces Apple’s Safari browser on iOS and macOS devices to reveal passwords, Gmail content, and more. The exploit is practical and doesn't require vast resources but demands in-depth reverse-engineering of Apple hardware. The side channel exploited is speculative execution, a feature in modern CPUs that has been the foundation for numerous attacks recently. The iLeakage attack, when executed, can recover YouTube viewing history, Gmail inbox content, and even passwords autofilled by credential managers. Apple is aware and plans to address this in an upcoming software release. 🚀🔍
Source: Ars Technica
Author: Dan Goodin - Senior Security Editor at Ars Technica. Profile
Tags: #iLeakage #Apple #Safari #SideChannel #Vulnerability #CyberSecurity #iOS #macOS #SpeculativeExecution 🌐🔐🍏
-
"🚨 iLeakage: Safari's Side Channel Vulnerability Exposed! 🍎🔓"
Researchers have unveiled a new attack, dubbed "iLeakage", that exploits a side channel vulnerability in Apple's A- and M-series CPUs. This attack forces Apple’s Safari browser on iOS and macOS devices to reveal passwords, Gmail content, and more. The exploit is practical and doesn't require vast resources but demands in-depth reverse-engineering of Apple hardware. The side channel exploited is speculative execution, a feature in modern CPUs that has been the foundation for numerous attacks recently. The iLeakage attack, when executed, can recover YouTube viewing history, Gmail inbox content, and even passwords autofilled by credential managers. Apple is aware and plans to address this in an upcoming software release. 🚀🔍
Source: Ars Technica
Author: Dan Goodin - Senior Security Editor at Ars Technica. Profile
Tags: #iLeakage #Apple #Safari #SideChannel #Vulnerability #CyberSecurity #iOS #macOS #SpeculativeExecution 🌐🔐🍏
-
"🚨 iLeakage: Safari's Side Channel Vulnerability Exposed! 🍎🔓"
Researchers have unveiled a new attack, dubbed "iLeakage", that exploits a side channel vulnerability in Apple's A- and M-series CPUs. This attack forces Apple’s Safari browser on iOS and macOS devices to reveal passwords, Gmail content, and more. The exploit is practical and doesn't require vast resources but demands in-depth reverse-engineering of Apple hardware. The side channel exploited is speculative execution, a feature in modern CPUs that has been the foundation for numerous attacks recently. The iLeakage attack, when executed, can recover YouTube viewing history, Gmail inbox content, and even passwords autofilled by credential managers. Apple is aware and plans to address this in an upcoming software release. 🚀🔍
Source: Ars Technica
Author: Dan Goodin - Senior Security Editor at Ars Technica. Profile
Tags: #iLeakage #Apple #Safari #SideChannel #Vulnerability #CyberSecurity #iOS #macOS #SpeculativeExecution 🌐🔐🍏
-
Hackers can force #iOS and #macOS browsers to divulge passwords and much more
Researchers devised an attack that forces #Apple’s #Safari browser to divulge #passwords, Gmail message content, and other secrets by exploiting a side channel #vulnerability in A- and M-series CPU running modern iOS and macOS devices dubbed #iLeakage. The side channel in this case is #speculativeexecution, a performance enhancement feature in modern #CPU that formed the basis of many attacks https://arstechnica.com/security/2023/10/hackers-can-force-ios-and-macos-browsers-to-divulge-passwords-and-a-whole-lot-more/ -
Hackers can force #iOS and #macOS browsers to divulge passwords and much more
Researchers devised an attack that forces #Apple’s #Safari browser to divulge #passwords, Gmail message content, and other secrets by exploiting a side channel #vulnerability in A- and M-series CPU running modern iOS and macOS devices dubbed #iLeakage. The side channel in this case is #speculativeexecution, a performance enhancement feature in modern #CPU that formed the basis of many attacks https://arstechnica.com/security/2023/10/hackers-can-force-ios-and-macos-browsers-to-divulge-passwords-and-a-whole-lot-more/ -
Hackers can force #iOS and #macOS browsers to divulge passwords and much more
