Meltdown & Spectre potpourri

[DrinkLyeAndDie]

Yet your user name commands us to commit suicide in one of the most horrific ways possible.

My username came about from an inside joke with a friend involving rhyming, homonyms (ie lye vs lie), and a dash of the movie Heathers.

Just seemed ironic.

I do see the irony.

The same friend who was part of the creation of my username was the source of the quote. She used to say it often.

 

[ocd]

And now there's a direct attack against SGX and its attestation keys. Sounds like patches have gone out, but maybe someone still has an unpatched system.

 

[gereral1]

The patches are more for software companies protection than for you! I left my max hero BIOS at manufacturer level so my ssds don't take a 30 percent hit. I tweaked overclock as to limit a 1.2 voltage limit. I believe Intel is trying to find a way to close sgx part so hackers cannot spy on UHD, software keys. If you keep your PC with only purchase programs you will be fine. Don't open email attachments and stay off shady webpages....

 

[Ch3vr0n]

You couldn't be more wrong. Almost all of the initial leaks can be abused to individuals too. The 30% hit isn't a guarantee, there's more things involved. Mine didn't drop a single %. But it's up to you if you want to stay vulnerable. Not all patches applied against it through windows fully protect you without bios updates

Sent from my Nexus 7 with Tapatalk

 

[gereral1]

You couldn't be more wrong. Almost all of the initial leaks can be abused to individuals too. The 30% hit isn't a guarantee, there's more things involved. Mine didn't drop a single %. But it's up to you if you want to stay vulnerable. Not all patches applied against it through windows fully protect you without bios updates

Sent from my Nexus 7 with Tapatalk

My windows stays updated but the BIOS no.... Max hero is known for the latest BIOS to hit ssd performance. I use export to dnxhr at high speeds like 8gig per minute so I need all the thru-put speed on my raid 0 on my ssds. Most won't notice this except if you are a davanci resolve user

 

[Ch3vr0n]

I'd love so see some evidence on that (not that i dont believe you), but there's more than just the board that matters. The CPU matters, the drives matter, their firmware matters...

 

[gereral1]

Sure when I get home I'll screen shot it for you.

 

[DrinkLyeAndDie]

More Intel ME goodness¹

Tom's Hardware: Intel ME's Undocumented Manufacturing Mode Suggests CPU Hacking Risks

Intel ME Manufacturing Mode

According to PT, Intel’s Manufacturing Mode in its processors is intended for configuration and testing of chips during manufacturing. The mode is expected to be disabled before shipping the for the same reason software's debugging mode is disabled before shipping: you don’t want hackers to gain easy access to it.

And, as it turns out in testing that Apple forgot to disable the Manufacturing Mode. There could be more.

The Register: Apple forgot to lock Intel Management Engine in laptops, so get patching

"Intel ME Manufacturing Mode is intended for configuration and testing of the end platform during manufacturing, and as such should be disabled (closed) before sale and shipment to users," explain Goryachy and Ermolov. "However, this mode and its potential risks are not described anywhere in Intel's public documentation."

Manufacturing Mode can only be accessed using a utility included in Intel ME System Tools software, which isn't available to the public. It's intended to configure important platform settings in one-time programmable memory called Field Programming Fuses (FPF) prior to product shipment and in ME's internal MFS (Minux File System) on SPI (Serial Peripheral Interface) flash memory, via parameters known as CVARs (Configurable NVARs, Named Variables).

In chipsets prior to Apollo Lake, Goryachy and Ermolov observe, Intel kept access rights for its Management Engine, Gigabit Ethernet, and CPU separate. The SPI controllers in more recent chips, however, have a capability called a Master Grant which overrides the access rights declared in the SPI descriptor.

"What this means is that even if the SPI descriptor forbids host access to an SPI region of ME, it is possible for ME to still provide access," the researchers explain.

And because it turns out that device makers may not disable Manufacturing Mode, there's an opportunity for an attacker – with local access – to alter the Intel ME to allow the writing of arbitrary data.

At least one Intel customer failed to turn Manufacturing Mode off: Apple. The researchers analyzed notebooks from several computer makers and found that Apple had left Manufacturing Model open. They reported the vulnerability (CVE-2018-4251) and Apple patched it in June via its macOS High Sierra 10.13.5 update.

As Apple put it in its description of the firmware issue, "A malicious application with root privileges may be able to modify the EFI flash memory region."

I can already predict many people saying that since this requires local access then it's no big deal. The typical "If it requires local access then it's not a danger and let's put all the blame on the end-user. Nothing to see here. Move along." BS. It is a big deal and again highlights flaws in the foundation of things, the fundamentals, the process, and mistakes being made. Humans f*** up. All the time.

