Hot answers tagged

112

Other answers give a good technical explanation but let me try with an analogy: Please send your credit card number to scam@example.com Did you read it? Did you do it? It's more or less the same for your CPU. Reading something is not the same as executing it.


64

CPU instructions are given in what are called opcodes, and you're right that those live in memory just like your image. They live in conceptually different "areas" of memory, though. For instance, you could imagine an opcode "read" (0x01) that reads a byte of input from stdin and puts it somewhere, and another operand "add" (0x02) that adds two bytes. Some ...


58

Can you send them? Yes, of course. Just assemble them and stick them somewhere in the image file. Will the target execute them? No, not unless you already have control over the target (and can thus put a program there to read and execute them), or you find some exploit in an image viewer and get the image to load in it.


33

You could if your target used a version of Internet Explorer from before August 2005 to view a JPG. Or if they were going to open a PNG in Windows Media Player on Windows 98 with no security updates installed. And so on. There was a lot of old software that used to have bugs where, if you made an image file in which the first part of the image file lied ...


24

As with a lot of breaking-news coverage of computer security, there's a lot of questionable reporting on PortSmash. It's not actually very interesting, as it doesn't really add much to the attacker toolkit. It only affects a very narrow set of targets, which are already vulnerable to other attacks (and have been for years). Colin Percival actually described ...


12

The state of the art was non-existent. At the time of the Pentium Pro, the World Wide Web was four years old. Widespread use of shared hosting was about ten years in the future; if you suggested that people would want to run untrusted code provided by random third parties, they'd look at you like you'd grown a second head. Memory protection was about ...


11

No. Image files such as JPEG files don't execute code, they are simply rendered and displayed. If you want to hide some information in a file that's called Steganography, but that only hides information, it doesn't execute any instructions. For a file to run code it has to be an executable, or be run by another program which reads the file, then executes ...


10

They are both about equally terrible and still highly vulnerable to Spectre. Unfortunately, you would have to have access to confidential design documents in order to even begin answering this question. From (quasi-privileged) anecdotal evidence, AMD used to be really bad with setting lock bits (MMIO/MSR defaults, if I recall correctly), whereas Intel puts ...


9

Intel has been releasing microcode updates for its CPUs since at least January 29, 2000. AMD has been releasing microcode updates for a similar length of time. In theory, it's possible to reprogram an Intel chip to do whatever you want, within the capabilities of the silicon. In practice, as the above website notes, microcode updates appear to be signed ...


9

If you have physical access, you can pretty much get anything you want out of the CPU. Particularly if you have a semiconductor test lab. Here's a quick, incomplete list, of how to get data out. JTAG: JTAG is the simplest method as it does not require you have any specialized equipment, and it's inexpensive ($100USD). The downside is that you have to ...


8

Warning: This answer contains educated speculation. "Rings" clearly expresses the "nested set" aspect of protection rings, which were described as "concentric" in early papers describing them. The earliest citation for rings which I can find is the 1967 paper "Protection in an Information Processing Utility" by Robert M. Graham. It states, We define ...


7

Spectre works by causing the CPU to speculatively execute code selected by the attacker in the context of the target process. It does this by getting the branch predictor to guess incorrectly about which way an upcoming branch instruction will go, then looking for side effects of the code whose execution was discarded. Any CPU that performs speculative ...


6

Fixing Meltdown is simple: if the CPU is performing speculative execution, don't read data from protected areas of memory. The fact that Meltdown is almost exclusively Intel-only shows that it's a design flaw, rather than an inherent side effect of speculative execution. Fixing Spectre in the general case is much harder. Spectre is about inducing a ...


6

You can, IF you also know what software stack will touch the image on the receiving side, AND IF there are unresolved security vulnerabilities in that software stack. Simply putting the instructions in the JPEG file does nothing. However, if there is a known way to make a certain exact JPEG reader implementation crash on a malformed JPEG file in a way ...


5

If an attacker has an unlimited physical access to CPU, but does not have access to memory, including RAM, can he attack and gain access to the user's data? If the attacker can listen in to the CPU instructions and register contents, he can obviously listen into the CPU as it processes the user data. In addition, if he can modify what the CPU does, he can ...