Researchers devised an attack that forces #Apple’s #Safari browser to divulge #passwords, Gmail message content, and other secrets by exploiting a side channel #vulnerability in A- and M-series CPU running modern iOS and macOS devices dubbed #iLeakage. The side channel in this case is #speculativeexecution, a performance enhancement feature in modern #CPU that formed the basis of many attacks https://arstechnica.com/security/2023/10/hackers-can-force-ios-and-macos-browsers-to-divulge-passwords-and-a-whole-lot-more/ -
Hackers can force #iOS and #macOS browsers to divulge passwords and much more
Researchers devised an attack that forces #Apple’s #Safari browser to divulge #passwords, Gmail message content, and other secrets by exploiting a side channel #vulnerability in A- and M-series CPU running modern iOS and macOS devices dubbed #iLeakage. The side channel in this case is #speculativeexecution, a performance enhancement feature in modern #CPU that formed the basis of many attacks https://arstechnica.com/security/2023/10/hackers-can-force-ios-and-macos-browsers-to-divulge-passwords-and-a-whole-lot-more/ -
Hackers can force #iOS and #macOS browsers to divulge passwords and much more
Researchers devised an attack that forces #Apple’s #Safari browser to divulge #passwords, Gmail message content, and other secrets by exploiting a side channel #vulnerability in A- and M-series CPU running modern iOS and macOS devices dubbed #iLeakage. The side channel in this case is #speculativeexecution, a performance enhancement feature in modern #CPU that formed the basis of many attacks https://arstechnica.com/security/2023/10/hackers-can-force-ios-and-macos-browsers-to-divulge-passwords-and-a-whole-lot-more/ -
CW: Moar speculative execution attacks
You might by now have heard of "Downfall"¹, yet another speculative execution attack on Intel processors.
The mitigations are going to cost another 50% performance on "selected workloads" which, by Murphy's, will inevitably be yours.
I quote something I find really rather irritating:
"
[Q] Can I disable the mitigation if my workload does not use Gather?[A] This is a bad idea. Even if your workload does not use vector instructions, modern CPUs rely on vector registers to optimize common operations, such as copying memory and switching register content, which leaks data to untrusted code exploiting Gather.
"No, you can freely decide to ignore microcode mitigations if you know what you are doing. There are thousands of reasons why you should not continue piling up Intel's microcode fixes on your machines and performance is indeed one of them.
This attack is based on the "gather" part of the "scatter-gather" SIMD algorithms, these are pretty ubiquitous if you have ever done HPC and, well, if your HPC machine is one telnet away from the Internet then you have a bigger problem than microcode².
Now, please understand, perhaps "for once and for all", that these attacks have a very simple "root cause": in the 1990s pretty much every processor manufacturer on the planet decided that performance trumped everything else and, therefore, went down (unprotected) speculative execution³.
This means that it cannot be fixed within current architectures.
#SpeculativeExecution #NamedVulnerabilities #Downfall #Hype #MitigationsDoneWrong
__
¹ https://downfall.page
² I used to manage an HPC network in the 1990s, I was hacked by, of all places, Intel in Israel (Haifa), no I cannot discuss this further, yes, I detected them.
³ If you read the literature you will discover that even IBM mainframe processors went down that route (hint, hint). -
CW: Moar speculative execution attacks
You might by now have heard of "Downfall"¹, yet another speculative execution attack on Intel processors.
The mitigations are going to cost another 50% performance on "selected workloads" which, by Murphy's, will inevitably be yours.
I quote something I find really rather irritating:
"
[Q] Can I disable the mitigation if my workload does not use Gather?[A] This is a bad idea. Even if your workload does not use vector instructions, modern CPUs rely on vector registers to optimize common operations, such as copying memory and switching register content, which leaks data to untrusted code exploiting Gather.