 

[DrinkLyeAndDie]

WCCF Tech: Windows 10 2019 Will Reduce Performance Hits Caused by Spectre Mitigations to “Noise-Level”

When the companies hustled to address Spectre and Meltdown vulnerabilities, one of the major concerns was the reduced performance of the PCs. Mitigation, in some tests, showed a severe impact on performance that could go from 5% to 30%. Intel’s microcode mitigations for Spectre variant 2, tracked as CVE- 2017-5715, were specifically of concern as they change how hardware speculatively executes.

However, Google’s cloud systems suffered little to no impact as the company engineers developed a software-based mitigation for Variant 2 known as Retpoline that offers near to no impact on performance.

It appears that the Windows maker is now planning to take a similar approach with Windows 10 19H1. According to reports (first spotted by MSPU), the Redmond tech giant will “enable Retpoline by default” starting from the next feature update that will be released to Windows 10. This change was first reported by Insiders who are currently testing the Windows 10 19H1 builds.

Windows Kernel team’s Mehmet Iyigun‏ later confirmed this change, suggesting that Windows 10 2019 will be able to reduce performance impact caused by Spectre v2 mitigations to “noise-level.”

 

[DrinkLyeAndDie]

Tech Spot: Windows update will reduce Spectre and Meltdown patch performance hit to 1-2%

Gaming performance on Intel processors dropped by 3-4% on average, 5% at most. But SSD storage suffered the most, where people were complaining of up to 30% decreases in speed. Fortunately, by enabling the Retpoline mitigation strategy with the Windows 10 19H1 update coming early next year, performance will be uplifted to only ~1-2% below to where it was originally.

 

[Ch3vr0n]

Irrelevant for this topic. That's the next build (it's it's the name. 19H1, 1st half of 2019)

Verstuurd vanaf mijn Nexus 6P met Tapatalk

 

[DrinkLyeAndDie]

Irrelevant for this topic. That's the next build (it's it's the name. 19H1, 1st half of 2019)

Given this entire thread is about Spectre and Meltdown it's not irrelevant.

 

[Ch3vr0n]

My bad, sorry. thought you posted it in the the 1809 build thread

 

[George++]

Tech Spot: Windows update will reduce Spectre and Meltdown patch performance hit to 1-2%

Nice to see something will be done to fix a bug that should have been patched years ago.

Not so nice to see the fix will have to wait several months.

Pure speculation on my part, but maybe some of the problems with the 1809 build others are experiencing, I'm not, might have been from an attempt to roll out this fix earlier by stealth means.

 

[DrinkLyeAndDie]

ZDNet: Intel CPUs impacted by new PortSmash side-channel vulnerability

Researchers have classified PortSmash as a side-channel attack. In computer security terms, a side-channel attack describes a technique used for leaking encrypted data from a computer's memory or CPU, which works by recording and analyzing discrepancies in operation times, power consumption, electromagnetic leaks, or even sound to gain additional info that may help break encryption algorithms and recovering the CPU's processed data.

More security news

Researchers say PortSmash impacts all CPUs that use a Simultaneous Multithreading (SMT)architecture, a technology that allows multiple computing threads to be executed simultaneously on a CPU core.

In lay terms, the attack works by running a malicious process next to legitimate ones using SMT's parallel thread running capabilities. The malicious PortSmash process than leaks small amounts of data from the legitimate process, helping an attacker reconstruct the encrypted data processed inside the legitimate process.

"Our attack has nothing to do with the memory subsystem or caching," said Billy Brumley, one of the five researchers, referring to previous side-channel attacks that have impacted SMT architectures and Intel's HT implementation.

"The nature of the leakage is due to execution engine sharing on SMT (e.g. Hyper-Threading) architectures. More specifically, we detect port contention to construct a timing side-channel to exfiltrate information from processes running in parallel on the same physical core," Brumley added.

"[PortSmash] definitely does not need root privileges," he said "Just user space."

Researchers say they notified Intel's security team last month, on October 1, but the company has not provided a patch until yesterday, the date on which researchers went public with their findings. An Intel spokesperson was not available for comment regarding the state of the PortSmash patching process before this article's publication.

AMD CPUs likely impacted

"We leave as future work exploring the capabilities of PortSmash on other architectures featuring SMT, especially on AMD Ryzen systems," the research team said in a version of their paper shared with ZDNet, but Brumley told us via email that he strongly suspects that AMD CPUs are also impacted.

