Tag: Spectre

a bit more on Spectre and Meltdown

~ hucktech ~ Leave a comment

News press release from Intel yesterday:
https://newsroom.intel.com/news/firmware-updates-and-initial-performance-data-for-data-center-systems/

https://security-center.intel.com/advisory.aspx?intelid=INTEL-SA-00088&languageid=en-fr

https://www.hardocp.com/news/2018/01/17/uefi_bios_updates_for_spectre

https://twitter.com/daniel_bilar/status/953969149734252545

 

Yuriy working on new CHIPSEC Spectre test

~ hucktech ~ 1 Comment

Nice to see some recent CHIPSEC activity, given all the recent related CVEs…
…But this is not from the CHIPSEC team, it is from ex-CHIPSEC team member Yuriy of Eclypsium.

Added new module checking for Spectre variant 2
The module checks if system is affected by Speculative Execution Side Channel vulnerabilities. Specifically, the module verifies that the system supports hardware mitigations for Branch Target Injection a.k.a. Spectre Variant 2 (CVE-2017-5715)

See source comments for more info.

https://github.com/c7zero/chipsec/commit/b11bce8a0ed19cbe1d6319ef9928a297b9308840

 

a bit more on Spectre and Meltdown

~ hucktech ~ Leave a comment

https://developer.arm.com/support/security-update

https://www.op-tee.org/security-advisories/

https://newsroom.intel.com/

https://ami.com/en/news/press-releases/american-megatrends-statement-in-response-to-meltdown-and-spectre-security-vulnerabilities/

https://kb.vmware.com/s/article/52345

https://twitter.com/aionescu/status/952014225714511872

https://twitter.com/josephfcox/status/952107644076118017

https://twitter.com/revskills/status/951934905319133185

more on Spectre/Meltdown

~ hucktech ~ Leave a comment

https://www.amd.com/en/corporate/speculative-execution?sf178974629=1

https://blogs.technet.microsoft.com/surface/2018/01/10/updates-for-surface-devices-09-january-2018/

https://news.hitb.org/content/intel-says-patches-can-cause-reboot-problems-old-chips

https://newsroom.intel.com/news/intel-security-issue-update-addressing-reboot-issues/

https://twitter.com/aionescu/status/949090063920504833

https://www.gdatasoftware.com/blog/2018/01/30333-inside-meltdown-spectre

http://nymag.com/selectall/2018/01/why-it-took-22-years-to-discover-fundamental-chip-flaw.html

https://www.theverge.com/2018/1/11/16878670/meltdown-spectre-disclosure-embargo-google-microsoft-linux

more on Spectre and Meltdown

~ hucktech ~ Leave a comment

https://www.enisa.europa.eu/publications/info-notes/meltdown-and-spectre-critical-processor-vulnerabilities
https://www.ibm.com/blogs/psirt/potential-cpu-security-issue/
https://www.ibm.com/blogs/psirt/potential-impact-processors-power-family/
https://cloudblogs.microsoft.com/microsoftsecure/2018/01/09/understanding-the-performance-impact-of-spectre-and-meltdown-mitigations-on-windows-systems/
https://github.com/xoreaxeaxeax/movfuscator/tree/master/validation/doom

Thoughts on Meltdown & Spectre

 

more on Meltdown and Spectre

~ hucktech ~ Leave a comment

https://wiki.ubuntu.com/SecurityTeam/KnowledgeBase/SpectreAndMeltdown

https://access.redhat.com/security/vulnerabilities/speculativeexecution

https://github.com/iaik/meltdown

https://www.endgame.com/blog/technical-blog/detecting-spectre-and-meltdown-using-hardware-performance-counters

https://github.com/GitMirar/meltdown-poc/blob/master/README.md

Securing Azure customers from CPU vulnerability

https://blog.cloudflare.com/meltdown-spectre-non-technical/

https://twitter.com/aionescu/status/949732198118080513

https://gallery.technet.microsoft.com/scriptcenter/Speculation-Control-e36f0050

https://blogs.technet.microsoft.com/ralphkyttle/2018/01/05/verifying-spectre-meltdown-protections-remotely/

https://www.powershellgallery.com/packages/SpeculationControl/1.0.3

https://github.com/ionescu007/SpecuCheck/releases

https://twitter.com/aionescu/status/948954595358752768

https://github.com/lgeek/spec_poc_arm

https://github.com/Viralmaniar/In-Spectre-Meltdown

https://twitter.com/daniel_bilar/status/950332477800898561

 

https://mspoweruser.com/hp-reportedly-starting-release-bios-fixes-meltdown-spectr-flaws/

https://groups.google.com/forum/m/#!topic/mechanical-sympathy/L9mHTbeQLNU

more on Meltdown and Spectre

~ hucktech ~ Leave a comment

http://nvidia.custhelp.com/app/answers/detail/a_id/4611/~/security-bulletin%3A-nvidia-gpu-display-driver-security-updates-for-speculative