"No, you can freely decide to ignore microcode mitigations if you know what you are doing. There are thousands of reasons why you should not continue piling up Intel's microcode fixes on your machines and performance is indeed one of them.
This attack is based on the "gather" part of the "scatter-gather" SIMD algorithms, these are pretty ubiquitous if you have ever done HPC and, well, if your HPC machine is one telnet away from the Internet then you have a bigger problem than microcode².
Now, please understand, perhaps "for once and for all", that these attacks have a very simple "root cause": in the 1990s pretty much every processor manufacturer on the planet decided that performance trumped everything else and, therefore, went down (unprotected) speculative execution³.
This means that it cannot be fixed within current architectures.
#SpeculativeExecution #NamedVulnerabilities #Downfall #Hype #MitigationsDoneWrong
__
¹ https://downfall.page
² I used to manage an HPC network in the 1990s, I was hacked by, of all places, Intel in Israel (Haifa), no I cannot discuss this further, yes, I detected them.
³ If you read the literature you will discover that even IBM mainframe processors went down that route (hint, hint). -
CW: Moar speculative execution attacks
You might by now have heard of "Downfall"¹, yet another speculative execution attack on Intel processors.
The mitigations are going to cost another 50% performance on "selected workloads" which, by Murphy's, will inevitably be yours.
I quote something I find really rather irritating:
"
[Q] Can I disable the mitigation if my workload does not use Gather?[A] This is a bad idea. Even if your workload does not use vector instructions, modern CPUs rely on vector registers to optimize common operations, such as copying memory and switching register content, which leaks data to untrusted code exploiting Gather.
"No, you can freely decide to ignore microcode mitigations if you know what you are doing. There are thousands of reasons why you should not continue piling up Intel's microcode fixes on your machines and performance is indeed one of them.
This attack is based on the "gather" part of the "scatter-gather" SIMD algorithms, these are pretty ubiquitous if you have ever done HPC and, well, if your HPC machine is one telnet away from the Internet then you have a bigger problem than microcode².
Now, please understand, perhaps "for once and for all", that these attacks have a very simple "root cause": in the 1990s pretty much every processor manufacturer on the planet decided that performance trumped everything else and, therefore, went down (unprotected) speculative execution³.
This means that it cannot be fixed within current architectures.
#SpeculativeExecution #NamedVulnerabilities #Downfall #Hype #MitigationsDoneWrong
__
¹ https://downfall.page
² I used to manage an HPC network in the 1990s, I was hacked by, of all places, Intel in Israel (Haifa), no I cannot discuss this further, yes, I detected them.
³ If you read the literature you will discover that even IBM mainframe processors went down that route (hint, hint). -
CW: Moar speculative execution attacks
You might by now have heard of "Downfall"¹, yet another speculative execution attack on Intel processors.
The mitigations are going to cost another 50% performance on "selected workloads" which, by Murphy's, will inevitably be yours.
I quote something I find really rather irritating:
"
[Q] Can I disable the mitigation if my workload does not use Gather?[A] This is a bad idea. Even if your workload does not use vector instructions, modern CPUs rely on vector registers to optimize common operations, such as copying memory and switching register content, which leaks data to untrusted code exploiting Gather.
"No, you can freely decide to ignore microcode mitigations if you know what you are doing. There are thousands of reasons why you should not continue piling up Intel's microcode fixes on your machines and performance is indeed one of them.
This attack is based on the "gather" part of the "scatter-gather" SIMD algorithms, these are pretty ubiquitous if you have ever done HPC and, well, if your HPC machine is one telnet away from the Internet then you have a bigger problem than microcode².
Now, please understand, perhaps "for once and for all", that these attacks have a very simple "root cause": in the 1990s pretty much every processor manufacturer on the planet decided that performance trumped everything else and, therefore, went down (unprotected) speculative execution³.
This means that it cannot be fixed within current architectures.
