kram36
You can't point out things like that.
 
This is an extreme security issue!
 
Intel and Nvidia are the worst components to have because of their security issues. Doesn't matter if the attack needs to be done locally or that the exploits have never been used in the real world.
 
Hair on fire time!!!!
 

ty_ger07

kram36
Intel and Nvidia are the worst components to have because of their security issues. Doesn't matter if the attack needs to be done locally or that the exploits have never been used in the real world.

To be fair, the Intel prediction exploit didn't require any special privileges, didn't require any additional malicious software or previous system compromises, could be exploited right after a fresh operating system install with no special software required, could be exploited remotely without any special access to the system, could read absolutely anything out of any part of system memory regardless of any existing operating system, software, or hardware attempts at protecting memory addresses, and was functionally demonstrated both locally and remotely using example code. Thankfully, the known holes were patched.

Comparing the Intel prediction exploit to these NVIDIA exploits, at least at face value (based on NVIDIA's word), is a laugh.

Apvrille's work backs up what we've heard from other researchers: so far, Spectre exploitation is theoretical, with no exploits in the wild. She wrote that while there was a flurry of “Spectre exploit” stories based on AV-Test sample collection, it turned out that all of the reported samples were proofs-of-concept rather than genuine malware.

ty_ger07
Remember this?

Blah, blah, I really don't understand how hard these exploits are to use, but blah!!! Thankfully, the known holes were patched.

I don't care if no one has provided evidence of the vulnerability being used in the wild. The demonstrated scope of the vulnerability was terrifying on its own. Thankfully it was quickly patched. What I want to know is why are you comparing the Intel prediction exploit to the above NVIDIA vulnerabilities? Like, what are you doing bringing up old unrelated opinions?

kram36

Cool GTX
Most important part of that Story:

"Fortunately, the ratings were kept below the “critical” line as none of the software issues could be exploited remotely, requiring local user access."
 
 

You can't point out things like that.
 
This is an extreme security issue!
 
Intel and Nvidia are the worst components to have because of their security issues. Doesn't matter if the attack needs to be done locally or that the exploits have never been used in the real world.
 
Hair on fire time!!!!
 

ty_ger07

You really need to educate yourself. A remote attack is extremely complex and you're making it out like this is an easy attack to execute for the attacker.

https://duo.com/decipher/...-speculative-execution

Each network hop between switches adds entropy to the latency of the overall request, Davidov said. Trying to execute the attack over the Internet might make it impossible to execute

Not impossible. Far from it. Like I said, it was even demonstrated. Worked fine. Before the browsers and javascript engine was patched, it was doable with javascript. No, no; not java. Javascript. ...The thing your browser is using right now to view this website. Javascript runs client-side and requires no network hops.

You make a javascript application to exploit the speculation vulnerability, place it inside a website and find a way to promote traffic to your website, the javascript runs client-side for any user who visits your website and uses no further internet connection, and when it finds what it is asked to find, that's the only time it uses the network to send the information back to the attacker. Demonstrated. Worked.

Your basing your opinion on current opinions after everything was patched. Before it was patched, it was terrifying. Therefore, newsworthy.

With most vulnerabilities, the fact that it can be exploited remotely would move the flaw up higher on the critical scale. That isn’t the case with NetSpectre, because it is an extremely slow attack, leaking 15 bits per hour, or 60 bits an hour via an AVX-based covert channel. It could take days to find and gather secrets such as encryption keys or authentication tokens.
 
Current attacks are very impractical and would likely not apply well in real-world scenarios,” said Mikhail Davidov, senior security researcher at Duo Security.

The precise timing and constant measurement required for NetSpectre makes it likely that noisy network environments would hamper execution. The research team’s proof-of-concept doesn’t reflect real-world situations, as the servers weren’t dealing with real traffic. The attack code was on a purpose-built application with only a single use. If the application had been dealing with a “real load” and not ideal network conditions, it would have slowed the attack down even further, Davidov said.
 
Each network hop between switches adds entropy to the latency of the overall request,” Davidov said. Trying to execute the attack over the Internet “might make it impossible to execute.

MasterMiner
I would point out that nation-states indeed *do* have this capability, particularly the biggies (Russia, China, Us, Israel, maybe France, UK). But any such attack, particularly on infrastructure, would be attributable and a declaration of war.

ty_ger07

MasterMiner
I do hate agreeing with kram, on anything... but on this he’s right.

The complexity of a completely remote attack without having a previously compromised system by some sort of internal operation / malware click, social engineering is incredibly difficult.

Unpatched, it required no previous compromises. I don't know why you made that statement. Like I said, any operating system install was exploitable by javascript in any web browser on any malicious website. Mac OS, Linux, Windows, all. No sandboxes stopped it.

ty_ger07
What is he talking about? Network load? NetSpectre? Why is he changing the subject? I am not talking about NetSpectre. I am talking about simple Meltdown in its original unpatched form. Javascript has virtually no network load. It is a client-side application. Did I even read the article? Ummm... did he even link relevant information? No.

ty_ger07
Just search "spectre javascript" and you will find all sorts of examples and articles from before it was patched. Not NetSpectre. Not something which requires high network precision or creates a lot of network traffic.

Tests indicate that the number of operations required for Spectre may be infeasible in JavaScript unless a user stays on a page for a LONG time.

ty_ger07

How do you know if NetSpectre is not javascript based if you didn't read the article?

Because the Javascript approach does not create high network load. It is a client-side application just like any other program you download and execute. Therefore it could not possibly be relevant. I didn't have to read the article to know that your comment and quote was not relevant.

Javascript is a client-side application framework which is included with any modern browser in any modern operating system and is required by the majority of modern websites and is therefore by default automatically trusted and executed without any user prompt or notification.

Tests indicate that the number of operations required for Spectre may be infeasible in JavaScript unless a user stays on a page for a LONG time.

veganfanatic
having read that article they are behind with 419.17 when 419.35 is been out for several days now
 
lets try to stay focused on today, not last months headaches
 

ty_ger07
You have heard of reserved memory addresses before, right? I feel like I am arguing with a loud rock.

ty_ger07
Long, slow? Yeah, sometimes.

ty_ger07
Never used? Well, I think that is impossible to prove. We cannot prove that it was used. But can we prove that it was never used? Of course not. But we can prove that it was demonstrated and functional.

ty_ger07

veganfanatic
having read that article they are behind with 419.17 when 419.35 is been out for several days now
 
lets try to stay focused on today, not last months headaches
 

I agree. But he has been very loud about this for months. He brought it up again, and I can't quietly stand by as he spouts a bunch of loud nonsense.