Securing Azure customers from CPU vulnerability

https://marc.info/?l=openbsd-tech&m=151521435721902&w=2

https://github.com/marcan/speculation-bugs/blob/master/README.md

https://github.com/raphaelsc/Am-I-affected-by-Meltdown

more on Meltdown and Spectre

~ hucktech ~ Leave a comment

We’re seeing browser and OS updates. The Microsoft Surface is the only firmware update I’ve seen so far…

 

Behind the scenes of a bug collision

https://access.redhat.com/security/vulnerabilities/speculativeexecution

https://support.apple.com/en-us/HT208394

Securing Azure customers from CPU vulnerability

https://lwn.net/Articles/741878/

https://lkml.org/lkml/2018/1/4/602

https://sourceforge.net/p/genode/mailman/message/36178974/

 

https://support.microsoft.com/en-us/help/4073119/protect-against-speculative-execution-side-channel-vulnerabilities-in

https://erc.europa.eu/news/Cybersecurity-ERC-grantee-behind-discovery-of-major-hardware-bugs

https://forums.opensuse.org/showthread.php/528926-security-announce-openSUSE-SU-2018-0026-1-important-Security-update-for-kernel-firmware?s=9b3628026a7a7d45c7c4e77b68a62da6&p=2850099#post2850099

 

more on Meltdown and Spectre

~ hucktech ~ Leave a comment

Intel advisory:
https://security-center.intel.com/advisory.aspx?intelid=INTEL-SA-00088&languageid=en-fr
Intel tool for Linux:
https://github.com/intel/INTEL-SA-00075-Linux-Detection-And-Mitigation-Tools
Intel tool for Windows:
https://downloadcenter.intel.com/download/26755/INTEL-SA-00075-Detection-and-Mitigation-Tool
https://www.intel.com/content/www/us/en/architecture-and-technology/facts-about-side-channel-analysis-and-intel-products.html

https://meltdownattack.com/
https://spectreattack.com/

https://access.redhat.com/security/vulnerabilities/speculativeexecution

https://www.freebsd.org/news/newsflash.html#event20180104:01

http://blog.dustinkirkland.com/2018/01/ubuntu-updates-for-meltdown-spectre.html

https://www.us-cert.gov/ncas/alerts/TA18-004A

http://www.commitstrip.com/en/2018/01/04/reactions-to-meltdown-and-spectre-exploits/?

https://www.reuters.com/article/us-cyber-intel-researcher/how-a-researcher-hacked-his-own-computer-and-found-worst-chip-flaw-idUSKBN1ET1ZR

more on Meltdown and Spectre

~ hucktech ~ Leave a comment

https://developer.arm.com/support/security-update

https://www.amd.com/en/corporate/speculative-execution

https://support.microsoft.com/en-us/help/4072698/windows-server-guidance-to-protect-against-the-speculative-execution

https://support.microsoft.com/en-us/help/4073119/windows-client-guidance-for-it-pros-to-protect-against-speculative-exe

Mitigations landing for new class of timing attack

https://support.google.com/chrome/answer/7623121?hl=en

https://github.com/ionescu007/SpecuCheck

https://lists.vmware.com/pipermail/security-announce/2018/000397.html

https://www.us-cert.gov/ncas/current-activity/2018/01/03/Meltdown-and-Spectre-Side-Channel-Vulnerabilities

Meltdown and Spectre

~ hucktech ~ Leave a comment

Intel says issue impacts other chip vendors, not just Intel:
https://newsroom.intel.com/news/intel-responds-to-security-research-findings/

https://spectreattack.com/
says: At the moment, it is unclear whether ARM and AMD processors are also affected by Meltdown.

https://security.googleblog.com/2018/01/todays-cpu-vulnerability-what-you-need.html

https://googleprojectzero.blogspot.co.uk/2018/01/reading-privileged-memory-with-side.html

A few news sources are saying Apple has a fix in place:
http://appleinsider.com/articles/18/01/03/apple-has-already-partially-implemented-fix-in-macos-for-kpti-intel-cpu-security-flaw

Official T-Shirts: coming soon…