undefined | Better HN

0 pointsCerthas8y ago0 comments

After skimming the articles it sounds like a lot hinges on just how hard Spectre is to pull off in practice/in the wild. Anyone have any insights on that?

0 comments

labster8y ago

I don't know much about this particular flaw, but I imagine it'll be pretty hard until someone releases an exploit kit, and then pretty easy after that.

contrarian_8y ago

It's an arms race, there will always be new ways of exploiting this flaw in unexpected ways unless speculation is disabled entirely on existing CPUs.

user59944618y ago

They say they can reliably read memory around 120kB/s with one vulnerability and 1kB/s with the other. It just works, all the time. Some of the PoC takes a few minutes to initialize.

I'd say difficulty level is easy.

CerthasOP8y ago

However, only one of the PoCs runs on AMD, and that doesn't cross process boundaries.

So how easy is it to turn that PoC into something I should worry about? Seems like browsers are the most affected by this scenario, but that also means harden the browser (separate process per page) and it might be difficult to exploit.

lrem8y ago

As a general rule of thumb, if everyone already has a PoC, you should assume someone has been doing targeted practical attacks for a while.

Avamander8y ago

Difficulty to exploit is easy once you have the exploit running. Writing a new exploit is really hard, otherwise we wouldn't be starting 2018 with these news.

FranOntanaya8y ago

It doesn't look that hard, and in any case, we will suffer the mitigation consequences either way.

contrarian_8y ago

Worse, no mitigation will ever be complete against Spectre, unless flat out disabling speculation across memory loads.

wilun8y ago

With the right new instructions inserted at the right place, assisted by a good type system, and a processor that does not share its resources like crazy in highly uncontrolled ways, this seems fixable.

Sadly, I feel the only part that won't happen will be the programming language part, but who knows.

olliej8y ago

it isn't. There have been a few PoC referenced on twitter, and the spectre paper itself reference a PoC in browser hosted javascript (e.g. random ad can scan memory)

it's obviously not a free + zero time activity, but I'm going to assume someone making an ad to scan memory isn't super concerned about end user cpu usage or battery life..

j / k navigate · click thread line to collapse

0 comments

labster8y ago

I don't know much about this particular flaw, but I imagine it'll be pretty hard until someone releases an exploit kit, and then pretty easy after that.

contrarian_8y ago

It's an arms race, there will always be new ways of exploiting this flaw in unexpected ways unless speculation is disabled entirely on existing CPUs.

user59944618y ago

They say they can reliably read memory around 120kB/s with one vulnerability and 1kB/s with the other. It just works, all the time. Some of the PoC takes a few minutes to initialize.

I'd say difficulty level is easy.

CerthasOP8y ago

However, only one of the PoCs runs on AMD, and that doesn't cross process boundaries.

lrem8y ago

As a general rule of thumb, if everyone already has a PoC, you should assume someone has been doing targeted practical attacks for a while.

Avamander8y ago

Difficulty to exploit is easy once you have the exploit running. Writing a new exploit is really hard, otherwise we wouldn't be starting 2018 with these news.

FranOntanaya8y ago

It doesn't look that hard, and in any case, we will suffer the mitigation consequences either way.

contrarian_8y ago

Worse, no mitigation will ever be complete against Spectre, unless flat out disabling speculation across memory loads.

wilun8y ago

Sadly, I feel the only part that won't happen will be the programming language part, but who knows.

olliej8y ago

it isn't. There have been a few PoC referenced on twitter, and the spectre paper itself reference a PoC in browser hosted javascript (e.g. random ad can scan memory)

it's obviously not a free + zero time activity, but I'm going to assume someone making an ad to scan memory isn't super concerned about end user cpu usage or battery life..

j / k navigate · click thread line to collapse