#SpeculativeExecution #NamedVulnerabilities #Downfall #Hype #MitigationsDoneWrong
__
¹ https://downfall.page
² I used to manage an HPC network in the 1990s, I was hacked by, of all places, Intel in Israel (Haifa), no I cannot discuss this further, yes, I detected them.
³ If you read the literature you will discover that even IBM mainframe processors went down that route (hint, hint). -
CW: Moar speculative execution attacks
You might by now have heard of "Downfall"¹, yet another speculative execution attack on Intel processors.
The mitigations are going to cost another 50% performance on "selected workloads" which, by Murphy's, will inevitably be yours.
I quote something I find really rather irritating:
"
[Q] Can I disable the mitigation if my workload does not use Gather?[A] This is a bad idea. Even if your workload does not use vector instructions, modern CPUs rely on vector registers to optimize common operations, such as copying memory and switching register content, which leaks data to untrusted code exploiting Gather.
"No, you can freely decide to ignore microcode mitigations if you know what you are doing. There are thousands of reasons why you should not continue piling up Intel's microcode fixes on your machines and performance is indeed one of them.
This attack is based on the "gather" part of the "scatter-gather" SIMD algorithms, these are pretty ubiquitous if you have ever done HPC and, well, if your HPC machine is one telnet away from the Internet then you have a bigger problem than microcode².
Now, please understand, perhaps "for once and for all", that these attacks have a very simple "root cause": in the 1990s pretty much every processor manufacturer on the planet decided that performance trumped everything else and, therefore, went down (unprotected) speculative execution³.
This means that it cannot be fixed within current architectures.
#SpeculativeExecution #NamedVulnerabilities #Downfall #Hype #MitigationsDoneWrong
__
¹ https://downfall.page
² I used to manage an HPC network in the 1990s, I was hacked by, of all places, Intel in Israel (Haifa), no I cannot discuss this further, yes, I detected them.
³ If you read the literature you will discover that even IBM mainframe processors went down that route (hint, hint). -
During this year's #BlackHat conference, security researcher Daniel Moghimi is set to present "Downfall", a new speculative execution vulnerability found in Intel processors from 2014-2023.
This new speculative execution vulnerability if exploited could allow attackers steal encryption keys & passwords.
Intel noted that they haven't seen this vulnerability being exploited in the wild and that detection is difficult.
Moghimi stated that exploiting was relatively easy, he goes on to say:When I discovered this vulnerability, it took me maybe a couple of weeks to come up with attacks that work. I was just a one-person researcher without any resources, you can imagine if you have a team of black hat hackers, you can probably do a lot more with it.
While the flaw exists in hardware, Intel has provided microcode updates & the #Linux kernel maintainers have published mitigations for this flaw in today's kernel release.
#infosec #cybersecurity #DOWNFALL #speculativeexecution #Intel #CPUBug
- https://cyberscoop.com/downfall-intel-cpu-vulnerability/
- https://www.bleepingcomputer.com/news/security/new-downfall-attacks-on-intel-cpus-steal-encryption-keys-data/ -
During this year's #BlackHat conference, security researcher Daniel Moghimi is set to present "Downfall", a new speculative execution vulnerability found in Intel processors from 2014-2023.
This new speculative execution vulnerability if exploited could allow attackers steal encryption keys & passwords.
Intel noted that they haven't seen this vulnerability being exploited in the wild and that detection is difficult.
Moghimi stated that exploiting was relatively easy, he goes on to say:When I discovered this vulnerability, it took me maybe a couple of weeks to come up with attacks that work. I was just a one-person researcher without any resources, you can imagine if you have a team of black hat hackers, you can probably do a lot more with it.
While the flaw exists in hardware, Intel has provided microcode updates & the #Linux kernel maintainers have published mitigations for this flaw in today's kernel release.
#infosec #cybersecurity #DOWNFALL #speculativeexecution #Intel #CPUBug
- https://cyberscoop.com/downfall-intel-cpu-vulnerability/
- https://www.bleepingcomputer.com/news/security/new-downfall-attacks-on-intel-cpus-steal-encryption-keys-data/