The work behind discovering PortSmash is also the first result of "SCARE: Side-Channel Aware Engineering," a five-year security research project funded by the European Research Council.

"The goal of the project is to find new side-channel vectors and mitigate them," Brumley told us.

 

[DrinkLyeAndDie]

The Register: Another Meltdown, Spectre scare: Data-blabbing holes continue to haunt Intel, AMD, Arm

Computer security researchers have uncovered yet another set of transient execution attacks on modern CPUs that allow a local attacker to gain access to privileged data, fulfilling predictions made when the Spectre and Meltdown flaws were reported at the beginning of the year.

The not-so-magnificent seven

The researchers describe seven new transient execution attacks, consisting of two new Meltdown variants (Meltdown-PK on Intel, and Meltdown-BR on Intel and AMD) and five new Spectre branch predictor mistraining strategies for previously disclosed flaws known as Spectre-PHT (Bounds Check Bypass) and Spectre-BTB (Branch Target Injection). They say they've responsibly disclosed their findings to chip vendors.

Where Spectre exploits branch prediction to gain access to transient data, Meltdown bypasses the isolation between applications and the operating system by evaluating transient out-of-order instructions following a CPU exception to read kernel memory.

 

[DrinkLyeAndDie]

Fudzilla: Latest Spectre patches bring big performance hits to Linux 4.20 kernel

Spectre and Meltdown fixes have been slowly coming for most of this year, and according to results, the performance hit on Intel CPUs in the latest Linux 4.20 kernel can be over 30 percent.

Caught by Joel Hruska from Extremetech.com with tests originally coming from Michael Larabel over at Phoronix.com, the hit on Intel's Core i9 CPUs in Linux 4.20 kernel is pretty severe, with some tests taking anywhere between 30 to around 50 percent more time to complete.

Larabel also noted that performance drops with Linux 4.20 are on top of those seen with Linux 4.19 which already had the out-of-the-box mitigations against Spectre, Meltdown, and Foreshadow, and while it is possible to better optimize the code to recover some of the performance, there is no apparent improvement in site, with only possible solution is to disable Spectre V2 mitigations for the Linux kernel making those performance systems potentially insecure.

 

[DrinkLyeAndDie]

Tech Crunch: New secret-spilling flaw affects almost every Intel chip since 2011

“ZombieLoad,” as it’s called, is a side-channel attack targeting Intel chips, allowing hackers to effectively exploit design flaws rather than injecting malicious code. Intel said ZombieLoad is made up of four bugs, which the researchers reported to the chip maker just a month ago.

Almost every computer with an Intel chips dating back to 2011 are affected by the vulnerabilities. AMD and ARM chips are not said to be vulnerable like earlier side-channel attacks.

ZombieLoad takes its name from a “zombie load,” an amount of data that the processor can’t understand or properly process, forcing the processor to ask for help from the processor’s microcode to prevent a crash. Apps are usually only able to see their own data, but this bug allows that data to bleed across those boundary walls. ZombieLoad will leak any data currently loaded by the processor’s core, the researchers said. Intel said patches to the microcode will help clear the processor’s buffers, preventing data from being read.

Tech Crunch: Apple, Google and Microsoft release patches for ZombieLoad chip flaws

Microsoft: ADV190013 | Microsoft Guidance to mitigate Microarchitectural Data Sampling vulnerabilities

 

[DrinkLyeAndDie]

Tom's Hardware: Intel Reveals New Spectre-Like Attack, Advises Disabling Hyper-Threading

Intel unveiled yet another speculative execution side-channel flaw in its processors. The vulnerability affects most of the company’s processor SKUs, except the 8th and 9th generation chips, which Intel said includes hardware mitigations against this flaw.

Significant Changes to Operating Systems, Core Software Are Required

Intel believes that in order to protect users against this speculative execution issue, Microsoft and other operating system vendors, hypervisor vendors, as well as Intel itself will need to implement significant changes in their software. The solution will involve clearing microarchitectural buffers when switching to software that is not trusted by the previous software.

For instance, every time a processor would switch from one third-party app to another, from a Windows process to a third-party app, or even from less trusted Windows processes to more trusted ones, the buffers would have to be cleared or overwritten. Adding such a significant step in the processing software will most likely lead to a performance loss. How large or small, it remains to be seen, but chances are it could be on the significant side.

Intel Recommends Disabling Hyper Threading

The company admitted in its white paper that the software mitigations will have a significant effect on how HT works. The threads will need a higher level of isolation between each other, and they will not be able to run processes from different security domains anymore. Threads from different security domains will simply become idle (thus turning into wasted processing power).