Hacker News Reader

Comment by sp332 | Hacker News Reader

Counterpoint: "There is no evidence in-the-wild malware is using Meltdown or Spectre" https://www.virusbulletin.com/blog/2018/02/there-no-evidence...

View on HN

>> the Flash Player patch Adobe will release next week.

Part of me thinks you could read that sentence this week, next week, a month or 6 months from now and it will still hold true...

that would only stay true until was it 2020 where they stop flash player support

Countercounterpoint: once a proof of concept shows it is possible to use something maliciously, in a way that isn't impractically inefficient, it will soon enough be used that way by someone.

So: don't panic, but do take precautions as soon as possible.

That looks good on paper, but it doesn't seem to be happening. researchers aren't having trouble reproducing the exploit independently, and it didn't take long to expand and improve it e.g. https://mobile.twitter.com/aionescu/status/95126147034336051... from almost a month ago. But malware authors just don't seem interested so far. Since it's a read-only attack and would have to be chained with other vulnerabilities for most malicious use-cases, maybe there's lower-hanging fruit or they just don't see the potential.

> malware authors just don't seem interested so far

Possibly because the issues are mostly mitigated in the wild and there are other, easier to exploit, holes out there too (particularly the water-bag problem: human engineering can be a great attack vector). So they are picking the lower hanging fruit instead. As soon as there is a PoC that seems to have a decent ROI for the implementation time, exploits will appear in the wild.

That's meltdown, not spectre. And meltdown relies on native code running with very little interference from other things causing timing to screw up.

If somebody could already run that code, they'd choose anther attack method.

There is no ^publicly disclosed evidence of in-the-wild malware using Meltdown or Spectre ^yet.

The real nightmare targets are cloud providers. Many smaller providers have not patched yet.

I can assure you this is 100% false. These techniques were being used in the wild on cloud provider(s) at least as early as June 2017. I witnessed this myself.

Do you have any further info about this?

Reply on news.ycombinator.com