5

The Spectre and Meltdown attacks are about programs reading data they're not supposed to. They don't provide any way to make modifications or take control of computers. If you're running a typical desktop system, the flaws aren't a major threat simply because anyone in a position to use them has so many other ways to do the same thing. The real risk is to ...


5

Hardware virtualization If an operating system is not a host virtualizing a guest, it is not running as "ring -1". If a hypervisor is not active, ring -1 effectively does not exist and does not matter. As such, unless you are purposefully running a virtual machine, you don't have to even think about hypervisors. The short answer is that ring -1 is ...


5

Intel will release patches for all processors that are not older than 5 years. Most of these patches will be provided within the next week, the rest until the end of January 2018. They also released this pdf and this should answer all further questions regarding these patches. TL;DR: Mitigation for: Bounds Check Bypass (=Spectre): Software modifications ...


5

Are the cpu protection rings meant to protect against malicious programs, or against unintentional programming mistakes? CPU protection rings are meant to enable operating system software the control and protection checks necessary to implement an overall security strategy with good performance.  This includes the notion of kernel mode vs. user mode.&...


5

First, this is not an OS question but more of a compiler one. OS can only execute binary programs that contain machine instructions and that can (if they were instructed to) test the overflow flag. So a part of the question is (IMHO): Why does not the C compilers allow to test the overflow flag? The reason is that the language is supposed to accept (almost)...


4

Recent Intel CPUs have PCID. PCID helps a lot with the performance hit because without it, you have to completely separate the kernel TLB from the userspace TLB. (* Ok, not completely, but mostly). If you have PCID, then the hardware has an extra feature to avoid the performance penalty from the cache misses that would normally happen when you do that. To ...


4

There's a bit in a register that indicates whether the CPU is currently in kernel mode or user mode. Program code cannot modify this bit directly: it has to use special instructions that do more than just change this bit. Certain instructions can only be used in kernel mode; attempting to use them in user mode instead triggers a trap. While the processor is ...


4

why aren't operating systems using this overflow flag to stop integer overflows? The operating system can't just forbid integer overflows, because sometimes it's not a bug but a feature. There is software out there which contains algorithms which actually rely on integer overflow behavior and would break if it would no longer work the way it does. Users ...


4

The short answer is: Yes, but only if you need to be that secure. The side-channel vulnerabilities are a variety of ways that software can determine what data exists in places that it should not have access to---either by reading it directly or by inference. There are a variety of approaches to prevent this, but the nature of the barrier is determined by ...


3

This is going to be a low-quality answer, I'm afraid... but I can't put a picture in a comment. I've always imagined it like the City of Gondor from The Lord of the Rings. To protect the tower in the centre of the city, the walls are built as concentric rings around the city. To gain entrance to the higher rings implied a higher level of trust from the ...


3

There's not much you as a user can do besides waiting for processor microcode updates (Spectre v3) and browser updates (Spectre v4). Once the microcode updates are here, you then have to update all the software that you use, because these have to be rewritten and recompiled to incorporate changes that are needed to mitigate Spectre (especially how software ...


3

The ocaml bug tracker still has the original bug report: https://caml.inria.fr/mantis/view.php?id=7452 Using the same ocaml version (4.03) and using the steps to reproduce, namely: while ocamlfind opt -c -g -bin-annot -ccopt -g -ccopt -O2 -ccopt -Wextra -ccopt '-Wstrict-overflow=5' -thread -w +a-4-40..42-44-45-48-58 -w -27-32 -package extprot test.ml -o ...


3

VIA's global market share in below 1%, therefore they are not even mentioned. As the "VIA Nano" generation from 2008 onward, is able to do out-of-order execution (https://en.wikipedia.org/wiki/VIA_Nano), it could be highly possible, they are affected as well. With respect to their ARM-based products, Cortex A8 and A9 were used there, so they would be ...


3

The CPU is where the code is executed so, no, you can't "hide" processing from it. At least, not if you have just a single CPU. But if you have additional processing units that you can program in a safe way, then you can protect some processing from the machine's CPU. Smartcards are an exemple of such offloading: they are programmed in advance with the ...


2

To express it clearer: the limiting factor of that will most probably be the "capabilities of the silicon" - beside the available possibilities to break the mentioned cryptography, as the available resources (microcode store area and hidden registers) in most cases should be very linited. Otherwise opening the micro instruction set and marketing the ...


Only top voted, non community-wiki answers of a minimum length are eligible